NexposeRunner 0.0.1

checksums.yaml

@@ -0,0 +1,15 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: !binary |-
+    NzBmMTJkNzgzNDFmNDgzZDY1ZmNmZDdmZGIyM2I4Mzk4ZWU2NjcxNQ==
+  data.tar.gz: !binary |-
+    MTM0OTI1YWVlZWZiZGIzZTBlYjE2OWE5YzE2ZWYwODA3YWQ2M2NjYg==
+SHA512:
+  metadata.gz: !binary |-
+    ZDE3NjZkNjljNTNmZTkzMTQ0ODA4MDcyZjZmN2E5M2FhNGQyMDFiODdhN2Zm
+    OWFhMjQ3ZTMxYmJjN2ZhMzc5ZDZjNDcxOTRiNTQ2Y2M2NTczMTg1ZDk5Y2Zm
+    NjI1NzA3NzRiZGVjYjQ5MGVlOWM5MzZmMzE3NDg4NmY1MzllMjU=
+  data.tar.gz: !binary |-
+    NGM5NDY2MjA2ZTE1NzMxNDFkYmM0MjE2NDdhNzQwNjc1MjI5NjM3OWE0ZmRj
+    YWQxNDUxODZmN2NiZDcwNDVjMzczMjVmMTI1NjEzODA2YWVkMzkzMGNjNDk0
+    ZmRiMGE0Mjg1NDM5MDZhYjQ3ZjY2Zjc4MTAyY2QzZDk3NDc4MWI=

data/.gitignore

@@ -0,0 +1,23 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp
+*.bundle
+*.so
+*.o
+*.a
+mkmf.log
+.idea/

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format documentation

data/.travis.yml

@@ -0,0 +1,14 @@
+language: ruby
+rvm:
+- 2.0.0
+- 1.9.3
+- jruby-19mode
+- rbx-2
+deploy:
+  provider: rubygems
+  api_key:
+    secure: TPDSN4fEjEmyZdNz9kEtzTxqR45q3IZPjj5Zw/2TEoYjQEAor/reMvc0x5Zz2OWFLUTw5P7cF7SHepNR2KNFJ0JLs4XYUPRdxryTziDktQ8Q6WDuq892fhuo9cLRAevL8KyAUlvyZiYRqfw6JefvxGXZoGfwCMlXerNX7sh/qig=
+  gem: nexpose-runner
+  on:
+    tags: true
+    repo: amngibson/nexpose-runner

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in NexposeRunner-scan.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2014 Nathan Gibson
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/NexposeRunner.gemspec

@@ -0,0 +1,26 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'NexposeRunner/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'NexposeRunner'
+  spec.version       = NexposeRunner::VERSION
+  spec.authors       = ['Nathan Gibson']
+  spec.email         = ['amngibson@gmail.com']
+  spec.summary       = 'This is a gem that provides the ability to create a new site, add an IP to the site, and perform a scan against the site using a defined/passed scan template, and finally produce a reports for vulnerabilities, installed software, and policy compliance.'
+  spec.description   = ''
+  spec.homepage      = ''
+  spec.license       = 'MIT'
+
+  spec.files         = `git ls-files -z`.split("\x0")
+  spec.executables   = %w(scan)
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'nexpose', '0.8.3'
+
+  spec.add_development_dependency 'bundler', '~> 1.6'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'rspec', '3.0.0'
+end

data/README.md

@@ -0,0 +1,42 @@
+# NexposeRunner::Scan
+
+This is a ruby gem that basically wraps the nexpose-client gem. It was primarily created to automate scanning and reporting of dynamic hosts. 
+
+This gem will make a nexpose server connection, create a new site, initiate a scan against the assets in the site, and generate a vulnerability report, software report, and policy compliance report. 
+
+Basically this gem allows you to attach Nexpose to your Continuous Delivery/Continuous Integration pipeline. Though it can be used for other purposes.
+
+At the end of the scan it will generate 3 csv reports and save them in the directory where the script was executed from. It will also raise an exception if a vulnerbaility is detected. This is used to break the Continuous Delivery/Continuous integration build.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'nexpose-runner'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install nexpose-runner
+
+## Usage
+
+This gem allows you to specify the Nexpose Server URL, Nexpose Username, Nexpose Password, Nexpose Server Port (optional, defaults to 3780), Site Name, Target IP Address, and a Scan Template.
+
+
+    $ scan "connection_url" "username" "password" "port" "site_name" "ip_address" "scan_template"
+    
+EXAMPLE:
+
+    $ scan "http://test.connection" "rapid7" "password" "3780" "my_cool_software_build-28" "10.5.0.15" "full-audit-widget-corp"
+
+## Contributing
+
+1. Fork it ( https://github.com/[my-github-username]/nexpose-scan/fork )
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create a new Pull Request

