nessus_client 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34cd232810e228f40b9badc3c3c38cd8ca0a4481baf376df4ff37f9f308af34b
-  data.tar.gz: 2c9fd0c05537ecf3aad03fb9c4e5f2abf7fde7eb3f1f805edcde53a3a025efe3
+  metadata.gz: 9b009898d60e9cf21fbaa66050139ddd5d38cf4aff33b45fae7fc146f56c518b
+  data.tar.gz: 7a6b5f73f2030bae2d4d2ddecd058fc088aaddb48da32384af977cfa6ffa0702
 SHA512:
-  metadata.gz: 29d460bc57991e7c9d162c77fd7efb247f6a6e68da82867dce865272497ba9b4a95d4214f73518498374cc680b64a4f69c78047d16ebbe85684c8b009066cccc
-  data.tar.gz: 6d4ce3058ec4c3cf6cf78a5b0041f0f02ce5adb1e02f6f3a3202a5ef5147197d0521d12673cac4976c05d2a97b0d468b8cf784e90fbd7f8414afd7ed100eeee3
+  metadata.gz: f1084ca533fe97317ebdf481df3c947e3e63249d7644f10c6428bca0ba0d67873d2eef99b8df4e5aec63d4da2005dfa3d38154a3d7036619c7e915636c9acc12
+  data.tar.gz: ab3fdc9d6b87679e4cea96e9efdd0cdd5fe65468649072d1a98c643aec69fdde04f8359b055e56f578d9d0be2aef7fbd8624d159079bc84fa64acaec313a1d29

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,71 @@
+# The NessusClient - Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+All complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org

data/README.md

@@ -1,11 +1,10 @@
 NessusClient
 =========
 
-Usable, fast, simple Ruby gem for Tenable Nessus Pro v6.x and v7.x
-
+Usable, fast, simple Ruby gem for Tenable Nessus Pro v7.x and v8.x
 NessusClient was designed to be simple, fast and performant through communication with Nessus over REST interface.
 
-[![Gem Version](https://badge.fury.io/rb/nessus_client.svg)](https://badge.fury.io/rb/nessus_client) [![codecov](https://codecov.io/gh/heyder/nessus_api/branch/master/graph/badge.svg)](https://codecov.io/gh/heyder/nessus_api) [![Inline docs](http://inch-ci.org/github/heyder/nessus_client.svg?branch=master)](http://inch-ci.org/github/heyder/nessus_client)
+[![Gem Version](https://badge.fury.io/rb/nessus_client.svg)](https://badge.fury.io/rb/nessus_client) [![codecov](https://codecov.io/gh/heyder/nessus_client/branch/master/graph/badge.svg)](https://codecov.io/gh/heyder/nessus_client) [![Inline docs](http://inch-ci.org/github/heyder/nessus_client.svg?branch=master)](http://inch-ci.org/github/heyder/nessus_client)
 
 **Ruby gem for Nessus API**
 
@@ -29,30 +28,38 @@ Getting started
 ```ruby
 require 'nessus_client'
 
-nc = NessusClient.new(
-  {
-    :uri=>'https://localhost:8834', 
-    :username=>'user',
-    :password=> 'password'
-  }
-)
-scan_uuid = nc.launch_by_name('scan_name',['192.168.10.0/28'])
-
-while true do
- scan_status = Oj.load( nc.scan_details( scan_uuid ) )["info"]["status"] 
-  if scan_status == "done"
-    export_id = nc.export_request( scan_uuid )
-    while true do
-      export_status = Oj.load( nc.export_status( export_id ) )["status"]
-      if export_status == "ready"
-        open("scan_report", "wb") do |file|
-          file.write(nc.export_download( scan_uuid ))
+nc = NessusClient.new( { :uri=>'https://localhost:8834', :username=>'username',:password=> 'password'} )
+status = Oj.load( nc.status )
+
+if status['status'] == 'ready'
+  scan_id = nc.get_scan_by_name('weekly_scan')
+  scan_uuid = Oj.load( nc.launch_by_name( 'weekly_scan' ,['127.0.0.1']) )['scan_uuid']
+
+  while true do
+   puts `clear`
+   scan_status = Oj.load( nc.scan_details( scan_id ) )["info"]["status"] 
+   puts " #{scan_id} - #{scan_uuid} - #{scan_status} "
+   sleep 5
+   if ["completed","canceled"].include? scan_status
+      export_request = Oj.load( nc.export_request( scan_id, "nessus" ))
+      puts " export request: #{export_request}"
+      while true do
+        puts `clear`
+        export_status = Oj.load( nc.export_status( export_request['token']) )["status"]
+        puts " export status: #{export_status}"
+        sleep 5
+        if export_status == "ready"
+          puts " downloading..."
+          open("scan_report", "wb") do |file|
+            file.write(nc.export_download( scan_id, export_request['file'] ))
+          end
+          exit 0
         end
-        break  
       end
-    end
- end
+   end
+  end
 end
+
 ```
 
 ## Installation
@@ -81,11 +88,11 @@ require 'oj'
 ## Code of Conduct
 
 Everyone participating in this project's development, issue trackers and other channels is expected to follow our
-[Code of Conduct](./CODE_OF_CONDUCT.md)
+[Code of Conduct](./CODE_OF_CONDUCT.md).
 
