librex 0.0.68 → 0.0.70

data/lib/rex/parser/openvas_nokogiri.rb

@@ -4,168 +4,168 @@ require "rex/parser/nokogiri_doc_mixin"
 module Rex
 module Parser
 
-	# If Nokogiri is available, define OpenVAS document class.
-	load_nokogiri && class OpenVASDocument < Nokogiri::XML::SAX::Document
-
-	include NokogiriDocMixin
-
-	# ourselves with the @state variable, turning things on when we
-	# get here (and turning things off when we exit in end_element()).
-	def start_element(name=nil,attrs=[])
-		attrs = normalize_attrs(attrs)
-		block = @block
-		@state[:current_tag][name] = true
-		case name
-		when "host"
-			@state[:has_text] = true
-		end
-	end
-
-	# When we exit a tag, this is triggered.
-	def end_element(name=nil)
-		block = @block
-		case name
-		when "name"
-			return if not in_tag("result")
-			@state[:has_text] = true
-			@state[:vuln_name] = @text.strip if @text
-			@text = nil
-		when "description"
-			@state[:has_text] = true
-			@state[:vuln_desc] = @text.strip if @text
-			@text = nil
-		when "bid"
-			return if not in_tag("result")
-			return if not in_tag("nvt")
-			@state[:has_text] = true
-			@state[:bid] = @text.strip if @text
-			@text = nil
-		when "cve"
-			return if not in_tag("result")
-			return if not in_tag("nvt")
-			@state[:has_text] = true
-			@state[:cves] = @text.strip if @text
-			@text = nil
-		when "risk_factor"
-			return if not in_tag("result")
-			return if not in_tag("nvt")
-
-			#we do this to clean out the buffer so to speak
-			#if we don't set text to nil now, the text will show up later
-			@state[:has_text] = true
-			@text = nil
-		when "cvss_base"
-			return if not in_tag("result")
-			return if not in_tag("nvt")
-			@state[:has_text] = true
-			@text = nil
-		when "subnet"
-			@state[:has_text] = true
-			@text = nil
-		when "result"
-			return if not in_tag("results")
-			record_vuln
-		when "threat"
-			return if not in_tag("ports")
-			return if not in_tag("port")
-			@state[:has_text] = true
-
-			if not @text.index('(')
-				@state[:name] = nil
-				@state[:port] = nil
-				@state[:proto] = nil
-				@text = nil
-				return
-			end
-
-			@state[:name] = @text.split(' ')[0] if @text
-			@state[:port] = @text.split('(')[1].split('/')[0] if @text
-			@state[:proto] = @text.split('(')[1].split('/')[1].split(')')[0] if @text
-
-			@text = nil
-		when "host"
-			if in_tag('result')
-				@state[:has_text] = true
-				@state[:host] = @text.strip if @text
-				@text = nil
-			elsif in_tag('ports')
-				return if not in_tag('port')
-				@state[:has_text] = true
-				@state[:host] = @text.strip if @text
-				@text = nil
-			end
-		when "port"
-			if in_tag('result')
-				@state[:has_text] = true
-				if not @text.index('(')
-					@state[:proto] = nil
-					@state[:port] = nil
-					@text = nil
-					return
-				end
-				@state[:proto] = @text.split('(')[0].strip if @text
-				@state[:port] = @text.split('(')[1].split('/')[0].gsub(/\)/, '') if @text
-				@text = nil
-			elsif in_tag('ports')
-				record_service
-			end
-		when "name"
-			return if not in_tag("result")
-			@state[:has_text] = true
-			@text = nil
-		end
-		@state[:current_tag].delete name
-	end
-
-	def record_vuln
-		if (@state[:cves] and @state[:cves] == "NOCVE")  and (@state[:bid] and @state[:bid] == "NOBID")
-			return
-		end
-
-		if @state[:cves] and @state[:cves] != "NOCVE" and !@state[:cves].empty?
