dradis-nessus 5.2.0 → 5.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +6 -0
  3. data/lib/dradis/plugins/nessus/gem_version.rb +1 -1
  4. metadata +2 -28
  5. data/.github/issue_template.md +0 -16
  6. data/.github/pull_request_template.md +0 -45
  7. data/.gitignore +0 -11
  8. data/.rspec +0 -2
  9. data/CHANGELOG.template +0 -12
  10. data/CONTRIBUTING.md +0 -3
  11. data/Gemfile +0 -23
  12. data/dradis-nessus.gemspec +0 -33
  13. data/spec/dradis/plugins/nessus/field_processor_spec.rb +0 -41
  14. data/spec/dradis/plugins/nessus/importer_spec.rb +0 -77
  15. data/spec/fixtures/files/example_v2.nessus +0 -2076
  16. data/spec/fixtures/files/host-01.xml +0 -18
  17. data/spec/fixtures/files/report_item-with-list.xml +0 -45
  18. data/spec/fixtures/files/vpr_score.xml +0 -37
  19. data/spec/fixtures/files/vulnerability_priority_rating.xml +0 -37
  20. data/spec/nessus/host_spec.rb +0 -29
  21. data/spec/spec_helper.rb +0 -10
data/spec/fixtures/files/host-01.xml DELETED
@@ -1,18 +0,0 @@
1
- <?xml version="1.0" ?>
2
- <NessusClientData_v2>
3
- <Report name="RSpec-01">
4
- <ReportHost name="10.0.0.1">
5
- <HostProperties>
6
- <tag name="HOST_END">Tue Aug 9 09:59:24 2011</tag>
7
- <tag name="HOST_START">Tue Aug 9 09:50:18 2011</tag>
8
- </HostProperties>
9
- <ReportItem port="0" svc_name="general" protocol="udp" severity="1" pluginID="10287" pluginName="Traceroute Information" pluginFamily="General" />
10
- <ReportItem port="0" svc_name="unknown" protocol="icmp" severity="0" pluginID="0" pluginName="" pluginFamily=""/>
11
- <ReportItem port="0" svc_name="unknown" protocol="tcp" severity="0" pluginID="0" pluginName="" pluginFamily=""/>
12
- <ReportItem port="0" svc_name="unknown" protocol="udp" severity="0" pluginID="0" pluginName="" pluginFamily=""/>
13
- <ReportItem port="21" svc_name="ftp?" protocol="tcp" severity="0" pluginID="0" pluginName="" pluginFamily=""/>
14
- <ReportItem port="22" svc_name="ssh" protocol="tcp" severity="0" pluginID="0" pluginName="" pluginFamily=""/>
15
- <ReportItem port="9090" svc_name="www" protocol="tcp" severity="0" pluginID="0" pluginName="" pluginFamily=""/>
16
- </ReportHost>
17
- </Report>
18
- </NessusClientData_v2>
data/spec/fixtures/files/report_item-with-list.xml DELETED
@@ -1,45 +0,0 @@
1
- <?xml version="1.0"?>
2
- <ReportItem port="80" svc_name="www" protocol="tcp" severity="2" pluginID="68915" pluginName="Apache 2.2.x &lt; 2.2.25 Multiple Vulnerabilities" pluginFamily="Web Servers">
3
- <bid>59826</bid>
4
- <bid>61129</bid>
5
- <cpe>cpe:/a:apache:http_server</cpe>
6
- <cve>CVE-2013-1862</cve>
7
- <cve>CVE-2013-1896</cve>
8
- <cvss_base_score>5.1</cvss_base_score>
9
- <cvss_temporal_score>4.4</cvss_temporal_score>
10
- <cvss_temporal_vector>CVSS2#E:ND/RL:OF/RC:C</cvss_temporal_vector>
11
- <cvss_vector>CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P</cvss_vector>
12
- <description>According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.25. It is, therefore, potentially affected by the following vulnerabilities :
13
-
14
- - A flaw exists in the 'RewriteLog' function where it fails to sanitize escape sequences from being written to log files, making it potentially vulnerable to arbitrary command execution. (CVE-2013-1862)
15
-
16
- - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests.
