NexposeRunner 0.0.16 → 0.0.17b

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: dba55e03de0483d335ea8587e78cf98fd592d822
-  data.tar.gz: 17d89e707f96cefae4c27781d5c4804913e58f8a
+  metadata.gz: e2590c12a930cd78ea7a98bc29b6ef168e3a58c9
+  data.tar.gz: 02cb068245f7a6f67ebd6766ac446dd83f08f21f
 SHA512:
-  metadata.gz: a12740921d51d353c6d49cba1b63244f07ae4de715843153da931bb934c4efdb0a67439f98d16f23df7124553068bddff75b8db1ca3e6db1a34eb8c87d77fb16
-  data.tar.gz: ab7c13e940e0cfe7057ba77c6944ec6dc9a8a99216126fb5d738cc6a08e8bf016a16e1a5914646947cf7ee5243210c54e251916e3c12b784c263c62ad89ccf5f
+  metadata.gz: cffa73b37cd25356e60f12324274806734a614a8827b4a14d2b44835e0f6c21be55cfcd62b71d934cfeba006ffe14fa3085ccbf1bce2e8c78793786477c4afad
+  data.tar.gz: 45f65266bd748c9264e945dc2699189b9bfc376a54b31a8573d28fa047dcfca007e186299665d39e405dca14dc056487aa63b0dbfd9576249f8dc459854b39a8

data/NexposeRunner.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'nexpose', '0.8.3'
+  spec.add_dependency 'nexpose', '7.1.1'
 
   spec.add_development_dependency 'bundler', '~> 1.6'
   spec.add_development_dependency 'rake', '< 11.0'

data/bin/scan

@@ -13,8 +13,9 @@ if ARGV.grep(/^--/).empty?
     'site_name' => ARGV[4], 
     'ip_addresses' => ARGV[5], 
     'scan_template' => ARGV[6],
-    'engine' => ARGV[7]
-  })
+    'engine' => ARGV[7],
+    'timeout' => ARGV[8],
+    'open_timeout' => ARGV[9]})
 else
   NexposeRunner::Scan.start(ARGV)
 end

data/config/scan.yml.example

@@ -6,3 +6,5 @@ site_name: ''
 ip_addresses: ''
 scan_template: ''
 engine: ''
+timeout: ''
+open_timeout: ''

data/lib/NexposeRunner/version.rb

@@ -1,3 +1,4 @@
 module NexposeRunner
-    VERSION = '0.0.16'
+    VERSION = '0.0.17b'
 end
+

data/lib/nexpose-runner/constants.rb

@@ -8,8 +8,10 @@ module CONSTANTS
   REQUIRED_SCAN_TEMPLATE_MESSAGE = 'OOPS! Looks like you forgot to give me a Scan Template to use'
   VULNERABILITY_FOUND_MESSAGE = '---------All YOUR BASE ARE BELONG TO US---------------\nVulnerabilities were found, breaking build'
   DEFAULT_PORT = '3780'
+  DEFAULT_TIMEOUT = '120'
+  DEFAULT_OPEN_TIMEOUT = '120'
   VULNERABILITY_REPORT_NAME = 'nexpose-vulnerability-report.csv'
-  VULNERABILITY_DETAIL_REPORT_NAME = 'nexpose-vulnerability-detail-report.csv' 
+  VULNERABILITY_DETAIL_REPORT_NAME = 'nexpose-vulnerability-detail-report.csv'
   SOFTWARE_REPORT_NAME = 'nexpose-software-report.csv'
   POLICY_REPORT_NAME = 'nexpose-policy-report.csv'
 

data/lib/nexpose-runner/scan.rb

@@ -8,7 +8,7 @@ require 'nexpose-runner/scan_run_description'
 
 module NexposeRunner
   module Scan
-
+    
     def self.allow_vulnerabilities?(vulnerabilities, run_details)
       vuln_array = []
       exceptions_array = get_exceptions(run_details)
@@ -33,13 +33,8 @@ module NexposeRunner
     end
 
     def self.get_exceptions(run_details)
-      path = "#{run_details.exceptions_list_url}"
-      uri = URI(path)
-      if path.include? "http:"
-        ex = Net::HTTP.get(uri).split("\n")
-      elsif (File.file?(path))
-        ex = File.read(path).split("\n")
-      end
+      uri = URI("#{run_details.exceptions_list_url}")
+      ex = Net::HTTP.get(uri).split("\n")
       ex
     end
 