-			@state[:cves].split(',').each do |cve|
-				vuln_info = {}
-				vuln_info[:host] = @state[:host]
-				vuln_info[:refs] = normalize_references([{ :source => "CVE", :value => cve}])
-				vuln_info[:name] = @state[:vuln_name]
-				vuln_info[:info] = @state[:vuln_desc]
-				vuln_info[:port] = @state[:port]
-				vuln_info[:proto] = @state[:proto]
-
-				db_report(:vuln, vuln_info)
-			end
-		end
-		if @state[:bid] and @state[:bid] != "NOBID" and !@state[:bid].empty?
-			@state[:bid].split(',').each do |bid|
-				vuln_info = {}
-				vuln_info[:host] = @state[:host]
-				vuln_info[:refs] = normalize_references([{ :source => "BID", :value => bid}])
-				vuln_info[:name] = @state[:vuln_name]
-				vuln_info[:info] = @state[:vuln_desc]
-				vuln_info[:port] = @state[:port]
-				vuln_info[:proto] = @state[:proto]
-
-				db_report(:vuln, vuln_info)
-			end
-		end
-	end
-
-	def record_service
-		return if not @state[:name]
-
-		service_info = {}
-		service_info[:host] = @state[:host]
-		service_info[:name] = @state[:name]
-		service_info[:port] = @state[:port]
-		service_info[:proto] = @state[:proto]
-
-		db_report(:service, service_info)
-
-		host_info = {}
-		host_info[:host] = @state[:host]
-
-		db_report(:host, host_info)
-	end
+  # If Nokogiri is available, define OpenVAS document class.
+  load_nokogiri && class OpenVASDocument < Nokogiri::XML::SAX::Document
+
+  include NokogiriDocMixin
+
+  # ourselves with the @state variable, turning things on when we
+  # get here (and turning things off when we exit in end_element()).
+  def start_element(name=nil,attrs=[])
+    attrs = normalize_attrs(attrs)
+    block = @block
+    @state[:current_tag][name] = true
+    case name
+    when "host"
+      @state[:has_text] = true
+    end
+  end
+
+  # When we exit a tag, this is triggered.
+  def end_element(name=nil)
+    block = @block
+    case name
+    when "name"
+      return if not in_tag("result")
+      @state[:has_text] = true
+      @state[:vuln_name] = @text.strip if @text
+      @text = nil
+    when "description"
+      @state[:has_text] = true
+      @state[:vuln_desc] = @text.strip if @text
+      @text = nil
+    when "bid"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+      @state[:has_text] = true
+      @state[:bid] = @text.strip if @text
+      @text = nil
+    when "cve"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+      @state[:has_text] = true
+      @state[:cves] = @text.strip if @text
+      @text = nil
+    when "risk_factor"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+
+      #we do this to clean out the buffer so to speak
+      #if we don't set text to nil now, the text will show up later
+      @state[:has_text] = true
+      @text = nil
+    when "cvss_base"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+      @state[:has_text] = true
+      @text = nil
+    when "subnet"
+      @state[:has_text] = true
+      @text = nil
+    when "result"
+      return if not in_tag("results")
+      record_vuln
+    when "threat"
+      return if not in_tag("ports")
+      return if not in_tag("port")
+      @state[:has_text] = true
+
+      if not @text.index('(')
+        @state[:name] = nil
+        @state[:port] = nil
+        @state[:proto] = nil
+        @text = nil
+        return
+      end
+
+      @state[:name] = @text.split(' ')[0] if @text
+      @state[:port] = @text.split('(')[1].split('/')[0] if @text
+      @state[:proto] = @text.split('(')[1].split('/')[1].split(')')[0] if @text
+
+      @text = nil
+    when "host"
+      if in_tag('result')
+        @state[:has_text] = true
+        @state[:host] = @text.strip if @text
+        @text = nil
+      elsif in_tag('ports')
+        return if not in_tag('port')
+        @state[:has_text] = true
+        @state[:host] = @text.strip if @text
+        @text = nil
+      end
+    when "port"
+      if in_tag('result')
+        @state[:has_text] = true
+        if not @text.index('(')
+          @state[:proto] = nil
+          @state[:port] = nil
+          @text = nil
+          return
+        end
+        @state[:proto] = @text.split('(')[0].strip if @text
+        @state[:port] = @text.split('(')[1].split('/')[0].gsub(/\)/, '') if @text
+        @text = nil
+      elsif in_tag('ports')
+        record_service
+      end
+    when "name"
+      return if not in_tag("result")
+      @state[:has_text] = true
+      @text = nil
+    end
+    @state[:current_tag].delete name
+  end
+
+  def record_vuln
+    if (@state[:cves] and @state[:cves] == "NOCVE")  and (@state[:bid] and @state[:bid] == "NOBID")
+      return
+    end
+
+    if @state[:cves] and @state[:cves] != "NOCVE" and !@state[:cves].empty?
