Cvedb CLI

Execute Cvedb workflows right from your terminal.

About

Cvedb platform is an IDE tailored for bug bounty hunters, penetration testers, and SecOps teams to build and automate workflows from start to finish.

Current workflow categories are:

• Vulnerability Scanning
• Misconfiguration Scanning
• Container Security
• Web Application Scanning
• Asset Discovery
• Network Scanning
• Fuzzing
• Static Code Analysis
• ... and a lot more

Library

Cvedb Library is a collection of public tools, Cvedb scripts, and Cvedb workflows available on the platform. More info can be found at Cvedb workflows repository <- (Coming soon!)

Installation

Binary

Binaries are available in the latest release.

Docker

docker run ghcr.io/cvedb/cvedb-cli

Authentication

You can find your authentication token on the Token page inside the Cvedb platform.

The authentication token can be provided through either a string flag --token, a file --token-file, or an environment variable CVEDB_TOKEN.

The token supplied as --token or --token-file will take priority over the environment variable if both are present.

Usage

List command

All

Use the list command to list all of your spaces along with their descriptions.

cvedb list

Spaces

Use the list command with the --space or --url flag to list the content of your particular space; its projects and workflows, and their descriptions.

cvedb list --space <space_name>

Projects

Use the list command with the --project or --url option to list the content of your particular project; its workflows, along with their descriptions.

cvedb list --project <project_name> --space <space_name>

GET

Use the get command to get details of a particular workflow (current status, node structure, etc.).

cvedb get --workflow <workflow_name> --space <space_name> [--watch]

Execute

Use the execute command to execute a particular workflow or tool.

cvedb execute --workflow <workflow_or_tool_name> --space <space_name> --config <config_file_path> --set-name "New Name" [--watch]

Provide parameters using config.yaml file

Use config.yaml file provided using `--config`` flag to specify:

• inputs values
• execution parallelism by machine type
• outputs to be downloaded.

The structure of you config.yaml file should look like this:

inputs:   # Input values for the particular workflow nodes.
  <node_name>.<input_name>: <input_value>
machines: # Machines configuration by type related to execution parallelisam.
  small:  <number>
  medium: <number>
  large:  <number>
outputs:  # List of nodes whose outputs will be downloaded.
  - <node_name>

You can use example-config.yaml as a starting point and edit it according to your workflow.

More example workflow config.yaml files can be found in the Cvedb Workflows repository. (Coming Soon ✨)

Continuous Integration

You can find the Github Action for the cvedb-cli at https://github.com/cvedb/action and the Docker image at https://ghcr.io/cvedb/cvedb-cli.

The execute command can be used as part of a CI pipeline to execute your Cvedb workflows whenever your code or infrastructure changes. Optionally, you can use the --watch command inside the action to watch a workflow's progress until it completes.

The --output, --output-all, and --output-dir commands will fetch the outputs of one or more nodes to a particular directory, respectively.

Example GitHub action usage

    - name: Cvedb Execute
      id: cvedb
      uses: cvedb/action@main
      env:
        CVEDB_TOKEN: "${{ secrets.CVEDB_TOKEN }}"
      with:
        workflow: "Example Workflow"
        space: "Example Space"
        project: "Example Project"
        watch: true
        output_dir: reports
        output_all: true
        output: "report"

Output

Use the output command to download the outputs of your particular workflow execution(s) to your local environment.

cvedb output --workflow <workflow_name> --space <space_name> [--nodes <comma_separated_list_of_nodes>] [--config <config_file_path>] [--runs <number>] [--output-dir <output_path_directory>]

Output Structure

When using the output command, cvedb-cli will keep the local directory/file structure the same as on the platform. All your spaces and projects will become directories with the appropriate outputs.

Library

Use the library command to get more info about Cvedb workflows and public tools available in the Cvedb Library.

List

Use library list command to list all public tools & workflows available in the library, along with their descriptions.

cvedb library list

Search

Use library search to search all Cvedb tools & workflows available in the library, along with their descriptions.

cvedb library search subdomain takeover

Files command

Interact with the Cvedb file storage

Get files

Use the get command with the --file flag to retrieve one or more files

cvedb files get --file my_file.txt --output-dir out

Create files

Use the create command with the --file flag to upload one or more files

cvedb files create --file targets.txt

Delete files

Use the delete command with the --file flag to delete one or more files

cvedb files delete --file delete_me.txt

Tools command

Manage private tools

⚒️ Learn how to add your first tool integration here.

Create a new private tool integration

cvedb tools create --file tool.yaml

Update a private tool integration

cvedb tools update --file tool.yaml

List private tool integrations

cvedb tools list

Delete a private tool integration

cvedb tools delete --name "my-tool"

Scripts command

Manage private scripts

Example script definition

name: hello-world
description: Write "Hello, world!" to the output
script_type: bash
script: echo "Hello, world!" | tee out/output.txt

Create a new private script

cvedb scripts create --file script.yaml

Update a private script

cvedb scripts update --file script.yaml

List private scripts

cvedb scripts list

Delete a private script

cvedb scripts delete --name "my-script"

Report Bugs / Feedback

We look forward to any feedback you want to share with us or if you're stuck with a problem you can contact us at [email protected].

You can also create an Issue in the Github repository.