data/Rakefile

@@ -0,0 +1,6 @@
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/scan

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+
+require 'nexpose-runner/scan'
+
+$stdout.sync = true
+NexposeRunner::Scan.start ARGV[0], ARGV[1], ARGV[2], ARGV[3], ARGV[4], ARGV[5], ARGV[6]

data/lib/NexposeRunner/version.rb

@@ -0,0 +1,4 @@
+module NexposeRunner
+    VERSION = '0.0.1'
+  end
+

data/lib/NexposeRunner.rb

@@ -0,0 +1,5 @@
+require 'NexposeScan/version'
+
+module NexposeScan
+  # Your code goes here...
+end

data/lib/nexpose-runner/constants.rb

@@ -0,0 +1,64 @@
+module CONSTANTS
+  REQUIRED_CONNECTION_URL_MESSAGE = 'OOPS! Looks like you forgot to give me the URL/IP address to your Nexpose Server'
+  REQUIRED_USERNAME_MESSAGE = 'OOPS! Looks like you forgot to give me a username to login to Nexpose with'
+  REQUIRED_PASSWORD_MESSAGE = 'OOPS! Looks like you forgot to give me a password to login to Nexpose with'
+  REQUIRED_SITE_NAME_MESSAGE = 'OOPS! Looks like you forgot to give me a Nexpose Site Name'
+  REQUIRED_IP_ADDRESS_MESSAGE = 'OOPS! Looks like you forgot to give me an IP Address to scan'
+  REQUIRED_SCAN_TEMPLATE_MESSAGE = 'OOPS! Looks like you forgot to give me a Scan Template to use'
+  VULNERABILITY_FOUND_MESSAGE = '---------All YOUR BASE ARE BELONG TO US---------------\nVulnerabilities were found, breaking build'
+  DEFAULT_PORT = '3780'
+  VULNERABILITY_REPORT_NAME = 'nexpose-vulnerability-report.csv'
+  SOFTWARE_REPORT_NAME = 'nexpose-software-report.csv'
+  POLICY_REPORT_NAME = 'nexpose-policy-report.csv'
+
+  VULNERABILITY_REPORT_QUERY = 'SELECT DISTINCT
+                                  ip_address,
+                                  title,
+                                  date_published,
+                                  severity,
+                                  summary,
+                                  fix
+                                FROM fact_asset_scan_vulnerability_finding
+                                JOIN dim_asset USING (asset_id)
+                                JOIN dim_vulnerability USING (vulnerability_id)
+                                JOIN dim_vulnerability_solution USING (vulnerability_id)
+                                JOIN dim_solution_highest_supercedence USING (solution_id)
+                                JOIN dim_solution ds ON superceding_solution_id = ds.solution_id'
+
+  SOFTWARE_REPORT_QUERY = 'SELECT
+                             dsi.name,
+                             da.ip_address,
+                             da.host_name,
+                             dos.description,
+                             dht.description,
+                             ds.vendor,
+                             ds.name,
+                             ds.version
+                           FROM dim_asset da
+                           JOIN dim_operating_system dos USING (operating_system_id)
+                           JOIN dim_host_type dht USING (host_type_id)
+                           JOIN dim_asset_software das USING (asset_id)
+                           JOIN dim_software ds USING (software_id)
+                           JOIN dim_site_asset dsa USING (asset_id)
+                           JOIN dim_site dsi USING (site_id)
+                           ORDER BY
+                            da.ip_address,
+                            ds.vendor,
+                            ds.name'
+
+  POLICY_REPORT_QUERY = 'SELECT
+                           fapr.compliance,
+                           dpr.title,
+                           dpr.description,
+                           da.ip_address,
+                           dp.title,
+                           dp.benchmark_name,
+                           dp.category,
+                           dpr.scope,
+                           fapr.proof
+                         FROM fact_asset_policy_rule fapr
+                         LEFT JOIN dim_policy dp on dp.policy_id = fapr.policy_id
+                         LEFT JOIN dim_policy_rule dpr on dpr.policy_id = fapr.policy_id and fapr.rule_id = dpr.rule_id
+                         LEFT JOIN dim_asset da on da.asset_id = fapr.asset_id
+                         ORDER BY da.ip_address'
+end

