$ show bitsadmin/wesng
WES-NG (Windows Exploit Suggester - Next Generation) is a monolithic CLI tool written in Python. Its core function is to read the output of the Windows `systeminfo` command and compare the detected operating system version and installed patches against a bundled database of known vulnerabilities (CVEs). It outputs a prioritized list of likely exploitable vulnerabilities, including links to public exploits. The architecture centers on `wes.py`, which handles input parsing, OS fingerprinting, patch matching, and output formatting. The vulnerability database is shipped as `definitions.zip`, a compressed CSV file. The tool employs a recursive graph traversal algorithm (`mark_superseeded_hotfix`) to filter out patches that have been superseded by newer updates, significantly reducing false positives. Optional companion scripts (`missingkbs.vbs`, `missingkbs.ps1`) can enumerate missing patches directly on a Windows host. The repository also contains a complete data collection pipeline (`collector/*.ps1`) used by the maintainers to regenerate the vulnerability database from sources like the MSRC API, NVD, and Exploit-DB. A large corpus of validation data (`validation/*.txt`) ensures the OS fingerprinting logic works across a wide range of Windows versions and locales. While the core logic is robust and well-tested, the codebase shows signs of technical drift, including remnants of Python 2 compatibility and reliance on hardcoded URLs for data updates. Overall, it is a highly effective and practical security auditing tool that accurately fulfills its stated purpose.
The LLM identified 5 files worth highlighting for reuse:
The `determine_product()` function parses raw Windows `systeminfo` output to identify the exact OS version, build, architecture, and service pack. It handles a vast array of formats, locales, and Windows versions (XP to 11, Server variants) using robust regex and string matching. This is a highly non-trivial, self-contained parsing component that could be extracted into a standalone Windows OS fingerprinting library.
The `mark_superseeded_hotfix()` function implements a recursive graph traversal (DFS) to determine if a security patch is superseded by another installed patch. It builds a supersedence graph from the `Supersedes` field in the vulnerability database. This is a classic graph algorithm applied to a security domain, demonstrating a non-obvious and highly effective pattern for reducing false positives in patch auditing.
This PowerShell script acts as the ETL pipeline for the project's vulnerability database. It merges data from multiple sources (MSRC API, NVD feeds, Exploit-DB, Microsoft Bulletin) into a single, deduplicated CSV. It handles URL normalization, CSV merging, and data enrichment. This is a well-structured, self-contained data integration pattern that is reusable for any project needing to aggregate security advisories.
This script scrapes the Microsoft Update Catalog to find the latest superseding KB for a given hotfix. It uses `mechanicalsoup` to navigate the HTML form and parse results. It implements a simple progress bar and handles network errors. This is a classic web scraping pattern applied to a specific security problem, and it is self-contained and reusable for any project needing to resolve Microsoft KB supersedence.
This script implements a golden-file regression test suite for the OS fingerprinting logic. It reads a corpus of real-world `systeminfo` output files, runs the parser against them, and validates the detected OS against the filename convention. This is a novel and highly reusable testing pattern for any project that needs to robustly parse semi-structured text output from diverse system configurations.