17
- (CVE-2013-1896)
18
-
19
- Note that Nessus did not actually test for these issues, but instead has relied on the version in the server's banner.</description>
20
- <exploit_available>false</exploit_available>
21
- <exploitability_ease>No known exploits are available</exploitability_ease>
22
- <fname>apache_2_2_25.nasl</fname>
23
- <osvdb>93366</osvdb>
24
- <osvdb>95498</osvdb>
25
- <patch_publication_date>2013/07/10</patch_publication_date>
26
- <plugin_modification_date>2015/10/19</plugin_modification_date>
27
- <plugin_name>Apache 2.2.x &lt; 2.2.25 Multiple Vulnerabilities</plugin_name>
28
- <plugin_publication_date>2013/07/16</plugin_publication_date>
29
- <plugin_type>remote</plugin_type>
30
- <risk_factor>Medium</risk_factor>
31
- <script_version>$Revision: 1.14 $</script_version>
32
- <see_also>https://archive.apache.org/dist/httpd/CHANGES_2.2.25
33
- http://httpd.apache.org/security/vulnerabilities_22.html
34
- http://www.nessus.org/u?f050c342</see_also>
35
- <solution>Upgrade to Apache version 2.2.25 or later. Alternatively, ensure that the affected modules are not in use.</solution>
36
- <synopsis>The remote web server may be affected by multiple cross-site scripting vulnerabilities.</synopsis>
37
- <vuln_publication_date>2013/05/13</vuln_publication_date>
38
- <xref>OSVDB:93366</xref>
39
- <xref>OSVDB:95498</xref>
40
- <plugin_output>
41
- Version source : Server: Apache/2.2.20
42
- Installed version : 2.2.20
43
- Fixed version : 2.2.25
44
- </plugin_output>
45
- </ReportItem>
data/spec/fixtures/files/vpr_score.xml DELETED
@@ -1,37 +0,0 @@
1
- <?xml version="1.0" ?>
2
- <NessusClientData_v2>
3
- <Report name="vprscore" xmlns:cm="http://www.nessus.org/cm">
4
- <ReportHost name="computer">
5
- <HostProperties>
6
- <tag name="host-fqdn">computer.domain</tag>
7
- <tag name="operating-system">windows</tag>
8
- <tag name="system-type">general-purpose</tag>
9
- <tag name="host-uuid">real-uuid</tag>
10
- <tag name="host-ip">0.0.0.0</tag>
11
- <tag name="netbios-name">computer</tag>
12
- <tag name="LastAuthenticatedResults">1111</tag>
13
- <tag name="local-checks-proto">local</tag>
14
- <tag name="bios-uuid">real-uuid</tag></HostProperties>
15
- <ReportItem port="9090" svc_name="www" protocol="tcp" severity="1" pluginID="24260" pluginName="HyperText Transfer Protocol (HTTP) Information" pluginFamily="Web Servers">
16
- <solution>n/a</solution><risk_factor>None</risk_factor><description>This test gives some information about the remote HTTP protocol - the
17
- version used, whether HTTP Keep-Alive and HTTP pipelining are enabled,
18
- etc...
