
๐บ Vulfy โ ๋น ๋ฅธ Rust ๊ธฐ๋ฐ ํจํค์ง ๋ฒ์ ์ค์บ๋
Vulfy๋ 9๊ฐ์ง ํ๋ก๊ทธ๋๋ฐ ์ธ์ด์ ๊ฑธ์ณ ํ๋ก์ ํธ ์์กด์ฑ์์ ์๋ ค์ง ๋ณด์ ๋ฌธ์ ๋ฅผ ๊ฒ์ฌํ๋ ์ด๊ณ ์ ์ทจ์ฝ์ ์ค์บ๋์ ๋๋ค. ์ต๋ ์ฑ๋ฅ์ ์ํด Rust๋ก ์ ์๋์์ผ๋ฉฐ OSV.dev ๋ฐ์ดํฐ๋ฒ ์ด์ค์ ํตํฉ๋์ด ์ ํํ๊ณ ์ต์ ์ ์ทจ์ฝ์ ์ ๋ณด๋ฅผ ์ ๊ณตํฉ๋๋ค.
๐ ์ ์ฒด ๋ฌธ์ - ์ข ํฉ ๊ฐ์ด๋, ํํ ๋ฆฌ์ผ ๋ฐ API ์ฐธ์กฐ
# Linux/WSL
curl -LO https://github.com/mindPatch/vulfy/releases/latest/download/vulfy-linux-x86_64.tar.gz
tar -xzf vulfy-linux-x86_64.tar.gz
sudo mv vulfy /usr/local/bin/
# macOS (Intel)
curl -LO https://github.com/mindPatch/vulfy/releases/latest/download/vulfy-macos-x86_64.tar.gz
tar -xzf vulfy-macos-x86_64.tar.gz
sudo mv vulfy /usr/local/bin/
# macOS (Apple Silicon)
curl -LO https://github.com/mindPatch/vulfy/releases/latest/download/vulfy-macos-aarch64.tar.gz
tar -xzf vulfy-macos-aarch64.tar.gz
sudo mv vulfy /usr/local/bin/
cargo install vulfy
git clone https://github.com/mindPatch/vulfy.git
cd vulfy
cargo build --release
sudo cp target/release/vulfy /usr/local/bin/
์ค์น ํ์ธ:
vulfy --version
# Should output: vulfy 0.1.0
# Scan current directory
vulfy scan packages
# Scan specific directory
vulfy scan packages --path /path/to/project
# Only show high-severity vulnerabilities
vulfy scan packages --high-only
# JSON for automation/CI
vulfy scan packages --format json --output security-report.json
# CSV for spreadsheet analysis
vulfy scan packages --format csv --output vulnerabilities.csv
# SARIF for GitHub Security tab
vulfy scan packages --format sarif --output vulfy.sarif
# Fail build if high-severity vulnerabilities found
vulfy scan packages --high-only --quiet || exit 1
# Scan specific ecosystems only
vulfy scan packages --ecosystems npm,pypi --no-dev-deps
| ์์ฝ์์คํ | ํจํค์ง ํ์ผ | ์ํ |
|---|---|---|
| ๐ฆ npm | package-lock.json, yarn.lock, pnpm-lock.yaml, package.json | โ |
| ๐ Python | requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml | โ |
| ๐ฆ Rust | Cargo.lock, Cargo.toml | โ |
| โ Java | pom.xml, build.gradle, build.gradle.kts | โ |
| ๐น Go | go.mod, go.sum, go.work | โ |
| ๐ Ruby | Gemfile.lock, Gemfile, *.gemspec | โ |
| โ๏ธ C/C++ | vcpkg.json, CMakeLists.txt, conanfile.txt | ๐ ์ ๊ท! |
| ๐ PHP | composer.json, composer.lock | ๐ ์ ๊ท! |
| ๐ท .NET | *.csproj, packages.config, *.nuspec | ๐ ์ ๊ท! |
๐ Scanning for package files...
๐ฆ Found 6 package files across 4 ecosystems
๐ก๏ธ VULNERABILITY REPORT
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโฌโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโฌโโโโโโโ
โ Title โ CVE ID โ Severity โ Package โ Year โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโค
โ Remote Code Execution in lodash โ CVE-2021-123 โ ๐ฅ High โ [email protected] โ 2021 โ
โ Path Traversal in express โ CVE-2022-456 โ ๐ก Mediumโ [email protected] โ 2022 โ
โ SQL Injection in sequelize โ CVE-2020-789 โ ๐ฅ High โ [email protected] โ 2020 โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโดโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโดโโโโโโโ
๐ SCAN SUMMARY
โข Total packages scanned: 42
โข Vulnerable packages: 8
โข Total vulnerabilities: 12
โข ๐ฅ High severity: 4
โข ๐ก Medium severity: 6
โข ๐ข Low severity: 2
๐ ๋ชจ๋ ์ถ๋ ฅ ํ์ ๋ณด๊ธฐ - JSON, CSV, SARIF ์์
Vulfy์๋ Git ์ ์ฅ์์ ์ง์์ ์ธ ๋ณด์ ๋ชจ๋ํฐ๋ง์ ์ํ ๊ฐ๋ ฅํ ์๋ํ ์์คํ ์ด ํฌํจ๋์ด ์์ต๋๋ค.
