Vulnerator 2.0 (v7.4.0-beta.1)

Vulnerator 2.0 — 7.4.0 beta 1

Add-on support. Vulnerator can now load optional add-ons, such as dashboards or integrations. No add-ons are
included; this release adds the mechanism only, and nothing changes if you don't use any.

How it works

• Add-ons go in the new Add-ons folder next to Vulnerator.exe. The main file ends in .AddOn.dll; an add-on with
  several files can have its own folder there. Restart Vulnerator after adding one.
• An add-on can add pages to the menu (before News) and options under Settings > Integrations. That section also
  lists every add-on found and whether it loaded.
• Add-ons read findings and hardware through a read-only database connection. They cannot change the database.
• A broken, damaged or incompatible add-on is skipped and the reason goes in the log. Vulnerator still starts.
• Each add-on gets its own data folder next to the database, so a portable copy keeps it.
• Files that Windows marks as downloaded from the internet can't be loaded. Unblock them (right-click, Properties,
  Unblock) and restart. Settings > Integrations says so when this happens.
• Works with strong-name bypass turned off, without admin rights, and with no native DLLs.

For add-on developers

• Vulnerator.AddOns.dll (MIT, with XML documentation) ships in the program folder and is the only file an add-on
  compiles against. It is versioned separately (interface version 1).

Tests

• The build compiles throw-away test add-ons (none ship) and checks the following: a working add-on, one in its own
  folder with a dependency, and add-ons that must be skipped (fails while starting, needs a newer version, not an
  add-on, wrong entry type, damaged file, duplicate ID). It also checks the read-only data, the menu pages and the
  Settings section.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.4.0-beta.1.zip.

SHA-256 Vulnerator-v7.4.0-beta.1.zip: f7181a1813ed4b4473d96acba5f5a7f18cf78adafff369e51f8a000c6bec4de1

For application control (allow by hash): Vulnerator.exe d9a294a91a84780288484ca2fa32dd2831b1cde81751b5c4111aee1cd89ccf3a. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.4.0-beta.1-file-hashes.txt.

Vulnerator 2.0 (v7.3.0)

Vulnerator 2.0 — 7.3.0

Every button on the Configuration Management Hardware and Software tabs works. Tested on a real system as 7.3.0 beta 1. These tabs come from the unfinished
upstream 7.0 alpha; several buttons were not connected or did the wrong thing.

Hardware tab

• Clear Selected Hardware works (it did nothing).
• Add/Update Hardware: adding a host checks for an empty or duplicate name and files the new host in the "All"
  group (so reports include it) with its IP address. Updating no longer overwrites the discovered host name with the
  preferred name - that broke matching on the next scan import (the host would come back as a duplicate).
• Lifecycle Status now saves (the list was bound to a name the screen does not have).
• Delete Selected Hardware asks first, and also removes the host's findings, POA&M and mitigation links and port
  evidence.
• Remove buttons: the MAC address trash button did nothing and the group trash button removed a MAC address
  instead; both now remove what their row shows.
• Add port / protocol / service failed silently; it now links the selected port to the host.
• After every change all tabs reload and the host stays selected; a failure shows a message instead of only a log line.

Software tab

• Clear Selected Software, Delete Selected Software (asks first) and Add/Update Software work (none did).
• Associate Hardware (+) adds the selected host; the trash button removes it. The host list now fills in.
• Adding software checks for an empty or duplicate name; updating keeps the discovered name used by imports.
• The unfinished "Associate Hardware/PPS" section (no way to save it) was removed.

Version, README and project page

• About and Help show the release version (for example 7.3.0; pre-releases show the beta number), stamped by the
  build from the release tag.
• New README and a project page (docs/index.html, for GitHub Pages) for Vulnerator 2.0.

Tests

• The build exercises every edit (add / update / delete hardware and software; add / remove IP, MAC, group, software and
  port links) against a test database, and opens both tabs' data the way the screens do.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.3.0.zip.

