dradis-nexpose 3.6.0 → 3.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0cdf3e6d6508a016228cb316d7ba3c19b4e7d3f8
-  data.tar.gz: c4df403c70467bb4ef0b781250ae4c1e22f49bd6
+  metadata.gz: 5906571b0939ca05af44ed77f903eca17d542fe8
+  data.tar.gz: 4172453a4ed16226603a3d50805f8bfe96b6974d
 SHA512:
-  metadata.gz: 5cd20b1775001e1590f1c1917d99df5149ca8fc06c5ba5e6a5f455a4c3d2d7376bcbb502b72c790b307d49d59a2e99296d805e55bd8c967036e1a9aa8837fc0b
-  data.tar.gz: 67a3b673a71da3de579fcee576d6bbf4fbf6cf5c47ee00d67f22e59ab8c00f2d2574a9b641685e8e1eb6b40cb2abde57b7ef0039d758dcad6eab5f2525da932d
+  metadata.gz: 99d93a7c9ea22931e5860e0595b5cc04226212ff283e1ff710ab8a524b00ffde7cacc103934bc896a09637ce7ba28bb3de019fc33c716b17abc621f12e46e898
+  data.tar.gz: 82bd8f4ae1a88e9b2cddfc0a046733b9e1d2f632d09dad925fef45d2f07d0bcdd98fb764a16e446128cf08407981b4a8b06984cd41fc0c1577bc390c1ea97f24

data/CHANGELOG.md

@@ -1,3 +1,9 @@
-## Dradis Framework 3.6 (March XX, 2017) ##
+## Dradis Framework 3.7 (July, 2017) ##
+
+*   Add full evidence template for exporting evidences.
+*   Fix issue resulting in Evidence with null content.
+
+
+## Dradis Framework 3.6 (March, 2017) ##
 
 *   No changes.

data/lib/dradis/plugins/nexpose/field_processor.rb

@@ -6,21 +6,23 @@ module Dradis::Plugins::Nexpose
 
     def post_initialize(args={})
       if data.kind_of?(Hash) ||
-          data.kind_of?(Nexpose::Scan) ||
           data.kind_of?(Nexpose::Node) ||
           data.kind_of?(Nexpose::Service) ||
+          data.kind_of?(Nexpose::Scan) ||
           data.kind_of?(Nexpose::Vulnerability)
         @nexpose_object = data
       else
         # XML from Plugin Manager
-        if (data.name == 'scan')
-          @nexpose_object = Nexpose::Scan.new(data)
-        elsif (data.name == 'node')
+        if (data.name == 'node')
           # Full - node
           @nexpose_object = Nexpose::Node.new(data)
         elsif (data.name == 'service')
           # Full - service
           @nexpose_object = Nexpose::Service.new(data)
+        elsif (data.name == 'scan')
+          @nexpose_object = Nexpose::Scan.new(data)
+        elsif (data.name == 'test')
+          @nexpose_object = Nexpose::Test.new(data)
         else
           if data['added']
             # Full - vulnerability
@@ -86,4 +88,4 @@ module Dradis::Plugins::Nexpose
       rows.join("\n")
     end
   end
-end
+end

data/lib/dradis/plugins/nexpose/formats/full.rb

@@ -9,7 +9,6 @@ module Dradis::Plugins::Nexpose::Formats
 
       @vuln_list = []
       evidence = Hash.new { |h, k| h[k] = {} }
-      hosts = Array.new
 
       # First, extract scans
       scan_node = content_service.create_node(label: 'Nexpose Scan Summary')
@@ -55,8 +54,10 @@ module Dradis::Plugins::Nexpose::Formats
           xml_vuln.add_child("<hosts/>") unless xml_vuln.last_element_child.name == "hosts"
 
           if xml_vuln.xpath("./hosts/host[text()='#{nexpose_node.address}']").empty?
-            xml_vuln.last_element_child.add_child( "<host>#{nexpose_node.address}</host>")
+            xml_vuln.last_element_child.add_child("<host>#{nexpose_node.address}</host>")
           end
+
+          evidence[test_id][nexpose_node.address] = node_test
         end
 
         nexpose_node.endpoints.each do |endpoint|
@@ -100,10 +101,10 @@ module Dradis::Plugins::Nexpose::Formats
               xml_vuln.add_child("<hosts/>") unless xml_vuln.last_element_child.name == "hosts"
 
               if xml_vuln.xpath("./hosts/host[text()='#{nexpose_node.address}']").empty?
-                xml_vuln.last_element_child.add_child( "<host>#{nexpose_node.address}</host>")
+                xml_vuln.last_element_child.add_child("<host>#{nexpose_node.address}</host>")
               end
 
-              evidence[test_id][nexpose_node.address] = service_test[:content]
+              evidence[test_id][nexpose_node.address] = service_test
             end
           end
         end
@@ -119,7 +120,10 @@ module Dradis::Plugins::Nexpose::Formats
       doc.xpath('//VulnerabilityDefinitions/vulnerability').each do |xml_vulnerability|
         id = xml_vulnerability['id'].downcase
         # if @vuln_list.include?(id)
-          issue_text = template_service.process_template(template: 'full_vulnerability', data: xml_vulnerability)
+          issue_text = template_service.process_template(
+            template: 'full_vulnerability',
+            data: xml_vulnerability
+          )
 
