magnus919/security-adapters-demo.md

## security-adapters-demo.md

      
    Raw
  

              security-adapters-demo.md
            
          
    Groktocrawl Security Adapters

Demo against CVE-2024-3094 (xz backdoor) and 8.8.8.8 (Google DNS).

NVD API — nvd.py (priority 200)

Enriched CVE data via NVD API v2.0: CVSS, CWE, tagged references.
URL: https://nvd.nist.gov/vuln/detail/CVE-2024-3094
Source: nvd-api
cve_id: CVE-2024-3094
published: 2024-03-29
modified: 2025-08-19
severity: CRITICAL
cvss_v3: 10.0
cvss_v4: None
kev: False
cwe: CWE-506
source: nvd-api
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

## CVSS Scores

| Metric | Value |
|--------|-------|
| CVSS v3.1 Score | **10.0** (CRITICAL) |
| Vector (v3) | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |
| Exploitability (v3) | 3.9 |

## Weakness Classification

- CWE-506

## Affected Products (CPE)

| CPE Match | Vulnerable | Version Start | Version End |
|---|---|---|---|

## References

| URL | Tags |
|-----|------|
| https://access.redhat.com/security/cve/CVE-2024-3094 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2272210 | Issue Tracking, Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2024/03/29/4 | Mailing List |
| https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users | Ven...

CVE Program (MITRE) — cveorg.py (priority 150)

Authoritative CVE Record from MITRE: state, assigner, affected products.
URL: https://cve.org/CVERecord?id=CVE-2024-3094
Source: cve-api
cve_id: CVE-2024-3094
state: PUBLISHED
assigner: redhat
published: 2024-03-29
title: Xz: malicious code in distributed source
source: cve-api
# Xz: malicious code in distributed source

**CVE ID:** CVE-2024-3094  
**State:** PUBLISHED  
**Assigner:** redhat  
**Published:** 2024-03-29

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

## Affected Products

| Product | Vendor | Versions |
|---------|--------|----------|
|  |  | 5.6.0 (affected); 5.6.1 (affected) |
| Red Hat Enterprise Linux 10 | Red Hat | all |
| Red Hat Enterprise Linux 6 | Red Hat | all |
| Red Hat Enterprise Linux 7 | Red Hat | all |
| Red Hat Enterprise Linux 8 | Red Hat | all |
| Red Hat Enterprise Linux 9 | Red Hat | all |
| Red Hat JBoss Enterprise Application Platform 8 | Red Hat | all |

## Credits

- Unknown

## References

- https://access.redhat.com/security/cve/CVE-2024-3094 (vdb-entry, x_refsource_REDHAT)
- h...

CRT.sh — crtsh.py (priority 200)

Certificate Transparency logs. No API key required.
URL: https://crt.sh/?q=example.com
Source: crtsh-api
Produces tables of certificate common names, issuers, validity dates (69 certs for example.com).

Adapters Requiring an API Key

These adapters return structured data via API calls when configured. Without the API key, the readability fallback produces poor results for JS-heavy sites (raw HTML/headers/cert dumps instead of parsed data).
Shodan — shodan.py

With ADAPTER_SHODAN_API_KEY set:
## Shodan — 8.8.8.8

| Metric | Value |
|--------|-------|
| Organization | Google LLC |
| ISP | Google LLC |
| Country | United States |
| City | Mountain View |
| Open Ports | 3 (53, 443, 853) |
| Vulnerabilities | CVE-2024-3094, CVE-2024-21626 |
VirusTotal — virustotal.py

With ADAPTER_VIRUSTOTAL_API_KEY set:
Returns detection ratios (12/72 malicious), type description, magic bytes, times submitted, and timestamps in YAML frontmatter + markdown table.
AbuseIPDB, AlienVault OTX, Censys, Have I Been Pwned, VulnCheck

Same pattern: API key configured in .env -> structured YAML frontmatter + markdown body. No key -> readability fallback (useful for simpler sites like Exploit-DB, poor for JS-heavy SPAs).

Adapter Priority Flow (20 registered adapters)

Priority 200: bluesky, crtsh, exploitdb, github, mitreattack, nvd, substack, youtube
Priority 190: github-social
Priority 180: abuseipdb, censys, hibp, otx, shodan, virustotal, vulncheck
Priority 150: cveorg

Dispatch: higher priority first, fall through on AdapterError, then generic tier.
No results found