Skip to content

Vulnerator 2.0 (v7.0.0)

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Nov 18:56
v7.0.0
7863d52

Vulnerator 2.0 — 7.0.0

First full release of Vulnerator 2.0, the maintained rewrite of Vulnerator for current DoD RMF work. It follows
eleven pre-releases (7.0.0 beta 1–11) and has been checked on a real system: STIG library, checklist, Evaluate-STIG,
ACAS and SCAP imports, and the eMASS POA&M, Hardware / Software, Risk Assessment and STIG Discrepancies reports.

Requirements

  • 64-bit Windows with .NET Framework 4.8. No installation and no administrator rights.
  • Unzip the whole folder and run Vulnerator.exe from it. If Windows marks the zip as downloaded, unblock it first
    (Properties > Unblock).
  • Works where endpoint protection blocks DLLs in user folders and where .NET strong-name bypass is disabled (DoD .NET
    hardening): the database engine is winsqlite3.dll, part of Windows.

Highlights

NIST SP 800-53 Rev 5

  • Controls and CCI mappings from the DISA CCI list and NIST OSCAL Rev 5; CNSSI 1253 baselines.
  • eMASS assessment procedures from your own IG/AP export (.xlsx or CSV, any column order); the data stays on your machine.

Imports (Vulnerability Management > Ingest: pick a file type, then Add Files / Zips... or Add Folder...)

  • STIG checklists: .ckl and STIG Viewer 3 .cklb, from files, zips and folders. Evaluate-STIG output: anything under
    a Previous folder is skipped. Checklists without a host load as STIG baselines.
  • ACAS: .nessus and CSV, from files, zips and folders of zips. Hosts are matched by host name across scans.
  • SCAP / SCC XCCDF results (XCCDF 1.1 / 1.2).
  • DISA STIG library (Settings): the quarterly zip, individual STIG zips or extracted benchmark .xml files, with an
    extractor for machines where the zip is not allowed. Newer releases replace older ones without deleting rules your
    findings use.

Exports (Reporting)

  • eMASS POA&M (one item per open rule / plugin, required fields from Settings > eMASS Export) and eMASS Hardware /
    Software list.
  • Risk Assessment Report and SCAP & STIG Discrepancies, with no service-specific branding.
  • Per-host STIG checklist (.ckl) from Configuration Management.
  • Every export asks for the classification / handling marking (header, footer and file properties; CKL MARKING).
    Labeled input files are imported only after you confirm the label.

Behaviour

  • Offline by default: nothing contacts the internet unless Settings > Online Checks is on.
  • Errors are logged with their cause and the message names the log file; Help pages rewritten.
  • New Vulnerator 2.0 logo.

Licensing

MIT (LICENSE.txt). Bundled components and their licenses are listed in THIRD-PARTY-NOTICES.txt. Icons are the free
Material Design Icons; the Font Awesome Pro icons in the original project are no longer included.

Credits

Vulnerator 2.0 application rewrite: Hector L. Bones. Based on Vulnerator by Alex Kuchta and contributors.

Checking your files

Test-RealData.ps1 in the folder imports a folder of your files into a throwaway database and prints one line per
file; nothing leaves your machine:

powershell -NoProfile -ExecutionPolicy Bypass -File .\Test-RealData.ps1 -InputDir "C:\path\to\files"

Verifying the download

Compare the SHA-256 below (also in the .sha256 file) with Get-FileHash .\Vulnerator-v7.0.0.zip. File hashes for
application allow-listing are in Vulnerator-v7.0.0-file-hashes.txt.

SHA-256 Vulnerator-v7.0.0.zip: 33396ae60d11b6cce6dd026951a6e30a57a6dd01b1b18d668182cc927abbb95c

For application control (allow by hash): Vulnerator.exe 58d50cef0fc8fcdd02feaf942c3084af2c9a83ce6dea68c660a5f8b23c2a7472. Vulnerator ships no native DLLs (SQLite comes from Windows); every file's hash is in Vulnerator-v7.0.0-file-hashes.txt.

Assets 5
Loading