threat-finder - Runtime vulnerability scanner: finds CVEs in the s

项目说明

OffSeq Threat Finder

![CI]()
![crates.io]()
![docs.rs]()

threat-finder finds the software _actually running_ on a host — not
what a manifest claims — and tells you which findings are network-reachable.
It resolves each running service (and, with --scope all, every installed OS
package) to an exact Package-URL and
matches it against the OffSeq Radar catalog using
ecosystem-nati rules, so backported/fixed builds aren't false-flagged.

!OffSeq Threat Finder

Install

Prebuilt archives for Linux/macOS (x86_64 + arm64) and Windows (x86_64) are on
the releases page.
Requires Rust ≥ 1.87 to build from source. Linux, macOS, the BSDs, and Windows
are all supported.

Quickstart

Scans the running services, prints a risk-ranked summary, and writes the full
JSON report to /tmp/threats.json. Add --scope all to also scan every
installed OS package.

Usage

| Flag | Description |
|------|-------------|
| -o, --output <PATH> | Write the JSON report to PATH (default: prompt, or /tmp/threats.json) |
| --json | Print the JSON report to stdout instead of a file |
| --scope <SCOPE> | running (default) or all (+ every installed OS package) |
| --se <LEVEL> | Only report findings at/above critical\|high\|medium\|low |
| --strict | Drop coordinate-unconfirmed findings (report only confirmed) |
| --fail-on <WHAT> | Exit 5 if matching findings exist: any\|critical\|high\|medium\|low\|ke |
| --sarif <PATH> | Also write a SARIF 2.1.0 report (for code-scanning UIs) |
| --include <GLOB> / --exclude <GLOB> | Filter assets by name glob (repeatable) |
| -q, --quiet | Suppress the banner, progress, and summary |
| --no-color | Disable ANSI colors |
| -y, --yes | Assume defaults, ne (CI/cron) |
| --reset | Re-enter the API key, ignoring the saved one |
| --register | Register the scanned host with Radar for continuous monitoring (no prompt) |
| --no-register | Don't register or prompt for monitoring this run |
| --host-name <NAME> | Friendly hostname to send with a registration |
| --unregister | Remove this host's in from Radar and exit |
| --windows-missing-updates | (Windows) Also list pending security updates from the Windows Update Agent (online scan; run elevated) |
| -h, --help / - | Help / |

Exit codes: 0 ok · 1 lookup/IO error · 2 no API key · 3 unsupported
OS · 4 rate limit/quota, or API access required (upgrade needed) · 5
--fail-on threshold met.

API key (get one from the Radar Console),
resolved in order:

1. OFFSEQ_API_KEY en (best for CI/cron).
2. The saved key in $XDG_CONFIG_HOME/offseq-rust/config.toml (0600),
unless --reset is given.
3. An interacti prompt on a TTY — then saved for next time.

Non-interactive (--yes / no TTY) with no key a exits 2.

Set OFFSEQ_CONFIG_DIR to o where the config lives (default: the OS
per-user config dir) — handy for containers/CI that need a deterministic path.

How it works

Exact-coordinate matching. Each asset becomes a purl carrying its _full_
(epoch + distro re) and a ?distro= qualifier, e.g.
pkg:deb/ubuntu/openssh-server@1:8.9p1-3ubuntu0.6?distro=jammy. The in is
matched in batched POST /match/batch calls (one request per tier-sized chunk)
ser, with ecosystem-nati rules (dpkg/rpm/apk/semver) — so a
backported-and-fixed build like 1.18.0-6+deb11u3 is correctly not flagged, and
there's no client-side guessing. Findings are split by the API's
confirmed flag: confirmed matches are reported; coordinate matches whose
can't be confirmed are surfaced separately as unconfirmed / triage
(excluded from the count, byCve, and --fail-on; drop them with --strict).

Network-exposure correlation. Manifest scanners (Tri, os)
read package lists; external scanners (Nessus, OpenVAS) need a second host. This
tool maps each running service's process to the sockets it is listening on
(/proc/net on Linux, lsof on the other Unixes, Get-NetTCPConnection /
netstat on Windows) and classifies reachability —
loopback / private / public. A service on 0.0.0.0 is a very
different risk from one on 127.0.0.1: findings rank exposed-first and
--fail-on exposed gates CI on exactly that. No packets are sent. Findings also
carry CISA KEV and EPSS.

Exposure-aware prioritization. Every finding gets a riskScore (0–100) and an
SS decision band — act-now · soon · schedule · track — fused
from se, EPSS, KEV, and the owning asset's network exposure. The summary
leads each line with a [ACT-NOW 92]-style badge and sorts by it, so the handful
of public-facing, known-exploited issues float to the top of a noisy host. The
score uses the same formula locally and ser (the Radar monitoring view
adds a small bonus when a KE is past its due date — a date the CLI
doesn't have), and appears in --json and SARIF (properties).

