dradis-burp 3.9.0 → 3.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 92ebf6124dc7f9bbbea7f0b495f8603642fe6bd2
-  data.tar.gz: edf3b9d76492afd44329a5eb870329e2f45e0da2
+  metadata.gz: fcd4870b2ac20839adc44a4abd01a94c6796a158
+  data.tar.gz: 73390a8db93ced0c81c63b37ab32bf0a3597b734
 SHA512:
-  metadata.gz: 407776fbe8094c434f784b23177f62f415c51f42d8cef60c9595cb3567f605c4c4879f52a69120ec617a135cceef93b59d2c4fa3c6111e5857094c20f8dd6828
-  data.tar.gz: 89e23d8d216fc270952d341e9a77305e3395c34a88fdc2f93da5a4a70401d58e6ade477e9298ebc57c37a7a9a65af8978866958f02392e4a4928a60fbf89a139
+  metadata.gz: 99e04356a79bc4f7dbeb11ef5e1ba7fb9d0ce32e8f091d09cdaf5210e7881484d2af1c33b308885c20c7ba2d82ee2cef5b20c78b5689c0ae9d9d16657a51401c
+  data.tar.gz: b831bdc6aef442661eadbdeeebc6a92c3a5f6c1f9050f6b7728a326326045e82ff00ebf8efddfd978690a19c554e8996a2233a520611d907bf2e4af41c6ca62f

data/CHANGELOG.md

@@ -1,18 +1,25 @@
-## Dradis Framework 3.9 (January, 2018) ##
+## Dradis Framework 3.10 (August, 2018) ##
+
+*   Adds `references` and `vulnerability_classifications` as available fields
+
+*   Adds `hostname` as a Node property
+
+*   Fixes formatting errors including `<p>`, `<a href="">`, and `<table>` tags
 
-*   Encode content with UTF-8 to avoid incompatible db errors.
+*   Findings with <type>134217728</type> are not bundled together into one Issue
 
+## Dradis Framework 3.9 (January, 2018) ##
+
+*   Encode content with UTF-8 to avoid incompatible db errors (v3.8.1)
 
 ## Dradis Framework 3.8 (September, 2017) ##
 
 *   No changes.
 
-
 ## Dradis Framework 3.7 (July, 2017) ##
 
 *   Detect non-base64 encoded files and binary req/res data.
 
-
 ## Dradis Framework 3.6 (March, 2017) ##
 
 *   Detect non-base64 encoded files and binary req/res data.

data/lib/burp/issue.rb

@@ -26,7 +26,7 @@ module Burp
         # simple tags
         :serial_number, :type, :name, :host, :path, :location, :severity,
         :confidence, :background, :remediation_background, :detail,
-        :remediation_detail,
+        :remediation_detail, :references, :vulnerability_classifications,
 
         # nested tags
         :request, :response
@@ -64,6 +64,7 @@ module Burp
         :detail => 'issueDetail',
         :remediation_background => 'remediationBackground',
         :remediation_detail => 'remediationDetail',
+        :vulnerability_classifications => 'vulnerabilityClassifications',
         :serial_number => 'serialNumber'
       }
 
@@ -98,27 +99,30 @@ module Burp
       result.gsub!(/&/, '&')
       result.gsub!(/&lt;/, '<')
       result.gsub!(/&gt;/, '>')
+      result.gsub!(/&nbsp;/, ' ')
 
       result.gsub!(/<b>(.*?)<\/b>/, '*\1*')
-      result.gsub!(/<br\/>/, "\n")
-      result.gsub!(/<br>/, "\n")
+      result.gsub!(/<br>|<\/br>/){"\n"}
       result.gsub!(/<font.*?>(.*?)<\/font>/m, '\1')
-      result.gsub!(/<h2>(.*?)<\/h2>/, '*\1*')
+      result.gsub!(/<h\d?>(.*?)<\/h\d?>/, '*\1*')
       result.gsub!(/<i>(.*?)<\/i>/, '\1')
-      result.gsub!(/<p>(.*?)<\/p>/, '\1')
+      result.gsub!(/<p>|<\/p>/){"\n"}
       result.gsub!(/<pre.*?>(.*?)<\/pre>/m){|m| "\n\nbc.. #{ $1 }\n\np.  \n" }
 
