---
name: sources-master
description: "MASTER SOURCE DATABASE — Every reliable source for CVE, exploit, and real-world red team intelligence. The agent consults this when scenarios are incomplete."
---

# RTExit Sources Master Database

> **The agent's library of trusted intelligence sources.** When the local scenarios don't cover a specific case, the agent MUST search these sources before giving up. Save new findings back here for the next agent.

---

## 🚨 CRITICAL RULE FOR AGENTS

**If you cannot find a scenario for a target:**

1. ❌ DO NOT make up a scenario
2. ❌ DO NOT invent a CVE number
3. ❌ DO NOT hallucinate a bounty amount
4. ✅ DO use `WebSearch` to find real sources
5. ✅ DO consult this Sources Master
6. ✅ DO add new sources to this file

---

## Tier 1: Authoritative CVE Sources (100% Trust)

| Source | URL | API | Use |
|--------|-----|-----|-----|
| **NVD (NIST)** | https://nvd.nist.gov/vuln/search | https://services.nvd.nist.gov/rest/json/cves/2.0 | **PRIMARY** — Always verify CVEs here |
| **MITRE CVE** | https://cve.mitre.org | https://cveawg.mitre.org/api/cve/ | Original CVE database |
| **CVE Details** | https://www.cvedetails.com | N/A | Vendor/product CVE browse |
| **Vulners** | https://vulners.com | https://vulners.com/api/v3/ | Searchable CVE corpus |
| **OSV** | https://osv.dev | https://api.osv.dev | Open Source Vulnerabilities |
| **GHSA (GitHub)** | https://github.com/advisories | https://api.github.com/advisories | GitHub Security Advisories |
| **Ubuntu USN** | https://ubuntu.com/security/notices | https://api.launchpad.net/1.0/ | Ubuntu-specific |
| **Red Hat CVE DB** | https://access.redhat.com/security/cve | N/A | RHEL-specific |
| **Debian Security** | https://security-tracker.debian.org | https://security-tracker.debian.org/tracker/data/json | Debian-specific |

**WebSearch queries to use:**
```
CVE-XXXX-XXXXX
site:nvd.nist.gov CVE-XXXX-XXXXX
CVE-XXXX-XXXXX [product]
"vulnerability" "[product]" "[version]"
```

---

## Tier 1: Vendor Security Advisories (100% Trust)

### Major Vendors
| Vendor | URL | Use |
|--------|-----|-----|
| **Microsoft** | https://msrc.microsoft.com/update-guide | Windows, Office, Exchange, etc. |
| **Apple** | https://support.apple.com/en-us/HT201222 | iOS, macOS |
| **Google** | https://source.android.com/docs/security/bulletin | Android |
| **Linux Kernel** | https://lore.kernel.org/linux-security-announce/ | Linux kernel CVEs |
| **Red Hat** | https://access.redhat.com/security/security-updates | RHEL CVEs |
| **Debian** | https://www.debian.org/security/ | Debian security |
| **Ubuntu** | https://ubuntu.com/security/notices | Ubuntu security |
| **SUSE** | https://www.suse.com/security/cve/ | SUSE CVEs |
| **Oracle** | https://www.oracle.com/security-alerts/ | Oracle CVEs |
| **Cisco** | https://tools.cisco.com/security/center/publicationListing | Cisco CVEs |
| **VMware** | https://www.vmware.com/security/advisories.html | VMware CVEs |
| **Fortinet** | https://www.fortiguard.com/psirt | Fortinet PSIRT |
| **Citrix** | https://support.citrix.com/article/CTX267149 | Citrix CVEs |
| **F5** | https://my.f5.com/manage/s/article/K46026907 | F5 CVEs |
| **Palo Alto** | https://security.paloaltonetworks.com/ | Palo Alto CVEs |
| **Atlassian** | https://confluence.atlassian.com/security | Atlassian CVEs |
| **GitLab** | https://about.gitlab.com/security/ | GitLab advisories |
| **Jenkins** | https://www.jenkins.io/security/advisories/ | Jenkins CVEs |
| **WordPress** | https://wordpress.org/news/category/security/ | WP CVEs |
| **Drupal** | https://www.drupal.org/security | Drupal CVEs |
| **Apache** | https://httpd.apache.org/security_report.html | Apache HTTPd |
| **nginx** | http://nginx.org/en/security_advisories.html | nginx CVEs |
| **PHP** | https://www.php.net/security | PHP CVEs |
| **Node.js** | https://nodejs.org/en/security/ | Node.js CVEs |
| **Spring** | https://spring.io/security/ | Spring CVEs |
| **Django** | https://www.djangoproject.com/security/ | Django CVEs |
| **Struts** | https://cwiki.apache.org/confluence/display/WW/Security | Struts CVEs |
| **Solr** | https://lucene.apache.org/solr/security.html | Solr CVEs |
| **Joomla** | https://developer.joomla.org/security-centre.html | Joomla CVEs |
| **Magento** | https://helpx.adobe.com/security/products/magento.html | Magento CVEs |
| **Shopify** | https://help.shopify.com/en/manual/intro-to-shopify/security | Shopify CVEs |

