CVE Hunting Python Repos with VulnHunter

Step 1: Installation

  1. Install Python 3.10 (required for Vulnhuntr to work reliably). Example On Ubuntu:

    sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt update
sudo apt install python3.10 python3.10-venv python3.10-dev
curl -sS https://bootstrap.pypa.io/get-pip.py | python3.10
python3.10 -m pip install --user pipx
python3.10 -m pipx ensurepath

  2. Install Vulnhuntr using pipx:

    pipx install git+https://github.com/protectai/vulnhuntr.git --python python3.10

Step 2: Running Vulnhuntr on Python Repositories

  • Vulnhuntr works with all Python repositories, not just those hosted on Huntr. It analyzes any Python codebase locally or remotely, focusing on files handling user input for better vulnerability detection.

  • Basic usage (scan entire Python repo):

    vulnhuntr.py -r /path/to/target/repo

  • Target specific files (recommended to reduce token use and improve accuracy):

    vulnhuntr.py -r /path/to/target/repo -a path/to/target_file.py

    For example, target files that handle HTTP routes or user input, such as those containing @route decorators in FastAPI or Flask.

  • Additional flags:

    • -l — select the LLM client (options: claude, gpt, ollama; default is claude)

    • -v — increase verbosity for detailed logs

Step 3: Analyze and Interpret Vulnhuntr Output

  • Review the output carefully; it contains a scratchpad with step-by-step reasoning, an analysis section explaining the vulnerability, and proof-of-concept (PoC) exploits.

  • Confidence scores:

    • 8+ = high-confidence vulnerability

    • 7 = suspicious, requires further investigation and tweaking

    • <6 = likely false positive

  • Always manually verify findings; do not copy Vulnhuntr output directly to maintainers.

Step 4: Manual Testing and Verification

  • Deploy or run the target project locally or in an isolated environment to reproduce vulnerabilities.

  • Use tools like Burp Suite for intercepting requests, manual fuzzing, and exploit verification.

  • Create manual proof-of-concept exploits to confirm impacts such as data leakage, command injection, or SSRF.

  • Focus on high-confidence alerts for verification and modify PoCs if needed.

Step 5: Reporting and Applying for CVEs

  • Prepare a detailed vulnerability report including:

    • Steps to reproduce

    • Impact assessment

    • Manual testing evidence

  • Submit your findings via:

    • Huntr.com directly or through the project's Security tab on GitHub

  • If accepted, Huntr can assist with applying for a CVE, or apply independently via the MITRE CVE request form: https://cveform.mitre.org/

Helpful Resources

PreviousBug Bounty ProgramsNextCoding/Programming

Last updated