SHA-256 Vulnerator-v7.3.0.zip: d2d882caaeb1bf1bc8cc1617c226bcde3dda4b71b06eb974481fcb03661cc34e

For application control (allow by hash): Vulnerator.exe 386ebb41ebacaba2e4d6581dc60e4001b9ee0d54e06247a4315cf8d028268f4f. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.3.0-file-hashes.txt.

Vulnerator 2.0 (v7.3.0-beta.1)

Vulnerator 2.0 — 7.3.0 beta 1

Every button on the Configuration Management Hardware and Software tabs works. These tabs come from the unfinished
upstream 7.0 alpha; several buttons were not connected or did the wrong thing.

Hardware tab

• Clear Selected Hardware works (it did nothing).
• Add/Update Hardware: adding a host checks for an empty or duplicate name and files the new host in the "All"
  group (so reports include it) with its IP address. Updating no longer overwrites the discovered host name with the
  preferred name - that broke matching on the next scan import (the host would come back as a duplicate).
• Lifecycle Status now saves (the list was bound to a name the screen does not have).
• Delete Selected Hardware asks first, and also removes the host's findings, POA&M and mitigation links and port
  evidence.
• Remove buttons: the MAC address trash button did nothing and the group trash button removed a MAC address
  instead; both now remove what their row shows.
• Add port / protocol / service failed silently; it now links the selected port to the host.
• After every change all tabs reload and the host stays selected; a failure shows a message instead of only a log line.

Software tab

• Clear Selected Software, Delete Selected Software (asks first) and Add/Update Software work (none did).
• Associate Hardware (+) adds the selected host; the trash button removes it. The host list now fills in.
• Adding software checks for an empty or duplicate name; updating keeps the discovered name used by imports.
• The unfinished "Associate Hardware/PPS" section (no way to save it) was removed.

Tests

• The build exercises every edit (add / update / delete hardware and software; add / remove IP, MAC, group, software and
  port links) against a test database, and opens both tabs' data the way the screens do.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.3.0-beta.1.zip.

SHA-256 Vulnerator-v7.3.0-beta.1.zip: f3b9a1cabb5898403899017f4fa07703c13d922eb9ea3c5b2a8464723528eda6

For application control (allow by hash): Vulnerator.exe be9732558ca3938f9969adf9fb43d7d16bfe36abc56c33264e7f7ab4dcf21a18. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.3.0-beta.1-file-hashes.txt.

Vulnerator 2.0 (v7.2.0)

Vulnerator 2.0 — 7.2.0

Ports, protocols and services (PPS) from your ACAS / Nessus scans. Tested on a real system as 7.2.0 beta 1 and 2.

New report: Ports, Protocols & Services (Excel)

• Ports Protocols Services sheet: one row per port / protocol / service the scans observed: the service as Nessus
  detected it, your service name and acronym, the number of hosts, host names, IP addresses, groups, and the Nessus
  plugins that showed it (the evidence).
• By Host sheet: one row per host and port.
• Header row frozen, filter buttons, your marking in the header and footer. Only the group filter applies.
• A starting point for the system's PPSM registration.

Configuration Management > Ports, Protocols, Services

• The tab now lists every port / protocol / service (it was empty: an unfinished part of the upstream 7.0 alpha), with
  the service as detected, service name, acronym and number of hosts.
• Select a row for its details and hosts; Save Name / Acronym, Delete PPS (asks first; a later scan that still
  shows it adds it back) and Clear Selection.

Import

• Nessus port 0 results ("general/tcp", "general/icmp") are no longer stored as services; existing ones are removed on
  the first start of this version.
• Each port records which plugin(s) showed it on each host (scans imported before 7.2.0 show no plugins until
  re-imported).

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.2.0.zip.

SHA-256 Vulnerator-v7.2.0.zip: 3cf32184f227fe2755f5eaa99e51ba88b3a18b98922ec46d00412ab4b3669158

For application control (allow by hash): Vulnerator.exe 235e5abd3c2f38c7441f95a23379f59f55df0c9108bcfc7c7a304f597ac79d51. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.2.0-file-hashes.txt.

