# Component Nday

> Fingerprint web application components and match against known N-day vulnerabilities (CVEs, public PoCs). Use exposed version strings, header fingerprints, and behavioral patterns to identify the exact component and version, then query CVE databases (NVD, KEV, ExploitDB) for known exploits. Core workflow for SRC/CNVD generic-type report generation.

- Skill: `wufufu770/component-nday` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/component-nday`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/component-nday/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/component-nday

---


## TL;DR

- **目的**：Fingerprint components and match against known N-day CVEs
- **适用**：通用型漏洞报告（CNVD / SRC）
- **输入**：目标 URL + 已知组件 / 响应头
- **输出**：组件指纹 + CVE 列表 + 复现路径
- **红线**：仅复现公开 PoC，不开发 0-day
- **关联**：上游：recon skill → 下游：fp-check, hunt-target-exploit, reporting



## When to Use

- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology

## When NOT to Use

- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
## Workflow

1. **Fingerprint** — Identify component, version, framework via headers/Wappalyzer/response body
2. **CVE lookup** — Query NVD / KEV / ExploitDB / GitHub Security Advisories
3. **PoC collection** — Find public PoC (ExploitDB, GitHub, Packet Storm)
4. **Reproduce** — Run PoC in isolated test environment first
5. **Verify** — Use fp-check for cross-validation
6. **Document** — Fill CNVD-common template



## Advanced Techniques

### Multi-Version Fingerprinting
Use parallel probes across multiple Wappalyzer rules + manual header inspection to disambiguate component versions (e.g., nginx 1.18.0 vs 1.20.2 with different OpenSSL).

### CVE Database Cross-Reference
Query multiple sources (NVD, KEV, ExploitDB, GitHub Security Advisories) in parallel to catch CVEs missed by any single source.

### Behavioral Fingerprinting
When version strings are stripped, use timing differences and behavior patterns to identify components (e.g., IIS vs nginx response to OPTIONS method).