19
-
20
- This test is informational only and does not denote any security
21
- problem.</description><synopsis>Some information about the remote HTTP configuration can be extracted.</synopsis><plugin_output>
22
- Protocol version : HTTP/1.1
23
- SSL : no
24
- Keep-Alive : no
25
- Options allowed : (Not implemented)
26
- Headers :
27
-
28
- Content-length: 1001
29
- Server: TwistedWeb/8.1.0
30
- Last-modified: Mon, 10 Aug 2009 07:16:33 GMT
31
- Connection: close
32
- Date: Fri, 11 Dec 2009 09:03:32 GMT
33
- Content-type: text/html
34
-
35
- </plugin_output>
36
- <vpr_score>9.0</vpr_score>
37
- <plugin_version>$Revision: 1.9 $</plugin_version></ReportItem></ReportHost></Report></NessusClientData_v2>
data/spec/fixtures/files/vulnerability_priority_rating.xml DELETED
@@ -1,37 +0,0 @@
1
- <?xml version="1.0" ?>
2
- <NessusClientData_v2>
3
- <Report name="vulnerability_priority_rating" xmlns:cm="http://www.nessus.org/cm">
4
- <ReportHost name="computer">
5
- <HostProperties>
6
- <tag name="host-fqdn">computer.domain</tag>
7
- <tag name="operating-system">windows</tag>
8
- <tag name="system-type">general-purpose</tag>
9
- <tag name="host-uuid">real-uuid</tag>
10
- <tag name="host-ip">0.0.0.0</tag>
11
- <tag name="netbios-name">computer</tag>
12
- <tag name="LastAuthenticatedResults">111111</tag>
13
- <tag name="local-checks-proto">local</tag>
14
- <tag name="bios-uuid">real-uuid</tag></HostProperties>
15
- <ReportItem port="9090" svc_name="www" protocol="tcp" severity="1" pluginID="24260" pluginName="HyperText Transfer Protocol (HTTP) Information" pluginFamily="Web Servers">
16
- <solution>n/a</solution><risk_factor>None</risk_factor><description>This test gives some information about the remote HTTP protocol - the
17
- version used, whether HTTP Keep-Alive and HTTP pipelining are enabled,
18
- etc...
19
-
20
- This test is informational only and does not denote any security
21
- problem.</description><synopsis>Some information about the remote HTTP configuration can be extracted.</synopsis><plugin_output>
22
- Protocol version : HTTP/1.1
23
- SSL : no
24
- Keep-Alive : no
25
- Options allowed : (Not implemented)
26
- Headers :
27
-
28
- Content-length: 1001
29
- Server: TwistedWeb/8.1.0
30
- Last-modified: Mon, 10 Aug 2009 07:16:33 GMT
31
- Connection: close
32
- Date: Fri, 11 Dec 2009 09:03:32 GMT
33
- Content-type: text/html
34
-
35
- </plugin_output>
36
- <vulnerability_priority_rating>9.0</vulnerability_priority_rating>
37
- <plugin_version>$Revision: 1.9 $</plugin_version></ReportItem></ReportHost></Report></NessusClientData_v2>
data/spec/nessus/host_spec.rb DELETED
@@ -1,29 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe Nessus::Host do
4
- let(:host1_xml) { File.expand_path('../../fixtures/files/host-01.xml', __FILE__) }
5
-
6
- before do
7
- doc = Nokogiri::XML(File.read(host1_xml))
8
- @host = Nessus::Host.new(doc.xpath('/NessusClientData_v2/Report/ReportHost').first)
9
- end
10
-
11
- # These are the properties we need to support:
12
- # host.name The name given at scan time, usually an IP address
13
- # host.ip The ip address of the host
14
- # host.fqdn The full qualified domain name of the host
15
- # host.operating_system The OS of the system if detected
16
- # host.mac_address The mac address if the scanned system was on the same subnet
17
- # host.netbios_name The netbios name of the system
18
- # host.scan_start_time The date/time the scan started
19
- # host.scan_stop_time The date/time the scan ended
20
- it 'Nessus::Host responds to all the expected fields' do
21
- expect(@host.name).to eq('10.0.0.1')
22
- expect(@host.scan_start_time).to eq('Tue Aug 9 09:50:18 2011')
23
- end
24
-
25
- it 'provides access to each of its ReportItems' do
26
- report_items = @host.report_items
27
- report_items.each { |item| expect(item).to be_a(Nessus::ReportItem) }
28
- end
29
- end
data/spec/spec_helper.rb DELETED
@@ -1,10 +0,0 @@
1
- require 'rubygems'
2
- require 'bundler/setup'
3
- require 'nokogiri'
4
-
5
- require 'combustion'
6
-
7
- Combustion.initialize!
8
-
9
- RSpec.configure do |config|
10
- end