Vulnerator 2.0 (v7.2.0-beta.2)

Vulnerator 2.0 — 7.2.0 beta 2

Fixes the empty Configuration Management > Ports, Protocols, Services tab.

• The tab's list was bound to a name the screen does not have (an unfinished part of the upstream 7.0 alpha), so it
  stayed empty even though the data was there - the new report showed it. The list now shows every port / protocol /
  service from your scans, sorted by port, with the service as detected, your service name and acronym, and the number
  of hosts.
• Selecting a row shows its details and hosts. Save Name / Acronym stores the service name and acronym (used by
  the Ports, Protocols & Services report). Delete PPS removes an entry and its host links after asking (a later
  scan that still shows it adds it back). Clear Selection reloads the list.
• Buttons that did nothing (an unfinished per-host remove and "Add Hardware" box) were removed from this tab.
• The build now opens this tab's data the way the screen does, after importing the test scan.

Also in this version (from beta 1): the Ports, Protocols & Services report, and Nessus port 0 results no longer stored
as services.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.2.0-beta.2.zip.

SHA-256 Vulnerator-v7.2.0-beta.2.zip: 579fca6f38f537b293c1fdd7cc1787b7c26d98e9c29fa1e840b3b4c88b23cd60

For application control (allow by hash): Vulnerator.exe aad44996204fdbb9708c70de8caa4f41ec372799654a2160232ca75b270f3796. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.2.0-beta.2-file-hashes.txt.

Vulnerator 2.0 (v7.2.0-beta.1)

Vulnerator 2.0 — 7.2.0 beta 1

Ports, protocols and services (PPS) from your ACAS / Nessus scans.

New report: Ports, Protocols & Services (Excel)

• Ports Protocols Services sheet: one row per port / protocol / service the scans observed, with the service name
  as Nessus detected it, your service name and acronym (set them under Configuration Management > Ports, Protocols,
  Services), the number of hosts, the host names, IP addresses, groups, and the Nessus plugins that showed it on those
  hosts (the evidence).
• By Host sheet: one row per host and port.
• Header row frozen, filter buttons, your marking in the header and footer. Only the group filter applies.
• A starting point for the system's PPSM registration.

Import

• Nessus files host-level results under port 0 ("general/tcp", "general/icmp"). Those are no longer stored as
  services, and existing port-0 entries are removed from your database on the first start of this version.
• Each port now records which plugin(s) showed it on each host. Ports in scans imported before this version have no
  plugins listed until the scan is imported again.

Tests

• The build now checks the PPS data from the test scan (no port 0, 22/tcp ssh on the right host, evidence plugin) and
  the new report's sheets and totals.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.2.0-beta.1.zip.

SHA-256 Vulnerator-v7.2.0-beta.1.zip: 2d3d9df40b4b877f97dfa3632dc28e624be4b6caf57f91d975a09f8b5e8fadc7

For application control (allow by hash): Vulnerator.exe 0c2c73fb21ea7640fdf5016b8842167bb9ee6bf149a71d230af097f1bb60d820. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.2.0-beta.1-file-hashes.txt.

Vulnerator 2.0 (v7.1.0)

Vulnerator 2.0 — 7.1.0

Two reports from Vulnerator 6 are back, rebuilt for 2.0: STIG Details and a PDF Summary. Tested on a real system as 7.1.0 beta 1.

STIG Details (Excel)

The successor of the Vulnerator 6 "STIG Details" tab.

• STIG Details sheet: every checklist (.ckl / .cklb / Evaluate-STIG) and SCAP / XCCDF rule result, one row per host
  and rule: STIG name and version, host, IP address, groups, Vuln ID, Rule ID, STIG ID, rule title, severity and
  override, status and mitigated status, NIST SP 800-53 Rev 5 controls, CCIs, discussion, check content, fix text,
  finding details, comments, finding type, source file and last observed date. Header row frozen, filter buttons on
  every column.
• Summary by STIG sheet: hosts, rules evaluated, open CAT I / II / III, Not a Finding, Not Applicable, Not
  Reviewed and compliance % for each STIG.
• The old DIACAP "IA Control" column is replaced by the Rev 5 controls.