@@ -63,7 +58,7 @@ module NexposeRunner
       puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Report"
       vulnerabilities = generate_report(CONSTANTS::VULNERABILITY_REPORT_QUERY, site.id, nsc)
       generate_csv(vulnerabilities, CONSTANTS::VULNERABILITY_REPORT_NAME)
-
+      
       puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Detail Report"
       vuln_details = generate_report(CONSTANTS:: VULNERABILITY_DETAIL_REPORT_QUERY, site.id, nsc)
       generate_csv(vuln_details, CONSTANTS::VULNERABILITY_DETAIL_REPORT_NAME)
@@ -78,7 +73,7 @@ module NexposeRunner
 
       puts "Scan complete for #{run_details.site_name}, Generating Audit Report"
       generate_template_report(nsc, site.id, CONSTANTS::AUDIT_REPORT_FILE_NAME, CONSTANTS::AUDIT_REPORT_NAME, CONSTANTS::AUDIT_REPORT_FORMAT)
-
+      
       puts "Scan complete for #{run_details.site_name}, Generating Xml Report"
       generate_template_report(nsc, site.id, CONSTANTS::XML_REPORT_FILE_NAME, CONSTANTS::XML_REPORT_NAME, CONSTANTS::XML_REPORT_FORMAT)
 
@@ -88,7 +83,7 @@ module NexposeRunner
     def self.verify_run(vulnerabilities, run_details)
 
       if run_details.exceptions_list_url.to_s.empty? and vulnerabilities.count > 0
-        raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE
+        raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE 
 
       elsif vulnerabilities.count == 0
           puts "No vulnerabilities found!"
@@ -116,14 +111,14 @@ module NexposeRunner
       puts "Creating a nexpose site named #{run_details.site_name}"
       site = Nexpose::Site.new run_details.site_name, run_details.scan_template
       run_details.ip_addresses.each { |address|
-          site.add_ip address
+          site.included_addresses address
       }
       if run_details.engine
         site.engine = run_details.engine
       end
       site.save nsc
       puts "Created site #{run_details.site_name} successfully with the following host(s) #{run_details.ip_addresses.join(', ')}"
-
+      
       site
     end
 

data/lib/nexpose-runner/scan_run_description.rb

@@ -5,6 +5,8 @@ class ScanRunDescription
   attr_accessor :connection_url, :exceptions_list_url, :username, :password, :port, :site_name, :ip_addresses, :scan_template, :engine
   @@port_value = ''
   @@ip_addresses = []
+  @@timeout = ''
+  @@open_timeout =''
   exceptions_list_url_value = ''
 
   def initialize(options)
@@ -23,6 +25,8 @@ class ScanRunDescription
     self.ip_addresses = options['ip_addresses']
     self.scan_template = options['scan_template']
     self.engine = options['engine']
+    self.timeout = options['timeout']
+    self.open_timeout = options['open_timeout']
   end
 
   def verify
@@ -43,6 +47,22 @@ class ScanRunDescription
     get_value(@@port_value, CONSTANTS::DEFAULT_PORT)
   end
 