**WebSearch query:**
```
"[vendor]" security advisory CVE-XXXX-XXXXX
site:[vendor-domain] security advisory
```

---

## Tier 1: Bug Bounty Platforms (High Trust)

### HackerOne
| Source | URL | Use |
|--------|-----|-----|
| **Hacktivity (Public)** | https://hackerone.com/hacktivity | **All disclosed reports** |
| **Directory** | https://hackerone.com/directory/all | All programs |
| **API** | https://api.hackerone.com | Programmatic access |

**WebSearch queries:**
```
site:hackerone.com "disclosed" "[vuln-type]"
site:hackerone.com "[company-name]" "[vuln-type]"
HackerOne "[company]" "[vuln]" disclosed
"hackerone.com" "[company]" "$[amount]" severity
```

### Bugcrowd
| Source | URL | Use |
|--------|-----|-----|
| **Disclose** | https://bugcrowd.com/disclose | Disclosed reports |
| **Programs** | https://bugcrowd.com/programs | All programs |

**WebSearch queries:**
```
site:bugcrowd.com "[vuln-type]"
Bugcrowd disclosed "[company]" "[vuln]"
```

### Intigriti
| Source | URL | Use |
|--------|-----|-----|
| **Public programs** | https://app.intigriti.com/programs | Programs |
| **Disclosed** | https://www.intigriti.com/bugbytes | Public reports |

### YesWeHack
| Source | URL | Use |
|--------|-----|-----|
| **Programs** | https://yeswehack.com/programs | Programs |
| **Disclose** | https://github.com/yeswehack | Disclosed reports |

---

## Tier 1: Research & Exploit Databases (High Trust)

| Source | URL | Use |
|--------|-----|-----|
| **Exploit-DB** | https://www.exploit-db.com | **PRIMARY for exploits** |
| **GitHub PoC** | https://github.com/nomi-sec/PoC-in-GitHub | Curated PoC list |
| **Packet Storm** | https://packetstormsecurity.com | Exploits, advisories |
| **0day.today** | https://0day.today | Exploits (verify!) |
| **Metasploit Modules** | https://github.com/rapid7/metasploit-framework/tree/master/modules | All MSF modules |
| **Rapid7 DB** | https://www.rapid7.com/db/ | Vulnerability DB |
| **VulHub** | https://github.com/vulhub/vulhub | Dockerized vulnerable apps |
| **VulnCheck** | https://vulncheck.com/ | Premium CVE/exploit data |
| **AttackerKB** | https://attackerkb.com | Rapid7 community |
| **KEV (CISA)** | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | **Actively exploited CVEs** |

**WebSearch queries:**
```
site:exploit-db.com "[vuln-type]"
github PoC CVE-XXXX-XXXXX
Metasploit module CVE-XXXX-XXXXX
```

