dradis-nikto 3.9.0 → 3.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 699ef84ebbae450a8028495368bd78a6a1a37dfb
-  data.tar.gz: 60f0b08be055ab6fa07665d895a7b41514b955a5
+  metadata.gz: 992cd75d7d286dbd1753f77d865997c480bca52a
+  data.tar.gz: 84027effa233dde232390219bf140943087b0d45
 SHA512:
-  metadata.gz: 3af836b341c7aa7950e6b0b811acacef39f73e676394de8934f322ddd1115ccd9924305257ebc4e57a09360fbc68788ded8fd50b4867d26069ee10c9cefa5771
-  data.tar.gz: 8ab08ba2f28e199ff3409eb5dbd435ceeb1607a61c9fe475b18710ebfc304827fddc796cb404a54db0838b4a425be7c1cc4e51aa561a6dae99aab024f29e4d31
+  metadata.gz: 277c27cdaf1bef181789223c624e16c1c15b0cc76e68c5e5849dc5e0da3d71cf8fdfe536adae5ec6f2d36d098bf066748322849cdfc57039b78094c82e53b792
+  data.tar.gz: 5932de1422c34276f7044aea1d784978b157c39e2f36055ec0c767704d1d606b2fb87c2e11b182a6f4105a7a24ba76ecba22a8bc6716c876f4fba6ded0f61ebc

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Dradis Framework 3.10 (August, 2018) ##
+
+*   Create Issues from each finding `id` and a piece of
+    Evidence for each instance of that finding.
+
+*   Label the Node from the `targetip`.
+
 ## Dradis Framework 3.9 (January, 2018) ##
 
 *   No changes.

data/lib/dradis/plugins/nikto/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 3
-        MINOR = 9
+        MINOR = 10
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/nikto/importer.rb

@@ -26,11 +26,7 @@ module Dradis::Plugins::Nikto
       end
 
       doc.xpath('/nikto/niktoscan/scandetails').each do |xml_scan|
-        if xml_scan.has_attribute? "sitename"
-          host_label = xml_scan['sitename']
-        else
-          host_label = xml_scan['siteip']
-        end
+        host_label = xml_scan['targetip']
 
         # Hack to include the file name in the xml
         # so we can use it in the template
@@ -44,6 +40,14 @@ module Dradis::Plugins::Nikto
           text: scan_text,
           node: host_node)
 
+        # Add Node properties
+        if host_node.respond_to?(:properties)
+          host_node.set_property(:hostname, xml_scan['hostheader'])
+          host_node.set_property(:ip, xml_scan['targetip'])
+          host_node.set_property(:os, xml_scan['targetbanner'])
+          host_node.save
+        end
+
         # Check for SSL cert tag and add that data in as well
         unless xml_scan.at_xpath("ssl").nil?
           xml_ssl = xml_scan.at_xpath("ssl")
@@ -55,16 +59,14 @@ module Dradis::Plugins::Nikto
 
         # Items
         xml_scan.xpath("item").each do |xml_item|
-          item_label = xml_item.has_attribute?("id") ? xml_item["id"] : "Unknown"
-          item_node = content_service.create_node(
-          label: item_label,
-          type: :default,
-          parent: host_node)
-
+          plugin_id = xml_item.has_attribute?("id") ? xml_item["id"] : "Unknown"
           item_text = template_service.process_template(template: 'item', data: xml_item)
-          content_service.create_note(
-            text: item_text,
-            node: item_node)
+          logger.info{ 'Creating Issue ID' + plugin_id }
+          issue = content_service.create_issue(text: item_text, id: plugin_id)
+
+          logger.info{ "\t\t => Creating new evidence" }
+          evidence_content = template_service.process_template(template: 'evidence', data: xml_item)
+          content_service.create_evidence(issue: issue, node: host_node, content: evidence_content)
         end
       end
 

data/spec/nikto_upload_spec.rb

@@ -1,8 +1,7 @@
 require 'spec_helper'
 
