Exploit and threat tools
Exploit counts and samples per source, in-the-wild sightings, indicators of compromise, threat actors, ATT&CK techniques and OpenSSF scorecards, with what Community withholds.
All six take one parameter, identifier. Below Pro, vdb-api withholds the individual records but returns the counts, and every tool says so in the result. See Plans and limits.
| Tool | Answers | Withheld below Pro |
|---|---|---|
vulnetix_exploits |
How many public exploits exist, per source | exploitsBySource records; note explains |
vulnetix_sightings |
Whether exploitation is current or historical | events; gated: true |
vulnetix_iocs |
Attacking IPs, ASNs, geography, Shadowserver scan counts | sightings records; gated: true |
vulnetix_threat_actors |
Actors and campaigns, malicious or impersonation flags | threatActors records; gated: true |
vulnetix_attack_techniques |
MITRE ATT&CK techniques and tactics | nothing |
vulnetix_scorecard |
OpenSSF scorecard and repository health for affected projects | nothing |
vulnetix_exploits
Aggregates ExploitDB, Metasploit, Nuclei, VulnCheck XDB, CrowdSec, GitHub PoCs, HackerOne, Bugcrowd, Intigriti, MISP, nmap NSE, Shadowserver and the Vulnetix KEV.
| Field | Contents |
|---|---|
exploitCount, sightingCount |
Totals |
summary |
Count per source, as vdb-api sends it |
activeSources |
Sources with a non-zero count, sorted by count |
exploitsBySource |
Per source: count and up to 5 samples with title, url, type |
note |
Present when counts exist but records were withheld |
Is CVE-2021-44228 being weaponised, and by which sources?vulnetix_sightings
count, firstObservation, lastObservation, daysSinceLastSeen and up to 50 events. A CVE last seen years ago needs different urgency from one seen this week.
vulnetix_iocs
total, shadowserver scan data, and up to 50 sightings records. Use it to build a blocklist or feed a SIEM.
vulnetix_threat_actors
counts, up to 40 threatActors, up to 40 iocs, isMalicious and impersonationTrap. Use it during incident response to attribute activity.
vulnetix_attack_techniques
total and up to 60 attackTechniques. Use it to map an advisory onto your detection controls or D3FEND counter-techniques.
vulnetix_scorecard
Up to 20 scorecards, commitHealth, prRepoHealth and sourceFixCorrelation for the projects an advisory touches. Use it to judge whether an upstream will ship the next fix.