-      result.gsub!(/<ul>/, "\n")
-      result.gsub!(/<\/ul>/, "\n")
-      result.gsub!(/<li>/, "\n* ")
-      result.gsub!(/<\/li>/, "\n")
+      result.gsub!(/<ul>(.*?)<\/ul>/m){|m| "#{ $1 }\n"}
+      result.gsub!(/<li>(.*?)<\/li>/m){|m| "\n* #{ $1 }"}
+      result.gsub!(/<a href=\"(.*?)\">(.*?)<\/a>/i) { "\"#{$2.strip}\":#{$1.strip}" }
+
+      result.gsub!(/<table>(.*?)<\/table>/m){|m| "\n\n#{ $1 }\n\n" }
+      result.gsub!(/<tr>(.*?)<\/tr>/m){|m| "|#{ $1 }\n" }
+      result.gsub!(/<td>(.*?)<\/td>/, '\1|')
 
       result
     end
 
     # Some of the values have embedded HTML content that we need to strip
     def tags_with_html_content
-      [:background, :detail, :remediation_background, :remediation_detail]
+      [:background, :detail, :remediation_background, :remediation_detail, :references, :vulnerability_classifications]
     end
 
     def requestresponse_child(field)

data/lib/dradis/plugins/burp/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 3
-        MINOR = 9
+        MINOR = 10
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/burp/importer.rb

@@ -5,91 +5,134 @@ module Dradis::Plugins::Burp
     # the dropdown list and uploads a file.
     # @returns true if the operation was successful, false otherwise
     def import(params = {})
-      file_content = File.read( params[:file] )
+      file_content = File.read(params[:file])
 
       if file_content =~ /base64="false"/
         error =  "Burp input contains HTTP request / response data that hasn't been Base64-encoded.\n"
-        error << "Please re-export your scanner results making sure the Base-64 encode option is selected."
+        error << 'Please re-export your scanner results making sure the Base-64 encode option is selected.'
 
         logger.fatal{ error }
         content_service.create_note text: error
         return false
       end
 
-      logger.info{ 'Parsing Burp Scanner output file...' }
-      doc = Nokogiri::XML( file_content )
-      logger.info{'Done.'}
+      logger.info { 'Parsing Burp Scanner output file...' }
+      doc = Nokogiri::XML(file_content)
+      logger.info { 'Done.' }
 
       if doc.root.name != 'issues'
         error = "Document doesn't seem to be in the Burp Scanner XML format."
-        logger.fatal{ error }
+        logger.fatal { error }
         content_service.create_note text: error
         return false
       end
 
       # This will be filled in by the Processor while iterating over the issues
-      hosts         = []
-      affected_host = nil
-      issue_text    = nil
-      evidence_text = nil
+      @hosts         = []
+      @affected_host = nil
+      @issue_text    = nil
+      @evidence_text = nil
 
       doc.xpath('issues/issue').each do |xml_issue|
-        issue_name = xml_issue.at('name').text
-        issue_type = xml_issue.at('type').text.to_i
+        process_issue(xml_issue)
+      end
 
-        logger.info{ "Adding #{ issue_name } (#{ issue_type })" }
+      logger.info { 'Burp Scanner results successfully imported' }
+      true
+    end
 
-        host_label = xml_issue.at('host')['ip']
-        host_label = xml_issue.at('host').text if host_label.empty?
-        affected_host = content_service.create_node(label: host_label, type: :host)
-        logger.info{ "\taffects: #{ host_label }" }
+    private
 
