skills.rest
Ed1s0nZ
Ed1s0nZCOMMUNITY
Explore all skills by this author →
GitHub

component-vuln-intel

Collects CVE, PoC, and exploit intelligence for identified components from public sources.

6.2k|1.0k|Updated Nov 8, 2025
Search Tags:#penetration testing#reconnaissance#osint#cve search#exploit research#vulnerability intelligence#poc discovery
One-click install
npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill component-vuln-intel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: component-vuln-intel
Source: https://github.com/Ed1s0nZ/CyberStrikeAI/tree/main/skills/component-vuln-intel
Command: npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill component-vuln-intel

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Once a penetration test identifies a framework, component, or version, testers often jump straight to exploitation without checking public vulnerability intelligence, leading to blind attacks and missed known CVEs. This Skill enforces a mandatory, structured online reconnaissance routine before any exploit attempt.

Core Features & Use Cases

  • Multi-source vulnerability search: Queries CVE databases (searchsploit, cve.circl.lu, GitHub advisories, CVEDetails), search engines (Google, Baidu, Bing, DuckDuckGo), and Chinese security communities (Seebug, FreeBuf, Qianxin, Anquanke) for known vulnerabilities and analysis.
  • PoC and exploit discovery: Searches GitHub repositories and code via API for exploit code, plus asset engines (FOFA, Shodan, ZoomEye, Censys) and real-time channels (X, Reddit, Exploit-DB) for in-the-wild intelligence.
  • Blocked-access fallback chain: When searches hit 403s, captchas, or empty results, it escalates through user-agent rotation, Jina reader, Google cache, Wayback Machine, GitHub API, alternate engines, and SOCKS5 proxies.
  • Use Case: During an authorized engagement you fingerprint a target running Apache Struts 2.5.30. The Skill immediately searches CVE feeds, Chinese community write-ups, and GitHub for working PoCs, then recursively repeats the process for each dependency found in the component's manifest files.

Quick Start

Identify the target's framework and version, then ask the agent to run full vulnerability intelligence collection on that component before attempting exploitation.

Frequently Asked Questions about component-vuln-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find known CVEs and PoCs for a specific component version?▼

Query CVE sources like searchsploit, cve.circl.lu, and GitHub advisories with the component name and version, then search GitHub repositories and code via its API for exploit or PoC references. Supplement with Google, Baidu, and security community searches for analysis write-ups.

What should I do before exploiting a fingerprinted framework in a pentest?▼

Run full online intelligence gathering first: check CVE databases, search engines, Chinese security communities like Seebug and FreeBuf, and GitHub for existing exploits. Treat all findings as tentative leads until verified against the actual target.

How do I bypass blocked searches or 403 errors during OSINT collection?▼

Rotate the user-agent string, use the Jina reader proxy, check Google cache and the Wayback Machine, switch to the GitHub API instead of web pages, try alternate search engines, or route through a SOCKS5 proxy. If all fail, record a negative finding.

Can asset search engines like FOFA and Shodan help vulnerability research?▼

Yes, FOFA, Shodan, ZoomEye, and Censys reveal how widely a vulnerable component is exposed and help locate similar targets. Query them with the component name or product fingerprint to assess exposure scope.

Does this approach cover third-party dependencies of a component?▼

Yes, after researching the primary component, extract its dependency list from manifests like package.json, pom.xml, requirements.txt, or go.mod, then repeat the full intelligence collection sequence for each dependency.

Related Skills

Explore More Software Engineering Skills→
securityfortechsecurityfortech
6

web-fingerprinting

Identify web server type, frameworks, and versions via banner and header analysis.

Official
Intermediate
jaskaranhundaljaskaranhundal
3

zero-day-response

Coordinate compensating controls for zero-day vulnerabilities lacking vendor patches.

Community
Advanced
ok-helloworldok-helloworld
241

vuln-analysis-agent

Correlate vulnerability findings from multiple agents into validated attack chains.

Community
Intermediate
ArianHobson333ArianHobson333
7

web2-recon

Automate web2 reconnaissance with subdomain enumeration, URL crawling, and fuzzing.

Community
Advanced