Skip to content

Commit d7f2b39

Browse files
rafabd1rafabd1
committed
version 1.0
1 parent ca343ec commit d7f2b39

File tree

11 files changed

+498
-215
lines changed

11 files changed

+498
-215
lines changed

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2025 Rafael-BD
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# theWatcher
2+
3+
<!-- <h1 align="center">
4+
<img src="#" alt="theWatcher" width="150px">
5+
</h1> -->
6+
7+
theWatcher is a security vulnerability collection and analysis tool. It retrieves data from multiple sources, applies AI-based classification and summarization when possible, and generates concise reports.
8+
9+
## Features
10+
11+
- Collect vulnerabilities from:
12+
- Full Disclosure
13+
- Exploit-DB
14+
- NIST
15+
- Summarize vulnerabilities using AI (OpenAI's Gemini-based model), grouping them by technology and highlighting trends
16+
- Filter vulnerabilities by severity
17+
- Limit the number of items collected from each source
18+
19+
## Prerequisites
20+
21+
- Python 3.7+
22+
- An optional Google Generative AI API key (placed in a .env file as GEMINI_API_KEY) for AI-based classification and summarization.
23+
- You can request access to the API [here](https://aistudio.google.com). The tool does not need the paid version of the API; the free tier is sufficient and does not require a credit card.
24+
25+
## Installation
26+
27+
1. Clone the repository.
28+
2. (Optional) Create a virtual environment and activate it.
29+
3. Install dependencies:
30+
pip install -r requirements.txt
31+
32+
4. (Optional) Create a .env file in the project root with the following content:
33+
GEMINI_API_KEY=YOUR_KEY_HERE
34+
35+
## Usage
36+
37+
Run the main script from the command line:
38+
python main.py [options]
39+
40+
Some useful options:
41+
- -c, --collect
42+
Collect vulnerabilities from the specified sources.
43+
- -s, --summarize
44+
Generate a summary report from collected vulnerabilities.
45+
- -F, --full-scan
46+
Collect from all sources (including NIST) over the last 30 days (implies --collect and --summarize).
47+
- -Q, --quick-scan
48+
Collect from all sources over the last 7 days, limiting each source to 50 items (implies --collect and --summarize).
49+
- -m, --max-items
50+
Maximum number of vulnerabilities to retrieve per source.
51+
- -t, --type [all|sources|nist]
52+
Overall scope (all sources or just NIST or custom sources).
53+
- -S, --sources [fulldisclosure exploitdb nist]
54+
Specify which sources to query.
55+
- -N, --no-ai
56+
Disable AI-based classification and summarization.
57+
- -o, --output-dir
58+
Select output directory for saved JSON and report files.
59+
60+
## Quick Demo
61+
62+
![Terminal Demo](./assets/image.png)
63+
64+
Here’s a quick command to collect data from all sources for the last 15 days and generate a report:
65+
66+
```console
67+
python main.py -c -s -d 15 --type all --max-items 50
68+
```
69+
70+
## Additional Usage Examples
71+
72+
```console
73+
# Collect vulnerabilities from multiple sources without AI
74+
python main.py --collect --sources fulldisclosure exploitdb --no-ai
75+
76+
# Run a comprehensive scan and summarization in headless mode
77+
python main.py -F --output-dir ./reports
78+
```
79+
80+
### Examples
81+
82+
1) Full scan of all sources, storing 100 items per source:
83+
python main.py --full-scan
84+
85+
2) Quick scan:
86+
python main.py --quick-scan
87+
88+
3) Custom scan (only Full Disclosure and Exploit-DB for the last 15 days without AI):
89+
python main.py -c -d 15 -S fulldisclosure exploitdb --no-ai
90+
91+
## Example Report
92+
93+
Here is an example of a generated report:
94+
95+
[Example Report](./example/all_report.md)
96+
97+
## Contributing
98+
99+
Feel free to open a pull request or submit an issue if you find any bugs or want to request new features.
100+
101+
## Development
102+
103+
This tool is under active development. New sources, AI APIs, and features will be added continuously.
104+
105+
## License
106+
107+
This project is licensed under the [MIT License](LICENSE).

‎assets/image.png

82.1 KB
Loading

‎example/all_report.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Vulnerability Analysis Report
2+
Generated: 2025-01-24 01:33:06
3+
Total Vulnerabilities Analyzed: 7
4+
5+
## Vulnerabilities by Technology
6+
7+
### Palo Alto Networks GlobalProtect
8+
9+
- [SEC Consult SA-20241009-0 :: Local Privilege Escalation via MSI installer in Palo Alto Networks GlobalProtect (CVE-2024-9473)](https://seclists.org/fulldisclosure/2024/Oct/2) ((Oct 09)) [Full Disclosure]
10+
- Local privilege escalation via a vulnerable MSI installer.
11+
12+
### Paxton Net2
13+
14+
- [CVE-2024-48939: Unauthorized enabling of API in Paxton Net2 software](https://seclists.org/fulldisclosure/2024/Oct/3) ((Oct 20)) [Full Disclosure]
15+
- Unauthorized enabling of API functionality.
16+
17+
### Rittal IoT Interface & CMC III Processing Unit
18+
19+
- [SEC Consult SA-20241015-0 :: Multiple Vulnerabilities in Rittal IoT Interface & CMC III Processing Unit (CVE-2024-47943, CVE-2024-47944, CVE-2024-47945)](https://seclists.org/fulldisclosure/2024/Oct/4) ((Oct 20)) [Full Disclosure]
20+
- Multiple vulnerabilities including improper signature verification of firmware upgrade files.
21+
22+
### SOPlanning
23+
24+
- [[webapps] SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)](https://www.exploit-db.com/exploits/52082) (Fri, 15 Nov 2024 00:00:00 +0000) [Exploit-DB]
25+
- Authenticated Remote Code Execution (RCE).
26+
27+
### IBM Tivoli Application Dependency Discovery Manager
28+
29+
- [CVE-2025-23227](https://nvd.nist.gov/vuln/detail/CVE-2025-23227) (January 23, 2025) [NIST]
30+
- Stored cross-site scripting (XSS) allowing arbitrary JavaScript execution.
31+
32+
### IBM Security Verify Bridge
33+
34+
- [CVE-2024-45672](https://nvd.nist.gov/vuln/detail/CVE-2024-45672) (January 23, 2025) [NIST]
35+
- Local privileged user can overwrite files due to excessive agent privileges, leading to potential DoS.
36+
37+
### Uyumsoft ERP
38+
39+
- [CVE-2024-10539](https://nvd.nist.gov/vuln/detail/CVE-2024-10539) (January 23, 2025) [NIST]
40+
- Reflected cross-site scripting (XSS) vulnerability using invalid characters.
41+
42+
43+
## Security Trends Analysis
44+
45+
### Privilege Escalation via Installer Vulnerabilities
46+
**Impact**: Allows attackers to gain elevated system access.
47+
48+
### Increase in Cross-Site Scripting (XSS) Vulnerabilities
49+
**Impact**: Allows attackers to execute malicious scripts within trusted web applications, potentially leading to data theft and account compromise
50+
51+
### API security vulnerabilities
52+
**Impact**: Unauthorized access and control over system functionalities
53+
54+
### Remote Code Execution (RCE)
55+
**Impact**: Allows attackers to execute arbitrary code on a vulnerable system
56+
57+
### Local File Manipulation
58+
**Impact**: Leads to DoS and system instability
59+
60+
### Firmware Update Vulnerabilities
61+
**Impact**: Allows execution of unsigned code by bypassing signature verification
62+

0 commit comments

Comments
 (0)