Continuous monitoring

A one-off scan is a point in time. Register a host once and Radar keeps watching:
when a newly-published CVE affects one of its coordinates, you get an alert
(email + Console), prioritized by exposure — no re-scan needed.

After an interactive scan, the tool asks:

Y registers this host; n skips this run; never remembers your choice (it's
saved to the config and you won't be asked again). On a re-scan it also reports
drift (+added / -removed / ~changed) and any findings **new since your last
scan**. Manage your hosts — toggle monitoring, view findings, deregister — under
In in the Radar Console.

For automation, skip the prompt: --register registers non-interactively (off by
default in CI), --no-register opts out, --host-name <NAME> labels the host, and
--unregister removes it. A stable per-host id and your prompt preference live in
$XDG_CONFIG_HOME/offseq-rust/config.toml. Registration ne the exit
code — a monitoring hiccup won't fail your scan. Requires a Basic/Pro/Enterprise
plan (or Pro Console).

Scope & co

--scope running (default) scans li — the small, high-signal set
whose exposure can be correlated. --scope all additionally enumerates **every
installed OS package** (dpkg/rpm/pacman/apk/brew/pkg/pkg_info),
expanding the matched surface 10–50×. A package that also backs a running,
exposed process keeps that exposure (assets are deduplicated and merged by
coordinate). The kernel is covered as its package (linux-image…) under
--scope all.

> --scope all can yield hundreds–thousands of packages. On the free tier
> (15 lookups/hour) this will rate-limit; the tool warns when the in
> exceeds the budget. (Lookups are already batched; a local result cache is on
> the roadmap.)

Per-OS support

| OS | Discovery | Coordinate source |
|----|-----------|-------------------|
| Linux (systemd) | ListUnits → /proc/<pid>/exe | dpkg / rpm / pacman / apk |
| Linux (Sys) | service --status-all / rc-status | package DB |
| macOS | launchctl list → ps (third-party only) | Homebrew |
| FreeBSD / DragonFly | service -e | pkg |
| OpenBSD | rcctl ls started | pkg_info |
| NetBSD | /etc/rc.d status | pkg_info |
| Solaris / illumos | svcs → s | probe (--) |
| Windows | Win32_Service → Get-NetTCPConnection / netstat | registry / winget / Appx / Chocolatey / Scoop → CPE; npm / pip / dotnet → purl; the OS build → CPE |

Where no package owns a binary, the falls back to a hardened --
probe (absolute path only, sanitized env). On macOS, Apple system services
(com.apple.*, SIP-protected paths) are skipped — they're covered by the OS
, and probing hundreds of them is pointless.

On Windows, e is gathered via the built-in powershell.exe
(no extra runtime, no admin for the core in). Installed apps map to NVD
CPEs through a curated name table (unmapped apps fall back to a name search
rather than a wrong guess); the OS edition/build becomes a feature-qualified OS
CPE (e.g. windows_11_23h2); and --windows-missing-updates adds an opt-in
Windows Update Agent ad of pending security patches.

Output

JSON, with deterministic (sorted) keys and no timestamp, so reports diff cleanly:

A SARIF 2.1.0 report (--sarif) is also a for code-scanning UIs.

The OffSeq ecosystem

| | |
|---|---|
| OffSeq | EU security audits, threat monitoring, CISO-as-a-Service, NIS2 compliance |
| Radar | Real-time threat intelligence — the catalog threat-finder matches against |
| Radar Console | Subscriptions, custom feeds, and your OFFSEQ_API_KEY |
| Radar API | REST docs for the /match endpoint used here |
| Radar Threats | Searchable CVE / malware / threat-actor database |
| Radar Feeds | Custom feeds aggregating CISA, CIRCL, ThreatFox, … |
| Radar Pricing | Free tier through Enterprise |
| Breach | Dark-web data-leak & exposed-credential monitoring |
| Veil | Client-side PNG steganography (AES-256-GCM) |
| Guard | AI website security & compliance analyst |
| Training | PECB-accredited security & privacy courses |

De

The engine is a library crate (find_threats) with a Collector abstraction
(running-services and os-packages today; lockfiles / containers / SBOM next), so
the binary is a thin CLI over it.

License

Dual-licensed under MIT or Apache-2.0, at your option.

项目信息

开发语言：Rust

Star 数：60

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Runtime vulnerability scanner: finds CVEs in the services actually running on a host and ranks them by network exposure.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。