+  def timeout=(value)
+    @@timeout = value
+  end
+
+  def timeout
+    get_value(@@timeout, CONSTANTS::DEFAULT_TIMEOUT)
+  end
+
+  def open_timeout=(value)
+    @@open_timeout = value
+  end
+
+  def open_timeout
+    get_value(@@open_timeout, CONSTANTS::DEFAULT_OPEN_TIMEOUT)
+  end
+
   def exceptions_list_url=(value)
     @@exceptions_list_url_value = value
   end

data/spec/scan_spec.rb

@@ -21,6 +21,8 @@ describe 'nexpose-runner' do
       @expected_site_name = 'my_cool_software_build-28'
       @expected_ips = '10.5.0.15,10.5.0.20,10.5.0.35'
       @expected_scan_template = 'full-audit-widget-corp'
+      @timeout = '120'
+      @open_timeout = '120'
 
       @mock_scan_id = '12'
       @mock_site_id = '1'
@@ -29,8 +31,8 @@ describe 'nexpose-runner' do
       @mock_vuln_report = 'ip_address,title,date_published,severity,summary,fix
                             10.5.0.15,Database Open Access,2010-01-01,Severe,Restrict database access,<p><p>Configure the database server to only allow access to trusted systems. For example, the PCI DSS standard requires you to place the database in an internal network zone, segregated from the DMZ </p></p>
                             10.5.0.15.180,MySQL Obsolete Version,2007-07-25,Critical,Upgrade to the latest version of Oracle MySQL,<p>Download and apply the upgrade from: <a href=http://dev.mysql.com/downloads/mysql>http://dev.mysql.com/downloads/mysql</a></p>'.chomp
-      @mock_exceptions = "Database Open Access\nMySQL Obsolete Version"
-
+      @mock_exceptions = "Database Open Access\nMySQL Obsolete Version"                      
+      
       @mock_vuln_detail_report = 'stuff'.chomp
 
       @mock_software_report = 'name,ip_address,host_name,description,description,vendor,name,version
@@ -63,6 +65,8 @@ describe 'nexpose-runner' do
         'site_name' => @expected_site_name,
         'ip_addresses' => @expected_ips,
         'scan_template' => @expected_scan_template,
+        'timeout' => @timeout,
+        'open_timeout' => @open_timeout
       }
 
     end
@@ -70,9 +74,10 @@ describe 'nexpose-runner' do
       it 'should create a session with the nexpose server' do
         expect(Nexpose::Connection).to receive(:new)
                                     .with(@options['connection_url'],
-                                          @options['username'],
-                                          @options['password'],
-                                          @options['port'])
+                                          @options['username'], 
+                                          @options['password'], 
+                                          @options['port']
+                                         )
                                     .and_return(@mock_nexpose_client)
 
         expect(@mock_nexpose_client).to receive(:login)
@@ -84,56 +89,56 @@ describe 'nexpose-runner' do
       it 'should throw an error if no connection url is passed' do
         options = @options.clone
         options['connection_url'] = nil
-        expect {
-          NexposeRunner::Scan.start(options)
+        expect { 
+          NexposeRunner::Scan.start(options) 
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me the URL/IP address to your Nexpose Server')
       end
 
       it 'should throw an error if no username is passed' do
         options = @options.clone
         options['username'] = nil
-        expect {
-          NexposeRunner::Scan.start(options)
+        expect { 
+          NexposeRunner::Scan.start(options) 
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a username to login to Nexpose with')
       end
 
       it 'should throw an error if no password is passed' do
         options = @options.clone
         options['password'] = nil
-        expect {
-          NexposeRunner::Scan.start(options)
+        expect { 
+          NexposeRunner::Scan.start(options) 
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a password to login to Nexpose with')
       end
 
       it 'should throw an error if no site name is passed' do
         options = @options.clone
         options['site_name'] = nil
-        expect {
-          NexposeRunner::Scan.start(options)
+        expect { 
+          NexposeRunner::Scan.start(options) 
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Nexpose Site Name')
       end
 
       it 'should throw an error if no ip address is passed' do
         options = @options.clone
         options['ip_addresses'] = '';
-        expect {
-          NexposeRunner::Scan.start(options)
+        expect { 
+          NexposeRunner::Scan.start(options) 
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me an IP Address to scan')
       end
 
       it 'should throw an error if no scan template is passed' do
         options = @options.clone
         options['scan_template'] = nil
-        expect {
-          NexposeRunner::Scan.start(options)
+        expect { 
+          NexposeRunner::Scan.start(options) 
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Scan Template to use')
       end
 
       it 'should use 3780 as default if port is empty string' do
         expect(Nexpose::Connection).to receive(:new)
-                                       .with(@options['connection_url'],
-                                             @options['username'],
-                                             @options['password'],
+                                       .with(@options['connection_url'], 
+                                             @options['username'], 
+                                             @options['password'], 
                                              '3780')
                                        .and_return(@mock_nexpose_client)
 