data/lib/nexpose-runner/scan.rb

@@ -0,0 +1,91 @@
+require 'nexpose'
+require 'csv'
+require 'nexpose-runner/constants'
+require 'nexpose-runner/scan_run_description'
+
+
+module NexposeRunner
+  module Scan
+    def Scan.start(connection_url, username, password, port, site_name, ip_address, scan_template)
+
+      run_details = ScanRunDescription.new connection_url, username, password, port, site_name, ip_address, scan_template
+      run_details.verify
+
+      nsc = get_new_nexpose_connection(run_details)
+
+      site = create_site(run_details, nsc)
+
+      start_scan(nsc, site, run_details)
+
+      reports = generate_reports(nsc, site, run_details)
+
+      verify_run(reports[0])
+    end
+
+    def self.generate_reports(nsc, site, run_details)
+      puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Report"
+      vulnerbilities = generate_report(CONSTANTS::VULNERABILITY_REPORT_QUERY, site.id, nsc)
+      generate_csv(vulnerbilities, CONSTANTS::VULNERABILITY_REPORT_NAME)
+
+      puts "Scan complete for #{run_details.site_name}, Generating Software Report"
+      software = generate_report(CONSTANTS::SOFTWARE_REPORT_QUERY, site.id, nsc)
+      generate_csv(software, CONSTANTS::SOFTWARE_REPORT_NAME)
+
+      puts "Scan complete for #{run_details.site_name}, Generating Policy Report"
+      policies = generate_report(CONSTANTS::POLICY_REPORT_QUERY, site.id, nsc)
+      generate_csv(policies, CONSTANTS::POLICY_REPORT_NAME)
+
+      [vulnerbilities, software, policies]
+    end
+
+    def self.verify_run(vulnerabilities)
+      raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE if vulnerabilities.count > 0
+    end
+
+    def self.start_scan(nsc, site, run_details)
+
+      puts "Starting scan for #{run_details.site_name} using the #{run_details.scan_template} scan template"
+      scan = site.scan nsc
+
+      begin
+        sleep(3)
+        status = nsc.scan_status(scan.id)
+        puts "Current #{run_details.site_name} scan status: #{status.to_s}"
+      end while status == Nexpose::Scan::Status::RUNNING
+    end
+
+    def self.create_site(run_details, nsc)
+      puts "Creating a nexpose site named #{run_details.site_name}"
+      site = Nexpose::Site.new run_details.site_name, run_details.scan_template
+      site.add_ip run_details.ip_address
+      site.save nsc
+      puts "Created site #{run_details.site_name} successfully with the following host #{run_details.ip_address}"
+      site
+    end
+
+    def self.get_new_nexpose_connection(run_details)
+      nsc = Nexpose::Connection.new run_details.connection_url, run_details.username, run_details.password, run_details.port
+      nsc.login
+      puts 'Successfully logged into the Nexpose Server'
+      nsc
+    end
+
+    def self.generate_report(sql, site, nsc)
+      report = Nexpose::AdhocReportConfig.new(nil, 'sql')
+      report.add_filter('version', '1.3.0')
+      report.add_filter('query', sql)
+      report.add_filter('site', site)
+      report_output = report.generate(nsc)
+      CSV.parse(report_output.chomp, {:headers => :first_row})
+    end
+
+    def self.generate_csv(csv_output, name)
+      CSV.open(name, 'w') do |csv_file|
+        csv_file << csv_output.headers
+        csv_output.each do |row|
+          csv_file << row
+        end
+      end
+    end
+  end
+end

