此工具将目标的补丁级别与微软漏洞数据库进行对比，以检测目标可能缺失的补丁。同时，它还会通知用户是否存在针对缺失公告的公开漏洞利用程序和Metasploit模块。
它需要Windows主机的'systeminfo'命令输出，以便与微软安全公告数据库进行比较，从而确定主机的补丁级别。
它能够使用--update标志自动从微软下载安全公告数据库，并将其保存为Excel电子表格。
在查看命令输出时，重要的是要注意，该工具假设所有漏洞都存在，然后根据修补程序数据有选择地移除它们。这可能导致许多误报，关键是要了解目标主机上实际运行的软件。例如，如果存在已知的IIS漏洞，即使目标主机上没有运行IIS，它也会标记出来。
输出会显示公开漏洞利用程序（E）或Metasploit模块（M），如字符值所示。
该工具深受Pentura的Linux_Exploit_Suggester启发。
博客文章："Introducing Windows Exploit Suggester", https://blog.gdssecurity.com/labs/2014/7/11/introducing-windows-exploit-suggester.html
更新数据库
$ ./windows-exploit-suggester.py --update
[*] initiating...
[*] successfully requested base url
[*] scraped ms download url
[+] writing to file 2014-06-06-mssb.xlsx
[*] done
安装依赖
（安装python-xlrd, $ pip install xlrd --upgrade）
提供"systeminfo"输入，并指向微软数据库
$ ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --systeminfo win7sp1-systeminfo.txt
[*] initiating...
[*] database file detected as xls or xlsx based on extension
[*] reading from the systeminfo input file
[*] querying database file for potential vulnerabilities
[*] comparing the 15 hotfix(es) against the 173 potential bulletins(s)
[*] there are now 168 remaining vulns
[+] windows version identified as 'Windows 7 SP1 32-bit'
[*]
[M] MS14-012: Cumulative Security Update for Internet Explorer (2925418) - Critical
[E] MS13-101: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430) - Important
[M] MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986) - Critical
[M] MS13-080: Cumulative Security Update for Internet Explorer (2879017) - Critical
[M] MS13-069: Cumulative Security Update for Internet Explorer (2870699) - Critical
[M] MS13-059: Cumulative Security Update for Internet Explorer (2862772) - Critical
[M] MS13-055: Cumulative Security Update for Internet Explorer (2846071) - Critical
[M] MS13-053: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2850851) - Critical
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[*] done
无需修补程序数据，即可针对操作系统使用可能的漏洞利用程序
$ ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --ostext 'windows server 2008 r2'
[*] initiating...
[*] database file detected as xls or xlsx based on extension
[*] getting OS information from command line text
[*] querying database file for potential vulnerabilities
[*] comparing the 0 hotfix(es) against the 196 potential bulletins(s)
[*] there are now 196 remaining vulns
[+] windows version identified as 'Windows 2008 R2 64-bit'
[*]
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
目前，如果'systeminfo'命令对于修补程序的输出显示为'File 1'，则无法确定哪些修补程序已安装在目标上。如果出现这种情况，需要从目标主机检索修补程序列表，并使用--hotfixes标志传入
目前它不会分离Windows操作系统的'版本'，例如'Tablet'或'Media Center'，也不会处理不同的体系结构，例如仅基于Itanium的版本
误报也可能发生，因为它假设目标Windows操作系统上安装了所有内容。如果您收到'File 1'输出，请尝试执行'wmic qfe list full'并将其作为输入，配合--hotfixes标志以及'systeminfo'
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.