dradis-ntospider 4.2.0 → 4.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 11f997efdf06327552b67bb577e2aa2f0624bc275012e05ab2e08bbf00838d9f
-  data.tar.gz: 8d977c4f311943e9efcea7a3c43e000ddfe397f42727dd6f205af072edb18ded
+  metadata.gz: 1987331dcc279d1c8dd41c450b72c73c89f6b3f1b40db57ab432875367543016
+  data.tar.gz: 07e3f53cf6f9f99f3c311293b2b00bf309860973ee3c6e768b0471fd5abc42c4
 SHA512:
-  metadata.gz: 8b5e62bde94537215c16679eceefdf98a87d1dfed85a55b57f4c81fb42cc555cef3d68c0be30fc0d0b8d366c79cddd5007b388f31d8203e6fb01aa3beed9a523
-  data.tar.gz: 4cc106f3fe09c7a5b4f289568de8e996cb146414e8321b647c5c75ff38a72895e18053fb22f66704fb9da3d7cf948213ebc28df669a5ed9f82cd4e2e411c6111
+  metadata.gz: 97be744805f078429d5a7767cf345d44094ada49a08c9ee40b51ac26d33a956a29cd73be89df0d7b043b16ff71a77bebaf050dcf6884fbb68a08895232b6ab32
+  data.tar.gz: 7bc9eb986d36009dc49bcdb194edcaa4a1b6d92f263f0127db7468033156035f2c03622608395061670597abb43d9512471a9580abab2ce1dc97a564daf1f7c4

data/.gitignore

@@ -5,3 +5,7 @@ Gemfile.lock
 
 # Gem artifacts
 /pkg/
+/spec/internal/
+
+# byebug
+.byebug_history

data/.rspec

@@ -0,0 +1,2 @@
+--color
+-f d

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+v4.3.0 (April 2022)
+  - Expose additional fields for use in both Issue and Evidence.
+
 v4.2.0 (February 2022)
   - No changes
 

data/README.md

@@ -17,6 +17,11 @@ See the Dradis Framework's [README.md](https://github.com/dradis/dradisframework
 See the Dradis Framework's [CONTRIBUTING.md](https://github.com/dradis/dradisframework/blob/master/CONTRIBUTING.md)
 
 
+## Contributors
+
+ - Michael Gargiullo
+
+
 ## License
 
 Dradis Framework and all its components are released under [GNU General Public License version 2.0](http://www.gnu.org/licenses/old-licenses/gpl-2.0.html) as published by the Free Software Foundation and appearing in the file LICENSE included in the packaging of this file.

data/dradis-ntospider.gemspec

@@ -27,6 +27,9 @@ Gem::Specification.new do |spec|
   # s.add_dependency 'rails', '~> 4.1.1'
   spec.add_dependency 'dradis-plugins', '~> 4.0'
 
-  spec.add_development_dependency 'bundler', '~> 1.6'
-  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'bundler'
+  spec.add_development_dependency 'byebug'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'rspec-rails'
+  spec.add_development_dependency 'combustion'
 end

data/lib/dradis/plugins/ntospider/field_processor.rb

@@ -2,7 +2,11 @@ module Dradis::Plugins::NTOSpider
   class FieldProcessor < Dradis::Plugins::Upload::FieldProcessor
 
     def post_initialize(args={})
-      @nto_object = ::NTOSpider::Vuln.new(data)
+      if data.name == 'Vuln'
+        @nto_object = ::NTOSpider::Vuln.new(data)
+      else
+        @nto_object = ::NTOSpider::Attack.new(data)
+      end
     end
 
     def value(args={})

data/lib/dradis/plugins/ntospider/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 4
-        MINOR = 2
+        MINOR = 3
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/ntospider/importer.rb

@@ -53,13 +53,16 @@ module Dradis::Plugins::NTOSpider
         )
         issue = content_service.create_issue text: issue_text, id: plugin_id
 
-        logger.info{ "\t\t => Creating new evidence" }
-        evidence_content = template_service.process_template(
-          template: 'evidence', data: vuln.xml
-        )
-        content_service.create_evidence(
-          issue: issue, node: host_node, content: evidence_content
-        )
+        # App Spider can provide multiple pieces of evidence for an issue.
+        xml_vuln.xpath('./AttackList/Attack').each do |attack_xml|
+          logger.info{ "\t\t => Creating new evidence" }
+          evidence_content = template_service.process_template(
+            template: 'evidence', data: attack_xml
+          )
+          content_service.create_evidence(
+            issue: issue, node: host_node, content: evidence_content
+          )
+        end
       end
 
       true

data/lib/dradis-ntospider.rb

@@ -5,4 +5,5 @@ require 'dradis-plugins'
 require 'dradis/plugins/ntospider'
 