           # retrieve hosts affected by this issue (injected in step 2)
           #
@@ -141,7 +145,10 @@ module Dradis::Plugins::Nexpose::Formats
             # if the node exists, this just returns it
             host_node = content_service.create_node(label: host_name, type: :host)
 
-            evidence_content = evidence[id][host_name]
+            evidence_content = template_service.process_template(
+              template: 'full_evidence',
+              data: evidence[id][host_name]
+            )
             content_service.create_evidence(content: evidence_content, issue: issue, node: host_node)
           end
 

data/lib/dradis/plugins/nexpose/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 3
-        MINOR = 6
+        MINOR = 7
         TINY = 0
         PRE = nil
 

data/lib/dradis-nexpose.rb

@@ -7,6 +7,7 @@ require 'dradis/plugins/nexpose'
 # Non-dradis related files
 require 'nexpose/endpoint'
 require 'nexpose/node'
-require 'nexpose/scan'
 require 'nexpose/service'
+require 'nexpose/scan'
+require 'nexpose/test'
 require 'nexpose/vulnerability'

data/lib/nexpose/node.rb

@@ -33,16 +33,7 @@ module Nexpose
     # Convert each ./test/test entry into a simple hash
     def tests(*args)
       @xml.xpath('./tests/test').collect do |xml_test|
-        {
-          :id => xml_test.attributes['id'],
-          :status => xml_test.attributes['status'],
-          # in some cases Nexpose doesn't include text content (e.g. udp-ipid-zero)
-          :content => if (xml_para = xml_test.xpath('./Paragraph').first)
-                        xml_para.text.split("\n").collect(&:strip).reject{|line| line.empty?}.join("\n")
-                      else
-                        ""
-                      end
-        }
+        Nexpose::Test.new(xml_test)
       end
     end
 

data/lib/nexpose/service.rb

@@ -29,17 +29,8 @@ module Nexpose
 
     # Convert each ./test/test entry into a simple hash
     def tests(*args)
-      @xml.xpath('./tests/test').collect do |xml_test|
-        content = if xml_test.at_xpath('./Paragraph')
-                    xml_test.at_xpath('./Paragraph').text.split("\n").collect(&:strip).reject{|line| line.empty?}.join("\n")
-                  else
-                    'n/a'
-                  end
-        {
-               id: xml_test.attributes['id'],
-           status: xml_test.attributes['status'],
-          content: content
-        }
+      @xml.xpath('./tests/test').map do |xml_test|
+        Nexpose::Test.new(xml_test)
       end
     end
 

data/lib/nexpose/test.rb

@@ -0,0 +1,23 @@
+module Nexpose
+  class Test
+    def self.new(xml_node)
+      content =
+        if xml_node.at_xpath('./Paragraph')
+          xml_node.
+            at_xpath('./Paragraph').
+            text.
+            split("\n").
+            collect(&:strip).
+            reject { |line| line.empty? }.join("\n")
+        else
+          'n/a'
+        end
+
+      {
+        id: xml_node.attributes['id'],
+        status: xml_node.attributes['status'],
+        content: content
+      }
+    end
+  end
+end

data/lib/nexpose/vulnerability.rb

@@ -25,7 +25,10 @@ module Nexpose
         :description, :solution,
 
         # multiple tags
-        :references, :tags
+        :references, :tags,
+
+        # evidence tag
+        :details
       ]
     end
 
@@ -83,13 +86,27 @@ module Nexpose
 
       # Finally the enumerations: references, tags
       if method_name == 'references'
-        @xml.xpath("./references/reference").collect{|entry| {:source => entry['source'], :text => entry.text} }
+        references =
+          @xml.xpath("./references/reference").map do |entry|
+            {:source => entry['source'], :text => entry.text}
+          end
+
+        return references
       elsif method == 'tags'
-        @xml.xpath("./tags/tag").collect(&:text)
-      else
-        # nothing found, the tag is valid but not present in this ReportItem
-        return nil
+        return @xml.xpath("./tags/tag").collect(&:text)
+      end
+
+      # Handle evidence creation
+      if method_name == 'details'
+        vuln_id = @xml.attributes['id'].value
+
+        return @xml.xpath("//test[@id='#{vuln_id}']/Paragraph").
+          text.split("\n").
+          collect(&:strip).
+          reject{|line| line.empty?}.join("\n")
       end
+
+      nil
     end
   end
 end

data/lib/tasks/thorfile.rb

@@ -7,9 +7,6 @@ class NexposeTasks < Thor
   def upload(file_path)
     require 'config/environment'
 
