NexposeRunner 0.0.19b → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: faa4204e94afada27ead08f1bf95f248b6a978ff
-  data.tar.gz: b35f5ca648674d15eca67eecc61f464d712a8fd4
+  metadata.gz: 1753280c807b7cbc9e9c3d2ce7926f544e455608
+  data.tar.gz: a4c4be6de7157c5a746469d0c9f878369e468328
 SHA512:
-  metadata.gz: 39179a02b8a68f6cec50ed602954a68deef7413e69eebc96700af88265880f1985d66d2ecb6a5a86e97237f8aa262dcaa192164d9ee527c6103a9079f8f31ca9
-  data.tar.gz: a54dde614f2af5d7c963635223a0e7fb771b170ca908113ad384cd67ab1a65a61abc3a14e9944b1cd401f8f944a427fad9a6ff0277cbb3811a36ca1b14ce6bd0
+  metadata.gz: 58d0eb323fd62798dd5fdfb5fd5e614f3524e6323f7d07e2a95104889b857cc1f0a15a18d184dd0db703eea92b776518b6f245afe53d0739e1152b5b64a95cbb
+  data.tar.gz: 2bd74be1ef45c64a473110a1c3b623675745d55a2e3577e97e540953c891e03475b88d34c06d3c6986ec1824c00e9ad19560874dd9b710390bd13feb280b57f0

data/lib/NexposeRunner/version.rb

@@ -1,4 +1,3 @@
 module NexposeRunner
-    VERSION = '0.0.19b'
+    VERSION = '1.0.0'
 end
-

data/lib/nexpose-runner/constants.rb

@@ -14,6 +14,7 @@ module CONSTANTS
   VULNERABILITY_DETAIL_REPORT_NAME = 'nexpose-vulnerability-detail-report.csv'
   SOFTWARE_REPORT_NAME = 'nexpose-software-report.csv'
   POLICY_REPORT_NAME = 'nexpose-policy-report.csv'
+  MAX_RETRY_COUNT = 5
 
   AUDIT_REPORT_FILE_NAME = 'nexpose-audit-report.html'
   AUDIT_REPORT_NAME = 'audit-report'

data/lib/nexpose-runner/scan.rb

@@ -8,7 +8,7 @@ require 'nexpose-runner/scan_run_description'
 
 module NexposeRunner
   module Scan
-    
+
     def self.allow_vulnerabilities?(vulnerabilities, run_details)
       vuln_array = []
       exceptions_array = get_exceptions(run_details)
@@ -33,8 +33,13 @@ module NexposeRunner
     end
 
     def self.get_exceptions(run_details)
-      uri = URI("#{run_details.exceptions_list_url}")
-      ex = Net::HTTP.get(uri).split("\n")
+      path = "#{run_details.exceptions_list_url}"
+      uri = URI(path)
+      if path.include? "http:"
+        ex = Net::HTTP.get(uri).split("\n")
+      elsif (File.file?(path))
+        ex = File.read(path).split("\n")
+      end
       ex
     end
 
@@ -58,7 +63,7 @@ module NexposeRunner
       puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Report"
       vulnerabilities = generate_report(CONSTANTS::VULNERABILITY_REPORT_QUERY, site.id, nsc)
       generate_csv(vulnerabilities, CONSTANTS::VULNERABILITY_REPORT_NAME)
-      
+
       puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Detail Report"
       vuln_details = generate_report(CONSTANTS:: VULNERABILITY_DETAIL_REPORT_QUERY, site.id, nsc)
       generate_csv(vuln_details, CONSTANTS::VULNERABILITY_DETAIL_REPORT_NAME)
@@ -73,7 +78,7 @@ module NexposeRunner
 
       puts "Scan complete for #{run_details.site_name}, Generating Audit Report"
       generate_template_report(nsc, site.id, CONSTANTS::AUDIT_REPORT_FILE_NAME, CONSTANTS::AUDIT_REPORT_NAME, CONSTANTS::AUDIT_REPORT_FORMAT)
-      
+
       puts "Scan complete for #{run_details.site_name}, Generating Xml Report"
       generate_template_report(nsc, site.id, CONSTANTS::XML_REPORT_FILE_NAME, CONSTANTS::XML_REPORT_NAME, CONSTANTS::XML_REPORT_FORMAT)
 