data/lib/nexpose-runner/scan_run_description.rb

@@ -0,0 +1,36 @@
+class ScanRunDescription
+  attr_accessor :connection_url, :username, :password, :port, :site_name, :ip_address, :scan_template
+  @@port_value = ''
+
+
+  def initialize(connection_url, username, password, port, site_name, ip_address, scan_template)
+    self.connection_url = connection_url
+    self.username = username
+    self.password = password
+    @@port_value = port
+    self.site_name = site_name
+    self.ip_address = ip_address
+    self.scan_template = scan_template
+  end
+
+  def verify
+    raise StandardError, CONSTANTS::REQUIRED_CONNECTION_URL_MESSAGE if connection_url.nil? || connection_url.empty?
+    raise StandardError, CONSTANTS::REQUIRED_USERNAME_MESSAGE if username.nil? || username.empty?
+    raise StandardError, CONSTANTS::REQUIRED_PASSWORD_MESSAGE if password.nil? || password.empty?
+    raise StandardError, CONSTANTS::REQUIRED_SITE_NAME_MESSAGE if site_name.nil? || site_name.empty?
+    raise StandardError, CONSTANTS::REQUIRED_IP_ADDRESS_MESSAGE if ip_address.nil? || ip_address.empty?
+    raise StandardError, CONSTANTS::REQUIRED_SCAN_TEMPLATE_MESSAGE if scan_template.nil? || scan_template.empty?
+  end
+
+  def port=(value)
+    @@port_value = value
+  end
+
+  def port
+    get_value(@@port_value, CONSTANTS::DEFAULT_PORT)
+  end
+
+  def get_value(value_to_check, default)
+    (value_to_check.nil? || value_to_check.empty?) ? default : value_to_check
+  end
+end