+      @state[:cves].split(',').each do |cve|
+        vuln_info = {}
+        vuln_info[:host] = @state[:host]
+        vuln_info[:refs] = normalize_references([{ :source => "CVE", :value => cve}])
+        vuln_info[:name] = @state[:vuln_name]
+        vuln_info[:info] = @state[:vuln_desc]
+        vuln_info[:port] = @state[:port]
+        vuln_info[:proto] = @state[:proto]
+
+        db_report(:vuln, vuln_info)
+      end
+    end
+    if @state[:bid] and @state[:bid] != "NOBID" and !@state[:bid].empty?
+      @state[:bid].split(',').each do |bid|
+        vuln_info = {}
+        vuln_info[:host] = @state[:host]
+        vuln_info[:refs] = normalize_references([{ :source => "BID", :value => bid}])
+        vuln_info[:name] = @state[:vuln_name]
+        vuln_info[:info] = @state[:vuln_desc]
+        vuln_info[:port] = @state[:port]
+        vuln_info[:proto] = @state[:proto]
+
+        db_report(:vuln, vuln_info)
+      end
+    end
+  end
+
+  def record_service
+    return if not @state[:name]
+
+    service_info = {}
+    service_info[:host] = @state[:host]
+    service_info[:name] = @state[:name]
+    service_info[:port] = @state[:port]
+    service_info[:proto] = @state[:proto]
+
+    db_report(:service, service_info)
+
+    host_info = {}
+    host_info[:host] = @state[:host]
+
+    db_report(:host, host_info)
+  end
 end
 end
 end

data/lib/rex/parser/outpost24_nokogiri.rb

@@ -0,0 +1,239 @@
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+module Parser
+
+load_nokogiri && class Outpost24Document < Nokogiri::XML::SAX::Document
+
+  include NokogiriDocMixin
+
+  def start_element(name, attrs)
+    @state[:current_tag][name] = true
+    case name
+    when "description", "information"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      record_text
+    when "detail"
+      return unless in_tag("detaillist")
+      record_vuln
+    when "detaillist"
+      record_vulns
+    when "host"
+      return unless in_tag("hostlist")
+      record_host
+    when "hostlist"
+      record_hosts
+    when "id"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      return unless in_tag("cve")
+      record_text
+    when "name"
+      return unless in_tag("hostlist") || in_tag("detaillist")
+      return unless in_tag("host") || in_tag("detail")
+      record_text
+    when "platform"
+      return unless in_tag("hostlist")
+      return unless in_tag("host")
+      record_text
+    when "portinfo"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      record_service
+    when "portlist"
+      record_services
+    when "portnumber", "protocol", "service"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      return unless in_tag("portinfo")
+      record_text
+    when "report", "ip"
+      record_text
+    end
+  end
+
+  def end_element(name)
+    case name
+    when "description", "information"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      collect_vuln_data(name)
+    when "detail"
+      return unless in_tag("detaillist")
+      collect_vuln
+    when "detaillist"
+      report_vulns
+    when "host"
+      return unless in_tag("hostlist")
+      collect_host
+    when "hostlist"
+      report_hosts
+    when "id"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      return unless in_tag("cve")
+      collect_vuln_data(name)
+    when "ip"
+      collect_ip
+    when "name"
+      if in_tag("hostlist") && in_tag("host")
+        collect_host_data(name)
+      elsif in_tag("detaillist") && in_tag("detail")
+        collect_vuln_data(name)
+      end
