Mass vulnerability audit — ac.id / go.id · DEDUP → LIVE → DETECT → NUCLEI → GATE · container cve-toolkit:latest di VPS theilm (podman rootless) · stdlib-only + wpprobe/onyx/nuclei · v1.0 · 2026-10-10
- SSH ke VPS theilm — bukan VPS utama
cd ~/cve-toolkit./cve scan -l list-acid.txt -t 16 --min-severity critical./cve build — rebuild image./cve shell — masuk container- Semua di podman rootless, user
kliverz
- wpprobe v0.12.11 — Go, MIT, 954★
- onyx v1.1.1 — feed Wordfence 162MB
- nuclei v3.11.1 — 13.619 template
- cms_audit.py — ~500 baris, stdlib only
- Fingerprint versi dari HTML/link/asset
- wordfence.json — 162MB / 41.596 rec
- wordfence_vulnerabilities.json — 24MB
- 17.630 slug plugin/theme
- 44.674 CVE · 2.718 critical
- Lokal, tanpa API key, tanpa kuota
- Joomla/Drupal — versi terdeteksi, tanpa gate CVE
- wpprobe/onyx WordPress-only
- subfinder/amass/dnsx absen — diganti
ct_recon.py
wp-shield tidak ada di PyPI- List target — blocker utama
- Input 3 host → 2 hidup
- Detect: WP 7.1.3, paytium 5.0.5
- Nuclei: 12 temuan (11 info, 1 low)
- Gate: DB 17.630 slug termuat
- Total waktu 174,5s
- User enum
admin terdeteksi
- Single —
./cve scan https://target
- Batch —
-l targets.txt (1 URL/baris, # komentar)
- Threads —
-t N, default 8
- Output —
-o JSONL, default ON
- Aman massal —
--check-only
- Filter —
--only-vuln