SISTEM A · 4 sumber (Telegram + NVD API + cvefeed + Joomla) → triage (MCP remote) → filter PHP CMS 56 → rotasi CMS → feedback loop → dashboard / handoff · cron 4 job di 4 profile · v8.2-light · 2026-09-27
VPS UTAMA — hermes-agent container · PID max 700 · MCP server TIDAK di sini (dipindah 09/06)
CPRapid lab — AlmaLinux 8.10 · cPanel · 128.199.11.220
01 · INGEST (4 SUMBER)
02 · DB + MCP ENRICH
03 · FILTER PHP CMS + ROTASI
04 · DORKING (COUNT-ONLY)
05 · FEEDBACK LOOP
CRON 4×/HARI · 4 PROFILE
09:00 artemis · 21:00 heracles
09:30+21:30 athena · 6h iris (record)
A · Telegram Scrape
t.me/CVEDaily + t.me/CVERadar
cvedaily_stalker.py · pages 15
feed generik · noise tinggi (~10% PHP CMS)
B · NVD API 2.0 per-produk
keywordSearch × 20 PHP CMS · window 2 hari
gate CVSS ≥ 9 langsung dari NVD
7s/req · ~2,5 mnt untuk 20 produk
C · cvefeed.io RSS + D · Joomla SC
RSS: judul memuat plugin + versi affected
Joomla: bulletin resmi + exploit type
CVSS TIDAK di RSS → dilengkapi via NVD lookup
sumber kandidat lebih awal dari Telegram
cms_source_collector.py
--source nvd | cvefeed | joomla | all
→ cms_targeted.jsonl
seen_cve.txt
watermark dedup GLOBAL — 1 set untuk 4 sumber
CVE dari sumber berbeda tidak dobel
sync_jsonl_to_db.py
multi-file: cvedaily.jsonl + cms_targeted.jsonl
INSERT OR IGNORE · severity HIGH-RCE dihormati
cvss_backfill.py
NVD API · 7s/req · cap 300/run
isi cvss + published · stamp backfill_attempted
cvedashboard.db
SQLite · scraped · kanban
fofa_counts · audit_results
audit_batch · dedup_stats · triage_score
triage_enrich.py
MCP client (streamable HTTP)
cap 20/run · budget 900s
EPSS + KEV + PoC → triage_score
MCP CVE SERVER — cve-mcp.service
systemd · streamable HTTP :8181/mcp · run_http.py (allowed_hosts)
32 tools · triage_cve · EPSS / KEV / PoC · GITHUB_TOKEN
CPU 40% · Mem 1G · ~5s/CVE serial · Python 3.12 (uv)
FILTER PHP CMS (56 CMS)
php_cms_filter.py — single source of truth
WordPress · Joomla · Drupal · Magento · PrestaShop …
detect_cms_php() dari deskripsi · ~32% match
ROTASI CMS
top 5 semua WordPress?
→ sisipkan 1 CMS lain
kompetisi lebih rendah
fofa_keys.py — 3 JALUR COUNT
T1 Apify kaix ($0.00005/q) → T2 proxy api-f (10/hari)
T3 FOFA direct size=1 (1 fpoint) · max 1×/CVE
[-501] = transient, retry 1× dulu — bukan habis
CT-log crt.sh
+ urlscan
fallback enumerasi
fofa_counts (DB)
best_dork + count
→ ranking target
record_audit_results.py — FEEDBACK LOOP
recursive scan cve-labs/ → tabel audit_results
funnel: targets → vuln → rce → shell → verified
hit_rate + shell_rate per metode/CMS
→ kalibrasi skoring rekomendasi berikutnya
CRON 6 JAM (profile iris) · --silent (no-spam)
cve_dashboard_server.py
:8787 · systemd · Python 3.6
OVH host (outside container)
filter PHP CMS di semua endpoint
cve.lintaskita.my.id
Cloudflare → nginx → :8787
sort triage_score
tab CVE Feed Workflow
auto_handoff.py
pending → board
satu arah A → B
SISTEM B (redteam)
redteam-cve: VALIDATE → RECON
→ SCAN → EXPLOIT → loot
Telegram — bot per-profile
artemis 09:00 · heracles 21:00
athena 09:30 + 21:30 (saran)
