Development of Tools for Automatic Collection of Vulnerability Information

In recent years, cyberattacks have become increasingly sophisticated, particularly in the reconnaissance phase where attackers gather detailed information to identify and exploit vulnerabilities. This study presents an automated vulnerability information collection tool that integrates multiple external resources—Censys, Maltego, gobuster, and the National Vulnerability Database (NVD). The tool provides two main functions: Attack Surface Management (ASM) and vulnerability assessment support, and visualizes collected data using Maltego. The ASM function retrieves OS and software information from a target IP address and identifies known vulnerabilities, while the assessment function discovers subdomains and directories. The tool is evaluated using a Raspberry Pi 4 Model B configured with known vulnerabilities, representing a class of lightweight IoT devices. Additional tests on external websites also confirmed its effectiveness, suggesting the tool's applicability to both conventional servers and IoT environments.