@@ -83,7 +88,7 @@ module NexposeRunner
     def self.verify_run(vulnerabilities, run_details)
 
       if run_details.exceptions_list_url.to_s.empty? and vulnerabilities.count > 0
-        raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE 
+        raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE
 
       elsif vulnerabilities.count == 0
           puts "No vulnerabilities found!"
@@ -98,13 +103,24 @@ module NexposeRunner
 
       puts "Starting scan for #{run_details.site_name} using the #{run_details.scan_template_id} scan template"
       scan = site.scan nsc
-
+      retry_count = 0
       begin
         sleep(3)
-        stats = nsc.scan_statistics(scan.id)
-        status = stats.status
+        begin
+          stats = nsc.scan_statistics(scan.id)
+        rescue
+          if retry_count == CONSTANTS::MAX_RETRY_COUNT
+            raise
+          end
+            puts "Status Check failed, incrementing retry count to #{retry_count}"
+            retry_count = retry_count + 1
+            next
+        end
+ 	    status = stats.status
         puts "Current #{run_details.site_name} scan status: #{status.to_s} -- PENDING: #{stats.tasks.pending.to_s} ACTIVE: #{stats.tasks.active.to_s} COMPLETED #{stats.tasks.completed.to_s}"
+        retry_count = 0
       end while status == Nexpose::Scan::Status::RUNNING
+
     end
 
     def self.create_site(run_details, nsc)
@@ -118,7 +134,7 @@ module NexposeRunner
       end
       site.save nsc
       puts "Created site #{run_details.site_name} successfully with the following host(s) #{run_details.ip_addresses.join(', ')}"
-      
+
       site
     end
 

data/spec/data/test_exclist.txt

@@ -0,0 +1,2 @@
+Database Open Access
+MySQL Obsolete Version

data/spec/scan_spec.rb

@@ -31,8 +31,8 @@ describe 'nexpose-runner' do
       @mock_vuln_report = 'ip_address,title,date_published,severity,summary,fix
                             10.5.0.15,Database Open Access,2010-01-01,Severe,Restrict database access,<p><p>Configure the database server to only allow access to trusted systems. For example, the PCI DSS standard requires you to place the database in an internal network zone, segregated from the DMZ </p></p>
                             10.5.0.15.180,MySQL Obsolete Version,2007-07-25,Critical,Upgrade to the latest version of Oracle MySQL,<p>Download and apply the upgrade from: <a href=http://dev.mysql.com/downloads/mysql>http://dev.mysql.com/downloads/mysql</a></p>'.chomp
-      @mock_exceptions = "Database Open Access\nMySQL Obsolete Version"                      
-      
+      @mock_exceptions = "Database Open Access\nMySQL Obsolete Version"
+
       @mock_vuln_detail_report = 'stuff'.chomp
 
       @mock_software_report = 'name,ip_address,host_name,description,description,vendor,name,version
@@ -89,40 +89,40 @@ describe 'nexpose-runner' do
       it 'should throw an error if no connection url is passed' do
         options = @options.clone
         options['connection_url'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me the URL/IP address to your Nexpose Server')
       end
 
       it 'should throw an error if no username is passed' do
         options = @options.clone
         options['username'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a username to login to Nexpose with')
       end
 
       it 'should throw an error if no password is passed' do
         options = @options.clone
         options['password'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a password to login to Nexpose with')
       end
 
       it 'should throw an error if no site name is passed' do
         options = @options.clone
         options['site_name'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Nexpose Site Name')
       end
 
       it 'should throw an error if no ip address is passed' do
         options = @options.clone
         options['ip_addresses'] = '';
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me an IP Address to scan')
       end
 
@@ -136,9 +136,9 @@ describe 'nexpose-runner' do
 
       it 'should use 3780 as default if port is empty string' do
         expect(Nexpose::Connection).to receive(:new)
-                                       .with(@options['connection_url'], 
-                                             @options['username'], 
-                                             @options['password'], 
+                                       .with(@options['connection_url'],
+                                             @options['username'],
+                                             @options['password'],
                                              '3780')
                                        .and_return(@mock_nexpose_client)
 
@@ -181,37 +181,37 @@ describe 'nexpose-runner' do
       describe 'wait for the Nexpose Scan to complete' do
         it 'should call to check the status of the scan' do
           expect(@mock_nexpose_client).to receive(:scan_statistics).with(@mock_scan_id)
-  
+
           NexposeRunner::Scan.start(@options)
         end
-  
+
         it 'should call to check the status until it is not running' do
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::RUNNING)
                                       .exactly(3).times
                                       .ordered
-  
+
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::FINISHED)
                                       .once
                                       .ordered
-  
+
           NexposeRunner::Scan.start(@options)
         end
-  
+
         it 'should sleep for 3 seconds if the status is still running' do
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::RUNNING)
                                       .exactly(3).times
                                       .ordered
-  
+
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::FINISHED)
                                       .once
                                       .ordered
 
           expect(NexposeRunner::Scan).to receive(:sleep).with(3).exactly(4).times
-  
+
           NexposeRunner::Scan.start(@options)
         end
       end
@@ -230,16 +230,16 @@ describe 'nexpose-runner' do
           expect(Nexpose::AdhocReportConfig).to receive(:new)
                                                 .with(CONSTANTS::AUDIT_REPORT_NAME, CONSTANTS::AUDIT_REPORT_FORMAT, @mock_site_id)
                                                 .and_return(@mock_report)
-        
+
           expect(Nexpose::AdhocReportConfig).to receive(:new)
                                                 .with(CONSTANTS::XML_REPORT_NAME, CONSTANTS::XML_REPORT_FORMAT, @mock_site_id)
                                                 .and_return(@mock_report)
 
           expect_template_report_to_be_called_with(CONSTANTS::AUDIT_REPORT_FILE_NAME)
           expect_template_report_to_be_called_with(CONSTANTS::XML_REPORT_FILE_NAME)
-          
-          expect { 
-            NexposeRunner::Scan.start(@options) 
+
+          expect {
+            NexposeRunner::Scan.start(@options)
           }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
       end
     end
@@ -247,19 +247,30 @@ describe 'nexpose-runner' do
       it 'should throw exception if vulnerability exists' do
       expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
 
