Vulmap- An Open Source Online Local Vulnerability Scanner Project

sn1per

Vulmap- An Open Source Online Local Vulnerability Scanner Project

It consists of online local vulnerability scanning programs for Windows and Linux operating systems. 

These scripts can be used for defensive and offensive purposes. It is possible to make vulnerability assessments using these scripts. Also they can be used for privilege escalation by pentesters/red team.

Vulmap can be used to, scan vulnerabilities on localhost, see related exploits and download them. Scripts basically, scan localhost to gather installed software information and ask vulmon.com api if there are any vulnerabilities and exploits related with installed software.

If vulnerabilities exist, Vulmap give CVE ID, risk score, vulnerability's detail link, if exists related exploit ids and exploit titles. Exploits can be downloaded with Vulmap also.

Main idea of Vulmap is getting real-time vulnerability data from Vulmon instead of relying of a local vulnerability database. Even the most recent vulnerabilities can be detected with this approach. Also its exploit download feature aids privilege escalation processes. Pentesters and red team can download exploits from Exploit DB from command prompt. To use this feature only thing needed is id of exploits.

Since most Linux installations have Python, Vulmap Linux is developed with Python while Vulmap Windows is developed with PowerShell to make it easy to run it on most Windows versions. Vulmap Linux is compatible with Python 2.x and dpkg package management system. Vulmap Windows is compatible with PowerShell v3 and higher.

Use below links to get detailed information about vulmap:

Vulmap Linux - Python script for Linux systems

Recommended Platform and Python Version

Vulmap currently only supports linux platforms and Python2

• The recommended version for Python 2 is 2.7.x
• Compatible with Linux distros uses dpkg

Installation

git clone https://github.com/vulmon/Vulmap-Local-Vulnerability-Scanners.git
Run in default mode

python vulmap-linux.py

Usage

Default mode. Check vulnerabilities of installed packages.

Short Form  Long Form                      Description
-v                  --verbose         Enable the verbose mode and display results in realtime
-d                 --download        <exploit_id> to download a specific exploit
-a                 --all-download Download all found exploits
-h                 --help                 Show the help message and exit

Examples

• To list all the basic options and switches use -h switch:

python vulmap-linux.py -h

• Run in default mode:

python vulmap-linux.py

• Enable the verbose mode:

python vulmap-linux.py -v

• To download of all found exploits:

python vulmap-linux.py -a

• To download a specific exploit:

python vulmap-linux.py -d <exploit_id>
python vulmap-linux.py -d EDB20
python vulmap-linux.py -d EDB8310

Vulmap Windows - Powershell script for Windows systems

Online local vulnerability scanner for Windows systems. Finds installed software on the host, asks their vulnerabilities to vulmon.com API and print vulnerabilities with available exploits. All found exploits can be downloaded by Vulmap.

Recommended Platform

Compatible with PowerShell v3 and higher

Usage

Parameter                                                 Description

• DefaultMode                                  Conducts a vulnerability scanning. Default mode.
• OnlyExploitableVulns                  Conducts a vulnerability scanning and only shows vulnerabilities that have exploits.
• DownloadExploit <exploit_id> Downloads given exploit.
• DownloadAllExploits                 Scans the computer and downloads all available exploits.

Examples

• Default mode. Conducts a vulnerability scanning:

PS> Invoke-Vulmap

• Conducts a vulnerability scanning and only shows vulnerabilities that have exploits:

PS> Invoke-Vulmap -OnlyExploitableVulns

• Downloads given exploit:

PS> Invoke-Vulmap -DownloadExploit EDB9386

• Scans the computer and downloads all available exploits:

PS> Invoke-Vulmap -DownloadAllExploits

To-Do:

• Operating system level vulnerabilities will be detected at Windows
• Other Linux package management systems will be supported
• macOS script will be developed
• Android and iOS scripts will be developed

Download Vulmap