How mohamed2007sarhan/vulnintel works
VulnIntel is a defensive vulnerability-intelligence desktop platform. Its main workflow monitors vulnerability feeds, searches public exploit sources, analyzes candidates with AI, records findings, and generates detection rules and reports; users can also search publicly and manage authorized lab targets and validation results. The README documents AI-generated PoCs, queue fallbacks, and database rotation, but the excerpts do not establish all their internal call paths, so those links are omitted. The GUI pipeline excerpt supports its feed, exploit, and detection orchestration; other subsystem wiring is shown only where documented or evidenced.
Main entry points: app.py GUI application · public_search_frame.py Public search · db_manager.py SQLite records · lab_manager.py Lab manager
Components 27
Desktop interface
- GUI application
gui/app.py - Public search
gui/public_search_frame.py - CVE browser
gui/cve_browser_frame.py - Processing queue
gui/queue_frame.py - Lab interface
gui/lab_frame.py - Reports interface
gui/reports_frame.py
Intelligence pipeline
- NVD source
sources/nvd_source.py - GitHub advisories
sources/github_advisories.py - Exploit-DB source
sources/exploitdb_source.py - Sploitus source
sources/sploitus_source.py
Analysis and safety
- AI analyzer
analysis/ai_analyzer.py - CVE analysis
analysis/cve_analyzer.py - Exploit classifier
analysis/exploit_classifier.py - Safety policy
analysis/safety_policy.py
Lab operations
- Lab manager
lab/lab_manager.py - Sandbox workflow
lab/sandbox_workflow.py - Sigma rules
generators/sigma_generator.py - YARA rules
generators/yara_generator.py - IOC summaries
generators/ioc_generator.py - Remediation
generators/remediation.py - Report generator
generators/report_generator.py
Persistence and outputs
- SQLite records
database/db_manager.py
Other components
- Defensive analyst
- NVD API
- GitHub Advisories
- Exploit sources
- AI model API
Connections 35
- Defensive analyst → GUI application: uses
- GUI application → Public search: opens
- GUI application → CVE browser: opens
- GUI application → Processing queue: opens
- GUI application → Lab interface: opens
- GUI application → Reports interface: opens
- GUI application → NVD source: fetches CVEs
- GUI application → GitHub advisories: fetches advisories
- GUI application → Exploit-DB source: searches exploits
- GUI application → Sploitus source: searches exploits
- GUI application → SQLite records: stores findings
- GUI application → Sigma rules: generates rules
- GUI application → YARA rules: generates rules
- GUI application → IOC summaries: generates summaries
- GUI application → AI analyzer: requests analysis
- Public search → NVD source: searches CVEs
- Public search → Exploit-DB source: searches exploits
- Public search → Sploitus source: searches exploits
- Public search → GitHub advisories: searches PoCs
- Public search → SQLite records: stores exploits
- NVD source → NVD API: requests data
- GitHub advisories → GitHub Advisories: requests data
- Exploit-DB source → Exploit sources: searches
- Sploitus source → Exploit sources: searches
- AI analyzer → AI model API: sends prompts
- Lab interface → Lab manager: manages targets
- Lab manager → Safety policy: validates target
- Lab manager → SQLite records: records targets
- Lab manager → SQLite records: records results
- Sandbox workflow → Safety policy: checks policy
- Reports interface → Report generator: requests report
- Reports interface → SQLite records: reads records
- Report generator → Remediation: includes guidance
- CVE browser → CVE analysis: requests analysis
- CVE browser → Exploit classifier: classifies exploits