-      expect { 
-        NexposeRunner::Scan.start(@options) 
+      expect {
+        NexposeRunner::Scan.start(@options)
       }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
     end
 
     it 'should not throw exception if exceptions exist for all vulnerabilities' do
       expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
-      
+
       options = @options.clone
       options['exceptions_list_url'] = 'http://google.com'
-      
+
       expect_exceptions_to_be_called_with(options['exceptions_list_url'])
-      
+
+      NexposeRunner::Scan.start(options)
+      end
+
+    it 'should not throw exception if exceptions exist from a file for all vulnerabilities' do
+      expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
+
+      options = @options.clone
+      options['exceptions_list_url'] = 'spec/data/test_exclist.txt'
+
+      expect_exceptions_to_be_called_with_file(options['exceptions_list_url'])
+
       NexposeRunner::Scan.start(options)
       end
   end
@@ -275,6 +286,10 @@ def expect_exceptions_to_be_called_with(exceptions_list_url)
                           .with(uri).and_return(@mock_exceptions)
 end
 
+def expect_exceptions_to_be_called_with_file(exceptions_list_url)
+  expect(File.read(exceptions_list_url)).to eq "Database Open Access\nMySQL Obsolete Version\n"
+end
+
 def expect_report_to_be_called_with(report_name, report_query, report_response)
   expect(@mock_report).to receive(:add_filter)
                           .with('version', '1.3.0')
@@ -311,29 +326,29 @@ def get_mock_nexpose_client
 
   allow(Nexpose::Connection).to receive(:new)
                              .and_return(mock_nexpose_client)
-                             
+
   allow(mock_nexpose_client).to receive(:make_xml)
                              .with(any_args)
                              .and_return(xml)
-                             
+
   allow(mock_nexpose_client).to receive(:make_xml)
                              .with(any_args)
                              .and_return(xml)
-                             
+
   allow(mock_nexpose_client).to receive(:filter)
                             .with(any_args)
-                            .and_return({})                             
-                             
+                            .and_return({})
+
   allow(mock_nexpose_client).to receive(:execute)
                              .with(any_args)
                              .and_return(mock_api_request)
-                             
+
   allow(mock_api_request).to receive(:success)
                              .and_return(false) #this is just to shut up the underlying api.
-                             
+
   allow(mock_api_request).to receive(:attributes)
-                             .and_return(xml)                             
-                             
+                             .and_return(xml)
+
   mock_nexpose_client
 end
 
@@ -345,9 +360,9 @@ def get_mock_scan_summary
   allow(mock_scan_summary).to receive(:tasks).and_return(tasks)
 
   allow(mock_scan_summary).to receive(:status).and_return(
-				Nexpose::Scan::Status::RUNNING, 
 				Nexpose::Scan::Status::RUNNING,
- 				Nexpose::Scan::Status::RUNNING, 
+				Nexpose::Scan::Status::RUNNING,
+ 				Nexpose::Scan::Status::RUNNING,
 				Nexpose::Scan::Status::FINISHED)
   mock_scan_summary
 end
@@ -411,4 +426,3 @@ def get_mock_scan
   allow(mock_scan).to receive(:id).and_return(@mock_scan_id)
   mock_scan
 end
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: NexposeRunner
 version: !ruby/object:Gem::Version
-  version: 0.0.19b
+  version: 1.0.0
 platform: ruby
 authors:
 - Nathan Gibson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-31 00:00:00.000000000 Z
+date: 2017-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nexpose
@@ -91,6 +91,7 @@ files:
 - lib/nexpose-runner/constants.rb
 - lib/nexpose-runner/scan.rb
 - lib/nexpose-runner/scan_run_description.rb
+- spec/data/test_exclist.txt
 - spec/scan_config_spec.rb
 - spec/scan_spec.rb
 - spec/spec_helper.rb
@@ -109,12 +110,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.4.5.2
 signing_key: 
 specification_version: 4
 summary: This is a gem that provides the ability to create a new site, add an IP to
@@ -122,6 +123,7 @@ summary: This is a gem that provides the ability to create a new site, add an IP
   and finally produce a reports for vulnerabilities, installed software, and policy
   compliance.
 test_files:
+- spec/data/test_exclist.txt
 - spec/scan_config_spec.rb
 - spec/scan_spec.rb
 - spec/spec_helper.rb