mithril

项目说明

IoT static scanner for secrets, SBOM, CVEs and more.

mithril analyzes the *contents* of firmware and IoT software, whether a single file or an unpacked rootfs. It looks for embedded secrets and keys, a software bill of materials (SBOM), known C those components, open-source licenses, boot-security posture (U-Boot en tree, FIT/AVB/UEFI boot), and weak or leaked public keys (keys whose private half is public, ROCA, undersized RSA). It reports each finding with its e and a confidence, and it speaks clean JSON so scripts and LLM agents can drive it as easily as people can.

A scan makes no network calls. Secrets, SBOM, and license analysis are fully offline, and the CVE pass reads a local mirror you refresh out of band.

mithril is the semantic companion to moria, which identifies and unpacks firmware. moria maps the bytes. mithril reads the contents.

It has no build-time dependency on moria. Point it at any file or directory.

Why mithril

Firmware-aware SBOM. Beyond package databases (dpkg/opkg/apk/rpm), it recovers components from ELF banners, libc filenames, and the kernel banner, so it finds openssl/busybox/uClibc even in a stripped image with no package manager. Emitted as CycloneDX and SPDX.

CVEs it owns end to end. A local OSV + NVD/CPE mirror plus a curated, and kconfig-gated kernel-C (high-signal, not exhaustive: an empty kernel result means none of the curated set is in range, not that the kernel is clean). Every match records how sure it is (exact range vs CPE), stays release-precise where /etc/os-release allows, and is annotated with CISA KEV and EPSS.

Honest by construction. Secrets ride a deterministic offline ladder: pattern (shape), then structural (a parsed JWT or PEM key), then (a recomputed checksum, such as GitHub tokens and crypt hashes). mithril asserts well-formed, never "live," and an empty result is a real answer rather than a tool failure.

Weak and leaked keys, pro. For every public key it recovers (certs, SSH host/authorized keys, embedded keys) it checks whether the private half is obtainable: a fingerprint match against a compiled-in corpus of hardcoded/default keys whose private half is public (rapid7 ssh-badkeys, the insecure key), the ROCA fingerprint (C), undersized/broken RSA, and factoring reco that hand you a factor outright (Fermat close primes, batch-GCD shared primes across the image, Wiener small-d) via a small in-tree bignum. A hit means impersonation, login, or forgery, not just a weak cipher suite.

Fully offline and reproducible. No network at scan time; the C is refreshed by an explicit, separate step. Air-gappable.

Safe on hostile input. Untrusted bytes go through one bounds-checked reader. Parsers degrade to a clean error rather than crash, and the C is memory-mapped so a scan ne the whole thing.

Build & Install

No third-party libraries. The install step places the mithril binary; a bare cp build/mithril ~/.local/bin works just as well. Debug with sanitizers: cmake -S . -B build -DMT_SANITIZE=ON.

Usage

Output is human-readable by default. Pass -j for JSON.

First run: the --cve pass needs a local mirror, so run mithril --fetch-db once before your first CVE scan (details under The C). Without it, --cve reports the missing DB and exits nonzero. Secrets, SBOM, and licenses are fully offline and need no setup.

Naming any of --secrets / --sbom / --cve / --licenses / --boot / --keys runs just those. Naming none runs them all.

The C

--cve reads a local mirror under ~/.local/share/mithril/ (honors $MITHRIL_DB), a compact, memory-mapped index built from OSV.dev, the NVD 2.0 API, the CISA KE, and FIRST's EPSS scores that a scan loads in a fraction of a second. Get it two ways, and only these two commands e the network:

mithril --fetch-db downloads a prebuilt index (rebuilt weekly) and every file against a published SHA-256 before installing. It does no upstream scraping: it just fetches the finished index. Needs curl. Point it at a mirror with $MITHRIL_DB_URL.

mithril --update-db rebuilds the index from the upstream feeds yourself. Slower, needs curl and unzip, and is the authoritative path if you want to control exactly what goes in. Set $N to raise the NVD rate limit (optional; it works without one, just slower).

Add --with-kernel-feed to either command to also get the optional full kernel.org (Linux CNA) CVE feed that backs --kernel-c. By default the kernel is triaged by a curated high-signal checklist; --kernel-c lists every kernel.org CVE for the detected instead, matched branch-aware (a bug fixed in 6.6.17 is reported for 6.6.10 but not 6.6.110). It is a separate asset so the base mirror stays lean; building it needs tar.

Build it once either way; every scan after that is offline. See docs/c.md and docs/c.md.

Scope

secrets: credential and key material in file content (cloud keys, tokens, JWTs, private keys, high-entropy KEY=… ). /etc/shadow and htpasswd hashes are classified with weak-algorithm and empty-password flags, and credential/crypto/config files are flagged by path.

sbom: components and from package databases, language manifests, binary strings, libc filenames, and the kernel banner, keyed on purl (with CPE co-derived), emitted as CycloneDX and SPDX.

cve: the SBOM joined against the local OSV + NVD/CPE mirror, plus the curated kernel-C, annotated with KEV and EPSS. The default human view shows only foothold-worthy component CVEs (on CISA KEV, or Critical, or a hard High/Critical floor of CVSS >= 7.0 with EPSS traction, low attack complexity, and real impact or a trending remote DoS), sorted worst-first; it drops Mediums, local DoS, and the high-complexity crypto class. --component-c lists them all. JSON always carries the complete set plus a component_c summary.

licenses: SPDX identification from SPDX-License-Identifier tags and LICENSE/COPYING/NOTICE text. Human output summarizes by id and count; --license-paths lists each license's file locations, and JSON always carries the full paths array.

File-type identification, extraction, and embedded key/certificate *file* signatures are moria's job; mithril reads content, it does not unpack. How discovery works is documented in docs/engine-design.md.

License

MIT, see LICENSE. The and license data fetched by --update-db (OSV.dev, NVD, CISA KE EPSS, and the kernel.org Linux CNA feed) belong to their respecti. mithril mirrors them locally and does not redistribute them.

项目信息

开发语言：C++

Star 数：334

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕IoT static scanner for secrets, SBOM, CVEs and more.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	mithril - IoT static scanner for secrets, SBOM, CVEs and mor
所属分类	安全软件
发布作者	admin
发布时间	2026-10-05 22:37:56
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	159
讨论数量	0
主题状态	正常讨论中

mithril - IoT static scanner for secrets, SBOM, CVEs and mor