-    logger = Logger.new(STDOUT)
-    logger.level = Logger::DEBUG
-
     unless File.exists?(file_path)
       $stderr.puts "** the file [#{file_path}] does not exist"
       exit -1
@@ -17,10 +14,8 @@ class NexposeTasks < Thor
 
     detect_and_set_project_scope
 
-    importer = Dradis::Plugins::Nexpose::Importer.new(logger: logger)
+    importer = Dradis::Plugins::Nexpose::Importer.new(task_options)
     importer.import(file: file_path)
-
-    logger.close
   end
 
 end

data/spec/nexpose_upload_spec.rb

@@ -11,12 +11,13 @@ describe 'Nexpose upload plugin' do
     # Init services
     plugin = Dradis::Plugins::Nexpose
 
-    @content_service = Dradis::Plugins::ContentService.new(plugin: plugin)
-    template_service = Dradis::Plugins::TemplateService.new(plugin: plugin)
+    @content_service = Dradis::Plugins::ContentService::Base.new(
+      logger: Logger.new(STDOUT),
+      plugin: plugin
+    )
 
     @importer = plugin::Importer.new(
       content_service: @content_service,
-      template_service: template_service
     )
 
     # Stub dradis-plugins methods
@@ -92,27 +93,23 @@ describe 'Nexpose upload plugin' do
       end.once
 
       expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq("123/udp (open)")
-        expect(args[:parent].label).to eq("1.1.1.1")
+        expect(args[:label]).to eq("Definitions")
         OpenStruct.new(args)
       end.once
       expect(@content_service).to receive(:create_note) do |args|
         expect(args[:text]).to include("#[Title]#\nService name: NTP")
-        expect(args[:node].label).to eq("123/udp (open)")
+        expect(args[:node].label).to eq("1.1.1.1")
       end.once
 
       expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq("161/udp (open)")
-        expect(args[:parent].label).to eq("1.1.1.1")
+        expect(args[:label]).to eq("1.1.1.1")
         OpenStruct.new(args)
       end.once
       expect(@content_service).to receive(:create_note) do |args|
         expect(args[:text]).to include("#[Title]#\nService name: SNMP")
-        expect(args[:node].label).to eq("161/udp (open)")
+        expect(args[:node].label).to eq("1.1.1.1")
       end.once
 
-      expect(@content_service).to receive(:create_node).with(hash_including label: "Definitions").once
-
       expect(@content_service).to receive(:create_issue) do |args|
         expect(args[:text]).to include("#[Title]#\nApache HTTPD: error responses can expose cookies (CVE-2012-0053)")
         expect(args[:id]).to eq("ntp-clock-variables-disclosure")
@@ -125,10 +122,8 @@ describe 'Nexpose upload plugin' do
         OpenStruct.new(args)
       end.once
 
-      expect(@content_service).to receive(:create_node).with(hash_including label: "1.1.1.1", type: :host).once
-
       expect(@content_service).to receive(:create_evidence) do |args|
-        expect(args[:content]).to include("n/a")
+        expect(args[:content]).to include("#[ID]#\nntp-clock-variables-disclosure\n\n")
         expect(args[:issue].id).to eq("ntp-clock-variables-disclosure")
         expect(args[:node].label).to eq("1.1.1.1")
       end.once

data/templates/full_evidence.fields

@@ -0,0 +1,3 @@
+evidence.id
+evidence.status
+evidence.content

data/templates/full_evidence.sample

@@ -0,0 +1,17 @@
+<test id="http-coldfusion-cfide-unprotected" key="/CFIDE/adminapi/base.cfc?wsdl" status="vulnerable-exploited" scan-id="4" vulnerable-since="20141110T165124356" pci-compliance-status="fail">
+  <Paragraph>
+    <UnorderedList>
+      <ListItem>Running HTTP service</ListItem>
+    </UnorderedList>
+    <Paragraph>
+      <ContainerBlockElement>
+        <ContainerBlockElement>
+          <Paragraph>HTTP GET request to
+            <URLLink LinkURL="http://10.0.0.1" LinkTitle="http://10.0.0.1"/>
+          </Paragraph>HTTP response code was an expected 200
+          <Paragraph preformat="true">2: &lt;?xml version="1.0" encoding="UTF-8"?&gt;
+2: &lt;wsdl:definitions name="xfdregistry"</Paragraph></ContainerBlockElement>
+      </ContainerBlockElement>
+    </Paragraph>
+  </Paragraph>
+</test>

data/templates/full_evidence.template

@@ -0,0 +1,8 @@
+#[ID]#
+%evidence.id%
+
+#[Status]#
+%evidence.status%
+
+#[Content]#
+%evidence.content%

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-nexpose
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.7.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-04-06 00:00:00.000000000 Z
+date: 2017-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -124,12 +124,16 @@ files:
 - lib/nexpose/node.rb
 - lib/nexpose/scan.rb
 - lib/nexpose/service.rb
+- lib/nexpose/test.rb
 - lib/nexpose/vulnerability.rb
 - lib/tasks/thorfile.rb
 - spec/fixtures/files/full.xml
 - spec/fixtures/files/simple.xml
 - spec/nexpose_upload_spec.rb
 - spec/spec_helper.rb
+- templates/full_evidence.fields
+- templates/full_evidence.sample
+- templates/full_evidence.template
 - templates/full_node.fields
 - templates/full_node.sample
 - templates/full_node.template
@@ -165,7 +169,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Nexpose add-on for the Dradis Framework.