dradis-nikto 4.2.0 → 4.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0923a16340a07a45168347565fa1712c4ad0659a7847ab77165b7cf28b71d2aa'
-  data.tar.gz: 3228efc9d79c6a3d3370ddc9286293fb73b1f66476caa0314c571411c3fa71a7
+  metadata.gz: 35e7d905453076a357fce2f4c628e5ae58141174e9529de58771817771769dbc
+  data.tar.gz: 533b94c165b7942009cb5481be374d7c4b4f7f7390fa5b28c970c456aef07f75
 SHA512:
-  metadata.gz: bd0db28850fc1d622b8f1d9679d5180e74c633d5da91b515fd87deb88b52d9104a6d9c6a7121da01ad43ab427864c7d584f9aa371f948cfa659b2d5c28cb0305
-  data.tar.gz: 565a1d06b816ba8b21f7e731859b15bb9541380aa9979abc438127128cb18b02574264d11af2a21ba4c6f5bc35831211f476d3fc88fada54cdaf9e5138be76e4
+  metadata.gz: 24cd76b957b7524813af35146b0b5b5da1f74a9cb73583262df051cb592d8a4ee20f84cc363296c9fb0776b8110dfea663110694f285aa5fc9d22f1f8573387b
+  data.tar.gz: f4a7ba049719a1eb3aeb5dda0d34e5c3639ae72ff288df7a8d02fdce61c694f39f139baa344ba65f4ea5e2a4ce4632be2d9d73b27011970df5d8badf15650410

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+v4.5.0 (August 2022)
+  - No changes
+
+v4.4.0 (June 2022)
+  - Make references available as an issue field
+  - Registers template mappings locally
+
+v4.3.0 (April 2022)
+  - No changes
+
 v4.2.0 (February 2022)
   - No changes
 

data/lib/dradis/plugins/nikto/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 4
-        MINOR = 2
+        MINOR = 5
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/nikto/importer.rb

@@ -1,5 +1,9 @@
 module Dradis::Plugins::Nikto
   class Importer < Dradis::Plugins::Upload::Importer
+    def self.templates
+      { evidence: 'evidence', issue: 'item' }
+    end
+
     # The framework will call this function if the user selects this plugin from
     # the dropdown list and uploads a file.
     # @returns true if the operation was successful, false otherwise

data/lib/nikto/item.rb

@@ -8,6 +8,8 @@ module Nikto
   # Instead of providing separate methods for each supported property we rely
   # on Ruby's #method_missing to do most of the work.
   class Item
+    TAGS_WITH_CSV_CONTENT = %i[references].freeze
+
     # Accepts an XML node from Nokogiri::XML.
     def initialize(xml_node)
       @xml = xml_node
@@ -18,10 +20,10 @@ module Nikto
     def supported_tags
       [
         # attributes
-        :id, :request_method, :osvdblink, :osvdbid,
+        :id, :osvdbid, :osvdblink, :request_method,
 
         # simple tags
-        :description, :uri, :namelink, :iplink
+        :description, :iplink, :namelink, :uri, :references
       ]
     end
 
@@ -57,10 +59,18 @@ module Nikto
       return @xml.attributes[method_name].value if @xml.attributes.key?(method_name)
 
       # Then we try simple children tags
-      tag = @xml.xpath("./#{ method_name }").first
-      if tag
-        return tag.text
+      tag = @xml.xpath("./#{method_name}").first
+
+      if tag && tag.text.present?
+        text = tag.text
+        TAGS_WITH_CSV_CONTENT.include?(method) ? cleanup_csv(text) : text
       end
     end
+
+    private
+
+    def cleanup_csv(text)
+      CSV.parse(text).join("\n")
+    end
   end
 end

data/spec/fixtures/files/sample_v2.5.0.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<!DOCTYPE niktoscan SYSTEM "docs/nikto.dtd">
+<niktoscan>
+<niktoscan hoststest="0" options="-h localhost -p 80 -out /tmp/localhost.xml" version="2.1.4" scanstart="Sun Jul 17 19:54:10 2011" scanend="Thu Jan  1 01:00:00 1970" scanelapsed=" seconds" nxmlversion="1.1">
+<scandetails targetip="127.0.0.1" targethostname="localhost" targetport="80" targetbanner="Apache/2.2.16 (Debian)" starttime="2011-07-18 19:54:10" sitename="http://localhost:80/" siteip="http://127.0.0.1:80/" hostheader="localhost">
+<ssl ciphers="DHE-RSA-AES256-SHA" issuers="/C=GB/ST=Berks/L=Ruscombe/O=XXXXXX/OU=XXXX/CN=asdf.com/emailAddress=someoneatasdf.com" info="/C=GB/ST=Berkshire/L=Ruscombe/O=Company/OU=UK/CN=vmx098" />
+
+<item id="750000" osvdbid="3268" osvdblink="3268_LINK" method="GET">
+<description><![CDATA[/: Directory indexing found.]]></description>
+<uri><![CDATA[/]]></uri>
+<namelink><![CDATA[http://localhost:80/]]></namelink>
+<iplink><![CDATA[http://127.0.0.1:80/]]></iplink>
+<references><![CDATA["000000","CVE-2006-6133","https://example.com/"]]></references>
+</item>
+
+<statistics elapsed="10" itemsfound="44" itemstested="6456" endtime="2011-07-18 19:54:20" />
+</scandetails>
+
+</niktoscan>
+  
+</niktoscan>

