wufufu770 TL;DR
- 目的：Query CISA KEV and prioritize CVEs by real-world exploitation
- 适用：时间受限的项目 + 大量 CVE 时的排序
- 输入：CVE 列表或组件名
- 输出：优先级排序（KEV + EPSS 分数）+ 报告建议
- 红线：仅参考 KEV，不作为唯一决策依据
- 关联：上游：component-nday → 下游：cve-poc-generator, fp-check
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
Workflow
- Get CVEs — From component fingerprint
- Check KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Get EPSS — https://api.first.org/data/v1/epss
- Score — KEV present = high priority; EPSS > 0.5 = high
- Prioritize — KEV + high EPSS first
- Report — Document exploitation likelihood
Advanced Techniques
CISA KEV API
Query https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json for latest additions (updated daily).
EPSS Cross-Reference
After KEV check, use EPSS API (https://api.first.org/data/v1/epss) for exploitation probability. KEV + EPSS > 0.5 = highest priority.
Threat Intel Integration
Combine KEV with your threat intel feeds (e.g., GreyNoise, Shodan Monitor) to know if active exploitation is observed in the wild right now.