What are all hostnames that CLI tool reaches out to on the internet?

[alan-czajkowski]

trafficstars

I have internet completely blocked at my organization, but I am able to whitelist certain hostnames.

What are all hostnames that CLI tool reaches out to on the internet?

[alan-czajkowski]

@jeremylong is this information documented somewhere?

[jeremylong]

I don't think it is "documented" anywhere but the source code. Luckily - just look for URLs in https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/resources/dependencycheck.properties

There aren't that many.

[OrangeDog]

The actual nvd.api.datafeed.url is not currently in that file.

[jeremylong]

The nvd.api.datafeed.url isn't used unless you specifically set it.

[OrangeDog]

But the tool still talks to the API at the default location, which isn't listed in that file.