@@ -153,7 +158,7 @@ describe 'nexpose-runner' do
 
       it 'should add the supplied ip address to the newly created site' do
         @expected_ips.split(',').each { |ip|
-          expect(@mock_nexpose_site).to receive(:add_ip).with(ip)
+          expect(@mock_nexpose_site).to receive(:included_addresses).with(ip)
         }
         NexposeRunner::Scan.start(@options)
       end
@@ -176,37 +181,37 @@ describe 'nexpose-runner' do
       describe 'wait for the Nexpose Scan to complete' do
         it 'should call to check the status of the scan' do
           expect(@mock_nexpose_client).to receive(:scan_statistics).with(@mock_scan_id)
-
+  
           NexposeRunner::Scan.start(@options)
         end
-
+  
         it 'should call to check the status until it is not running' do
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::RUNNING)
                                       .exactly(3).times
                                       .ordered
-
+  
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::FINISHED)
                                       .once
                                       .ordered
-
+  
           NexposeRunner::Scan.start(@options)
         end
-
+  
         it 'should sleep for 3 seconds if the status is still running' do
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::RUNNING)
                                       .exactly(3).times
                                       .ordered
-
+  
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::FINISHED)
                                       .once
                                       .ordered
 
           expect(NexposeRunner::Scan).to receive(:sleep).with(3).exactly(4).times
-
+  
           NexposeRunner::Scan.start(@options)
         end
       end
@@ -225,16 +230,16 @@ describe 'nexpose-runner' do
           expect(Nexpose::AdhocReportConfig).to receive(:new)
                                                 .with(CONSTANTS::AUDIT_REPORT_NAME, CONSTANTS::AUDIT_REPORT_FORMAT, @mock_site_id)
                                                 .and_return(@mock_report)
-
+        
           expect(Nexpose::AdhocReportConfig).to receive(:new)
                                                 .with(CONSTANTS::XML_REPORT_NAME, CONSTANTS::XML_REPORT_FORMAT, @mock_site_id)
                                                 .and_return(@mock_report)
 
           expect_template_report_to_be_called_with(CONSTANTS::AUDIT_REPORT_FILE_NAME)
           expect_template_report_to_be_called_with(CONSTANTS::XML_REPORT_FILE_NAME)
-
-          expect {
-            NexposeRunner::Scan.start(@options)
+          
+          expect { 
+            NexposeRunner::Scan.start(@options) 
           }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
       end
     end
@@ -242,30 +247,19 @@ describe 'nexpose-runner' do
       it 'should throw exception if vulnerability exists' do
       expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
 
-      expect {
-        NexposeRunner::Scan.start(@options)
+      expect { 
+        NexposeRunner::Scan.start(@options) 
       }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
     end
 
     it 'should not throw exception if exceptions exist for all vulnerabilities' do
       expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
-
+      
       options = @options.clone
       options['exceptions_list_url'] = 'http://google.com'
-
+      
       expect_exceptions_to_be_called_with(options['exceptions_list_url'])
-
-      NexposeRunner::Scan.start(options)
-      end
-
-    it 'should not throw exception if exceptions exist from a file for all vulnerabilities' do
-      expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
-
-      options = @options.clone
-      options['exceptions_list_url'] = 'spec/data/test_exclist.txt'
-
-      expect_exceptions_to_be_called_with_file(options['exceptions_list_url'])
-
+      
       NexposeRunner::Scan.start(options)
       end
   end
@@ -281,10 +275,6 @@ def expect_exceptions_to_be_called_with(exceptions_list_url)
                           .with(uri).and_return(@mock_exceptions)
 end
 
