rjsog / cve-scrapper

Node Js CVE Automated Scrapper

CVE Scrapper v1.0.0

CVE Scrapper is a tool used to request vulnerability from the official CVE Website.

WHY ?!

Because i wanted to build something easy to use from the command line to rapidly get vulnerability of a specifc technologie. Plus, this process can be run automaticly using cron, so you can have a "daily" or "weekly" updates about the vulnerabilities of the tools or services you use.

Easy Installation :

1. First go to https://nodejs.org/en/ to install Node.js.
2. Download or clone the repo using git clone https://github.com/Eli0ttD0NATIEN/cve-scrapper.git.
3. Move into the directory and run npm install to install all the required dependencies.
4. Have fun !

Using CVE Scrapper

Running CVE Scrapper :

Since this tools is built in Node.js to run the project you must run :

• npm run start -- *command*

Available Flags :

• -h - Outputs the help.
• -f=*filepath* - Specify a file to define "used products".
• -p=*products1,products2* - Specify "used products" through command line.
• --last - Get latest vulnerability of the product(s) you specified.

Will be available in future versions :

• -O=*filepath* - Specify a output file.
• -GUI - Run the tools through a graphical interface (for the beginners).

Examples :

-f - Specify a input file :

Command line example: npm run start -- -f=example.txt.

Output:

    > [email protected] start
    > node src/index.js "-f=example.txt"

    ========================================
    CVE Scrapper v1.0.0:
    by Eli0ttD0NATIEN
    ========================================

    Used Products : modus,wordfence
    Looking for Vulnerability...
    ========================================
    Finded Vulnerabilities for modus : 

        Vulnerability N°1 : 
        CVE-2000-1033 : Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users.
    ========================================
    Finded Vulnerabilities for wordfence : 

        Vulnerability N°1 : 
        CVE-2019-9669 : The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.

        Vulnerability N°2 : 
        CVE-2014-4932 : Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.

        Vulnerability N°3 : 
        CVE-2014-4664 : Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
    ========================================

-p - Specify used products through CLI :

Command line example: npm run start --- -p=wordfence,modus.

Output :

    > [email protected] start
    > node src/index.js "-f=example.txt"

    ========================================
    CVE Scrapper v1.0.0:
    by Eli0ttD0NATIEN
    ========================================

    Used Products : modus,wordfence
    Looking for Vulnerability...
    ========================================
    Finded Vulnerabilities for modus : 

        Vulnerability N°1 : 
        CVE-2000-1033 : Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users.
    ========================================
    Finded Vulnerabilities for wordfence : 

        Vulnerability N°1 : 
        CVE-2019-9669 : The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.

        Vulnerability N°2 : 
        CVE-2014-4932 : Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.

        Vulnerability N°3 : 
        CVE-2014-4664 : Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
    ========================================

--last - Get latest vulnerability :

Command line example : npm run start -- -p=worfence --last.

Output :

    > [email protected] start
    > node src/index.js "-p=wordfence" "--last"

    ========================================
    CVE Scrapper v1.0.0:
    by Eli0ttD0NATIEN
    ========================================
    Used Products : wordfence
    Looking for Vulnerability...
    ========================================
    Vulnerability found for wordfence : 
            CVE-2019-9669 : The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.
    ========================================