vamp-forticheck

Multi-Vendor Edge Device CVE Scanner — VampSecure Labs

Overview

vamp-forticheck is an asynchronous, non-destructive security scanner that detects CVE vulnerabilities across seven major network security vendors. It performs a structured three-phase analysis:

1. Passive detection — identifies vendor and firmware version fingerprints from HTTP response headers, banners, and login page artifacts without triggering authentication.
2. Semi-active CVE probes — targeted HTTP requests that confirm specific vulnerability conditions including version disclosure, path traversal, and pre-auth RCE indicators.
3. Secondary exposure analysis — checks for administrative interfaces, management APIs, and credential-exposure endpoints exposed on the same host.

Coverage spans 16 CVEs across 7 vendors: FortiOS/FortiGate, Palo Alto PAN-OS, Cisco ASA, Cisco IOS-XE, Check Point Gateway, Juniper Junos, and F5 BIG-IP.

Features

• Fully asynchronous scanning via asyncio + aiohttp with configurable concurrency
• Seven-vendor CVE database including actively exploited critical vulnerabilities
• Scope enforcement via allowlist file — prevents unintended out-of-scope probing
• Risk scoring: CVSS × confidence_factor (1.0 for confirmed findings, 0.55 for version-match only)
• Bulk target input from file or direct command-line arguments
• Standalone HTML report for client delivery or archival
• Client-grade HTML + PDF reporting via the shared vampsec_report module

Requirements

Python 3.11+
aiohttp >= 3.9.0
rich >= 13.7.0

Install dependencies:

pip install -r requirements.txt

Installation

git clone https://github.com/belky-me/vamp-forticheck.git
cd vamp-forticheck
pip install -r requirements.txt

Usage

python vamp_forticheck.py [OPTIONS]

Target selection:
  -t, --target HOST [HOST ...]   One or more targets (IP, hostname, or HOST:PORT)
  -i, --input FILE               File with one target per line

Scope:
  -s, --scope FILE               Allowlist file (CIDR blocks, wildcards, or exact hosts)

Performance:
  -c, --concurrency N            Maximum concurrent connections (default: 10)
      --timeout N                Per-request timeout in seconds (default: 10)

Output:
  -o, --output FILE              Write all findings to a JSON file
      --html FILE                Generate a standalone HTML report
  -v, --verbose                  Show detailed probe traces and HTTP responses

Examples

Scan a single edge device and write a JSON report:

python vamp_forticheck.py -t 203.0.113.1 -o results.json

Scan a target list within a defined scope, with HTML output and verbose logging:

python vamp_forticheck.py -i targets.txt -s scope.txt --html report.html -v

Scan multiple hosts with increased concurrency:

python vamp_forticheck.py -t 10.0.0.1 10.0.0.2 10.0.0.254 -c 20 -o findings.json

Scan a management interface on a non-standard port:

python vamp_forticheck.py -t firewall.corp.example:8443 --html firewall_report.html

Output Formats

Exit Codes

Risk Levels

Score = CVSS_base × confidence_factor. Confidence is 1.0 when a probe confirms the vulnerability condition, and 0.55 when the finding is based on version disclosure alone.

Part of VampSecure Labs Toolkit

vamp-forticheck is part of the VampSecure Labs Security Research Toolkit — a collection of professional-grade, self-hosted security assessment tools.

© VampSecure Studios — VampSecure Labs Security Research Division
For authorized security assessments only. Unauthorized use is prohibited.