I was planning to do a blog post in about a month's time. The DC4420 meetings and/or talks are not recorded (luckily!), but I intend to polish the talk up for a future re-run.

On the other hand.. I do have something that might be enough to get you going. The setup we built is open: https://github.com/smarkets/vuln-scanner - go have a look.

The glue code has comments on some of the stranger bugs I had to work around. So does the readme. If something isn't clear, feel free to ask.