diff options
| author | hrbrmstr <bob@rud.is> | 2026-09-14 09:09:14 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-09-14 09:09:14 -0400 |
| commit | f043cd297f2235682ca9e21572c503b9e78e6f0d (patch) | |
| tree | 4ed31751594e9c2b99650ab7ab9389f78b60b28b | |
| parent | 5102ce853135eff384b578fe218a0cb3d377d592 (diff) | |
| -rw-r--r-- | README.md | 15 | ||||
| -rw-r--r-- | fprox.go | 6 |
2 files changed, 10 insertions, 11 deletions
@@ -2,10 +2,7 @@ Scan Homebrew for vulnerabilities that already have known exploits. -`brew-sploits` reads the vulnerabilities that `brew vulns --json` reports for -your installed formulae. For every real CVE identifier, it asks the fprox -service whether public proof-of-concepts or exploitation activity exist. It -prints one JSON report to stdout. +`brew-sploits` reads the vulnerabilities that `brew vulns --json` reports for your installed formulae. For every real CVE identifier, it asks the fprox service whether public proof-of-concepts or exploitation activity exist. It prints one JSON report to stdout. ## Output @@ -16,15 +13,13 @@ The report has four fields. - `non_cve` lists the vulnerability IDs that are not CVEs, such as `OSV-*`. - `vulnerable_packages` lists the unique Homebrew formulae that the CVEs affect. -For a single CVE, the tool marks it as exploited when either -`.props.pageProps.cveInfo.proofOfConcepts` or -`.props.pageProps.cveInfo.exploitedAt` holds at least one entry. +For a single CVE, the tool marks it as exploited when either proof-of-concepts exist or proof-of-exploited is true. ## Requirements - Go 1.26 or later - Homebrew, with `brew` on `PATH` -- Network access to `fprox.hrbrmstr.app` +- A live internet connection ## Build @@ -47,6 +42,4 @@ and `--version` for the version. ## Limitations -The tool skips any CVE that the fprox lookup fails to resolve. It writes a -warning to stderr for each skipped CVE. It never labels a skipped CVE as -exploited or not exploited. +The tool skips any CVE that the lookup fails to resolve. It writes a warning to stderr for each skipped CVE. It never labels a skipped CVE as exploited or not exploited. @@ -38,6 +38,12 @@ func CveHasExploits(cve string) (bool, error) { return false, nil } +// This file was generated from JSON Schema using quicktype, do not modify it directly. +// To parse and unparse this JSON data, add this code to your project and do: +// +// fproxResponse, err := UnmarshalFproxResponse(bytes) +// bytes, err = fproxResponse.Marshal() + func UnmarshalFproxResponse(data []byte) (FproxResponse, error) { var r FproxResponse err := json.Unmarshal(data, &r) |