data/spec/{nikto_upload_spec.rb → upload_v2.1.4_spec.rb}

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 module Dradis::Plugins
-  describe 'Nikto upload plugin' do
+  describe 'Nikto v2.1.4 upload plugin' do
     before(:each) do
       # Stub template service
       templates_dir = File.expand_path('../../templates', __FILE__)
@@ -24,21 +24,14 @@ module Dradis::Plugins
       #
       # They return their argument hashes as objects mimicking
       # Nodes, Issues, etc
-      allow(@content_service).to receive(:create_node) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_note) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_issue) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_evidence) do |args|
-        OpenStruct.new(args)
+      %w[evidence issue node note].each do |resource|
+        allow(@content_service).to receive("create_#{resource}") do |args|
+          OpenStruct.new(args)
+        end
       end
     end
 
-    let(:example_xml) { 'spec/fixtures/files/localhost.xml' }
+    let(:example_xml) { 'spec/fixtures/files/sample_v2.1.4.xml' }
 
     def run_import!
       @importer.import(file: example_xml)

data/spec/upload_v2.5.0_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+module Dradis::Plugins
+  describe 'Nikto v2.5.0 upload plugin' do
+    before(:each) do
+      # Stub template service
+      templates_dir = File.expand_path('../../templates', __FILE__)
+      expect_any_instance_of(Dradis::Plugins::TemplateService)
+      .to receive(:default_templates_dir).and_return(templates_dir)
+
+      # Init services
+      plugin = Dradis::Plugins::Nikto
+
+      @content_service = Dradis::Plugins::ContentService::Base.new(
+        logger: Logger.new(STDOUT),
+        plugin: plugin
+      )
+
+      @importer = Dradis::Plugins::Nikto::Importer.new(
+        content_service: @content_service,
+      )
+
+      # Stub dradis-plugins methods
+      #
+      # They return their argument hashes as objects mimicking
+      # Nodes, Issues, etc
+      %w[evidence issue node note].each do |resource|
+        allow(@content_service).to receive("create_#{resource}") do |args|
+          OpenStruct.new(args)
+        end
+      end
+    end
+
+    let(:example_xml) { 'spec/fixtures/files/sample_v2.5.0.xml' }
+
+    def run_import!
+      @importer.import(file: example_xml)
+    end
+
+    it 'creates issue with references' do
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include("#[Title]#\n\/\: Directory indexing found.")
+        expect(args[:text]).to include("#[References]#\n000000\nCVE-2006-6133\nhttps://example.com/")
+        OpenStruct.new(args)
+      end
+
+      run_import!
+    end
+  end
+end

data/templates/item.fields

@@ -1,8 +1,9 @@
+item.description
 item.id
-item.request_method
+item.iplink
+item.namelink
 item.osvdbid
 item.osvdblink
-item.description
+item.references
+item.request_method
 item.uri
-item.namelink
-item.iplink

data/templates/item.sample

@@ -3,4 +3,5 @@
   <uri><![CDATA[/]]></uri>
   <namelink><![CDATA[http://localhost:80/]]></namelink>
   <iplink><![CDATA[http://127.0.0.1:80/]]></iplink>
+  <references><![CDATA[http://example.com]]></references>
 </item>

data/templates/item.template

@@ -4,5 +4,5 @@
 #[Details]#
 %item.description%
 
-#[OSVDB]#
-"%item.osvdbid%":%item.osvdblink%
+#[References]#
+%item.references%

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-nikto
 version: !ruby/object:Gem::Version
-  version: 4.2.0
+  version: 4.5.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-14 00:00:00.000000000 Z
+date: 2022-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -125,9 +125,11 @@ files:
 - lib/nikto/scan.rb
 - lib/nikto/ssl.rb
 - lib/tasks/thorfile.rb
-- spec/fixtures/files/localhost.xml
-- spec/nikto_upload_spec.rb
+- spec/fixtures/files/sample_v2.1.4.xml
+- spec/fixtures/files/sample_v2.5.0.xml
 - spec/spec_helper.rb
+- spec/upload_v2.1.4_spec.rb
+- spec/upload_v2.5.0_spec.rb
 - templates/evidence.fields
 - templates/evidence.sample
 - templates/evidence.template
@@ -159,11 +161,13 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.28
 signing_key: 
 specification_version: 4
 summary: Nikto add-on for the Dradis Framework.
 test_files:
-- spec/fixtures/files/localhost.xml
-- spec/nikto_upload_spec.rb
+- spec/fixtures/files/sample_v2.1.4.xml
+- spec/fixtures/files/sample_v2.5.0.xml
 - spec/spec_helper.rb
+- spec/upload_v2.1.4_spec.rb
+- spec/upload_v2.5.0_spec.rb