---

## Tier 1: Research Labs & Blogs (High Trust)

### Commercial Labs (premium-quality)
| Lab | URL | Specialty |
|-----|-----|-----------|
| **PortSwigger Research** | https://portswigger.net/research | **Web attacks — top tier** |
| **Project Discovery** | https://blog.projectdiscovery.io | Nuclei templates |
| **Assetnote Research** | https://blog.assetnote.io | Bug bounty, recon |
| **NCC Group** | https://research.nccgroup.com | All-around |
| **Trail of Bits** | https://blog.trailofbits.com | Crypto, blockchain, RE |
| **NCC Group Watch** | https://research.nccgroup.com/category/ | Diverse research |
| **Cure53** | https://cure53.de | Web security |
| **Google Project Zero** | https://googleprojectzero.blogspot.com | **Top-tier vuln research** |
| **Google Bug Hunters** | https://bughunters.google.com/blog | Google-specific |
| **Microsoft Research** | https://www.microsoft.com/en-us/research/security/ | Microsoft |
| **Apple Security** | https://support.apple.com/en-us/HT201222 | Apple |
| **GitHub Security** | https://github.blog/security/ | GitHub |
| **Akamai Research** | https://www.akamai.com/security-research | Cloud, CDN |
| **Cloudflare Research** | https://blog.cloudflare.com/tag/security/ | Web, network |
| **Verizon DBIR** | https://www.verizon.com/business/resources/reports/dbir/ | Annual breach report |
| **Mandiant** | https://www.mandiant.com/resources/blog | APT, IR |
| **CrowdStrike Research** | https://www.crowdstrike.com/blog/category/threat-intel/ | APT, TTPs |
| **SophosLabs** | https://news.sophos.com/ | Malware, exploits |
| **Kaspersky** | https://securelist.com/ | Threat intel |
| **Trend Micro** | https://www.trendmicro.com/en_us/research.html | Research |
| **Recorded Future** | https://www.recordedfuture.com/threat-intelligence-101 | Threat intel |

### Independent Researchers (top names)
| Researcher | Blog | Specialty |
|-----------|------|-----------|
| **James Kettle (PortSwigger)** | https://portswigger.net/research | HTTP smuggling, web |
| **Orange Tsai** | https://blog.orange.tw | Web, recon |
| **Dirk-jan Mollema** | https://dirkjanm.io | AD, NTLM |
| **SpecterOps** | https://posts.specterops.io | AD, Azure, M365 |
| **Will Schroeder** | https://www.harmj0y.net | AD, C2 |
| **Lee Christensen** | https://www.youtube.com/c/LeeChristensen | ADCS |
| **Benjamin Delpy** | https://github.com/gentilkiwi | Mimikatz |
| **Tarlogic** | https://www.tarlogic.com/blog/ | AD, exploitation |
| **HackTricks** | https://book.hacktricks.xyz | **Comprehensive pentest wiki** |
| **ired.team** | https://www.ired.team | Red team notes |
| **Pentesterland** | https://pentester.land | Pentest writeups |
| **Yaworsk** | https://blog.yaworsk.me | Bug bounty |
| **Nahamsec** | https://nahamsec.medium.com | Bug bounty |
| **0xTib3rius** | https://0xtib3rius.medium.com | AD, PrivEsc |
| **ippsec** | https://ippsec.rocks | HTB walkthroughs |
| **John Hammond** | https://www.youtube.com/@_JohnHammond | CTF, malware |
| **LiveOverflow** | https://www.youtube.com/@LiveOverflow | RE, exploit dev |
| **IppSec** | https://www.youtube.com/@ippsec | HTB |
| **The Cyber Mentor** | https://www.youtube.com/@TCMSecurityAcademy | Pentest |

**WebSearch queries:**
```
"[researcher]" research "[vuln-type]"
site:portswigger.net research "[topic]"
"James Kettle" "HTTP request smuggling"
"Orange Tsai" "conference talk" [year]
```

