<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Red Team Validation — API Reference

## Nuclei CLI

```bash
# Validate specific CVE
nuclei -u https://target -t cves/2024/CVE-2024-6387.yaml -json

# Batch validate from target list
nuclei -l targets.txt -t cves/ -severity critical,high -json -o results.json

# Rate-limited safe validation
nuclei -l targets.txt -t cves/ -rate-limit 10 -bulk-size 5 -concurrency 2

# Validate with custom templates
nuclei -l targets.txt -t custom-templates/ -json -o custom_results.json

# Update templates
nuclei -ut
```

## Metasploit Framework

```bash
# SSH version scanning
msfconsole -q -x "use auxiliary/scanner/ssh/ssh_version; set RHOSTS TARGET; run; exit"

# SMB vulnerability check (EternalBlue)
msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17_010; set RHOSTS TARGET; run; exit"

# HTTP vulnerability scanning
msfconsole -q -x "use auxiliary/scanner/http/apache_log4j; set RHOSTS TARGET; set RPORT 8080; run; exit"

# Resource script for batch validation
msfconsole -q -r validation_script.rc

# Database integration
msfconsole -q -x "db_connect user:pass@localhost/msf; workspace validation; db_nmap -sV TARGET; vulns; exit"
```

## Nmap NSE Scripts

```bash
# Vulnerability scanning with NSE
nmap --script vuln -sV TARGET -oA vuln_scan

# Specific vulnerability check
nmap --script smb-vuln-ms17-010 -p445 TARGET

# SSL/TLS vulnerability check
nmap --script ssl-enum-ciphers,ssl-heartbleed -p443 TARGET

# HTTP vulnerability checks
nmap --script http-vuln* -p80,443,8080 TARGET
```

## Evidence Collection

```bash
# Network capture
tcpdump -i eth0 -w evidence.pcap host TARGET

# Session recording
script -t timing.log session.log

# Screenshot capture
chromium --headless --screenshot=evidence.png "https://target"

# curl with full response
curl -sk -v "https://target/vulnerable_endpoint" 2>&1 | tee evidence.txt
```

## Validation Status Reference

| Status | Description | Action |
|--------|-------------|--------|
| `confirmed` | Exploitation successful | Priority remediation |
| `false_positive` | Not exploitable | Suppress in scanner |
| `inconclusive` | Could not confirm | Manual investigation |
| `partially_validated` | Version confirmed, exploit blocked | Assess compensating controls |