+    when "platform"
+      return unless in_tag("hostlist")
+      return unless in_tag("host")
+      collect_host_data(name)
+    when "portinfo"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      collect_service
+    when "portlist"
+      report_services
+    when "portnumber", "protocol", "service"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      return unless in_tag("portinfo")
+      collect_service_data(name)
+    when "report"
+      collect_product
+    end
+    @state[:current_tag].delete(name)
+  end
+
+  def record_hosts
+    @report_data[:hosts] = []
+  end
+
+  def record_services
+    @report_data[:services] = []
+  end
+
+  def record_vulns
+    @report_data[:vulns] = []
+  end
+
+  def record_host
+    @host = {}
+  end
+
+  def record_service
+    @service = {}
+  end
+
+  def record_vuln
+    @vuln = {}
+    @refs = []
+  end
+
+  def record_text
+    @state[:has_text] = true
+  end
+
+  def collect_host
+    @host[:host] = @state[:host]
+    @host[:name] = @state[:hname]
+    @host[:os_name] = @state[:os_name]
+    @host[:info] = @state[:pinfo]
+    @report_data[:hosts] << @host
+  end
+
+  def collect_service
+    @service[:host] = @state[:host]
+    @service[:port] = @state[:port]
+    @service[:proto] = @state[:proto]
+    @service[:name] = @state[:sname]
+    @service[:info] = @state[:pinfo]
+    @report_data[:services] << @service
+  end
+
+  def collect_vuln
+    @vuln[:host] = @state[:host]
+    @vuln[:name] = @state[:vname]
+    @vuln[:info] = @state[:vinfo]
+    @vuln[:refs] = @refs
+    @report_data[:vulns] << @vuln
+  end
+
+  def collect_product
+    @state[:has_text] = false
+    @state[:pinfo] = @text.strip if @text
+    @text = nil
+  end
+
+  def collect_ip
+    @state[:has_text] = false
+    @state[:host] = @text.strip if @text
+    @text = nil
+  end
+
+  def collect_host_data(name)
+    @state[:has_text] = false
+    if name == "name"
+      @state[:hname] = @text.strip if @text
+    elsif name == "platform"
+      if @text
+        @state[:os_name] = @text.strip
+      else
+        @state[:os_name] = Msf::OperatingSystems::UNKNOWN
+      end
+    end
+    @text = nil
+  end
+
+  def collect_service_data(name)
+    @state[:has_text] = false
+    if name == "portnumber"
+      @state[:port] = @text.strip if @text
+    elsif name == "protocol"
+      @state[:proto] = @text.strip.downcase if @text
+    elsif name == "service"
+      @state[:sname] = @text.strip if @text
+    end
+    @text = nil
+  end
+
+  def collect_vuln_data(name)
+    @state[:has_text] = false
+    if name == "name"
+      @state[:vname] = @text.strip if @text
+    elsif name == "description"
+      @state[:vinfo] = @text.strip if @text
+    elsif name == "information"
+      @state[:vinfo] << " #{@text.strip if @text}"
+    elsif name == "id"
+      @state[:ref] = @text.strip if @text
+      @refs << normalize_ref("CVE", @state[:ref])
+    end
+    @text = nil
+  end
+
+  def report_hosts
+    block = @block
+    @report_data[:hosts].each do |h|
+      db.emit(:address, h[:host], &block) if block
+      db_report(:host, h)
+    end
+  end
+
+  def report_services
+    block = @block
+    @report_data[:services].each do |s|
+      db.emit(:service, "#{s[:host]}:#{s[:port]}/#{s[:proto]}", &block) if block
+      db_report(:service, s)
+    end
+  end
+
+  def report_vulns
+    block = @block
+    @report_data[:vulns].each do |v|
+      db.emit(:vuln, ["#{v[:name]} (#{v[:host]})", 1], &block) if block
+      db_report(:vuln, v)
+    end
+  end
+
+end
+end
+end