微修正
This commit is contained in:
		
							
								
								
									
										20
									
								
								README.md
									
									
									
									
									
								
							
							
						
						
									
										20
									
								
								README.md
									
									
									
									
									
								
							@@ -88,7 +88,9 @@ This can be done in the following steps.
 | 
			
		||||
    repo_upgrade: none
 | 
			
		||||
    ```
 | 
			
		||||
 | 
			
		||||
## Step2. Generate a ssh-key on local machine
 | 
			
		||||
## Step2. SSH setting
 | 
			
		||||
 | 
			
		||||
This is required to ssh to itself.
 | 
			
		||||
 | 
			
		||||
Create a keypair then append public key to authorized_keys
 | 
			
		||||
```bash
 | 
			
		||||
@@ -181,7 +183,7 @@ user        = "ec2-user"
 | 
			
		||||
keyPath     = "/home/ec2-user/.ssh/id_rsa"
 | 
			
		||||
```
 | 
			
		||||
 | 
			
		||||
## Step7. Initializing Vuls 
 | 
			
		||||
## Step7. Setting up target servers for vuls  
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
$ vuls prepare
 | 
			
		||||
@@ -241,14 +243,14 @@ $ vuls tui
 | 
			
		||||
- Fetch vulnerbility information from NVD, JVN(Japanese), then insert into SQLite.
 | 
			
		||||
 | 
			
		||||
## Vuls
 | 
			
		||||
- Scan vulnerabilities of the servers and generate a list of the CVE ID
 | 
			
		||||
- In order to get more information of the detected CVE, send HTTP request to go-cve-dictinary
 | 
			
		||||
- Scan vulnerabilities on the servers and create a list of the CVE ID
 | 
			
		||||
- For more detailed information of the detected CVE, send HTTP request to go-cve-dictinary
 | 
			
		||||
- Send a report by Slack, Email
 | 
			
		||||
- System operator can view the latest report by terminal
 | 
			
		||||
 | 
			
		||||
----
 | 
			
		||||
 | 
			
		||||
# Use cases
 | 
			
		||||
# Use Cases
 | 
			
		||||
 | 
			
		||||
## Scan all servers
 | 
			
		||||
 | 
			
		||||
@@ -507,7 +509,7 @@ $ vuls scan --report-slack --report-mail --cvss-over=7
 | 
			
		||||
With this sample command, it will ..
 | 
			
		||||
- Scan all servers defined in config file
 | 
			
		||||
- Send scan results to slack and email
 | 
			
		||||
- Only Reporting CVEs that CVSS score is over 7
 | 
			
		||||
- Only Report CVEs that CVSS score is over 7
 | 
			
		||||
- Print scan result to terminal
 | 
			
		||||
 | 
			
		||||
### Scan specific servers
 | 
			
		||||
@@ -522,14 +524,14 @@ With this sample command, it will ..
 | 
			
		||||
 | 
			
		||||
# Usage: Scan vulnerability of non-OS package
 | 
			
		||||
 | 
			
		||||
It is possible to detect vulnerabilities something you compiled by yourself or the language libraries and the frameworks that have been registered in the [CPE](https://nvd.nist.gov/cpe.cfm).
 | 
			
		||||
It is possible to detect vulnerabilities something you compiled by yourself, the language libraries and the frameworks that have been registered in the [CPE](https://nvd.nist.gov/cpe.cfm).
 | 
			
		||||
 | 
			
		||||
-  How to search CPE name by software name
 | 
			
		||||
    - [NVD: Search Common Platform Enumerations (CPE)](https://web.nvd.nist.gov/view/cpe/search)  
 | 
			
		||||
    **Check CPE Naming Format: 2.2**
 | 
			
		||||
 | 
			
		||||
- Configuration  
 | 
			
		||||
If you want to detect the vulnerbility of Ruby on Rails v4.2.1, here is an example.
 | 
			
		||||
To detect the vulnerbility of Ruby on Rails v4.2.1, cpeNames needs to be set in the servers section.
 | 
			
		||||
    ```
 | 
			
		||||
    [servers]
 | 
			
		||||
 | 
			
		||||
@@ -569,7 +571,7 @@ fetchnvd:
 | 
			
		||||
$ go-cve-dictionary fetchnvd -entire
 | 
			
		||||
```
 | 
			
		||||
 | 
			
		||||
- Fetch data of the last 2 years
 | 
			
		||||
- Fetch data in the last 2 years
 | 
			
		||||
 | 
			
		||||
```
 | 
			
		||||
$ go-cve-dictionary fetchnvd -last2y
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user