Every vector is unique, what makes it unique is its HASH which is calculated using a combination of:
Multiple vectors can have the same name, and tags, but the ‘Exploit demo URL’ and IP & port are unique to each vector.
We found out that a considerable amount of assets is behind some kind of mechanism that rotates IPs. Rotating IPs is a common practice, it is done for security, load balancing or other purposes, resulting in a different IP address and a duplication of vectors problem. To combat this issue, we slightly changed the vectors' hash to exclude the IP & port. By doing this, we keep the unique part of the vector, the ‘Exploit demo URL' in the HASH and eliminate the issue of a single vector having multiple IPs.
The logic works like this: when the scanner finds a vector, it adds up its name, tags, and exploit demo URL to create a hash, this hash is the VectorID, it then checks whether the VectorID exists in the database, i.e., whether it is unique. If it is, it creates a new vector, if it isn’t it updates the ‘Last seen’ date of the vector.
.png)