-describe 'Nikto upload plugin' do
-  describe "Importer" do
-
+module Dradis::Plugins
+  describe 'Nikto upload plugin' do
     before(:each) do
       # Stub template service
       templates_dir = File.expand_path('../../templates', __FILE__)
@@ -12,12 +11,13 @@ describe 'Nikto upload plugin' do
       # Init services
       plugin = Dradis::Plugins::Nikto
 
-      @content_service = Dradis::Plugins::ContentService.new(plugin: plugin)
-      template_service = Dradis::Plugins::TemplateService.new(plugin: plugin)
+      @content_service = Dradis::Plugins::ContentService::Base.new(
+        logger: Logger.new(STDOUT),
+        plugin: plugin
+      )
 
-      @importer = plugin::Importer.new(
+      @importer = Dradis::Plugins::Nikto::Importer.new(
         content_service: @content_service,
-        template_service: template_service
       )
 
       # Stub dradis-plugins methods
@@ -25,95 +25,86 @@ describe 'Nikto upload plugin' do
       # They return their argument hashes as objects mimicking
       # Nodes, Issues, etc
       allow(@content_service).to receive(:create_node) do |args|
-        puts "create_node: #{ args.inspect }"
         OpenStruct.new(args)
       end
       allow(@content_service).to receive(:create_note) do |args|
-        puts "create_note: #{ args.inspect }"
         OpenStruct.new(args)
       end
       allow(@content_service).to receive(:create_issue) do |args|
-        puts "create_issue: #{ args.inspect }"
         OpenStruct.new(args)
       end
       allow(@content_service).to receive(:create_evidence) do |args|
-        puts "create_evidence: #{ args.inspect }"
         OpenStruct.new(args)
       end
     end
 
-    it "creates nodes, issues, notes and an evidences as needed" do
-      # Host node and basic host info note
+    let(:example_xml) { 'spec/fixtures/files/localhost.xml' }
+
+    def run_import!
+      @importer.import(file: example_xml)
+    end
+
+    it "creates nodes as needed" do
+      # Creates the Host Node
       expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq('http://localhost:80/')
+        expect(args[:label]).to eq('127.0.0.1')
         expect(args[:type]).to eq(:host)
         OpenStruct.new(args)
       end.once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:node].label).to eq("http://localhost:80/")
-        expect(args[:text]).to include("#[Title]#\nNikto upload: localhost.xml")
-        expect(args[:text]).to_not include("not recognized by the plugin")
-        OpenStruct.new(args)
-      end.once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:node].label).to eq("http://localhost:80/")
-        expect(args[:text]).to include("SSL Cert Information")
-        expect(args[:text]).to_not include("not recognized by the plugin")
-        OpenStruct.new(args)
-      end.once
+      run_import!
+    end
 
-      expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq('750000')
-        expect(args[:parent].label).to eq("http://localhost:80/")
+    it "creates issues as needed" do
+      # Creates 3 Issues
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include("#[Title]#\n\/\: Directory indexing found.")
         OpenStruct.new(args)
-      end.once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:node].label).to eq("750000")
-        expect(args[:text]).to include("/: Directory indexing found.")
-        expect(args[:text]).to_not include("not recognized by the plugin")
-        expect(args[:text]).to include("OSVDB: \"3268\":3268_LINK")
-        OpenStruct.new(args)
-      end.once
+      end
 
-      expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq('600050')
-        expect(args[:parent].label).to eq("http://localhost:80/")
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include("#[Title]#\nApache/2.2.16 appears to be outdated (current is at least Apache/2.2.19). Apache 1.3.42 (final release) and 2.0.64 are also current.")
         OpenStruct.new(args)
       end.once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:node].label).to eq("600050")
-        expect(args[:text]).to include("Apache/2.2.16 appears to be outdated")
-        expect(args[:text]).to_not include("not recognized by the plugin")
+
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include("#[Title]#\nAllowed HTTP Methods: GET, HEAD, POST, OPTIONS")
         OpenStruct.new(args)
       end.once
 
