dradis-netsparker 3.8.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (30) hide show
  1. checksums.yaml +7 -0
  2. data/.gitignore +12 -0
  3. data/CHANGELOG.md +4 -0
  4. data/CONTRIBUTING.md +3 -0
  5. data/Gemfile +23 -0
  6. data/LICENSE +339 -0
  7. data/README.md +27 -0
  8. data/Rakefile +1 -0
  9. data/dradis-netsparker.gemspec +35 -0
  10. data/lib/dradis-netsparker.rb +8 -0
  11. data/lib/dradis/plugins/netsparker.rb +11 -0
  12. data/lib/dradis/plugins/netsparker/engine.rb +9 -0
  13. data/lib/dradis/plugins/netsparker/field_processor.rb +21 -0
  14. data/lib/dradis/plugins/netsparker/gem_version.rb +19 -0
  15. data/lib/dradis/plugins/netsparker/importer.rb +64 -0
  16. data/lib/dradis/plugins/netsparker/version.rb +13 -0
  17. data/lib/netsparker/vulnerability.rb +130 -0
  18. data/lib/tasks/thorfile.rb +20 -0
  19. data/spec/dradis-netsparker_spec.rb +85 -0
  20. data/spec/fixtures/files/example-evidence.xml +85 -0
  21. data/spec/fixtures/files/example.xml +2485 -0
  22. data/spec/fixtures/files/netsparker-localhost-demo.xml +2529 -0
  23. data/spec/spec_helper.rb +10 -0
  24. data/templates/evidence.fields +3 -0
  25. data/templates/evidence.sample +55 -0
  26. data/templates/evidence.template +8 -0
  27. data/templates/issue.fields +14 -0
  28. data/templates/issue.sample +55 -0
  29. data/templates/issue.template +15 -0
  30. metadata +162 -0
data/spec/spec_helper.rb ADDED
@@ -0,0 +1,10 @@
1
+ require 'rubygems'
2
+ require 'bundler/setup'
3
+ require 'nokogiri'
4
+
5
+ require 'combustion'
6
+
7
+ Combustion.initialize!
8
+
9
+ RSpec.configure do |config|
10
+ end
data/templates/evidence.fields ADDED
@@ -0,0 +1,3 @@
1
+ evidence.rawrequest
2
+ evidence.rawresponse
3
+ evidence.url
data/templates/evidence.sample ADDED
@@ -0,0 +1,55 @@
1
+ <vulnerability confirmed="False">
2
+ <url>http://test.testlab.com:3000/</url>
3
+ <type>MissingXssProtectionHeader</type>
4
+ <severity>Information</severity>
5
+ <certainty>100</certainty>
6
+ ​<description><![CDATA[<p>Netsparker detected a missing <code>X-XSS-Protection</code> header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.</p>]]></description>
7
+ <remedy><![CDATA[<div>Add the X-XSS-Protection header with a value of "1; mode= block".<ul><li><pre class="code">X-XSS-Protection: 1; mode=block</pre></li></ul></div>]]></remedy>
8
+
9
+ <rawrequest><![CDATA[GET /javascripts/responsive.js HTTP/1.1
10
+ Host: test.testlab.com:3000
11
+ Cache-Control: no-cache
12
+ Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
13
+ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.16 Safari/537.36
14
+ Accept-Language: en-us,en;q=0.5
15
+ X-Scanner: Netsparker
16
+ Cookie: _redmine_session=V2tvR3dUZ
17
+ Accept-Encoding: gzip, deflate
18
+
19
+ ]]></rawrequest>
20
+ <rawresponse><![CDATA[HTTP/1.1 200 OK
21
+ Server: WEBrick/1.3.1 (Ruby/2.3.0/2015-12-25)
22
+ Connection: Keep-Alive
23
+ Content-Length: 2002
24
+ Last-Modified: Sun, 19 Jun 2016 12:47:24 GMT
25
+ Content-Type: application/javascript
26
+ Date: Wed, 08 Feb 2017 20:49:45 GMT
27
+
28
+ // generic layout specific responsive stuff goes here
29
+
30
+ function openFlyout() {
31
+ $('html').addClass('flyout-is-active');
32
+ $('#wrapper2').on('click', function(e){
33
+ e.preventDefault();
34
+ e.stopPropagation();
35
+ closeFlyout();
36
+ });
37
+ }
38
+ ]]></rawresponse>
39
+ <extrainformation></extrainformation>
40
+
41
+ <proofs></proofs>
42
+
43
+
44
+ <classification>
45
+ <OWASP2013></OWASP2013>
46
+ <WASC></WASC>
47
+ <CWE></CWE>
48
+ <CAPEC></CAPEC>
49
+ <PCI31></PCI31>
50
+ <PCI32></PCI32>
51
+ <HIPAA>164.308(a)</HIPAA>
52
+ <OWASPPC>C9</OWASPPC>
53
+ </classification>
54
+
55
+ </vulnerability>
data/templates/evidence.template ADDED
@@ -0,0 +1,8 @@
1
