☠ VULNFORGE

Web Vulnerability & CVE-Correlation Scanner — fingerprint a web target, correlate detected components against an offline CVE knowledge base, and audit its HTTP security posture in one pass.

VULNFORGE only sends a handful of ordinary GET requests. It does not exploit, fuzz, brute-force, or attempt any denial of service. It is a passive reconnaissance and configuration-audit tool for authorized assessments and learning.

---

Features

• Technology & version fingerprinting from the HTTP response:
  • Server, X-Powered-By, X-Generator headers (Apache, nginx, IIS, LiteSpeed, PHP, OpenSSL, Drupal).
  • <meta name="generator"> tags (WordPress, Drupal, Joomla) — via BeautifulSoup when installed, with a pure-regex fallback when it is not.
  • Client-side library versions (jQuery, Bootstrap) parsed from script/link URLs and inline banners.
  • WordPress confirmation via /wp-json, /wp-content, /wp-includes markers.
• CVE correlation against a bundled offline cve_db.json (~15 real, well-known CVEs). Detected product + version is matched against affected ranges and flagged with a CVSS-derived severity.
• Security-header audit: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — present/missing plus concrete advice for each gap.
• Cookie audit: every Set-Cookie is checked for Secure, HttpOnly, and SameSite flags.
• HTTPS/TLS basics: is the target HTTPS, and does plain HTTP redirect to HTTPS?
• Output: colored console (colorama) + optional standalone dark-themed HTML report (inline CSS, no external assets) + optional JSON for tooling/CI.
• Robust error handling — a single bad response never crashes the scan.

---

How the CVE database works

The knowledge base ships as a plain JSON file (cve_db.json) so it is fully offline and easy to audit or extend. Each entry looks like:

{
  "product": "apache",
  "version_lt": "2.4.51",
  "cve": "CVE-2021-42013",
  "cvss": 9.8,
  "description": "Apache HTTP Server path traversal / RCE via crafted URLs..."
}

• product — lowercase identifier matched against a fingerprinted component.
• version_lt — the fixed version. Any detected version strictly below this is flagged. Use null to flag the product at any version (e.g. a design weakness).
• cvss — base score; VULNFORGE maps it to CRITICAL / HIGH / MEDIUM / LOW.
• Version comparison is segment-aware and even handles alphabetic suffixes (so OpenSSL 1.0.1f is correctly seen as older than the 1.0.1g Heartbleed fix).

If a component is detected but no version could be read, VULNFORGE only matches it against version_lt: null entries and labels the finding unconfirmed.

Extending it

Just add objects to the cves array — no code changes needed:

{ "product": "nginx", "version_lt": "1.25.3", "cve": "CVE-2024-XXXXX", "cvss": 7.5, "description": "..." }

Make sure the product string matches what the fingerprinter emits (e.g. apache, nginx, php, wordpress, jquery, bootstrap, openssl, drupal, joomla, openssh). Point at a custom file any time with --db my_cves.json.

⚠️ This is a curated starter knowledge base, not a complete vulnerability feed. It exists to demonstrate the correlation engine. For production use, sync it against an authoritative source (NVD, vendor advisories) on your own schedule.

---

Install

git clone <your-repo-url>
cd VULNFORGE
pip install -r requirements.txt

Python 3.7+. Only requests and colorama are strictly required; beautifulsoup4 is optional but recommended.

---

Usage

# Basic scan
python vulnforge.py -u https://example.com

# Full report set
python vulnforge.py -u https://example.com --html report.html --json out.json

# Use a custom CVE database and a longer timeout
python vulnforge.py -u example.com --db my_cves.json --timeout 20

# Skip TLS verification (e.g. lab targets with self-signed certs)
python vulnforge.py -u https://10.0.0.5 --insecure --no-color

Flag	Description
-u, --url	Target URL (scheme optional; defaults to https://). Required.
--html FILE	Write a standalone dark-themed HTML report.
--json FILE	Write raw findings as JSON.
--db FILE	Custom CVE database (default: bundled cve_db.json).
--timeout N	Per-request timeout in seconds (default 12).
--insecure	Do not verify TLS certificates.
--no-color	Disable ANSI colors.

Exit codes: 0 clean-ish, 1 at least one HIGH/CRITICAL CVE matched, 2 could not connect — handy in CI.

---

Sample output

 __      __   _ _   _______
 \ \    / /  | | | |  ___/ /___  _ __ __ _  ___
  \ \  / /_ _| | | | |_ / // _ \| '__/ _` |/ _ \
   \ \/ / _` | | | |  _/ // (_) | | | (_| |  __/
    \  / (_| | | | | |  \ \\___/|_|  \__, |\___|
     \/ \__,_|_|_| \_|   \_\         |___/

  VULNFORGE v1.0.0  -  Web Vulnerability & CVE-Correlation Scanner

[*] Target: https://example.com
[*] HTTP status: 200

=== Transport Security ===
  [+] HTTPS in use               yes
  [-] HTTP -> HTTPS redirect      NO

=== Detected Components ===
  apache      2.4.49    (Server header)
  php         7.4.3     (X-Powered-By header)
  wordpress   5.7.1     (meta generator tag)
  jquery      3.4.1     (asset URL / inline script)

=== CVE Correlation ===
  [CRITICAL] CVE-2021-42013  CVSS 9.8  apache 2.4.49
        Apache HTTP Server path traversal / RCE via crafted URLs...
  [HIGH] CVE-2022-31626  CVSS 9.8  php 7.4.3
        PHP mysqlnd/pdo_mysql buffer overflow ... remote code execution.
  [MEDIUM] CVE-2020-11022  CVSS 6.1  jquery 3.4.1
        jQuery cross-site scripting (XSS) via untrusted HTML ...

=== Security Headers ===
  [-] Content-Security-Policy     MISSING
        advice: Missing CSP. Add a policy to mitigate XSS ...
  [+] X-Content-Type-Options      present
  [-] Strict-Transport-Security   MISSING
        advice: Missing HSTS. Add 'max-age=31536000; includeSubDomains' ...

=== Cookies ===
  PHPSESSID   missing Secure, missing HttpOnly, missing SameSite

=== Summary ===
  CVEs: 3  (CRIT 1, HIGH 1, MED 1, LOW 0)
  Missing security headers: 4
  Weak cookies: 1

(Illustrative output — the components/CVEs shown depend entirely on the real target.)

---

⚠️ Legal / Ethical Use

VULNFORGE is intended exclusively for:

• Systems you own, or
• Systems you have explicit, written authorization to test, and
• Education and research in controlled lab environments.

Scanning or probing systems without permission may be illegal in your jurisdiction and can carry serious civil and criminal penalties. You are solely responsible for how you use this tool. The author accepts no liability for misuse or for any damage resulting from its use. If you are unsure whether you are authorized — you are not.

---

Author

Əliəsgər Fətullayev Cybersecurity student · offensive-security & tooling.

Released under the MIT License · © 2026.