token dari config.yaml · tag [profil]
GATE SILENT
tidak ada CVE PHP CMS baru →
stdout kosong = tidak dikirim
no_agent: empty = no delivery
critical
critical ≥ 9
kandidat
enrich
streamable HTTP :8181
score writeback
filter
PHP CMS
top 5
briefing
dork
count
hit/shell rate
service
database
remote/cron
gate/handoff
frontend
external/out
MCP call
score writeback
dork fallback
feedback loop
data flow
• 4 sumber ingest (dulu 2): Telegram + NVD API per-produk + cvefeed.io RSS + Joomla Security Centre via cms_source_collector.py
• Temuan nyata: sumber terarah menemukan 3 CVE critical yang TIDAK ADA di Telegram — CVE-2026-73373 (Joomla 9.8), CVE-2026-87796 (WP 9.8), CVE-2026-73337 (Joomla 8.2)
• CVSS dari RSS? cvefeed.io tidak menyertakan CVSS → CVE diambil sebagai kandidat, skor dilengkapi via NVD lookup
• Joomla: jangan percaya label Severity — CVE-2026-73373 ditandai "Severity: Low" tapi NVD 9.8. Gate = severity OR impact OR exploit type RCE
• Cron 2×/hari (dulu 1×): 09:00 WIB pipeline penuh · 21:00 WIB breaking check ringan
• Filter PHP CMS 56 CMS (dulu 3-CMS) — semua output cron + dashboard
• Rotasi CMS otomatis kalau top 5 semua WordPress
• Feedback loop audit_results — funnel hasil audit nyata dikalibrasi balik ke rekomendasi
• CISA KEV dihapus sebagai sumber (target sudah dipatch)
• Cron pindah ke 4 profile (09/25): artemis 09:00 · heracles 21:00 · athena 09:30+21:30 · iris record tiap 6 jam · default profile 0 job
• Bot per-profile (09/25): token dibaca dari config.yaml profil aktif · tag [nama] di awal pesan · fallback bot CVE_Monitoring
• Count 3 jalur (directive 09/25): Apify → FOFA proxy → FOFA direct (1 fpoint) · CT-log/SearXNG bukan lagi sumber sizing
• Filter PHP CMS 56 (naik dari 46) · tabel audit_batch + dedup_stats ditambahkan
• Telegram (CVEDaily + CVERadar): feed generik, ~10% PHP CMS — noise tinggi tapi cepat
• NVD API per-produk: 20 keyword × 7s = ~2,5 mnt · window 2 hari · gate CVSS ≥ 9 langsung
• cvefeed.io RSS: 25 item/feed, judul memuat plugin + versi · butuh NVD untuk skor
• Joomla Security Centre: bulletin resmi, ~25 CVE · label severity tidak reliabel
• Count = 3 jalur, urut biaya: T1 Apify kaix $0.00005/query → T2 FOFA proxy api-f (10/hari) → T3 FOFA direct size=1 (1 fpoint)
• Direct key count-only: bobaruwl1 ~2836 fpoint · barbar03 ~15 (cadangan) · maks 1 count_dork/CVE · [-501] transient → retry 1×
• CT-log + urlscan: unlimited — fallback enumerasi host
• seen_cve.txt: 1 watermark global untuk 4 sumber — dedup lintas-sumber otomatis
• Entry = CVSS ≥ 9 (KEV bypass) · pengecualian HIGH-RCE : Joomla unrestricted upload + Impact High lolos meski CVSS < 9
• Dashboard = filter 56 PHP CMS via php_cms_filter.py — single source of truth
• triage_score = CVSS×0.20 + EPSS×0.35 + KEV×0.30 + PoC×0.15
• KEV override: label CRITICAL, score ≥ 76
• GATE SILENT: tidak ada CVE PHP CMS baru → stdout kosong → tidak dikirim
• Handoff A→B via board (satu arah) → redteam-cve (VALIDATE → RECON → SCAN → EXPLOIT) → redteam-loot
• Output audit → cve/<CVE-ID>/RESULT/ → direkam ke audit_results