---

## Tier 1: Conference Talks (High Trust)

### Top Conferences
| Conference | URL | Talks |
|------------|-----|-------|
| **DEF CON** | https://www.defcon.org | https://media.defcon.org |
| **Black Hat** | https://www.blackhat.com | https://www.blackhat.com/html/archives.html |
| **RSA Conference** | https://www.rsaconference.com | Search by year |
| **HITB** | https://conference.hitb.org | https://conference.hitb.org/hack-in-the-box-security-conference/ |
| **BruCON** | https://brucon.org | https://www.youtube.com/@BruCON |
| **OWASP AppSec** | https://owasp.org/www-pdf-archive/ | https://owasp.org/events/ |
| **NULLCON** | https://nullcon.net | Various |

**WebSearch queries:**
```
"DEF CON" [year] "[vuln-type]" talk
"Black Hat" [year] "[vuln-type]" presentation
site:youtube.com "DEF CON" "[topic]"
```

### Conference Video Archives
- **YouTube** — search "DEF CON [year] [topic]"
- **SecurityTube** — https://www.securitytube.net
- **Iron Geek** — https://www.irongeek.com

---

## Tier 1: Standards Bodies (100% Trust)

| Source | URL | Use |
|--------|-----|-----|
| **OWASP** | https://owasp.org | **Web security standards** |
| **OWASP API Security** | https://owasp.org/API-Security/ | API Top 10 |
| **OWASP ASVS** | https://owasp.org/www-project-application-security-verification-standard/ | Testing checklist |
| **OWASP Testing Guide** | https://owasp.org/www-project-web-security-testing-guide/ | **WSTG v4.2** |
| **OWASP CheatSheets** | https://cheatsheetseries.owasp.org/ | **Implementation cheatsheets** |
| **PTES** | http://www.pentest-standard.org | Pentest methodology |
| **NIST SP 800-115** | https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf | Pentest guide |
| **MITRE ATT&CK** | https://attack.mitre.org | **TTP framework** |
| **MITRE D3FEND** | https://d3fend.mitre.org | Defensive techniques |
| **MITRE CAPEC** | https://capec.mitre.org | Attack patterns |
| **STRIDE** | Microsoft | Threat modeling |
| **PASTA** | OWASP | Threat modeling |
| **PCI-DSS** | https://www.pcisecuritystandards.org | Compliance |
| **ISO 27001** | https://www.iso.org/standard/27001 | Compliance |

**WebSearch queries:**
```
OWASP "API Security Top 10" [year]
OWASP "Testing Guide" "[vuln-type]"
MITRE ATT&CK technique [T-number]
PTES "[methodology-step]"
```

---

## Tier 1: News & Disclosure (Medium-High Trust)

| Source | URL | Use |
|--------|-----|-----|
| **BleepingComputer** | https://www.bleepingcomputer.com | Breaking news |
| **The Hacker News** | https://thehackernews.com | News |
| **Dark Reading** | https://www.darkreading.com | News |
| **SecurityWeek** | https://www.securityweek.com | News |
| **CSO Online** | https://www.csoonline.com | News |
| **Krebs on Security** | https://krebsonsecurity.com | Deep investigations |
| **Schneier on Security** | https://www.schneier.com | Cryptography, security |
| **The Register Security** | https://www.theregister.com/Security/ | News |
| **Threatpost** | https://threatpost.com | News |
| **Help Net Security** | https://www.helpnetsecurity.com | News |
| **GBHackers** | https://gbhackers.com | News |
| **Cyber Security News** | https://cybersecuritynews.com | News |

**WebSearch queries:**
```
"[company]" breach [year] site:bleepingcomputer.com
"[vuln-type]" "[product]" exploit site:thehackernews.com
```

---

## Tier 1: CVSS & Severity (100% Trust)

| Source | URL | Use |
|--------|-----|-----|
| **FIRST CVSS** | https://www.first.org/cvss/calculator/4.0 | **CVSS 4.0 calculator** |
| **CVSS Spec** | https://www.first.org/cvss/v4.0/specification-document | Spec |
| **NVD CVSS** | https://nvd.nist.gov/vuln-metrics/cvss | Official scores |