-        if !hosts.include?(affected_host.label)
-          hosts << affected_host.label
-          url = xml_issue.at('host').text
-          host_description = "\#[HostInfo]\#\n#{ url }\n\n"
-          content_service.create_note(text: host_description, node: affected_host)
-        end
+    # Creates the Nodes/properties
+    def process_issue(xml_issue)
+      host_label = xml_issue.at('host')['ip']
+      host_label = xml_issue.at('host').text if host_label.empty?
+      affected_host = content_service.create_node(label: host_label, type: :host)
+      logger.info { "\taffects: #{host_label}" }
 
-        issue_text = template_service.process_template(
-          template: 'issue',
-          data: xml_issue)
+      unless @hosts.include?(affected_host.label)
+        @hosts << affected_host.label
+        url = xml_issue.at('host').text
+        affected_host.set_property(:hostname, url)
+        affected_host.save
+      end
 
-        if issue_text.include?(::Burp::INVALID_UTF_REPLACE)
-          logger.info %{
-            "\tdetected invalid UTF-8 bytes in your issue. " \
-            "Replacing them with '#{::Burp::INVALID_UTF_REPLACE}'."
-          }
-        end
+      # Burp extensions don't follow the "unique type for every Issue" logic
+      # so we have to deal with them separately
+      if xml_issue.at('type').text.to_str == '134217728'
+        process_extension_issues(affected_host, xml_issue)
+      else
+        process_burp_issues(affected_host, xml_issue)
+      end
+    end
 
-        issue = content_service.create_issue(
-          text: issue_text,
-          id: issue_type)
+    # If the Issues come from the Burp app, use the type as the plugin_ic
+    def process_burp_issues(affected_host, xml_issue)
+      issue_name = xml_issue.at('name').text
+      issue_type = xml_issue.at('type').text.to_i
 
-        logger.info{ "\tadding evidence for this instance to #{ affected_host.label }."}
+      logger.info { "Adding #{issue_name} (#{issue_type})" }
 
-        evidence_text = template_service.process_template(
-          template: 'evidence',
+      create_issue(
+        affected_host: affected_host,
+        id: issue_type,
+        xml_issue: xml_issue
+      )
+    end
+
+    # If the Issues come from a Burp extension (type = 134217728), then
+    # use the name (spaces removed) as the plugin_id
+    def process_extension_issues(affected_host, xml_issue)
+      ext_name = xml_issue.at('name').text
+      ext_name = ext_name.gsub!(" ", "")
+
+      logger.info { "Adding #{ext_name}" }
+
+      create_issue(
+        affected_host: affected_host,
+        id: ext_name,
+        xml_issue: xml_issue
+      )
+    end
+
+    def create_issue(affected_host:, id:, xml_issue:)
+      issue_text =
+        template_service.process_template(
+          template: 'issue',
           data: xml_issue
         )
 
-        if evidence_text.include?(::Burp::INVALID_UTF_REPLACE)
-          logger.info {
-            "\tdetected invalid UTF-8 bytes in your evidence. " \
-            "Replacing them with '#{::Burp::INVALID_UTF_REPLACE}'."
-          }
+      if issue_text.include?(::Burp::INVALID_UTF_REPLACE)
+        logger.info do
+          "\tdetected invalid UTF-8 bytes in your issue. " \
+          "Replacing them with '#{::Burp::INVALID_UTF_REPLACE}'."
         end
+      end
+
+      issue = content_service.create_issue(text: issue_text, id: id)
 
-        content_service.create_evidence(
-          issue: issue,
-          node: affected_host,
-          content: evidence_text
+      logger.info do
+        "\tadding evidence for this instance to #{affected_host.label}."
+      end
+
+      evidence_text =
+        template_service.process_template(
+          template: 'evidence',
+          data: xml_issue
         )
 
+      if evidence_text.include?(::Burp::INVALID_UTF_REPLACE)
+        logger.info do
+          "\tdetected invalid UTF-8 bytes in your evidence. " \
+          "Replacing them with '#{::Burp::INVALID_UTF_REPLACE}'."
+        end
       end
-      logger.info{ 'Burp Scanner results successfully imported' }
-      return true
-    end
 
