wufufu770 TL;DR
- 目的：Fingerprint components and match against known N-day CVEs
- 适用：通用型漏洞报告（CNVD / SRC）
- 输入：目标 URL + 已知组件 / 响应头
- 输出：组件指纹 + CVE 列表 + 复现路径
- 红线：仅复现公开 PoC，不开发 0-day
- 关联：上游：recon skill → 下游：fp-check, hunt-target-exploit, reporting
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
Workflow
- Fingerprint — Identify component, version, framework via headers/Wappalyzer/response body
- CVE lookup — Query NVD / KEV / ExploitDB / GitHub Security Advisories
- PoC collection — Find public PoC (ExploitDB, GitHub, Packet Storm)
- Reproduce — Run PoC in isolated test environment first
- Verify — Use fp-check for cross-validation
- Document — Fill CNVD-common template
Advanced Techniques
Multi-Version Fingerprinting
Use parallel probes across multiple Wappalyzer rules + manual header inspection to disambiguate component versions (e.g., nginx 1.18.0 vs 1.20.2 with different OpenSSL).
CVE Database Cross-Reference
Query multiple sources (NVD, KEV, ExploitDB, GitHub Security Advisories) in parallel to catch CVEs missed by any single source.
Behavioral Fingerprinting
When version strings are stripped, use timing differences and behavior patterns to identify components (e.g., IIS vs nginx response to OPTIONS method).