Vulnerability & Threat Intelligence Lookup
Purpose
Perform unified, multi-source threat intelligence lookup for any CVE to determine:
- Real-world exploitation status: Is this vulnerability currently being actively exploited in the wild by threat actors or ransomware groups (CISA KEV)?
- Exploitation likelihood: What is the 30-day statistical probability of exploitation (FIRST EPSS)?
- Severity & Impact: What is the technical severity score (CVSS v3/v4), weakness type (CWE), and affected scope (NVD)?
- PoC Availability: Are public exploits and Proof of Concepts indexed on Exploit-DB or trending on GitHub?
This skill focuses strictly on defensive risk assessment, threat intelligence, triage prioritization, and remediation planning.
Workflow
Run the bundled read-only CLI helper from the repository root:
1. Comprehensive Threat Intel Lookup for a CVE
powershellpython vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2024-6387
2. Machine-Readable JSON Output (for Agents & Pipelines)
powershellpython vulnerability-lookup\scripts\lookup_vuln.py --cve CVE-2021-44228 --json
3. List Recent Actively Exploited Vulnerabilities (CISA KEV)
powershellpython vulnerability-lookup\scripts\lookup_vuln.py --recent-kev 10
4. Shodan Host & IP Reconnaissance (Open Ports, CVEs, Web View)
powershellpython vulnerability-lookup\scripts\lookup_vuln.py --ip 1.1.1.1
Queries Shodan InternetDB (100% free, no key required) for open ports, hostnames, and indexed CVEs, generating a direct web link (https://www.shodan.io/host/<IP>) and quick-launch browser commands.
Environment Variables (Optional)
NVD_API_KEY: Increases NIST NVD rate limit from 5 to 50 requests per 30 seconds.GITHUB_TOKEN: Increases GitHub Search API rate limit from 10 to 30 requests per minute.SHODAN_API_KEY: Enriches Shodan IP lookup with ISP, ASN, operating system, and city metadata.
Triaging & Prioritization Matrix
Correlate findings to establish defensive urgency:
| KEV Status | EPSS Score | CVSS Score | Priority | Action Guidance |
|---|---|---|---|---|
| In KEV (Active) | Any (usually high) | Any | P0 - Emergency | Active wild exploitation confirmed. Patch immediately before CISA due date or isolate systems. |
| Not in KEV | > 30% (High) | >= 7.0 (High/Crit) | P1 - High | High weaponization risk; public PoCs likely in automated scans. Fast-track patching. |
| Not in KEV | < 10% (Low) | >= 9.0 (Critical) | P2 - Medium | High theoretical impact but low current exploit activity. Follow standard patch cycle with monitoring. |
| Not in KEV | < 5% (Low) | < 7.0 (Low/Med) | P3 - Routine | Low exploitation risk and moderate impact. Routine maintenance update. |
Defensive & Remediation Guidelines
When presenting intelligence to users:
- Never download, compile, or execute exploit scripts. The presence of GitHub PoCs or Exploit-DB entries is evidence of weaponization, not an authorization to run untested exploit code.
- Highlight Ransomware Flags: If CISA KEV marks
knownRansomwareCampaignUse: Known, explicitly warn about ransomware risk. - Verify Product Applicability: Confirm target software version matches the affected CPEs before recommending remediation.
- Link to Official Vendor Advisories: Prioritize vendor patches and mitigation guidance over third-party workarounds.
Output Contract
When queried, report:
- CVE Identifier & Query timestamp
- Threat Summary Alert (Active KEV warning, high EPSS alert, or normal notice)
- Scoring Table: CVSS score + vector, EPSS score + percentile, CISA KEV status + due date
- Technical Summary: Description, CWE weaknesses, and references
- PoC References: Exploit-DB IDs and top public GitHub PoC repos with star counts
- Recommended Action: Priority level and vendor mitigation steps
