From a CVE to exposed servers, step by step
An analyst's pivot: CVEs from Liberty91, the IPs exploiting them from GreyNoise, then Shodan, Modat and Censys for open directories. It ends in a report written with a skill.
In this video
- Pulling recently exploited CVEs from Liberty91
- Finding the IPs exploiting them in GreyNoise and saving them to a collection
- Picking the collection up in ChatGPT and checking each IP with Shodan, Modat and Censys
- Writing the report with a skill
Chapters
Transcript
So just wanted to record a quick video to demonstrate some of the capabilities of Cyproxy and show the power of it essentially and in particular look at the use of multiple integrations so multiple different security tools the use of skills and how we can store things in collections using Cyproxy so kind of demonstrating how an analyst might pivot perhaps so to do this I'm going to use the Cyproxy agent you can use ChatGPT you can use Claude whichever agent you have set up with Cyproxy via the MCP in this case I will use the Cyproxy agent so I was going to one-shot this but I'm going to break it down into multiple steps so
First of all I want to demonstrate the use of one one tool so tell me about the in fact let me rephrase that grab the two CVEs that related to PHP that were recently reported as being targeted in the wild via Liberty91. Return only the CVEs.
I then want you to pass these into GreyNoise and identify the top 10 IPs that were being identified on the sensors save those IPs to a collection in Cyproxy so in this step we're already doing a pivot so we're grabbing the two CVEs that were recently under active exploitation or attempted exploitation we're then so we're grabbing them from Liberty91 we're then going to pass those CVEs into gray noise and identify the ones that were being targeted or seen scanning the the GreyNoise honeypot sensors so you can see it's already returned a list of the top 10 IPs and it has saved them to a collection there are some caveats there we'll ignore those for the purposes of this without further investigation but what we can see is classification so where they've been identified as being malicious or not and it's created this collection on its own so going back to the
Cyproxy agent so I in fact let's move over to ChatGPT and leverage this collection there so using the collection we have just created in Cyproxy take the IPs and run them against Shodan Modat and Censys and identify any open directories and any interesting scripts on those directories save the results on resulting IPs to another collection this one will take a little bit longer because we're running it in ChatGPT and it will do a bit more thinking than the standard Cyproxy agent the deep one does go a bit deeper so this will take a bit longer and I may skip through this recording
Okay so we've got our results back and we've checked all 10 IPs identified some open directories and if we just go back to what we asked for so we asked it to save it to another collection let's just check that it's been done and here we go so if we go back we can see the open directories and we can see the context that was provided by the various different scanning tools.
Now we haven't demonstrated skills just yet so one last thing to do. Let's use it's a bit of a wild one to use or a bit of a long shot on this one but we will attempt to create reports so let's so use this skill to create a report also include the collection relating to open directories
And there we have it. So it's produced its final report using the Feedly multi-feed Triage Consolidation and it's given us a write up. I won't go into it all just now, but just to demonstrate the capabilities of using Cyproxy and pivoting across different agents, using different skills and integrations and what is possible.