Metadata-Version: 2.4
Name: ExploitDBSighting
Version: 0.3.0
Summary: A client that retrieves vulnerability observations from Exploit-DB and pushes them to a Vulnerability-Lookup instance.
License-Expression: GPL-3.0-or-later
License-File: COPYING
Keywords: vulnerability,cve,sighting,observations,Exploit-DB,Vulnerability-Lookup
Author: Cédric Bonhomme
Author-email: cedric.bonhomme@circl.lu
Requires-Python: >=3.10,<4.0
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Science/Research
Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3.15
Classifier: Topic :: Security
Requires-Dist: argparse (>=1.4.0)
Requires-Dist: pyvulnerabilitylookup (>=2.2.0)
Requires-Dist: requests (>=2.32.3)
Project-URL: Homepage, https://github.com/vulnerability-lookup/ExploitDBSighting
Project-URL: Repository, https://github.com/vulnerability-lookup/ExploitDBSighting
Description-Content-Type: text/markdown

# ExploitDBSighting

A client that retrieves vulnerability observations from
[Exploit-DB](https://www.exploit-db.com) and pushes them to a
[Vulnerability-Lookup](https://github.com/vulnerability-lookup/vulnerability-lookup) instance.

Exploit-DB.com is a comprehensive and publicly accessible database of security
vulnerabilities and exploits, maintained by Offensive Security. It serves as a
crucial resource for penetration testers, researchers, and ethical hackers by
offering detailed information and proof-of-concept code.

Within the Vulnerability-Lookup project, data from Exploit-DB are leveraged as sightings
of type ``published-proof-of-concept``, dated with the exploit's publication date. An
Exploit-DB entry shows that exploit code for the vulnerability is public; it is not an
observation of the vulnerability being exploited, which is what the ``exploited`` type
records ("This vulnerability was exploited and seen by the user reporting the sighting").

> [!IMPORTANT]
> Earlier versions documented the ``exploited`` type, and a configuration that still
> sets ``sighting_type = "exploited"`` makes every Exploit-DB entry count as observed
> exploitation (for example in the vulnerability timeline of Vulnerability-Lookup). Set it
> to ``published-proof-of-concept``; the client prints a warning until you do. Sightings
> already pushed with the wrong type are retyped on the Vulnerability-Lookup side with
> ``flask --app website.app retype_sightings``.

More information about the sightings:

- [Corresponding MISP taxonomy](https://github.com/MISP/misp-taxonomies/blob/fd2fbaf2a450e42a490551e5a8e2fa6df039a6b8/vulnerability/machinetag.json#L26-L63)
- [Vulnerability-Lookup documentation](https://www.vulnerability-lookup.org/documentation/sightings.html)

## Installation


[pipx](https://github.com/pypa/pipx) is an easy way to install and run Python applications in isolated environments.
It's easy to [install](https://github.com/pypa/pipx?tab=readme-ov-file#on-linux).


```bash
$ pipx install ExploitDBSighting
$ export ExploitDBSighting_CONFIG=~/conf.py
```

The configuration should be defined in a Python file (e.g., ``~/.conf.py``).
You must then set an environment variable (``ExploitDBSighting_CONFIG``) with the full path to this file.


### With Docker

```bash
git clone https://github.com/vulnerability-lookup/ExploitDBSighting
cd ExploitDBSighting

# Make sure conf.py exists in the project root before running
docker compose up --build
```

> [!NOTE]
> The docker-compose.yml expects a conf.py file in the root directory.
> You can create it manually or copy the provided example:
> 
> ```bash
> $ cp exploitdbsighting/conf_sample.py conf.py
> ```


## Usage

### Publishing sightings to Vulnerability-Lookup

```bash
$ ExploitDBSighting
CVE-2017-14084
https://www.exploit-db.com/exploits/42891
2017-09-28 00:00:00+00:00
Pushing sighting to Vulnerability-Lookup…

CVE-2017-14085
https://www.exploit-db.com/exploits/42893
2017-09-28 00:00:00+00:00
Pushing sighting to Vulnerability-Lookup…

CVE-2017-14086
https://www.exploit-db.com/exploits/42892
2017-09-28 00:00:00+00:00
Pushing sighting to Vulnerability-Lookup…
```

By specifying a date with the --since parameter:

```bash
$ ExploitDBSighting --since 2025-01-01
Fetching records starting at 0…
CVE-2025-48932
https://www.exploit-db.com/exploits/52383
2025-07-28 00:00:00+00:00
Pushing sighting to Vulnerability-Lookup…

CVE-2025-1974
https://www.exploit-db.com/exploits/52338
2025-06-20 00:00:00+00:00
Pushing sighting to Vulnerability-Lookup…

CVE-2025-0868
https://www.exploit-db.com/exploits/52145
2025-04-09 00:00:00+00:00
Pushing sighting to Vulnerability-Lookup…

Encountered record older than specified --since date (2025-01-01 00:00:00+00:00). Stopping.
```

By default, all CVE-tagged exploits are imported. Exploit-DB verifies only a small
fraction of recent submissions, so filtering on verified exploits misses most of them.
To import only verified exploits anyway, use ``--verified-only``:

```bash
$ ExploitDBSighting --since 2025-01-01 --verified-only
```


## License

[ExploitDBSighting](https://github.com/vulnerability-lookup/ExploitDBSighting) is licensed under
[GNU General Public License version 3](https://www.gnu.org/licenses/gpl-3.0.html)

~~~
Copyright (c) 2024-2025 Computer Incident Response Center Luxembourg (CIRCL)
Copyright (C) 2024-2025 Cédric Bonhomme - https://github.com/cedricbonhomme
~~~