-def expect_exceptions_to_be_called_with_file(exceptions_list_url)
-  expect(File.read(exceptions_list_url)).to eq "Database Open Access\nMySQL Obsolete Version\n"
-end
-
 def expect_report_to_be_called_with(report_name, report_query, report_response)
   expect(@mock_report).to receive(:add_filter)
                           .with('version', '1.3.0')
@@ -321,29 +311,29 @@ def get_mock_nexpose_client
 
   allow(Nexpose::Connection).to receive(:new)
                              .and_return(mock_nexpose_client)
-
+                             
   allow(mock_nexpose_client).to receive(:make_xml)
                              .with(any_args)
                              .and_return(xml)
-
+                             
   allow(mock_nexpose_client).to receive(:make_xml)
                              .with(any_args)
                              .and_return(xml)
-
+                             
   allow(mock_nexpose_client).to receive(:filter)
                             .with(any_args)
-                            .and_return({})
-
+                            .and_return({})                             
+                             
   allow(mock_nexpose_client).to receive(:execute)
                              .with(any_args)
                              .and_return(mock_api_request)
-
+                             
   allow(mock_api_request).to receive(:success)
                              .and_return(false) #this is just to shut up the underlying api.
-
+                             
   allow(mock_api_request).to receive(:attributes)
-                             .and_return(xml)
-
+                             .and_return(xml)                             
+                             
   mock_nexpose_client
 end
 
@@ -355,9 +345,9 @@ def get_mock_scan_summary
   allow(mock_scan_summary).to receive(:tasks).and_return(tasks)
 
   allow(mock_scan_summary).to receive(:status).and_return(
+				Nexpose::Scan::Status::RUNNING, 
 				Nexpose::Scan::Status::RUNNING,
-				Nexpose::Scan::Status::RUNNING,
- 				Nexpose::Scan::Status::RUNNING,
+ 				Nexpose::Scan::Status::RUNNING, 
 				Nexpose::Scan::Status::FINISHED)
   mock_scan_summary
 end
@@ -374,7 +364,7 @@ def get_mock_nexpose_site
                           .and_return(@mock_site_id)
 
   @expected_ips.split(',').each { |ip|
-    allow(mock_nexpose_site).to receive(:add_ip).with(ip)
+    allow(mock_nexpose_site).to receive(:included_addresses).with(ip)
   }
 
   allow(mock_nexpose_site).to receive(:save)
@@ -421,3 +411,4 @@ def get_mock_scan
   allow(mock_scan).to receive(:id).and_return(@mock_scan_id)
   mock_scan
 end
+

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: NexposeRunner
 version: !ruby/object:Gem::Version
-  version: 0.0.16
+  version: 0.0.17b
 platform: ruby
 authors:
 - Nathan Gibson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-30 00:00:00.000000000 Z
+date: 2017-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nexpose
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.8.3
+        version: 7.1.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.8.3
+        version: 7.1.1
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -91,7 +91,6 @@ files:
 - lib/nexpose-runner/constants.rb
 - lib/nexpose-runner/scan.rb
 - lib/nexpose-runner/scan_run_description.rb
-- spec/data/test_exclist.txt
 - spec/scan_config_spec.rb
 - spec/scan_spec.rb
 - spec/spec_helper.rb
@@ -110,9 +109,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.5.2
@@ -123,7 +122,6 @@ summary: This is a gem that provides the ability to create a new site, add an IP
   and finally produce a reports for vulnerabilities, installed software, and policy
   compliance.
 test_files:
-- spec/data/test_exclist.txt
 - spec/scan_config_spec.rb
 - spec/scan_spec.rb
 - spec/spec_helper.rb

data/spec/data/test_exclist.txt

@@ -1,2 +0,0 @@
-Database Open Access
-MySQL Obsolete Version