+      content_service.create_evidence(
+        issue: issue,
+        node: affected_host,
+        content: evidence_text
+      )
+    end
   end
 end

data/spec/burp_upload_spec.rb

@@ -37,10 +37,9 @@ describe 'Burp upload plugin' do
       # They return their argument hashes as objects mimicking
       # Nodes, Issues, etc
       allow(@content_service).to receive(:create_node) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_note) do |args|
-        OpenStruct.new(args)
+        obj = OpenStruct.new(args)
+        obj.define_singleton_method(:set_property) { |_, __| }
+        obj
       end
       allow(@content_service).to receive(:create_issue) do |args|
         OpenStruct.new(args)
@@ -50,24 +49,20 @@ describe 'Burp upload plugin' do
       end
     end
 
-    it "creates nodes, issues, notes and an evidences as needed" do
+    it "creates nodes, issues, and evidence as needed" do
 
-      # Host node and basic host info note
+      # Host node
       #
       # create_node should be called once for each issue in the xml,
       # but ContentService knows it's already created and NOOPs
       expect(@content_service).to receive(:create_node)
       .with(hash_including label: '10.0.0.1')
       .exactly(4).times
-      # create_note should be calld just once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:text]).to include("#[HostInfo]#\nhttp://www.test.com")
-        OpenStruct.new(args)
-      end.once
 
       # create_issue should be called once for each issue in the xml
       expect(@content_service).to receive(:create_issue) do |args|
         expect(args[:text]).to include("#[Title]#\nIssue 1")
+        expect(args[:id]).to eq(8781630)
         OpenStruct.new(args)
       end.once
       expect(@content_service).to receive(:create_evidence) do |args|
@@ -78,6 +73,7 @@ describe 'Burp upload plugin' do
 
       expect(@content_service).to receive(:create_issue) do |args|
         expect(args[:text]).to include("#[Title]#\nIssue 2")
+        expect(args[:id]).to eq(8781631)
         OpenStruct.new(args)
       end.once
       expect(@content_service).to receive(:create_evidence) do |args|
@@ -86,8 +82,12 @@ describe 'Burp upload plugin' do
         expect(args[:node].label).to eq("10.0.0.1")
       end.once
 
+      # Issue 3 is an Extension finding so we need to confirm
+      # that it triggers process_extension_issues instead of process_burp_issues
+      # and the plugin_id is not set to the Type (134217728)
       expect(@content_service).to receive(:create_issue) do |args|
         expect(args[:text]).to include("#[Title]#\nIssue 3")
+        expect(args[:id]).to eq("Issue3")
         OpenStruct.new(args)
       end.once
       expect(@content_service).to receive(:create_evidence) do |args|
@@ -98,6 +98,7 @@ describe 'Burp upload plugin' do
 
       expect(@content_service).to receive(:create_issue) do |args|
         expect(args[:text]).to include("#[Title]#\nIssue 4")
+        expect(args[:id]).to eq(8781633)
         OpenStruct.new(args)
       end.once
       expect(@content_service).to receive(:create_evidence) do |args|

data/spec/fixtures/files/burp.xml

@@ -63,7 +63,7 @@
   </issue>
   <issue>
     <serialNumber>1833460934674078322</serialNumber>
-    <type>8781632</type>
+    <type>134217728</type>
     <name>Issue 3</name>
     <host ip="10.0.0.1">http://www.test.com</host>
     <path><![CDATA[/Common/login.aspx]]></path>

data/templates/issue.fields

@@ -3,3 +3,5 @@ issue.background
 issue.remediation_background
 issue.detail
 issue.remediation_detail
+issue.references
+issue.vulnerability_classifications