**Use:** Calculate CVSS 4.0 base score with full vector.

---

## Tier 1: Cloud-Specific (High Trust)

| Source | URL | Use |
|--------|-----|-----|
| **AWS Security Bulletins** | https://aws.amazon.com/security/security-bulletins/ | AWS-specific |
| **AWS Security Blog** | https://aws.amazon.com/blogs/security/ | AWS best practices |
| **Azure Security** | https://msrc.microsoft.com/azure/ | Azure-specific |
| **GCP Security** | https://cloud.google.com/security/bulletins | GCP-specific |
| **Rhino Security Labs** | https://rhinosecuritylabs.com/research/ | **Cloud pentest research** |
| **Cloud Security Alliance** | https://cloudsecurityalliance.org | Standards |
| **PwnedLabs** | https://portal.pwnedlabs.io/ | Cloud training |

---

## Tier 2: Community (Medium Trust — Verify)

| Source | URL | Use |
|--------|-----|-----|
| **Reddit /r/netsec** | https://reddit.com/r/netsec | News, discussion |
| **Hacker News** | https://news.ycombinator.com | Tech news |
| **Twitter/X security** | https://twitter.com/search?q=security | Research updates |
| **Mastodon security** | https://infosec.exchange | Privacy-respecting |

**Researchers to follow on Twitter/X:**
- @PortSwigger
- @jjjkok
- @RootLocal
- @0xTib3rius
- @Harmj0y
- @tifkin
- @RedTeamNews
- @Cneelis
- @pdiscoveryio
- @reznok
- @irsdl
- @pnptn
- @s3c_krd

**Mastodon / infosec.exchange:**
- Same accounts, often more thoughtful discussion

---

## Tier 2: Tools (High Trust for capabilities)

| Tool | URL | Use |
|------|-----|-----|
| **PayloadsAllTheThings** | https://github.com/swisskyrepo/PayloadsAllTheThings | **PRIMARY payload repo** |
| **SecLists** | https://github.com/danielmiessler/SecLists | Wordlists |
| **HackTricks** | https://book.hacktricks.xyz | Pentest wiki |
| **LOLBAS** | https://lolbas-project.github.io/ | Living Off The Land binaries (Windows) |
| **LOLDrivers** | https://www.loldrivers.io/ | Vulnerable drivers |
| **GTFOBins** | https://gtfobins.github.io/ | Living Off The Land (Linux) |
| **WADComs** | https://wadcoms.github.io/ | AD interactive cheatsheet |
| **LOLAD** | https://lolad-project.github.io/ | Living Off The Land (AD) |
| **HackTricks Cheatsheets** | https://cloud.hacktricks.wiki/en/cheatsheets | Cloud cheatsheets |
| **Red Team Resources** | https://github.com/yeyintminthuhtut/Awesome-Red-Teaming | Curated list |
| **Awesome Web Hacking** | https://github.com/infoslack/awesome-web-hacking | Web hacking list |
| **Awesome Bug Bounty** | https://github.com/djadmin/awesome-bug-bounty | Bug bounty list |
| **Awesome Pentest** | https://github.com/enaqx/awesome-pentest | Pentest list |
| **Awesome Hacking** | https://github.com/Hack-with-Github/Awesome-Hacking | General |
| **Awesome Cloud Security** | https://github.com/4ndersonLin/awesome-cloud-security | Cloud |
| **Awesome Kubernetes** | https://github.com/ramitsurana/awesome-kubernetes | K8s |
| **Awesome Container Security** | https://github.com/kai5263499/container-security-awesome | Containers |
| **Awesome OSINT** | https://github.com/jivoi/awesome-osint | OSINT |
| **Awesome Mobile** | https://github.com/vaib25vicky/awesome-mobile-security | Mobile |
| **Awesome AD** | https://github.com/Orange-Cyberdefense/awesome-active-directory | AD |

