Detection Engineering & Vulnerability Research - CVE-2011-2523 (vsftpd 2.3.4)

A CVE to Detection Signature Engineering Project: researching a disclosed vulnerability, building a fingerprint that identifies it externally, and validating detection quality against real lab targets.

Why This Project Exists

Most vulnerability-research portfolios stop at "I exploited X." This one is built around a different question, closer to what detection engineering actually asks:

Once a CVE is disclosed, how do you reliably identify — externally, at scale, without exploiting anything — which internet-facing assets are actually running the vulnerable technology?

This repo documents that full workflow for one real CVE: CVE-2011-2523, the vsftpd 2.3.4 backdoor. It goes from vulnerability research through fingerprint design, detection script engineering, and validation against live lab targets — deliberately built as detection, not exploitation.

How This Maps to Detection Engineering / Vulnerability Research Work

Methodology

CVE Disclosure  →  Research & Version Analysis  →  Fingerprint Design
      →  Detection Script  →  Validation (TP/FP/FN review)  →  Evidence Output

1. Research — Identified CVE-2011-2523 (vsftpd 2.3.4 backdoor): a trojaned build of vsftpd distributed for a ~72-hour window in 2011, triggered by a specific login pattern, granting a remote shell.
2. Fingerprint design — vsftpd announces its exact version in the FTP 220 welcome banner. That banner is the fingerprint surface — no authentication, no exploitation required to read it.
3. Detection script — fingerprint_vsftpd_cve_2011_2523.py connects, captures the banner, regex-matches it against the known vulnerable signature, and classifies the result.
4. Validation — Run against a known-vulnerable Metasploitable2 target (confirms true positive) and a closed/filtered port (confirms the script correctly reports undetermined rather than a false negative).
5. Evidence output — Structured JSON per finding (host, port, banner, verdict, reason, CVE reference, timestamp) — designed to slot into a larger findings pipeline rather than a one-off printout.

Screenshots — Script & Validation Run

Rename your screenshot files to match, or update these paths, once uploaded to /screenshots.

Additional run detail:

Detail Detail Detail Detail

Usage

# Single target
python3 fingerprint_vsftpd_cve_2011_2523.py --target 192.168.56.101

# Batch — multiple hosts, evidence-style JSON output
python3 fingerprint_vsftpd_cve_2011_2523.py --targets-file targets.json \
    --output evidence/vsftpd_fingerprint_findings.json

Sample output:

{
  "scan_type": "vsftpd_2.3.4_backdoor_fingerprint",
  "cve": "CVE-2011-2523",
  "total_targets": 1,
  "vulnerable_count": 1,
  "findings": [
    {
      "host": "192.168.56.101",
      "port": 21,
      "banner": "220 (vsFTPd 2.3.4)",
      "verdict": "vulnerable",
      "reason": "Banner matches known vulnerable signature (vsftpd 2.3.4)"
    }
  ]
}

Validation Summary

This three-way split is the core detection-quality control in the project: a naive detector collapses "couldn't check" and "checked and clean" into the same result, which is exactly how false negatives hide in production detection logic.

Repository Structure

.
├── fingerprint_vsftpd_cve_2011_2523.py
├── docs/
│   └── CVE-RESEARCH.md
├── evidence/
│   └── vsftpd_fingerprint_findings.json
├── screenshots/
│   └── (script + validation run screenshots)
└── README.md

Roadmap

• Add fingerprint modules for additional disclosed CVEs (expanding beyond vsftpd)
• Add Nmap NSE-assisted enumeration as a pre-fingerprint discovery step
• Add HTTP/TLS-based fingerprinting module (web-technology identification, not just banner services)
• Add automated false-positive/false-negative regression tests

Repository Visitors

Author

BASSEY SOLOMON HENRY

Cybersecurity Engineer | Detection Engineer | Vulnerability Researcher | Purple Team | SIEM | Enterprise Security

Focused on the research-to-detection pipeline: taking a disclosed CVE from advisory to a working, validated fingerprint capable of identifying vulnerable technology externally and at scale — built on hands-on offensive and defensive lab work rather than theory alone.

Connect With Me

Personal Philosophy

"A vulnerability isn't real risk until you can prove, at scale, which systems actually have it. Research tells you what's possible — detection engineering tells you what's true."

— Bassey Solomon Henry