vulnerabilitySearcher.py

import sys
import requests
import re
from termcolor import colored
import json
from pyExploitDb import PyExploitDb
from bs4 import BeautifulSoup
import subprocess


art="""
 __  __ ___ ____      _    _  __
|  \/  |_ _|  _ \    / \  | |/ /
| |\/| || || |_) |  / _ \ | ' / 
| |  | || ||  _ <  / ___ \| . \ 
|_|  |_|___|_| \_\/_/   \_\_|\_\ """

print(colored(art, "magenta"))

def find_cpes(component, version):
    base_url = "https://nvd.nist.gov/products/cpe/search/results"
    params = {
        "namingFormat": "2.3",
        "keyword": f"{component} {version}"
    }

    response = requests.get(base_url, params=params)
    content = response.text

    cpe_matches = re.findall(r'cpe:(.*?)<', content)
    return cpe_matches

def synk_db(cve_id):
    res = requests.get(f"https://security.snyk.io/vuln/?search={cve_id}")
    a_tag_pattern = r'data-snyk-test="vuln table title".*>([^"]+)<!----><!---->'
    a_tag_matches = re.findall(a_tag_pattern, res.text)

    if a_tag_matches:
        snyk_short_name = a_tag_matches[0].strip()
        return snyk_short_name


def search_exploit(cve_id):
    try:
        # Execute searchsploit command
        output = subprocess.check_output(['searchsploit', cve_id], stderr=subprocess.STDOUT, universal_newlines=True)
        
        # Check if any results were found
        if output.strip():
            return 1
        else:
            return 0
    except subprocess.CalledProcessError:
        # Error occurred (e.g., searchsploit not found, or no results found)
        return "Error occurred while searching for exploit"
    

def fetch_cve_details(cpe_string):
    base_url = "https://services.nvd.nist.gov/rest/json/cves/2.0"
    cves = []

    url = f"{base_url}?cpeName=cpe:{cpe_string}"
    #print(colored(f">>> {url}", "red"))

    response = requests.get(url)

    if response.status_code != 200:
        print(colored(f"Error: Unable to retrieve CVE data for CPE: {cpe_string}. Status code: {response.status_code}", "yellow"))
        return []

    try:
        data = response.json()
    except json.JSONDecodeError:
        print(colored(f"Error decoding JSON for CPE: {cpe_string}. Skipping.", "red"))
        return []

    all_cve_details=[]
    for cve_item in data["vulnerabilities"]:

        cve_id = cve_item["cve"]["id"]
        description_text = cve_item["cve"]["descriptions"][0]["value"]
        severity = cve_item["cve"]["metrics"]["cvssMetricV2"][0]["baseSeverity"] if "cvssMetricV2" in cve_item["cve"]["metrics"] else "Not Available"
        link = f"https://nvd.nist.gov/vuln/detail/{cve_id}"
        snyk_short_name = synk_db(cve_id)
        weaknesses = []

        if "weaknesses" in cve_item["cve"]:
            for problem_type in cve_item["cve"]["weaknesses"]:
                for description in problem_type["description"]:
                    weaknesses.append(description["value"])

            all_cve_details.append({
                "CVE ID": cve_id,
                "Short Name": snyk_short_name,
                "Description": description_text,
                "Weaknesses": ", ".join(weaknesses),
                "severity": severity
            })
        else :
            all_cve_details.append({
                "CVE ID": cve_id,
                "Short Name": snyk_short_name,
                "Description": description_text,
                "Weaknesses": "NO CWE",
                "severity": severity
            })

    return all_cve_details

def fetch_github_urls(cve_id):
    api_url = f"https://poc-in-github.motikan2010.net/api/v1/?cve_id={cve_id}"
    response = requests.get(api_url)

    if response.status_code == 200:
        data = response.json()
        if "pocs" in data and data["pocs"]:
            github_urls = [poc["html_url"] for poc in data["pocs"]]
            return github_urls
    return []

def search_and_extract_download_links(product_name):
    search_url = f"https://packetstormsecurity.com/search/?q={product_name}"
    response = requests.get(search_url)

    download_links = []

    if response.status_code == 200:
        soup = BeautifulSoup(response.text, 'html.parser')
        results = soup.find_all('a', href=True)

        for result in results:
            href = result['href']
            if '/files/download/' in href and href.endswith('.txt'):
                download_links.append(f"https://packetstormsecurity.com{href}")

        if not download_links:
            print(colored("No download links found on Packet Storm Security.", "green", attrs=["underline"]))
            return None

    return download_links

def search_marc_info(search_term):
    # Make a GET request to the URL
    url = f"https://marc.info/?l=full-disclosure&s={search_term}"
    response = requests.get(url)

