What’s new.
Two new modules added to the web application:

• The BlockList module
• The Analyzer module

Blocklist Module

The blocklist module collects IoCs from a large number of public lists. The web application allow you to search for URLs, IPs and FQDNs. You can search a single item using the “Search” tab. The query result display you if an exact match will be found and also the similar results.

Using the “Bulk Search” tab you can submit 100 items per query, but in this case only the exact match will be displayed. In any case you can export the results in CSV format.

Analyzer Module

The analyzer module consists in a automatic souspicious file analyzer. Any page contains the static analysis of the file and a basic bahavior analysis. The submitted files are taken by OSINT sources (and not only). You can subscribe the RSS feed, if you want to be notified for every submitted file.

The easiest way to find information is the use of the dedicated search engine. You can search by MD5, SHA1 and SHA256 just submitting the correspondent hash.

Special searches are available with the use of the following keywords:

• imphash:$IMPORT_TABLE_HASH
• domain:$FQDN
• url:$URL_HOSTING_MALWARE

The search results page use a permalink structure you can use for further searches. The search results are exportable in CSV format. The CSV link is availables on the same page and reflects the permalink structure of the web search.

A new way to aggregate data is the use of the tagging system. Occasionally a report includes comments. Often comments are used to add a keywords, making the report aggregable via tag search. Just an example using one of the latest detected threat: #EternalRocks.

Any report can be exported in PDF format, at this time with limited information.

Hope this help.

Some example:

• Internet Explorer – 2015
• Adobe Flash Player – 2015
• Oracle JDK – 2015

Remember: all URLs are CPE compliance!

Many thanks to Bootstrap Framework developers, that make web design something possibile also to me!

This is first time I write FAQ for this service. Considering I’m the main (and only) developer there’s no question I need to do, but maybe a lots of questions I should reply to. So, feel free to ask for more details in the comments below.

What is the Pentest.IT’s mission?

Pentest.IT has not specific mission. You have to consider it just as an aggregation center for public CVEs. The purpose (not the mission) is to help people and organizations in the vulnerability management process.

What does it mean CVE?

CVE is the acronym for “Common Vulnerabilities and Exposures”. The MITRE () defines CVEs has “…a dictionary of publicly known information security vulnerabilities and exposures“.

What is a Vulnerability and an Exposure?

A “vulnerability” is a mistake in software that can be directly used by a hacker to gain access to a system or network.
An “exposure” is a system configuration issue or a mistake in software that allows access to information or capabilities that can be used by a hacker as a stepping-stone into a system or network.
The different between vulnerability and explosure is that the first one is usable to compromise a system. An exposure, even if is not usable itself to hack a system, is usually an important component of a successful attack.

What does it mean CWE?

CWE is the acronym for “Common Weakness Enumeration“. CWE provides a dictionary of commons software weaknesses. When a CWE is associated to a CVE entry the vulnerability is more detailed in its weak point. By this way it should be easiest apply security solution such as logical or physical security.
Note that a CWE entry describe just a weak point. It doesn’t specify how an attacker could gain advantage by the vulnerability. The attack methodologies are listed by the CAPEC dictionary.

What does it mean CAPEC?

CAPEC is the acronym for “Common Attack Pattern Enumeration and Classification“. CAPEC provides a dictionary of commons attack methodologies with the scope of understanding how a real attack can be performed and a better defence strategy could be applied.
CAPEC are usually mapped to one or more CWE entries.

What does it mean CPE?

CPE is the acronym for “Common Platform Enumeration“. As NVD report, it consist on a “…structured naming scheme for information technology systems, software, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal name format, a method for checking names against a system, and a description format for binding text and tests to a name”.
Understanding CPE syntax is necessary to use Pentest.IT features as well!

What is CVSS?

CVSS is the acronym for “Common Vulnerability Scoring System“. Its value can be in a range between 0 and 10. Grater value stay for greater risks. Actually CVEs are mapped to CVSSv2 Base Score. More information about CVSS are available in first.org website.

What is a patch?

In this scenario a patch is a piece of software applied to another one, designed to fix a vulnerability or a generic software flaw.

What are the available informations provided by Pentest.IT?

The service provides the followind items:

• Full list of published vulnerabilities with an associate RSS feed for the latest 25 items;
• Published vulnerabilities for any specific vendor with an associate RSS feed for the latest 25 items;
• Published vulnerabilities for a specific software with full CPE notation and an associate RSS feed for the latest 25 items;
• Published vulnerabilities for specifics product family (go to “The concept of Product Family“) with an associate RSS feed for the latest 25 items;
• Full list of “Common Weakness Enumeration”;
• Full list of “Common Attack Pattern Enumeraion and Classification”.

The concept of “Product Family”

Pentest.IT consider a “product family” as the aggregation of all vulnerabilities regarding a specific vendor and a specific product. In the CPE notation, two version of the same product have differents CPE entries (of course). But consider the case on you manage a set of machines where various version of the same software (aka CPE product) are installed (this happens often in the real world).
To aggregate these informations in a single view use this feature.

Permalinks structure for HTML resources

Pentest.IT has a basic set of API based on the permalinks structures.

• Single CVE entry: /cve-YYYY-CODE.html (example);
• Focus on specific vendor: /vendor-CPE_VENDOR.html (example);
• All CVE for a specific vendor: /vendorcve-CPE_VENDOR.html (example);
• Focus on a specific product family: /product/family/CPE_VENDOR:CPE_PRODUCT.html (example);
• All CVE for a specific product family: /product/family/all/CPE_VENDOR:CPE_PRODUCT.html (example);
• Focus on a specific CPE dictionary entry: /cvesoftware/CPE_PART:CPE_VENDOR:CPE_PRODUCT:CPE_VERSION:CPE_UPDATE:CPE_EDITION:CE_LANGUAGE.html (example).

Permalinks structure for RSS feed resources

Pentest.IT provides the following RSS feed:

• Latest 25 vulnerabilities: http://www.pentest.it/cve.rss;
• Specific vendor vulnerabilities: /vendor-CPE_VENDOR.rss (example);
• Product family vulnerabilities: /product/family/CPE_VENDOR:CPE_PRODUCT.rss (example);
• Specific CPE entry: /cvesoftware/CPE_PART:CPE_VENDOR:CPE_PRODUCT:CPE_VERSION:CPE_UPDATE:CPE_EDITION:CPE_LANGUAGE.rss (example).

Pentest.IT has the ability to map in a single view all available attributes:

• CVE Code
• Published date
• Updated date
• Description
• CVSS score and details
• Affected OS(s)/Application(s)/Hardware(s)
• Affected product family
• References
• CWE reference and related CAPEC
• MS Patches (only for Microsoft related CVEs)
• Related CVEs
• JSON data representation

RESTful API for CVE entries

Pentest.IT has the ability of give you all CVE informations in a single JSON stream. Use the following permalink structure:

• http://www.pentest.it/cve-AAAA-CODE.json (example).