data/templates/issue.sample

@@ -1,12 +1,23 @@
 <issue>
-  <serialNumber>5236964506139299840</serialNumber>
-  <type>6291712</type>
-  <name>Directory listing</name>
-  <host ip="10.0.0.1">http://wiki.local</host>
-  <path><![CDATA[/crmmanager/]]></path>
-  <location><![CDATA[/crmmanager/]]></location>
-  <severity>Information</severity>
-  <confidence>Firm</confidence>
-  <issueBackground><![CDATA[Directory listings do not necessarily constitute a security vulnerability. Any sensitive resources within your web root should be properly access-controlled in any case, and should not be accessible by an unauthorized party who happens to know the URL. Nevertheless, directory listings can aid an attacker by enabling them to quickly identify the resources at a given path, and proceed directly to analyzing and attacking them.]]></issueBackground>
-  <remediationBackground><![CDATA[There is not usually any good reason to provide directory listings, and disabling them may place additional hurdles in the path of an attacker. This can normally be achieved in two ways:<ul><li>Configure your web server to prevent directory listings for all paths beneath the web root; </li><li>Place into each directory a default file (such as index.htm) which the web server will display instead of returning a directory listing.</li></ul>]]></remediationBackground>
+  <serialNumber>5863488220648493056</serialNumber>
+  <type>16777984</type>
+  <name><![CDATA[Strict transport security not enforced]]></name>
+  <host ip="192.168.1.1">https://this.is.a.url</host>
+  <path><![CDATA[/]]></path>
+  <location><![CDATA[/]]></location>
+  <severity>Low</severity>
+  <confidence>Certain</confidence>
+  <issueBackground><![CDATA[<p> The application fails to prevent users from connecting  to it over unencrypted connections.  An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption, and use the application as a platform for attacks against its users. This attack is performed by rewriting HTTPS links as HTTP, so that if a targeted user follows a link to the site from an HTTP page, their browser never attempts to use an encrypted connection. The sslstrip tool  automates this process. </p>
+<p>
+To exploit this vulnerability, an attacker must be suitably positioned to intercept and modify the victim's network traffic.This scenario typically occurs when a client communicates with the server over an insecure connection such as public Wi-Fi, or a corporate or home network that is shared with a compromised computer. Common defenses such as switched networks are not sufficient to prevent this. An attacker situated in the user's ISP or the application's hosting infrastructure could also perform this attack. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure. </p>]]></issueBackground>
+  <remediationBackground><![CDATA[<p>The application should instruct web browsers to only access the application using HTTPS. To do this, enable HTTP Strict Transport Security (HSTS) by adding a response header with the name 'Strict-Transport-Security' and the value 'max-age=expireTime', where expireTime is the time in seconds that browsers should remember that the site should only be accessed using HTTPS. Consider adding the 'includeSubDomains' flag if appropriate.</p>
+<p>Note that because HSTS is a &quot;trust on first use&quot; (TOFU) protocol, a user who has never accessed the application will never have seen the HSTS header, and will therefore still be vulnerable to SSL stripping attacks. To mitigate this risk, you can optionally add the 'preload' flag to the HSTS header, and submit the domain for review by browser vendors.</p>]]></remediationBackground>
+  <references><![CDATA[<ul>
+<li><a href="https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security">HTTP Strict Transport Security</a></li>
+<li><a href="http://www.thoughtcrime.org/software/sslstrip/">sslstrip</a></li>
+<li><a href="https://hstspreload.appspot.com/">HSTS Preload Form</a></li>
+</ul>]]></references>
+  <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/523.html">CWE-523: Unprotected Transport of Credentials</a></li>
+</ul>]]></vulnerabilityClassifications>
 </issue>

data/templates/issue.template

@@ -16,3 +16,11 @@
 
 #[RemediationDetails]#
 %issue.remediation_detail%
+
+
+#[References]#
+%issue.references%
+
+
+#[Classifications]#
+%issue.vulnerability_classifications%

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-burp
 version: !ruby/object:Gem::Version
-  version: 3.9.0
+  version: 3.10.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-08 00:00:00.000000000 Z
+date: 2018-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -151,7 +151,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Burp Scanner upload plugin for the Dradis Framework.