+ #[URL]#
2
+ %evidence.url%
3
+
4
+ #[Request]#
5
+ bc.. %evidence.rawrequest%
6
+
7
+ #[Response]#
8
+ bc.. %evidence.rawresponse%
data/templates/issue.fields ADDED
@@ -0,0 +1,14 @@
1
+ issue.certainty
2
+ issue.classification_capec
3
+ issue.classification_cwe
4
+ issue.classification_hipaa
5
+ issue.classification_owasp2013
6
+ issue.classification_owasppc
7
+ issue.classification_pci31
8
+ issue.classification_pci32
9
+ issue.classification_wasc
10
+ issue.description
11
+ issue.remedy
12
+ issue.severity
13
+ issue.title
14
+ issue.type
data/templates/issue.sample ADDED
@@ -0,0 +1,55 @@
1
+ <vulnerability confirmed="False">
2
+ <url>http://test.testlab.com:3000/</url>
3
+ <type>MissingXssProtectionHeader</type>
4
+ <severity>Information</severity>
5
+ <certainty>100</certainty>
6
+ ​<description><![CDATA[<p>Netsparker detected a missing <code>X-XSS-Protection</code> header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.</p>]]></description>
7
+ <remedy><![CDATA[<div>Add the X-XSS-Protection header with a value of "1; mode= block".<ul><li><pre class="code">X-XSS-Protection: 1; mode=block</pre></li></ul></div>]]></remedy>
8
+
9
+ <rawrequest><![CDATA[GET /javascripts/responsive.js HTTP/1.1
10
+ Host: test.testlab.com:3000
11
+ Cache-Control: no-cache
12
+ Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
13
+ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.16 Safari/537.36
14
+ Accept-Language: en-us,en;q=0.5
15
+ X-Scanner: Netsparker
16
+ Cookie: _redmine_session=V2tvR3dUZ
17
+ Accept-Encoding: gzip, deflate
18
+
19
+ ]]></rawrequest>
20
+ <rawresponse><![CDATA[HTTP/1.1 200 OK
21
+ Server: WEBrick/1.3.1 (Ruby/2.3.0/2015-12-25)
22
+ Connection: Keep-Alive
23
+ Content-Length: 2002
24
+ Last-Modified: Sun, 19 Jun 2016 12:47:24 GMT
25
+ Content-Type: application/javascript
26
+ Date: Wed, 08 Feb 2017 20:49:45 GMT
27
+
28
+ // generic layout specific responsive stuff goes here
29
+
30
+ function openFlyout() {
31
+ $('html').addClass('flyout-is-active');
32
+ $('#wrapper2').on('click', function(e){
33
+ e.preventDefault();
34
+ e.stopPropagation();
35
+ closeFlyout();
36
+ });
37
+ }
38
+ ]]></rawresponse>
39
+ <extrainformation></extrainformation>
40
+
41
+ <proofs></proofs>
42
+
43
+
44
+ <classification>
45
+ <OWASP2013></OWASP2013>
46
+ <WASC></WASC>
47
+ <CWE></CWE>
48
+ <CAPEC></CAPEC>
49
+ <PCI31></PCI31>
50
+ <PCI32></PCI32>
51
+ <HIPAA>164.308(a)</HIPAA>
52
+ <OWASPPC>C9</OWASPPC>
53
+ </classification>
54
+
55
+ </vulnerability>
data/templates/issue.template ADDED
@@ -0,0 +1,15 @@
1
+ #[Title]#
2
+ %issue.title%
3
+
4
+ #[Severity]#
5
+ %issue.severity%
6
+
7
+ #[Certainty]#
8
+ %issue.certainty%
9
+
10
+ #[Description]#
11
+ %issue.description%
12
+
13
+ #[Remedy]#
14
+ %issue.remedy%
15
+
metadata ADDED
@@ -0,0 +1,162 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: dradis-netsparker
3
+ version: !ruby/object:Gem::Version
4
+ version: 3.8.0
5
+ platform: ruby
6
+ authors:
7
+ - Daniel Martin
8
+ autorequire:
9
+ bindir: bin
10
+ cert_chain: []
11
+ date: 2017-09-27 00:00:00.000000000 Z
12
+ dependencies:
13
+ - !ruby/object:Gem::Dependency
14
+ name: dradis-plugins
15
+ requirement: !ruby/object:Gem::Requirement
16
+ requirements:
17
+ - - "~>"
18
+ - !ruby/object:Gem::Version
19
+ version: '3.2'
20
+ type: :runtime
21
+ prerelease: false
22
+ version_requirements: !ruby/object:Gem::Requirement
23
+ requirements:
24
+ - - "~>"
25
+ - !ruby/object:Gem::Version
26
+ version: '3.2'
27
+ - !ruby/object:Gem::Dependency
28
+ name: nokogiri
29
+ requirement: !ruby/object:Gem::Requirement
30
+ requirements:
31
+ - - "~>"
32
+ - !ruby/object:Gem::Version
33
+ version: '1.3'
34
+ type: :runtime
35
+ prerelease: false
36
+ version_requirements: !ruby/object:Gem::Requirement