# Initialize automation with example configuration
vulfy automation init --with-examples
# Validate configuration
vulfy automation validate
# Run manual scan using automation config
vulfy automation run
# Start continuous monitoring
vulfy automation start --foreground
# Monitor multiple repositories
[[repositories]]
name = "my-web-app"
url = "https://github.com/user/my-web-app.git"
branches = ["main", "develop"]
ecosystems = ["npm", "pypi"]
[repositories.credentials]
username = "git"
token = "your_github_token_here"
# Schedule daily scans at 2:00 AM UTC
[schedule]
frequency = "daily"
time = "02:00"
timezone = "UTC"
# Discord webhook notifications
[[notifications.webhooks]]
name = "Security Alerts"
url = "https://discord.com/api/webhooks/..."
webhook_type = "discord"
enabled = true
# Advanced security policies
[[policies]]
name = "Critical Authentication Issues"
enabled = true
[policies.conditions]
title_contains = ["authentication", "auth", "bypass"]
severity = ["high", "critical"]
[policies.actions]
notify = true
priority = "critical"
custom_message = "๐จ Critical auth vulnerability detected!"
๐ ์ ์ฒด ์๋ํ ๊ฐ์ด๋ - ์์ธ ์ค์ ๋ฐ ๊ตฌ์ฑ
vulfy scan packages [OPTIONS]
OPTIONS:
-p, --path <PATH> Directory to scan [default: current directory]
-f, --format <FORMAT> Output format: table, json, csv, summary, sarif
-o, --output <FILE> Save results to file
-e, --ecosystems <LIST> Only scan specific ecosystems (comma-separated)
-q, --quiet Suppress progress output
--high-only Show only high/critical severity vulnerabilities
--no-recursive Don't scan subdirectories
--no-dev-deps Skip development dependencies
ํ๋ก์ ํธ ๋ฃจํธ์ .vulfy.toml์ ์์ฑํ์ธ์:
[scan]
ecosystems = ["npm", "pypi", "crates.io"]
min_severity = "medium"
skip_dev_deps = true
ignore_paths = ["node_modules", "vendor", ".git"]
[output]
format = "table"
color = "auto"
[api]
timeout = 30
max_concurrent = 10
retry_attempts = 3
๐ ์ ์ฒด ๊ตฌ์ฑ ์ฐธ์กฐ - ์ ์ฒด ์คํค๋ง ๋ฌธ์
๊ธฐ๋ฅ ์์ฒญ์ด ์์ผ์ ๊ฐ์? ์ด์๋ฅผ ์ด์ด ํจ๊ป ๋ ผ์ํด ๋ณด์ธ์!
Vulfy๋ ์ฑ๋ฅ๊ณผ ์์ ์ฑ์ ํต์ฌ ์์น์ผ๋ก ๊ตฌ์ถ๋์์ต๋๋ค:
๐ ์ํคํ ์ฒ ์ฌ์ธต ๋ถ์ - ๊ธฐ์ ๊ตฌํ ์ธ๋ถ ์ฌํญ
๊ธฐ์ฌ๋ฅผ ํ์ํฉ๋๋ค! ๋ฒ๊ทธ ์์ , ์๋ก์ด ๊ธฐ๋ฅ, ์์ฝ์์คํ ์ง์ ๋ฑ ๋ฌด์์ด๋ ์ข์ต๋๋ค.
git clone https://github.com/mindPatch/vulfy.git
cd vulfy
cargo build
cargo test
cargo clippy๋ฅผ ์คํํ์ธ์.๐ ๊ธฐ์ฌ ๊ฐ์ด๋ - ์์ธ ๊ธฐ์ฌ ์ง์นจ
vulfy ๋ฐ์ด๋๋ฆฌ์ ์คํ ๊ถํ์ด ์๋์ง ํ์ธํ์ธ์: chmod +x vulfy์ด ํ๋ก์ ํธ๋ MIT ๋ผ์ด์ ์ค์ ๋ฐ๋ผ ๋ผ์ด์ ์ค๊ฐ ๋ถ์ฌ๋ฉ๋๋ค. ์์ธํ ๋ด์ฉ์ LICENSE ํ์ผ์ ์ฐธ์กฐํ์ธ์.