I've been considering doing something similar with research groups like Project Zero. Since they have responsible disclosure policies it won't be as good as 0days, but even if the vendor affected comes out with a patch there's going to be thousands upon thousands of organizations and individuals that won't get patched until a good time later and some won't patch as all. The idea is, grab the research automatically, press releases and details of the vuln, pull the relevant information out, use the information to run massive automated scans of the entire internet. Have servers running AutoSploit pull from the data pool, as soon of course as the pocs are made available. Even if Project Zero doesn't release a PoC you can bet your ass it will be on Github in a couple days.
Cross reference the research data with Github data. Then when a match is found scan the internet Once you have them both load targets and PoCs into turbo AutoSploit ?????????????????? PROFIT!
The fun part of security automation is that you get to do things on ridiculous scales. Now imagine it's a wormable exploit. Lel. I guess it's a multidisciplinary approach to hacking the planet. It's security + automation + big data. I can already hear the MULTI BILLION DOLLAR INDUSTRY weep in dismay. But actually Cyber Security is a racket, so while they will be weeping on the outside they'll be making happy merchant hand gestures on the inside. Hey everyone wins. Everyone except the ordinary user. But who cares about those guys right.
In any case, even if such a system wouldn't be monetized, it would provide a birds eye view of the threat landscape, it will have predictive power. Which should be very interesting.
Originally posted by filtration
That's a good idea. Ever thought of using the latest CVE's, generating videos for Youtube using a robotic voice and the screenshot of the POC and then monetising it? (Call your Chanel something like CVE 0Day)I could help you if you'd like.
Seems like a bad waste of a good tool. I have greater ambitions than Youtube money. But we could do my project, and for your trouble you could have the CVE 0Day channel.
The future is going to be great. Now we are confined to building weapons of mass destruction on the internet, tomorrow we will all have pocket nukes. And the day after that we'll have fully sentient AI powered swarm intelligence in billions upon billions of nanobots to tear you apart at the molecular level that would fit inside a pokeball.