PDF Summary

A printable overview (the Vulnerator 6 PDF only had a cover table): system name and who prepared it; totals; open
findings by source (ACAS, checklists, SCAP) and CAT; results by status; STIG compliance; the 20 assets with the most
open findings; the 20 most widespread open findings. The marking is printed at the top and bottom of every page.

Both use their own filters on the Reporting page (finding type, severity, status, group, or the Global values) and are
included in Launch Selected Reports. The group RMF override does not apply to them.

Fixes

• Help > Using the Software lists every report.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.1.0.zip.

SHA-256 Vulnerator-v7.1.0.zip: dad6d815eec1519a932a7d90534419d1aa8bb7fb700d3a0a9e2e0f467bc7681b

For application control (allow by hash): Vulnerator.exe 60085526acb24dd99180959ef25bccaab9d38ae6285aa60ede7aa0af9d76338b. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.1.0-file-hashes.txt.

Vulnerator 2.0 (v7.1.0-beta.1)

Vulnerator 2.0 — 7.1.0 beta 1

Two reports from Vulnerator 6 are back, rebuilt for 2.0: STIG Details and a PDF Summary.

STIG Details (Excel)

The successor of the Vulnerator 6 "STIG Details" tab.

• STIG Details sheet: every checklist (.ckl / .cklb / Evaluate-STIG) and SCAP / XCCDF rule result, one row per host
  and rule: STIG name and version, host, IP address, groups, Vuln ID, Rule ID, STIG ID, rule title, severity and
  override, status and mitigated status, NIST SP 800-53 Rev 5 controls, CCIs, discussion, check content, fix text,
  finding details, comments, finding type, source file and last observed date. Header row frozen, filter buttons on
  every column.
• Summary by STIG sheet: hosts, rules evaluated, open CAT I / II / III, Not a Finding, Not Applicable, Not
  Reviewed and compliance % for each STIG.
• The old DIACAP "IA Control" column is replaced by the Rev 5 controls.

PDF Summary

A printable overview (the Vulnerator 6 PDF only had a cover table): system name and who prepared it; totals; open
findings by source (ACAS, checklists, SCAP) and CAT; results by status; STIG compliance; the 20 assets with the most
open findings; the 20 most widespread open findings. The marking is printed at the top and bottom of every page.

Both use their own filters on the Reporting page (finding type, severity, status, group, or the Global values) and are
included in Launch Selected Reports. The group RMF override does not apply to them.

Fixes

• Help > Using the Software lists every report.

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.1.0-beta.1.zip.

SHA-256 Vulnerator-v7.1.0-beta.1.zip: 2fb8ad8ccb1def8352e7dd9e3a9953a06a3118149c7232b3dc651f0a00666c7c

For application control (allow by hash): Vulnerator.exe 503dd31681a5411dc3fe02786fc63873194a49ac578cf3b4579d6c9a0f979ed1. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.1.0-beta.1-file-hashes.txt.

Vulnerator 2.0 (v7.0.0)

Vulnerator 2.0 — 7.0.0

First full release of Vulnerator 2.0, the maintained rewrite of Vulnerator for current DoD RMF work. It follows
eleven pre-releases (7.0.0 beta 1–11) and has been checked on a real system: STIG library, checklist, Evaluate-STIG,
ACAS and SCAP imports, and the eMASS POA&M, Hardware / Software, Risk Assessment and STIG Discrepancies reports.

Requirements

• 64-bit Windows with .NET Framework 4.8. No installation and no administrator rights.
• Unzip the whole folder and run Vulnerator.exe from it. If Windows marks the zip as downloaded, unblock it first
  (Properties > Unblock).
• Works where endpoint protection blocks DLLs in user folders and where .NET strong-name bypass is disabled (DoD .NET
  hardening): the database engine is winsqlite3.dll, part of Windows.

