Initial Access Community

API / スキーマ

VulnCheck APIとわかりやすいJSONスキーマを使用して、VulnCheck Initial Access Intelligence Community Editionと統合します。

VulnCheck Initial Access Intelligence Community Editionは、initial-access-communityインデックスを通じてVulnCheck Communityアカウントで利用できます。脆弱性ごとにクエリすることも、インデックス全体をバックアップとしてダウンロードすることもできます。

インデックスのクエリ

curl --request GET \
    --url 'https://api.vulncheck.com/v3/index/initial-access-community?cve=CVE-2026-63077' \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

vulncheck index list initial-access-community --cve CVE-2026-63077

バックアップのダウンロード

curl --request GET \
    --url https://api.vulncheck.com/v3/backup/initial-access-community \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
 "context"
 "encoding/json"
 "fmt"
 "log"
 "os"

 vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
 configuration := vulncheck.NewConfiguration()
 configuration.Scheme = "https"
 configuration.Host = "api.vulncheck.com"

 client := vulncheck.NewAPIClient(configuration)

 token := os.Getenv("VULNCHECK_API_TOKEN")
 auth := context.WithValue(
  context.Background(),
  vulncheck.ContextAPIKeys,
  map[string]vulncheck.APIKey{
   "Bearer": {Key: token},
  },
 )
 resp, httpRes, err := client.EndpointsAPI.BackupIndexGet(auth, "initial-access-community").Execute()

 if err != nil || httpRes.StatusCode != 200 {
  log.Fatal(err)
 }

 prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
 if err != nil {
  log.Fatalf("Failed to generate JSON: %v", err)
  return
 }

 fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    endpoints_client = vulncheck_sdk.EndpointsApi(api_client)

    api_response = endpoints_client.backup_index_get("initial-access-community")

    print(api_response.data[0].url)

vulncheck backup download initial-access-community

JSONスキーマ

各レコードはCVEで識別される1つの脆弱性を対象とし、1つ以上のアーティファクトを含みます。アーティファクトのフィールドの多くは、その種類のアーティファクトがリポジトリにあるかどうかを示すブール値、またはクエリURLのリストです。artifactsURLフィールドは、アーティファクトそのものが置かれているリポジトリ内の脆弱性ディレクトリにリンクしています。

Initial Access Communityのエントリ例

以下は、initial-access-communityインデックスのレコード例です。

"data": [
  {
    "id": "625a3455-0711-4aee-baa8-09fe3d1387dc",
    "cve": "CVE-2026-63077",
    "artifacts": [
      {
        "vendor": "JetBrains",
        "targetEncryptedComms": "either",
        "mitreAttackTechniques": [
          "T1190",
          "T1059.004"
        ],
        "product": [
          "TeamCity"
        ],
        "dateAdded": "2026-09-23T00:00:00Z",
        "artifactName": "JetBrains TeamCity Agent Polling XStream Deserialization Unauthenticated RCE",
        "exploit": true,
        "versionScanner": true,
        "pcap": true,
        "sigmaRule": true,
        "suricataRule": true,
        "snortRule": true,
        "yara": true,
        "nmapScript": false,
        "zeroday": false,
        "targetService": "HTTP",
        "targetDocker": true,
        "googleQueries": [],
        "googleRawQueries": null,
        "baiduQueries": [],
        "baiduRawQueries": null,
        "shodanQueries": [
          "https://www.shodan.io/search?query=TeamCity-Node-Id+%2B%22TCSESSIONID%22"
        ],
        "censysQueries": [
          "https://platform.censys.io/search?q=%28web.endpoints.http.headers.key%3A%22TeamCity-Node-Id%22+and+%28web.endpoints.http.headers%3A+%28key%3A+%22Set-Cookie%22+and+value%3A+%22TCSESSIONID%22%29%29%29+or+%28host.services.endpoints.http.headers.key%3A%22TeamCity-Node-Id%22+and+%28host.services.endpoints.http.headers%3A+%28key%3A+%22Set-Cookie%22+and+value%3A+%22TCSESSIONID%22%29%29%29"
        ],
        "driftnetQueries": [],
        "driftnetRawQueries": [],
        "greynoiseQueries": [],
        "fofaQueries": [
          "https://en.fofa.info/result?qbase64=aGVhZGVyPSJUZWFtQ2l0eS1Ob2RlLUlkIiAmJiBoZWFkZXI9IlRDU0VTU0lPTklEIg%3D%3D"
        ],
        "fofaRawQueries": null,
        "zoomEyeQueries": [
          "https://www.zoomeye.ai/searchResult?q=aHR0cC5oZWFkZXI9IlRlYW1DaXR5LU5vZGUtSWQiICYmIGh0dHAuaGVhZGVyPSJUQ1NFU1NJT05JRCI%3D"
        ],
        "zoomEyeRawQueries": null,
        "shodanRawQueries": null,
        "censysRawQueries": null,
        "cloneSSHURL": "git@github.com:vulncheck-oss/initial-access-community.git",
        "artifactsURL": [
          "https://github.com/vulncheck-oss/initial-access-community/tree/main/feed/cve-2026-63077"
        ],
        "vcTargetIntelQuery": [],
        "goexploit": {
          "exploitType": "CodeExecution",
          "protocol": "HTTP",
          "defaultPort": 8111,
          "assetDetection": true,
          "versionScanner": true,
          "exploitation": true,
          "supportedC2": [
            "SSLShellServer",
            "SimpleShellServer",
            "HTTPServeShell",
            "HTTPServeFile"
          ],
          "cpe": [
            "cpe:2.3:a:jetbrains:teamcity"
          ],
          "customFlags": [
            {
              "name": "webroot-relative",
              "type": "string",
              "default": "../webapps/ROOT",
              "usage": "TeamCity webroot relative to the HSQLDB process working directory (default suits the standard Linux/Docker and Windows layouts)"
            },
            {
              "name": "command",
              "type": "string",
              "default": "",
              "usage": "Command to use for the exploit, an empty string will use the exploit default."
            }
          ]
        }
      }
    ]
  }
]

概要

インテリジェンスを活用する 101