Exploit linking

Kvasir attempts to link vulnerabilities and exploits together based on the following criteria:

• Exploit list to Nexpose vulnerability ID
• CVE references

Exploit references must be imported each time since Kvasir begins as a blank slate. Kvasir currently supports two formats:

• Nexpose exploits.xml (found in /opt/rapid7/nexpose/plugins/conf)
• ImmunitySec CANVAS exploit XML

Import Exploit Data

From the menu bar Exploit data can be managed from the Administration -> VulnDB section.

Import Nexpose Exploits

Nexpose Exploit XML data can be found in the static/etc directory or from a Nexpose installation (/opt/rapid7/nexpose/plugins/conf in Linux).

Import options:

• XML File: Upload your exploits.xml file
• Use Kvasir static path: Use the file from $KVASIR/static/etc
• Use local file path: Use the file from /opt/rapid7/nexpose/plugins/conf
• Run in background task: Send to the scheduler to run in the background

Import ImmunitySec CANVAS Exploits

ImmunitySec CANVAS XML data can be generated from your own installation or downloaded from ImmunitySec. Kvasir will automatically download the latest file if requested.

Import options:

• XML File: Upload your CANVAS exploits.xml output file
• Use Kvasir static path: Use the file from $KVASIR/static/etc
• Use local file path: Use the file 'canvas_exploits.xml' from the provided local directory
• Download: Download the exploits file from ImmunitySec's website
• Run in background task: Send to the scheduler to run in the background

Dynamic linking of Vulnerabilities and Exploits

Generally exploits and vulnerabilities will be connected after scanner imports have completed. Sometimes this doesn't happen so Kvasir provides the ability to do call this function from Administration -> VulnDB -> Connect Vulns/Exploits