Jenderal92/livewire-vuln-scanner

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 script that passively scans websites for Livewire versions by inspecting HTML/JavaScript content and flags targets running versions below 3.6.4 as vulnerable. It does not exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python 2.7 script that passively scans websites for Livewire versions and flags those below 3.6.4 as vulnerable. It performs only HTTP GET requests to user-supplied targets, extracts version strings from responses, and writes vulnerable domains to a local file. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed source code or documentation.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareLivewire
Attack typesCWE-94: Improper Control of Generation of Code ('Code Injection')
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The README explicitly states the tool 'does not exploit any vulnerability' and only analyzes public page content to detect versions. The code performs HTTP GET requests and version comparison without any payload delivery or command execution, consistent with a scanner.

README.md:6-8livewire_scan.py:67-91

Requirements

  • A list of target URLs in a text file.livewire_scan.py:98-100

Observed behavior

  • Fetches the homepage of each target URL via HTTP GET.livewire_scan.py:67-73
  • Searches the response body for Livewire version strings using regular expressions.livewire_scan.py:77-80
  • Compares the detected version against 3.6.4 and prints VULN or SAFE.livewire_scan.py:82-91
  • Writes domains identified as vulnerable to vuln.txt.livewire_scan.py:85-87
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
HTTP GET requests to user-supplied URLs with a static User-Agent headerThe script fetches page content to detect Livewire versions; no data exfiltration or command-and-control communication is implemented.livewire_scan.py:67-73
File Write
Writes vulnerable domains to 'vuln.txt'Output is a simple list of domains matching the version condition; no executable payload or persistence mechanism is written.livewire_scan.py:85-87
Review boundaries

What the analysis did not establish

  • Only the two text files in the repository snapshot were reviewed; no binary or non-text files were present.
  • The review does not assess the safety of the external link in the README disclaimer (line 100).
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1