Highlights

NIST SP 800-53 Rev 5

• Controls and CCI mappings from the DISA CCI list and NIST OSCAL Rev 5; CNSSI 1253 baselines.
• eMASS assessment procedures from your own IG/AP export (.xlsx or CSV, any column order); the data stays on your machine.

Imports (Vulnerability Management > Ingest: pick a file type, then Add Files / Zips... or Add Folder...)

• STIG checklists: .ckl and STIG Viewer 3 .cklb, from files, zips and folders. Evaluate-STIG output: anything under
  a Previous folder is skipped. Checklists without a host load as STIG baselines.
• ACAS: .nessus and CSV, from files, zips and folders of zips. Hosts are matched by host name across scans.
• SCAP / SCC XCCDF results (XCCDF 1.1 / 1.2).
• DISA STIG library (Settings): the quarterly zip, individual STIG zips or extracted benchmark .xml files, with an
  extractor for machines where the zip is not allowed. Newer releases replace older ones without deleting rules your
  findings use.

Exports (Reporting)

• eMASS POA&M (one item per open rule / plugin, required fields from Settings > eMASS Export) and eMASS Hardware /
  Software list.
• Risk Assessment Report and SCAP & STIG Discrepancies, with no service-specific branding.
• Per-host STIG checklist (.ckl) from Configuration Management.
• Every export asks for the classification / handling marking (header, footer and file properties; CKL MARKING).
  Labeled input files are imported only after you confirm the label.

Behaviour

• Offline by default: nothing contacts the internet unless Settings > Online Checks is on.
• Errors are logged with their cause and the message names the log file; Help pages rewritten.
• New Vulnerator 2.0 logo.

Licensing

MIT (LICENSE.txt). Bundled components and their licenses are listed in THIRD-PARTY-NOTICES.txt. Icons are the free
Material Design Icons; the Font Awesome Pro icons in the original project are no longer included.

Credits

Vulnerator 2.0 application rewrite: Hector L. Bones. Based on Vulnerator by Alex Kuchta and contributors.

Checking your files

Test-RealData.ps1 in the folder imports a folder of your files into a throwaway database and prints one line per
file; nothing leaves your machine:

powershell -NoProfile -ExecutionPolicy Bypass -File .\Test-RealData.ps1 -InputDir "C:\path\to\files"

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.0.0.zip. File hashes for
application allow-listing are in Vulnerator-v7.0.0-file-hashes.txt.

SHA-256 Vulnerator-v7.0.0.zip: 33396ae60d11b6cce6dd026951a6e30a57a6dd01b1b18d668182cc927abbb95c

For application control (allow by hash): Vulnerator.exe 58d50cef0fc8fcdd02feaf942c3084af2c9a83ce6dea68c660a5f8b23c2a7472. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.0.0-file-hashes.txt.

Vulnerator 2.0 (v7.0.0-beta.11)

Vulnerator 2.0 — 7.0.0 beta 11

Licensing clean-up for the Vulnerator 2.0 release.

• Icons: the app no longer ships the custom icon library from the original project, which contained Font Awesome
  Pro ("Light") icons that are licensed only to the original purchaser. Every icon now comes from the free
  MahApps.Metro.IconPacks Material pack (Material Design Icons). The icons look slightly different; nothing else
  changes. The download is about 17 MB smaller.
• LICENSE.txt (MIT, with the original 2017 copyright and the 2026 Vulnerator 2.0 line) and
  THIRD-PARTY-NOTICES.txt (every bundled library with its license, generated from the packages in the build) are now
  in the release folder next to Vulnerator.exe.

SHA-256 Vulnerator-v7.0.0-beta.11.zip: 74ca58d559e80a90504945f454e7f233304286d75291f876a0ffbde584964385

For application control (allow by hash): Vulnerator.exe f584c2b4d567d7abbb6ce6f6da9dfc21ed70e0305eff15660d1bcb446c74afc4. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.0.0-beta.11-file-hashes.txt.