 # load supporting NTOSpider classes
+require 'ntospider/attack'
 require 'ntospider/vuln'

data/lib/ntospider/attack.rb

@@ -0,0 +1,75 @@
+module NTOSpider
+  # This class represents each of the vulnerabilities reported in the
+  # AppSpider VulnerabilitiesSummary.xml file as
+  # <AttackList/Attack> entities.
+  class Attack
+    attr_accessor :xml
+    # Accepts an XML node from Nokogiri::XML.
+    def initialize(xml_node)
+      @xml = xml_node
+    end
+
+    # List of supported tags. They can be attributes, simple descendants or
+    # collections (e.g. <references/>, <tags/>)
+    def supported_tags
+      [
+        # attributes
+
+        # simple tags
+        :attack_config_description, :attack_description, :attack_id,
+        :attack_matched_string, :attack_post_params, :attack_user_notes,
+        :attack_value, :attack_vuln_url, :original_response_code,
+        :original_value,
+
+        # nested tags
+        :attack_request, :attack_response, :benign
+      ]
+    end
+
+    # This allows external callers (and specs) to check for implemented
+    # properties
+    def respond_to?(method, include_private=false)
+      return true if supported_tags.include?(method.to_sym)
+      super
+    end
+
+    # This method is invoked by Ruby when a method that is not defined in this
+    # instance is called.
+    #
+    # In our case we inspect the @method@ parameter and try to find the
+    # attribute, simple descendent or collection that it maps to in the XML
+    # tree.
+    def method_missing(method, *args)
+      # We could remove this check and return nil for any non-recognized tag.
+      # The problem would be that it would make tricky to debug problems with
+      # typos. For instance: <>.potr would return nil instead of raising an
+      # exception
+      unless supported_tags.include?(method)
+        super
+        return
+      end
+
+      # First we try the attributes. In Ruby we use snake_case, but in XML
+      # CamelCase is used for some attributes
+      translations_table = {
+         attack_request: 'AttackRequestList/AttackRequest/Request',
+        attack_response: 'AttackRequestList/AttackRequest/Response',
+                 benign: 'AttackRequestList/AttackRequest/Benign'
+      }
+
+      method_name = translations_table.fetch(method, method.to_s.camelcase)
+
+      # no attributes in the <attack> node
+      # return @xml.attributes[method_name].value if @xml.attributes.key?(method_name)
+
+      # Then we try simple children tags: name, type, ...
+      tag = @xml.at_xpath("./#{method_name}")
+      if tag && !tag.text.blank?
+        return tag.text
+      else
+        # nothing found, the tag is valid but not present in this Attack
+        return nil
+      end
+    end
+  end
+end

data/lib/ntospider/vuln.rb

@@ -22,12 +22,18 @@ module NTOSpider
 
         # simple tags
         :attack_class, :attack_score, :attack_type, :attack_value, :capec,
-        :cwe_id, :description, :dissa_asc, :normalized_url, :oval, :owasp2007,
-        :owasp2010, :owasp2013, :recommendation, :vuln_method, :vuln_param,
-        :vuln_type, :vuln_url, :web_site
+        :confidence, :cwe_id, :description, :dissa_asc, :html_entity_attacked,
+        :normalized_url, :oval, :owasp2007, :owasp2010, :owasp2013, :owasp2017,
+        :page, :recommendation, :scan_date,
+        :statistically_prevalent_original_response_code, :url, :vuln_method,
+        :vuln_param, :vuln_param_type, :vuln_type, :vuln_url, :wasc, :web_site,
+        :web_site_ip,
+
         # nested tags
+        :imperva_bl, :imperva_wl, :mod_security_bl, :mod_security_wl,
+        :pcre_regex_bl, :pcre_regex_wl, :snort_bl, :snort_wl
       ]
-end
+    end
 
     # This allows external callers (and specs) to check for implemented
     # properties
@@ -55,18 +61,28 @@ end
       # First we try the attributes. In Ruby we use snake_case, but in XML
       # CamelCase is used for some attributes
       translations_table = {
-        capec:     'CAPEC',
+        capec: 'CAPEC',
         dissa_asc: 'DISSA_ASC',
+        imperva_bl: 'DefenseBL/Imperva',
+        imperva_wl: 'DefenseWL/Imperva',
+        mod_security_bl: 'DefenseBL/ModSecurity',
+        mod_security_wl: 'DefenseWL/ModSecurity',
+        oval: 'OVAL',
         owasp2007: 'OWASP2007',
         owasp2010: 'OWASP2010',
         owasp2013: 'OWASP2013',
-        oval:      'OVAL',
-        wasc:      'WASC'
+        owasp2017: 'OWASP2017',
+        pcre_regex_bl: 'DefenseBL/PcreRegex',
+        pcre_regex_wl: 'DefenseWL/PcreRegex',
+        snort_bl: 'DefenseBL/Snort',
+        snort_wl: 'DefenseWL/Snort',
+        wasc: 'WASC',
+        web_site_ip: 'WebSiteIP'
       }
 
       method_name = translations_table.fetch(method, method.to_s.camelcase)
 
-      # no attributes in the <issue> node
+      # no attributes in the <Vuln> node
       # return @xml.attributes[method_name].value if @xml.attributes.key?(method_name)
 
       # Then we try simple children tags: name, type, ...
@@ -113,6 +129,5 @@ end
     def tags_with_html_content
       [:description, :recommendation]
     end
-
   end
 end