ExploitRank - Exploit Intelligence Engine (EIE)

ExploitRank is an Exploit Intelligence Engine (EIE) for ingesting, normalizing, and scoring vulnerability records and exploit-candidate evidence.

Core Capabilities

Ingestion

• NVD Adapter: Ingests legacy NVD feeds and the official NVD API 2.0 vulnerabilities[].cve response.
• GitHub Adapter: Finds repositories mentioning a CVE. Only explicit exploit or proof-of-concept descriptions count as exploit evidence; other results remain references.
• Extensible adapters: Supports additional structured sources.

Normalization and scoring

Records are normalized into VulnRecord and ExploitCandidate models. The configurable Exploit Rank Score (ERS) combines:

• CVSS severity
• explicit exploit availability
• vulnerability recency

Remediation recipes

The CLI can generate a JSON remediation recipe for a CVE after it has been ingested and scored.

Installation

Prerequisites:

• Python 3.9+
• Node.js 20+ for the optional web interface

git clone https://github.com/BlueDot-IT/ExploitRank.git
cd ExploitRank
python3 -m venv venv
source venv/bin/activate
pip install -e .

Usage

# Ingest NVD data
eie ingest --nvd ./nvd_dump.json

# Calculate ERS
eie score CVE-2024-9999

# Generate a recipe after scoring
eie recipe CVE-2024-9999 --output-dir ./recipes/

Web Interface and API

Start the API:

python -m api.main

Start the web UI:

cd web
npm ci
npm run dev

The web proxy expects the API on loopback port 8000.

License

Licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). See LICENSE.