cve-cli

High-performance attack surface reconnaissance and vulnerability scanner in C++20.

cve-cli discovers open ports, extracts software banners, identifies configuration leaks, and maps assets to known CVEs using an offline SQLite NVD/KEV database — all in a single self-contained native binary with zero runtime dependencies.

---

Installation

One-line Automated Install (Linux)

curl -fsSL https://raw.githubusercontent.com/NoNFake/cve-cli/master/install.sh | bash

Manual Build from Source

cmake -B build
cmake --build build -j$(nproc 2>/dev/null || sysctl -n hw.ncpu)

Prerequisites:

• C++20 compiler (gcc 11+ or clang 14+)
• CMake 3.16+
• Libraries: libcurl, openssl, sqlite3, nlohmann-json, libmaxminddb (optional)

---

Quick Start

# 1. Scan target (fast port & service discovery)
./build/cve scan example.com

# 1b. Deep scan (10-step full reconnaissance & vulnerability audit)
./build/cve scan example.com --deep

# 2. View asset profile, open ports, and detected CVEs
./build/cve show example.com
./build/cve show example.com --json

# 3. Search discovered asset repository
./build/cve search --server apache
./build/cve search --cve CVE-2021-44228
./build/cve search --port 8080

# 4. Lookup CVEs for a specific software version in local NVD
./build/cve lookup --product apache --version 2.4.50

---

Command Reference

cve scan <target> [options]

Scans a hostname, IP address, or CIDR range (192.168.1.0/24).

Option	Description	Default
--deep	Full 10-step recon (DNS, OSINT, JS parsing, leaks, web audit)	Fast scan
--ports <list>	Ports to scan (top100, top1000, all, 80,443,8080)	top100
--threads <N>	Concurrency worker threads	100
--timeout <ms>	Socket connection timeout in ms	300
--proxy <url>	Route scan via HTTP/SOCKS5 proxy	Direct
--stealth	Adaptive delays, rotating proxies, browser UA emulation	Off
--json	Stream events in JSON format	Text

cve show <target> [options]

Displays stored inventory, open ports, services, banners, risk scores, and mapped vulnerabilities from data/cve.db.

Option	Description
--json	Dump structured JSON report

cve search [options]

Queries the discovered asset repository (data/cve.db) by specific attribute.

Option	Description
--server <name>	Find assets matching HTTP Server banner (e.g. --server nginx)
--title <text>	Find assets matching HTML title
--port <port>	Find all assets with specific open port
--cve <id>	Find assets affected by a specific CVE ID
--sha256 <hash>	Find assets matching TLS certificate SHA-256 fingerprint
--san <domain>	Find assets by TLS Subject Alternative Name
--db <type>	Find discovered databases (e.g. --db redis)
--db-exposed	List all unauthenticated exposed databases
--dump	List all identified exposed database dumps
--config-leak	List all identified exposed configuration files
--secret	List all detected leaked credentials and tokens

cve query "<DSL query>"

Flexible search query across discovered assets using filter syntax.

./build/cve query "port:443 country:UA server:nginx"
./build/cve query "ip:192.168.1.0/24 port:80"

cve lookup [options]

Queries the local NIST NVD SQLite database (data/nvd.db) directly for CVE records.

# Lookup by product and version
./build/cve lookup --product openssh --version 8.9p1

# Lookup by exact CPE 2.3 string
./build/cve lookup --cpe "cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*"

cve osint <target>

Passive threat intelligence and reconnaissance without touching the target server directly. Queries Shodan, Censys, AlienVault OTX, and extracts historical endpoints via Wayback Machine CDX API.

./build/cve osint example.com

cve web-scan [options]

Targeted web application vulnerability scanner and offline DevTools traffic auditor.

Option	Description
--target <url>	Scan live target for web misconfigurations & vulnerabilities
--har <file.har>	Offline audit of browser DevTools HAR recording (extracts endpoints & scans for leaked API keys/tokens)
--scan	Automatically test endpoints extracted from HAR for web vulnerabilities
-v, --verbose	Show verbose finding payloads and discovered endpoints

# Offline secret leak & endpoint audit of browser HAR capture
./build/cve web-scan --har devtools_recording.har -v

# Live vulnerability scan
./build/cve web-scan --target https://example.com

cve dns <domain> / cve subdomains <domain>

Performs subdomain enumeration and DNS intelligence using passive Certificate Transparency (crt.sh) and multi-record DNS resolution.

./build/cve dns example.com
./build/cve subdomains example.com

cve asn <AS_NUMBER|IP|DOMAIN>

Autonomous System and BGP reconnaissance. Identifies organization name, country code, abuse contacts, and announced IPv4/IPv6 routing prefixes.

./build/cve asn AS13335
./build/cve asn 1.1.1.1
./build/cve asn cloudflare.com

cve diff <target>

Compares the last two scans of a target in data/cve.db and reports infrastructure changes:

• New, removed, or changed open ports
• Web server banner alterations
• Certificate changes
• Newly introduced or resolved CVEs

./build/cve diff example.com

cve risk <target>

Computes cumulative CVSS risk scores, maximum severity levels, and vulnerability density metrics for an asset.

./build/cve risk example.com

cve batch --file <file>

Scans multiple targets sequentially from a newline-delimited text file.

./build/cve batch --file targets.txt --ports top100 --threads 50

cve sync [options]

Synchronizes the local SQLite vulnerability database (data/nvd.db) with NIST NVD 2.0 API and CISA Known Exploited Vulnerabilities (KEV) catalog.

Option	Description	Default
--days <N>	Delta sync window in days	8
--api-key <key>	Optional NIST NVD API key to avoid public rate limits	$NVD_API_KEY
--nvd-db <path>	Path to target SQLite NVD database	data/nvd.db

./build/cve sync --days 8

cve completion [bash|zsh]

Outputs shell autocompletion script.

# Bash completion
source <(./build/cve completion bash)

# Zsh completion
source <(./build/cve completion zsh)