Main Features
Scan for any vulnerabilities in Linux/FreeBSD Server
- Alpine, Ubuntu, Debian, CentOS, Amazon Linux, RHEL, Oracle Linux, SUSE Enterprise Linux and Raspbian, FreeBSD
- Cloud, on-premise, Docker
High quality scan
Vuls uses Multiple vulnerability databases
- NVD
- JVN(Japanese)
- OVAL
- Alpine-secdb
- Red Hat Security Advisories
- Debian Security Bug Tracker
- Commands(yum, zypper, pkg-audit)
- RHSA/ALAS/ELSA/FreeBSD-SA
- Exploit Database
- US-CERT
- JPCERT
- WPVulnDB
- Node.js Security Working Group
- Ruby Advisory Database
- Safety DB(Python)
- PHP Security Advisories Database
- RustSec Advisory Database
- Changelog
Fast scan and Deep scan
- Scan without root privilege, no dependencies
- Almost no load on the scan target server
- Offline mode scan with no internet access. (Red Hat, CentOS, OracleLinux, Ubuntu, Debian)
- Scan with root privilege
- Almost no load on the scan target server
- Detect processes affected by update using yum-ps (Red Hat, CentOS, Oracle Linux and Amazon Linux)
- Detect processes which updated before but not restarting yet using checkrestart of debian-goodies (Debian and Ubuntu)
- Offline mode scan with no internet access. (Red Hat, CentOS, OracleLinux, Ubuntu, Debian)
- same as first-root scan mode for now.
Remote scan mode, Local scan mode, Server mode
- User is required to only setup one machine that is connected to other target servers via SSH
- If you don't want the central Vuls server to connect to each server by SSH, you can use Vuls in the Local Scan mode.
- No SSH needed, No Scanner needed. Only issuing Linux commands directory on the scan tareget serve.
- First, start Vuls in server mode and listen as an HTTP server.
- Start Vuls in server mode and listen as an HTTP server.
- Next, issue a command on the scan target server to collect software information. Then send the result to Vuls Server via HTTP. You receive the scan results as JSON format.
Dynamic Analysis
- It is possible to acquire the state of the server by connecting via SSH and executing the command
- Vuls warns not-restarting-processes which updated before but not restarting yet and detects processes affecting software update in advance.
Static Container Analysis
- Vuls can scan container images such as Docker Image on ECR, GCR and local.
- TODO Link
Scan middleware that are not included in OS package management
- Scan middleware, programming language libraries and framework for vulnerability
- Support software registered in CPE
Integration
MISC
- Nondestructive testing
- Pre-authorization is NOT necessary before scanning on AWS
- Vuls works well with Continuous Integration since tests can be run every day. This allows you to find vulnerabilities very quickly.
- Auto generation of configuration file template
- Auto detection of servers set using CIDR, generate configuration file template
- Email and Slack notification is possible (supports Japanese language)
- Scan result is viewable on accessory software, TUI Viewer on terminal or Web UI (VulsRepo).