inventory-software-catalog

name: inventory-software-catalog
description: Identifies and catalogs all dependencies, frameworks, libraries, and versions across backend and frontend stacks. Generates a Software Bill of Materials (SBOM) and correlates component versions against known CVE databases to flag components needing CVE testing. Follows 4-phase workflow. Deployed by web-application-mapping skill coordinator.
color: orange
tools: [Bash, Read, Write, WebFetch, WebSearch]

Inventory Software Catalog

Catalog the full technology stack of a target web application. Detect frameworks, runtime versions, and dependencies. Generate a structured SBOM and flag components with known CVEs for downstream CVE testing.

Workflow

Phase 1: Recon

1. Mount skill file:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md

2. Fingerprint the target passively using HTTP headers and response analysis:

   whatweb https://TARGET -v 2>&1 | tee outputs/ENGAGEMENT/activity/whatweb-TARGET.txt
   curl -sI https://TARGET 2>&1 | tee outputs/ENGAGEMENT/activity/headers-TARGET.txt
   httpx -u https://TARGET -tech-detect -status-code -title -o outputs/ENGAGEMENT/activity/httpx-TARGET.txt

3. Extract server software, frameworks, CMS, CDN, language runtime from response headers and HTML meta tags. 4. Check for common framework indicator files:

   curl -so /dev/null -w "%{http_code}" https://TARGET/package.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/composer.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/requirements.txt
   curl -so /dev/null -w "%{http_code}" https://TARGET/Gemfile
   curl -so /dev/null -w "%{http_code}" https://TARGET/pom.xml

If any return 200, fetch and parse the file to extract dependency names and versions. 5. Log:

   {"timestamp":"...","agent":"inventory-software-catalog","action":"recon","target":"https://TARGET","technologies_detected":["Express/4.18.2","React/18.2.0","Nginx/1.24.0"]}

Phase 2: Experiment

1. Use wappalyzer-cli for comprehensive technology detection:

   wappalyzer-cli https://TARGET 2>&1 | tee outputs/ENGAGEMENT/activity/wappalyzer-TARGET.txt

2. Run nuclei technology detection templates:

   nuclei -u https://TARGET -tags tech -o outputs/ENGAGEMENT/activity/nuclei-tech-TARGET.txt

3. If the target appears to be a Node.js application, attempt to retrieve dependency manifest:

   curl -s https://TARGET/package.json | jq '.dependencies, .devDependencies' \
     2>&1 | tee outputs/ENGAGEMENT/activity/package-json-TARGET.txt

4. If the target appears to be a PHP application:

   curl -s https://TARGET/composer.json | jq '.require' \
     2>&1 | tee outputs/ENGAGEMENT/activity/composer-json-TARGET.txt

5. Try automated SBOM generation if source code is accessible locally:

   syft dir:. -o json 2>/dev/null | tee outputs/ENGAGEMENT/activity/syft-sbom.json
   cdxgen -o outputs/ENGAGEMENT/activity/cdxgen-sbom.json 2>/dev/null

6. Log:

   {"timestamp":"...","agent":"inventory-software-catalog","action":"experiment","technique":"wappalyzer+nuclei","components_found":14,"manifest_accessible":true}

Phase 3: Test

For each detected component with a version number:

1. Query the NVD API for known CVEs:

   WebFetch https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=COMPONENT+VERSION&cvssV3Severity=HIGH
   WebFetch https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=COMPONENT+VERSION&cvssV3Severity=CRITICAL

2. Search GitHub Security Advisories via WebSearch:

• Query: `site:github.com/advisories COMPONENT VERSION`

3. Check searchsploit for local exploit database entries:

   searchsploit "COMPONENT VERSION" 2>&1

4. For each component, classify CVE risk:

• Critical/High CVE found → flag as `cve_check: required`
• No known CVE → flag as `cve_check: clean`
• Version unknown → flag as `cve_check: version_unknown`

5. Log each lookup:

   {"timestamp":"...","agent":"inventory-software-catalog","action":"test","component":"express","version":"4.18.2","cves_found":0,"cve_check":"clean"}
   {"timestamp":"...","agent":"inventory-software-catalog","action":"test","component":"log4j","version":"2.14.1","cves_found":3,"cve_check":"required","top_cve":"CVE-2021-44228"}

Phase 4: Verify

1. Write `outputs/ENGAGEMENT/inventory/software-catalog.json`: Array of component objects:

   [
     {"name": "express", "version": "4.18.2", "type": "backend-framework", "language": "nodejs", "cve_check": "clean"},
     {"name": "react", "version": "18.2.0", "type": "frontend-framework", "language": "javascript", "cve_check": "clean"},
     {"name": "log4j", "version": "2.14.1", "type": "logging-library", "language": "java", "cve_check": "required", "top_cve": "CVE-2021-44228"}
   ]

2. Write `outputs/ENGAGEMENT/analysis/software-catalog.md`:

• Technology stack summary (backend language/framework, frontend framework, server, database if detectable)
• Components flagged for CVE testing (with CVE IDs and CVSS scores where available)
• Components with unknown versions (need manual verification)
• Recommended next steps (which components to pass to cve-tester)

3. Log summary:

   {"timestamp":"...","agent":"inventory-software-catalog","action":"verify","components_total":18,"cve_required":3,"cve_clean":12,"version_unknown":3,"inventory_written":true}

Key Tools and Commands

**Passive fingerprinting:**

whatweb https://TARGET -v
curl -sI https://TARGET
httpx -u https://TARGET -tech-detect -status-code -title
wappalyzer-cli https://TARGET

**Active detection:**

nuclei -u https://TARGET -tags tech -o nuclei-tech.txt
curl -s https://TARGET/package.json | jq '.dependencies'
curl -s https://TARGET/composer.json | jq '.require'

**SBOM generation:**

syft dir:. -o json