---

## Tier 3: Historical / Reference (Medium-Low Trust — verify)

| Source | URL | Use |
|--------|-----|-----|
| **Wikipedia (CVE)** | https://en.wikipedia.org/wiki/ | Background info |
| **OWASP Wiki** | https://wiki.owasp.org/ | Historical reference |
| **BugTraq** | http://www.securityfocus.com/archive/1 | Old list |
| **Full Disclosure** | http://seclists.org/fulldisclosure/ | Old list |
| **Mailing lists** | Various | Old-school |

---

## 🔍 HOW TO SEARCH (The 5-Step Method)

When the agent encounters an unknown target or vulnerability:

### Step 1: Identify the Target
- What product? (Apache, WordPress, Spring, etc.)
- What version? (if known)
- What's the surface? (web, API, network, AD, cloud)

### Step 2: Search NVD First (Authoritative)
```bash
# Via WebSearch:
"site:nvd.nist.gov [product] [version]"
# Or directly:
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=apache+tomcat&resultsPerPage=20"
```

### Step 3: Search HackerOne (Real-world)
```bash
"site:hackerone.com [company] [vuln-type]"
"HackerOne disclosed [company] [vuln-type]"
```

### Step 4: Search Research (Deep)
```bash
"site:portswigger.net [topic]"
"PortSwigger [vuln-type] research"
"[researcher] [vuln-type] blog"
```

### Step 5: Search Exploits (Practical)
```bash
"site:github.com PoC CVE-XXXX-XXXXX"
"site:exploit-db.com [product]"
"Metasploit module [vuln-type]"
```

### Step 6: Save to Local
After finding a real source, **add it to `_rtexit-output/data/intel/`**:

```bash
mkdir -p _rtexit-output/data/intel/
# Save the source
echo "CVE-XXXX-XXXXX: [description]
Source: [URL]
Verified: [date]
Exploit: [link]
Notes: [your analysis]
" > _rtexit-output/data/intel/CVE-XXXX-XXXXX.md
```

---

## 📝 SOURCE TEMPLATE

When adding a new source to this file, use this format:

```markdown
### [Source Name]
- **URL:** [link]
- **Type:** [NVD/HackerOne/Blog/Research/Exploit]
- **Trust:** [Tier 1/2/3]
- **Specialty:** [what it's best for]
- **WebSearch Query:** [how to search it]
- **Notes:** [any caveats]
```

---

## 🔄 UPDATE WORKFLOW

When the agent finds a new reliable source:

1. **Verify** — check it's a real, accessible source
2. **Document** — use the template above
3. **Save** — add it to this file in the right category
4. **Commit** — the change should be visible to other agents

**This file grows with the community.**

---

## Quick Reference Card (Copy-Paste for WebSearch)

```
NVD:           site:nvd.nist.gov [search-term]
HackerOne:     site:hackerone.com [company] [vuln]
Bugcrowd:      site:bugcrowd.com [vuln]
Exploit-DB:    site:exploit-db.com [product]
PortSwigger:   site:portswigger.net [topic]
GitHub PoC:    site:github.com PoC [CVE-num]
Metasploit:    "Metasploit" [CVE-num]
CISA KEV:      site:cisa.gov KEV [CVE-num]
OWASP:         site:owasp.org [topic]
MITRE:         site:attack.mitre.org [technique]
Vendor:        site:[vendor-domain] security [CVE-num]
NVD API:       https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-XXXX-XXXXX
```

---

## 🆘 Emergency: When Nothing Works

If after all the above, you still can't find a real source:

1. **Check if it's a real scenario** — maybe the user is asking about a non-issue
2. **Escalate to user** — explain what you searched, what you found
3. **Suggest manual testing** — if appropriate
4. **NEVER hallucinate** — better to say "I cannot find a real source" than make one up

```bash
# Example response:
"I searched NVD, HackerOne, PortSwigger, and GitHub for [topic] but cannot find a real public disclosure. The technique may be from internal research or a private engagement. Would you like me to:
1. Help you test for it manually?
2. Search for related CVEs?
3. Check if there's a similar technique documented elsewhere?"
```