37
+ requirements:
38
+ - - "~>"
39
+ - !ruby/object:Gem::Version
40
+ version: '1.3'
41
+ - !ruby/object:Gem::Dependency
42
+ name: bundler
43
+ requirement: !ruby/object:Gem::Requirement
44
+ requirements:
45
+ - - "~>"
46
+ - !ruby/object:Gem::Version
47
+ version: '1.6'
48
+ type: :development
49
+ prerelease: false
50
+ version_requirements: !ruby/object:Gem::Requirement
51
+ requirements:
52
+ - - "~>"
53
+ - !ruby/object:Gem::Version
54
+ version: '1.6'
55
+ - !ruby/object:Gem::Dependency
56
+ name: rake
57
+ requirement: !ruby/object:Gem::Requirement
58
+ requirements:
59
+ - - "~>"
60
+ - !ruby/object:Gem::Version
61
+ version: '10.0'
62
+ type: :development
63
+ prerelease: false
64
+ version_requirements: !ruby/object:Gem::Requirement
65
+ requirements:
66
+ - - "~>"
67
+ - !ruby/object:Gem::Version
68
+ version: '10.0'
69
+ - !ruby/object:Gem::Dependency
70
+ name: rspec-rails
71
+ requirement: !ruby/object:Gem::Requirement
72
+ requirements:
73
+ - - ">="
74
+ - !ruby/object:Gem::Version
75
+ version: '0'
76
+ type: :development
77
+ prerelease: false
78
+ version_requirements: !ruby/object:Gem::Requirement
79
+ requirements:
80
+ - - ">="
81
+ - !ruby/object:Gem::Version
82
+ version: '0'
83
+ - !ruby/object:Gem::Dependency
84
+ name: combustion
85
+ requirement: !ruby/object:Gem::Requirement
86
+ requirements:
87
+ - - "~>"
88
+ - !ruby/object:Gem::Version
89
+ version: 0.5.2
90
+ type: :development
91
+ prerelease: false
92
+ version_requirements: !ruby/object:Gem::Requirement
93
+ requirements:
94
+ - - "~>"
95
+ - !ruby/object:Gem::Version
96
+ version: 0.5.2
97
+ description: This add-on allows you to upload and parse output produced from Netsparker
98
+ Web Vulnerability Scanner into Dradis.
99
+ email:
100
+ - etd@nomejortu.com
101
+ executables: []
102
+ extensions: []
103
+ extra_rdoc_files: []
104
+ files:
105
+ - ".gitignore"
106
+ - CHANGELOG.md
107
+ - CONTRIBUTING.md
108
+ - Gemfile
109
+ - LICENSE
110
+ - README.md
111
+ - Rakefile
112
+ - dradis-netsparker.gemspec
113
+ - lib/dradis-netsparker.rb
114
+ - lib/dradis/plugins/netsparker.rb
115
+ - lib/dradis/plugins/netsparker/engine.rb
116
+ - lib/dradis/plugins/netsparker/field_processor.rb
117
+ - lib/dradis/plugins/netsparker/gem_version.rb
118
+ - lib/dradis/plugins/netsparker/importer.rb
119
+ - lib/dradis/plugins/netsparker/version.rb
120
+ - lib/netsparker/vulnerability.rb
121
+ - lib/tasks/thorfile.rb
122
+ - spec/dradis-netsparker_spec.rb
123
+ - spec/fixtures/files/example-evidence.xml
124
+ - spec/fixtures/files/example.xml
125
+ - spec/fixtures/files/netsparker-localhost-demo.xml
126
+ - spec/spec_helper.rb
127
+ - templates/evidence.fields
128
+ - templates/evidence.sample
129
+ - templates/evidence.template
130
+ - templates/issue.fields
131
+ - templates/issue.sample
132
+ - templates/issue.template
133
+ homepage: http://dradisframework.org
134
+ licenses:
135
+ - GPL-2
136
+ metadata: {}
137
+ post_install_message:
138
+ rdoc_options: []
139
+ require_paths:
140
+ - lib
141
+ required_ruby_version: !ruby/object:Gem::Requirement
142
+ requirements:
143
+ - - ">="
144
+ - !ruby/object:Gem::Version
145
+ version: '0'
146
+ required_rubygems_version: !ruby/object:Gem::Requirement
147
+ requirements:
148
+ - - ">="
149
+ - !ruby/object:Gem::Version
150
+ version: '0'
151
+ requirements: []
152
+ rubyforge_project:
153
+ rubygems_version: 2.6.8
154
+ signing_key:
155
+ specification_version: 4
156
+ summary: Netsparker add-on for the Dradis Framework.
157
+ test_files:
158
+ - spec/dradis-netsparker_spec.rb
159
+ - spec/fixtures/files/example-evidence.xml
160
+ - spec/fixtures/files/example.xml
161
+ - spec/fixtures/files/netsparker-localhost-demo.xml
162
+ - spec/spec_helper.rb