FourIsNotRandom

Detection-only CLI (fourisnotrandom) that fingerprints software versions and TLS/CA configuration to report exposure to a small set of currently relevant advisories.

This tool performs read-only version/fingerprint checks only. It does not exploit, does not send attack payloads, and must only be run against systems you own or are authorized to assess.

What it checks

No CIDR sweeps: every run requires an explicit host, URL, path, image name, or a targets file of discrete entries.

Install

python -m pip install -U pip
pip install -e ".[dev]"
fourisnotrandom --help

Auditing this tool's own dependencies

Run pip-audit against the pinned requirements file - not bare pip-audit:

pip-audit -r requirements.txt

A bare pip-audit run audits your entire environment and will also flag the venv's bootstrap pip package, which is unrelated to this tool's dependencies. Use pip-audit -r requirements.txt so findings reflect only what this project declares.

Usage

# PHP
fourisnotrandom php --local
fourisnotrandom php --local --php-bin /usr/bin/php8.3
fourisnotrandom php --url https://example.com/
fourisnotrandom php --fs /var/www/html

# eMudhra / toolchains
fourisnotrandom emudhra --host example.com
fourisnotrandom emudhra --path /etc/ssl/certs
fourisnotrandom emudhra --docker my-image:tag
fourisnotrandom emudhra --toolchains

# GitLab (both CVSS 10.0 CVEs evaluated separately)
fourisnotrandom gitlab --url https://gitlab.example.com

# LiteLLM exact compromised pin
fourisnotrandom litellm --env
fourisnotrandom litellm --path .
fourisnotrandom litellm --docker ghcr.io/berriai/litellm:v1.107.0

# Explicit target list only (global flags before the subcommand)
fourisnotrandom --format json all --targets-file targets.txt
fourisnotrandom --format json emudhra toolchains

Exit codes: 0 = no FAIL, 1 = at least one FAIL, 2 = tool/config error.

Advisory data (editable)

Bundled under src/fourisnotrandom/data/:

Data provenance

• PHP floors: PHP project security releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches ≤8.1 have no upstream fix.
• GitLab: Official critical patch notes for CVE-2026-110264 (Oct 21) and CVE-2026-97229 (Oct 12). Both are reported separately so an Oct-12-only patch does not look “fully covered.”
• eMudhra hashes: Certificate SHA-256 fingerprints from Cisco Talos “Compromised eMudhra intermediate certificates” (Oct 21, 2026), citing Mozilla Bugzilla 2083449. The scanner matches either full-cert SHA-256 or SPKI SHA-256 against the configured set (Talos publishes cert fingerprints; Go’s CVE-2026-111943 fix matches SPKI - dual match avoids assuming hash type after a refresh).
• certifi: Floor 2026.10.18 (first release blocking compromised roots). 2026.10.19 restores some legitimate emSign roots (stability), not a security boundary.
• Go: Fixed in 1.27.3 / 1.26.10 (CVE-2026-111943).
• LiteLLM: Exact malicious PyPI/Docker release 1.107.0 only.

# Refresh eMudhra hash list from a JSON file with the same schema
fourisnotrandom update-hashes --from ./my-hashes.json

Safety

Read-only / authorized use only. This tool fingerprints versions and TLS/CA material. It does not exploit, does not send attack payloads, and must only be run against systems you own or are authorized to assess.

• Fingerprints only: versions, headers, banners, cert digests, read-only php.ini values.
• Does not send session.upload_progress exploits, memory-corruption probes, or any PoC payloads.
• Does not scan networks you did not name explicitly.
• Rejects CIDR ranges and bare wildcards - every target must be an explicit host, URL, or path.