data/spec/scan_spec.rb

@@ -0,0 +1,279 @@
+require 'nexpose-runner/scan'
+require 'nexpose-runner/constants'
+
+describe 'nexpose-runner' do
+  before(:each) do
+    allow(NexposeRunner::Scan).to receive(:sleep)
+  end
+
+  describe 'scan' do
+    before(:each) do
+      @expected_connection = 'http://test.connection'
+      @expected_username = 'rapid7'
+      @expected_password = 'password'
+      @expected_port = '3781'
+      @expected_site_name = 'my_cool_software_build-28'
+      @expected_ip = '10.5.0.15'
+      @expected_scan_template = 'full-audit-widget-corp'
+      @mock_scan_id = '12'
+      @mock_site_id = '1'
+
+      @mock_no_vuln_report = 'ip_address,title,date_published,severity,summary,fix'
+      @mock_vuln_report = 'ip_address,title,date_published,severity,summary,fix
+                            172.31.32.180,Database Open Access,2010-01-01,Severe,Restrict database access,<p><p>Configure the database server to only allow access to trusted systems. For example, the PCI DSS standard requires you to place the database in an internal network zone, segregated from the DMZ </p></p>
+                            172.31.32.180,MySQL Obsolete Version,2007-07-25,Critical,Upgrade to the latest version of Oracle MySQL,<p>Download and apply the upgrade from: <a href=http://dev.mysql.com/downloads/mysql>http://dev.mysql.com/downloads/mysql</a></p>'.chomp
+
+      @mock_software_report = 'name,ip_address,host_name,description,description,vendor,name,version
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,MAKEDEV,3.24-6.el6
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,acl,2.2.49-6.el6
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,acpid,1.0.10-2.1.el6
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,attr,2.4.44-7.el6
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,audit,2.2-4.el6_5
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,audit-libs,2.2-4.el6_5
+                              my_cool_software_build-28,10.5.0.15,,CentOS Linux 6.5,Virtual Machine,Linux,authconfig,6.1.12-13.el6'.chomp
+
+      @mock_policy_report = 'compliance,title,description,ip_address,title,benchmark_name,category,scope,proof
+                            false,Create Separate Partition for /tmp,The /tmp directory is a world-writable directory used for temporary storage by all users and some applications.,10.0.39.104,CIS CentOS 6 CentOS Level 1,centos_6_benchmark,Custom Policies,Custom,"Based on the following 2 results: * Based on the following 1 results: * * At least one specified RPM Package Information entry must match the given criteria. At least one evaluation must pass.<Table TableTitle=""""><tr RowTitle="""">centos-releasePASS * * At least one specified Text File Content entry must match the given criteria. At least one evaluation must pass.<Table TableTitle=""""><tr RowTitle=""Path:/etc/fstab	Pattern:^[\s]*[\S][\s]([\S])[\s][\S][\s][\S][\s][\S][\s][\S]$"">/etc/fstab<Table TableTitle=""""><tr RowTitle="""">Pattern:^[\s]*[\S][\s]([\S])[\s][\S][\s][\S][\s][\S][\s][\S]$<td width=""40"">FAIL<Table TableTitle=""""><tr RowTitle="""">Pattern:^[\s]*[\S][\s]([\S])[\s][\S][\s][\S][\s][\S][\s][\S]$<td width=""40"">FAIL<Table TableTitle=""""><tr RowTitle="""">Pattern:^[\s]*[\S][\s]([\S])[\s][\S][\s][\S][\s][\S][\s][\S]$<td width=""40"">FAIL<Table TableTitle=""""><tr RowTitle="""">Pattern:^[\s]*[\S][\s]([\S])[\s][\S][\s][\S][\s][\S][\s][\S]$<td width=""40"">FAIL<Table TableTitle=""""><tr RowTitle="""">Pattern:^[\s]*[\S][\s]([\S])[\s][\S][\s][\S][\s][\S][\s][\S]$<td width=""40"">FAIL"
+                            false,Set nodev option for /tmp Partition,The nodev mount option specifies that the filesystem cannot contain special devices.,10.0.39.104,CIS CentOS 6 CentOS Level 1,centos_6_benchmark,Custom Policies,Custom,"Based on the following 2 results: * Based on the following 1 results: * * At least one specified RPM Package Information entry must match the given criteria. At least one evaluation must pass.<Table TableTitle=""""><tr RowTitle="""">centos-releasePASS * * At least one specified Text File Content entry must match the given criteria. At least one evaluation must pass.<Table TableTitle=""""><tr RowTitle="""">The specified Text File Content entry was not found based on given criteria."
+                            '.chomp
+
+
+      @mock_scan = get_mock_scan
+      @mock_nexpose_client = get_mock_nexpose_client
+      @mock_nexpose_site = get_mock_nexpose_site
+      @mock_report = get_mock_report
+    end
+
+      it 'should create a session with the nexpose server' do
+        expect(Nexpose::Connection).to receive(:new)
+                                    .with(@expected_connection, @expected_username, @expected_password, @expected_port)
+                                    .and_return(@mock_nexpose_client)
+
+        expect(@mock_nexpose_client).to receive(:login)
+                                    .and_return(true)
+
+        NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+      end
+
+      it 'should throw an error if no connection url is passed' do
+        expect { NexposeRunner::Scan.start('', @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me the URL/IP address to your Nexpose Server')
+        expect { NexposeRunner::Scan.start(nil, @expected_port, @expected_username, @expected_password, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me the URL/IP address to your Nexpose Server')
+      end
+
+      it 'should throw an error if no username is passed' do
+        expect { NexposeRunner::Scan.start(@expected_connection, '', @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a username to login to Nexpose with')
+        expect { NexposeRunner::Scan.start(@expected_connection, nil, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a username to login to Nexpose with')
+      end
+
+      it 'should throw an error if no password is passed' do
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, '', @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a password to login to Nexpose with')
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, nil, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a password to login to Nexpose with')
+      end
+
+      it 'should throw an error if no site name is passed' do
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, '', @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Nexpose Site Name')
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, nil, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Nexpose Site Name')
+      end
+
+      it 'should throw an error if no ip address is passed' do
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, '', @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me an IP Address to scan')
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, nil, @expected_scan_template) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me an IP Address to scan')
+      end
+
+      it 'should throw an error if no scan template is passed' do
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, '') }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Scan Template to use')
+        expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, nil) }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Scan Template to use')
+      end
+
+      it 'should use 3780 as default if port is empty string' do
+        expect(Nexpose::Connection).to receive(:new)