-      expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq('999990')
-        expect(args[:parent].label).to eq("http://localhost:80/")
+      run_import!
+    end
+
+    it "creates evidence as needed" do
+      # Creates 4 instances of Evidence for the 3 Issues
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("Link: http://localhost:80/")
+        expect(args[:issue].text).to include("Directory indexing found.")
+        expect(args[:node].label).to eq("127.0.0.1")
         OpenStruct.new(args)
       end.once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:node].label).to eq("999990")
-        expect(args[:text]).to include("Allowed HTTP Methods: GET, HEAD, POST, OPTIONS")
-        expect(args[:text]).to_not include("not recognized by the plugin")
+
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("Link: http://localhost:80/")
+        expect(args[:issue].text).to include("Apache/2.2.16 appears to be outdated (current is at least Apache/2.2.19). Apache 1.3.42 (final release) and 2.0.64 are also current.")
+        expect(args[:node].label).to eq("127.0.0.1")
         OpenStruct.new(args)
       end.once
 
-      expect(@content_service).to receive(:create_node) do |args|
-        expect(args[:label]).to eq('750000')
-        expect(args[:parent].label).to eq("http://localhost:80/")
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("Link: http://localhost:80/")
+        expect(args[:issue].text).to include("Allowed HTTP Methods: GET, HEAD, POST, OPTIONS")
+        expect(args[:node].label).to eq("127.0.0.1")
         OpenStruct.new(args)
       end.once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:node].label).to eq("750000")
-        expect(args[:text]).to include("/?show=http://cirt.net/rfiinc.txt??: Directory indexing found.")
-        expect(args[:text]).to_not include("not recognized by the plugin")
-        expect(args[:text]).to include("OSVDB: \"n/a\":n/a")
+
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("Link: http://localhost:80/?show=http://cirt.net/rfiinc.txt??")
+        expect(args[:issue].text).to include("Directory indexing found.")
+        expect(args[:node].label).to eq("127.0.0.1")
         OpenStruct.new(args)
       end.once
 
-      # Run the import
-      @importer.import(file: 'spec/fixtures/files/localhost.xml')
+      run_import!
     end
 
   end

data/templates/evidence.fields

@@ -0,0 +1,4 @@
+item.request_method
+item.uri
+item.namelink
+item.iplink

data/templates/evidence.sample

@@ -0,0 +1,6 @@
+<item id="750000" method="GET" osvdbid="3268" osvdblink="3268_LINK">
+  <description><![CDATA[/: Directory indexing found.]]></description>
+  <uri><![CDATA[/]]></uri>
+  <namelink><![CDATA[http://localhost:80/]]></namelink>
+  <iplink><![CDATA[http://127.0.0.1:80/]]></iplink>
+</item>

data/templates/evidence.template

@@ -0,0 +1,6 @@
+#[Request]#
+Request Method: %item.request_method%
+
+#[Links]#
+Link: %item.namelink%
+IP Based Link: %item.iplink%

data/templates/item.template

@@ -1,10 +1,8 @@
-#[Title]#
-Finding
-
+##[Title]#
+%item.description%
 
 #[Details]#
-OSVDB: "%item.osvdbid%":%item.osvdblink%
-Request Method: %item.request_method%
-Description: %item.description%
-Link: %item.namelink%
-IP Based Link: %item.iplink%
+%item.description%
+
+#[OSVDB]#
+"%item.osvdbid%":%item.osvdblink%

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-nikto
 version: !ruby/object:Gem::Version
-  version: 3.9.0
+  version: 3.10.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-08 00:00:00.000000000 Z
+date: 2018-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -125,6 +125,9 @@ files:
 - spec/fixtures/files/localhost.xml
 - spec/nikto_upload_spec.rb
 - spec/spec_helper.rb
+- templates/evidence.fields
+- templates/evidence.sample
+- templates/evidence.template
 - templates/item.fields
 - templates/item.sample
 - templates/item.template
@@ -154,7 +157,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Nikto add-on for the Dradis Framework.