    # Check if the request was successful
    if response.status_code == 200:
        # Parse the HTML content of the page
        soup = BeautifulSoup(response.text, 'html.parser')

        # Check if the response contains "No hits found for"
        if "No hits found for" in soup.get_text():
            print(colored("No matching exploits found.", "red", attrs=["underline"]))
        else:
            # Find all <a> tags within <pre> tags, excluding those with "full-disc" in the text
            post_links = soup.find('pre').find_all('a', string=lambda text: "full-disc" not in text)

            # Print all names and links
            if post_links:
                results = []
                for link in post_links:
                    name = link.get_text(strip=True)
                    link_url = "https://marc.info" + link['href']
                    results.append({"Name": name, "Link": link_url})
                return results
            else:
                print(colored("No matching exploits found.", "green"))
    else:
        print(colored("Failed to retrieve the web page.", "red"))
        print(f"Status code: {response.status_code}")
        return None

if __name__ == "__main__":
    print(colored("CVE and Exploit Searcher - @kimko\n\n", "magenta", attrs=["bold"]))

    component = input(colored("> Enter technology name : ", "magenta"))
    version = input(colored("> Enter version : ", "magenta"))

    cpe_strings = find_cpes(component, version)
    
    if cpe_strings:
        print(colored("\nCOMMON PLATFORM ENUMERATION Searcher", "green",attrs=["bold"]))
        for cpe_string in cpe_strings:
            print(colored(f"{cpe_string}", "white"))
        

        for cpe_string in cpe_strings:
            results=[]
            #print(colored("\nCPE CHECK >> "+ cpe_string, "cyan",attrs=["underline"]))
            results = fetch_cve_details(cpe_string)
            if results:
                for result in results:
                    cve_id = result["CVE ID"]
                    print ("____________________________________________________________________________________________")
                    if result["Short Name"]:
                        print(colored(f"\nCVE DETAILS > {cve_id} [{result['Short Name']}]", "magenta", attrs=["bold"]))
                    else :
                        print(colored(f"\nCVE DETAILS > {cve_id}", "magenta", attrs=["bold"]))

                    if result["Weaknesses"]:
                        print(colored(f"Weakness Enumeration {result['Weaknesses']}", "white"))

                    if result['severity'] == "CRITICAL" or result['severity'] == "HIGH" :
                        print("SEVERITY >> "+ colored(f"{result['severity']}", "red", attrs=["bold"]))

                    if result['severity'] == "MEDIUM":
                        print("SEVERITY >> "+colored(f"{result['severity']}", "yellow", attrs=["bold"]))

                    if result['severity'] == "LOW":
                        print("SEVERITY >> "+colored(f"{result['severity']}", "green", attrs=["bold"]))

                    print(colored(f"{result['Description']}", "yellow", attrs=["bold"]))


                    github_urls = fetch_github_urls(cve_id)
                    if github_urls:
                        print(colored("[Github] Public Exploit/POC >", "red"))
                        for url in github_urls:
                            print(colored(f"  {url}", "blue"))
                    else:
                        print(colored("NO Public Exploit/POC is found Over Github", "green"))
                    
                    
                    if search_exploit(cve_id) == 1:
                        print(colored(f"[Exploit-DB] Public Exploit >", "red"))
                        print(colored(f"  https://www.exploit-db.com/search?cve="+cve_id, "blue"))
                    elif search_exploit(cve_id) == 0:
                        print(colored(f"No Public Exploit Found over Exploit-DB\n", "green"))
                    else:
                        print(search_exploit(cve_id))
                    

    else:
        print(colored("No CPEs found for the provided component and version.", "red"))
    
    # Search for download links on Packet Storm Security even if no CPEs were found
    download_links = search_and_extract_download_links(component)
    
    if download_links:
        print(colored("\nPossible Exploits [Packet Storm Security]", "magenta", attrs=["underline"]))
        for link in download_links:
            print(link)
    else:
        print(colored("No download links found on Packet Storm Security.", "red", attrs=["underline"]))

    # Search Marc.Info
    search_term_marc = f"{component} {version}"
    print(f"\nUsing keyword "+search_term_marc+" for lookup...")
    marc_results = search_marc_info(search_term_marc)
    if marc_results:
        print(colored("\nPossible Exploits", "magenta", attrs=["underline"]))
        for result in marc_results:
            print(colored(f"\nName: {result['Name']}", "white"))
            print(colored(f"Link: {result['Link']}", "blue"))