+                                       .with(@expected_connection, @expected_username, @expected_password, '3780')
+                                       .and_return(@mock_nexpose_client)
+
+        NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, '', @expected_site_name, @expected_ip, @expected_scan_template)
+      end
+
+      it 'should create a new Nexpose site with the supplied site name and scan template' do
+        expect(Nexpose::Site).to receive(:new)
+                                       .with(@expected_site_name, @expected_scan_template)
+                                       .and_return(@mock_nexpose_site)
+
+        NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+      end
+
+      it 'should add the supplied ip address to the newly created site' do
+        expect(@mock_nexpose_site).to receive(:add_ip)
+                                .with(@expected_ip)
+
+        NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+      end
+
+      it 'should save the new site configuration' do
+        expect(@mock_nexpose_site).to receive(:save)
+                                      .with(@mock_nexpose_client)
+
+        NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+      end
+
+      it 'should initiate a scan' do
+        expect(@mock_nexpose_site).to receive(:scan)
+                                      .with(@mock_nexpose_client)
+                                      .and_return(@mock_scan)
+
+        NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+      end
+
+      describe 'wait for the Nexpose Scan to complete' do
+        it 'should call to check the status of the scan' do
+          expect(@mock_nexpose_client).to receive(:scan_status).with(@mock_scan_id)
+  
+          NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+        end
+  
+        it 'should call to check the status until it is not running' do
+          expect(@mock_nexpose_client).to receive(:scan_status)
+                                      .with(@mock_scan_id)
+                                      .and_return(Nexpose::Scan::Status::RUNNING)
+                                      .exactly(3).times
+                                      .ordered
+  
+          expect(@mock_nexpose_client).to receive(:scan_status)
+                                      .with(@mock_scan_id)
+                                      .and_return(Nexpose::Scan::Status::FINISHED)
+                                      .once
+                                      .ordered
+  
+          NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+        end
+  
+        it 'should sleep for 3 seconds if the status is still running' do
+          expect(@mock_nexpose_client).to receive(:scan_status)
+                                      .with(@mock_scan_id)
+                                      .and_return(Nexpose::Scan::Status::RUNNING)
+                                      .exactly(3).times
+                                      .ordered
+  
+          expect(@mock_nexpose_client).to receive(:scan_status)
+                                      .with(@mock_scan_id)
+                                      .and_return(Nexpose::Scan::Status::FINISHED)
+                                      .once
+                                      .ordered
+
+          expect(NexposeRunner::Scan).to receive(:sleep).with(3).exactly(4).times
+  
+          NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template)
+        end
+      end
+
+      describe 'it should create reports' do
+      it 'should generate, download, and parse an adhoc reports for Vulnerability, Software, and Policies' do
+        expect(Nexpose::AdhocReportConfig).to receive(:new)
+                                                .with(nil, 'sql')
+                                                .and_return(@mock_report)
+
+          expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
+          expect_report_to_be_called_with(CONSTANTS::SOFTWARE_REPORT_NAME, CONSTANTS::SOFTWARE_REPORT_QUERY, @mock_software_report)
+          expect_report_to_be_called_with(CONSTANTS::POLICY_REPORT_NAME, CONSTANTS::POLICY_REPORT_QUERY, @mock_policy_report)
+
+          expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
+      end
+    end
+
+      it 'should throw exception if vulnerability exists' do
+      expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
+
+      expect { NexposeRunner::Scan.start(@expected_connection, @expected_username, @expected_password, @expected_port, @expected_site_name, @expected_ip, @expected_scan_template) }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
+    end
+  end
+end
+
+def expect_report_to_be_called_with(report_name, report_query, report_response)
+  expect(@mock_report).to receive(:add_filter)
+                          .with('version', '1.3.0')
+
+  expect(@mock_report).to receive(:add_filter)
+                          .with('query', report_query).ordered
+
+  expect(@mock_report).to receive(:add_filter)
+                          .with('site', @mock_site_id)
+
+  expect(@mock_report).to receive(:generate).with(@mock_nexpose_client).and_return(report_response).ordered
+
+  expect(CSV).to receive(:open).with(report_name, 'w').ordered
+end
+
+def get_mock_nexpose_client
+  mock_nexpose_client = double(Nexpose::Connection)
+
+  allow(mock_nexpose_client).to receive(:call).with(any_args).and_return({})
+
+  allow(mock_nexpose_client).to receive(:scan_status)
+                                 .with(@mock_scan_id)
+
+  allow(mock_nexpose_client).to receive(:login)
+                                  .and_return(true)
+
+  allow(Nexpose::Connection).to receive(:new)
+                             .and_return(mock_nexpose_client)
+
+  mock_nexpose_client
+end
+
+def get_mock_nexpose_site
+  mock_nexpose_site = double(Nexpose::Site)
+
+  allow(mock_nexpose_site).to receive(:call).with(any_args).and_return({})
+
+  allow(mock_nexpose_site).to receive(:scan)
+                          .and_return(@mock_scan)
+
+  allow(mock_nexpose_site).to receive(:id)
+                          .and_return(@mock_site_id)
+
+
+  allow(mock_nexpose_site).to receive(:add_ip)
+                                .with(@expected_ip)
+
+  allow(mock_nexpose_site).to receive(:save)
+                                .with(@mock_nexpose_client)
+
+  allow(mock_nexpose_site).to receive(:scan)
+                                .with(@mock_nexpose_client)
+                                .and_return(@mock_scan)
+
+  allow(Nexpose::Site).to receive(:new)
+                                .and_return(mock_nexpose_site)
+
+  mock_nexpose_site
+end
+
+def get_mock_report
+  mock_report = double(Nexpose::AdhocReportConfig)
+
+  allow(mock_report).to receive(:call).with(any_args).and_return({})
+
+  allow(mock_report).to receive(:add_filter)
+                          .with(any_args)
+
+  allow(mock_report).to receive(:add_filter)
+                          .with(any_args)
+
+  allow(mock_report).to receive(:add_filter)
+                          .with(any_args)
+
+  allow(mock_report).to receive(:generate).with(any_args)
+                        .and_return(@mock_no_vuln_report)
+
+  allow(Nexpose::AdhocReportConfig).to receive(:new)
+                          .and_return(mock_report)
+
+  allow(CSV).to receive(:open).with(any_args)
+
+  mock_report
+end
+
+def get_mock_scan
+  mock_scan = double(Nexpose::Scan)
+  allow(mock_scan).to receive(:id).and_return(@mock_scan_id)
+  mock_scan
+end

data/spec/spec_helper.rb

@@ -0,0 +1,9 @@
+RSpec.configure do |config|
+
+  config.mock_with :rspec do |mocks|
+    mocks.verify_partial_doubles = true
+  end
+
+  Dir['./spec/support/**/*.rb'].sort.each { |f| require f }
+
+end

metadata

@@ -0,0 +1,122 @@
+--- !ruby/object:Gem::Specification
+name: NexposeRunner
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Nathan Gibson
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-08-28 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: nexpose
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.8.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.8.3
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.6'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+description: ''
+email:
+- amngibson@gmail.com
+executables:
+- scan
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- .rspec
+- .travis.yml
+- Gemfile
+- LICENSE.txt
+- NexposeRunner.gemspec
+- README.md
+- Rakefile
+- bin/scan
+- lib/NexposeRunner.rb
+- lib/NexposeRunner/version.rb
+- lib/nexpose-runner/constants.rb
+- lib/nexpose-runner/scan.rb
+- lib/nexpose-runner/scan_run_description.rb
+- spec/scan_spec.rb
+- spec/spec_helper.rb
+homepage: ''
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: This is a gem that provides the ability to create a new site, add an IP to
+  the site, and perform a scan against the site using a defined/passed scan template,
+  and finally produce a reports for vulnerabilities, installed software, and policy
+  compliance.
+test_files:
+- spec/scan_spec.rb
+- spec/spec_helper.rb