 ## Contributing
 
-See the [contributing guide](https://github.com/heyder/nessus_client/blob/master/CONTRIBUTING.md).
+See the [contributing guide](./CONTRIBUTING.md).
 
 ## Copyright
 

data/lib/modules/exports.rb

@@ -1,15 +1,12 @@
-# require_relative '../nessus_client/request'
-
 module NessusClient::Exports
 
-  # Reques a export of vulnerabilities scan.
+  # Request a export of vulnerabilities scan.
   # @param [String] scan_id The export uuid string.
-  # @param [String] format The export format.This
-  #   can be `nessus` or `nessus_db`.
+  # @param [String] format The file format to use (Nessus, HTML, PDF, CSV, or DB).
   # @return [JSON]  
-  def export_request( scan_id, format )
-    params = {:format => format }
-    self.request.post( "/scans/#{scan_id}/export", params )
+  def export_request( scan_id, format="nessus" )
+    payload = {:format => format }
+    self.request.post( { :path => "/scans/#{scan_id}/export", :payload => payload, :headers => self.headers} )
   end
 
   # Check the status of a export request
@@ -19,19 +16,20 @@ module NessusClient::Exports
   #   export_status = nc.export_status( "73376c41-1508-46b7-8587-483d159cd956" )
   #   return true if export_status["status"] == "ready"
   def export_status( export_id )
-    self.request.get( "/tokens/#{export_id}/status" )
+    self.request.get( {:path => "/tokens/#{export_id}/status", :headers => self.headers} )
   end
 
   # Download a vulnerabities scan output.
-  # @param [String] export_id The export uuid string.
+  # @param [Integer] scan_id The id of the scan to export.
+  # @param [Integer] file_id The id of the file to download (see #export_request).
   # @return (see #format)
   # @example Download a ready export.
   #   export = nc.export_download("73376c41-1508-46b7-8587-483d159cd956")
   #   open("scan_report", "wb") do |file|
   #     file.write( export )
   #   end
-  def export_download( export_id )
-    self.request.get( "/tokens/#{export_id}/download" )
+  def export_download( scan_id, file_id )
+    self.request.get( {:path => "/scans/#{scan_id}/export/#{file_id}/download", :headers => self.headers} )
   end
 
 end

data/lib/modules/folders.rb

@@ -1,16 +1,14 @@
-# require_relative '../nessus_client/request'
-
 module NessusClient::Folders
   # Get the list of folders from the endpoint.
   # @return [JSON]
   def list_folders
-    self.request.get("/folders")
+    self.request.get({:path => "/folders", :headers => self.headers})
   end
   # Create a folder into the endpoint.
   # @param [String] folder_name The name of the folder the will be created.
   # @return [Json]
   def create_folder( folder_name )
-    params = {:name => folder_name }.to_json
-    self.request.post("/folders", params)
+    payload = {:name => folder_name }
+    self.request.post({:path=>"/folders", :payload => payload, :headers => self.headers})
   end
 end

data/lib/modules/policies.rb

@@ -1,9 +1,7 @@
-# require_relative '../nessus_client/request'
-
 module NessusClient::Policies
   # List the scan polices from the endpoint.
   # @return [JSON]
   def policies
-    self.request.get( "/policies" )
+    self.request.get( {:path => "/policies", :headers => self.headers} )
   end
 end

data/lib/modules/scans.rb

@@ -6,7 +6,7 @@ module NessusClient::Scans
   # @return [JSON]
   def list_scans( folder_id=nil )
     query = folder_id.nil? ? nil : { "folder_id" => folder_id }
-    self.request.get( "/scans", nil, query )
+    self.request.get( {:path => "/scans", :query => query, :headers => self.headers} )
   end
   alias_method :scans, :list_scans 
 
@@ -16,17 +16,25 @@ module NessusClient::Scans
   # @return [JSON]
   def scan_details( scan_id, history_id=nil )
     query = history_id.nil? ? nil : { "history_id" => history_id }
-    self.request.get( "/scans/#{scan_id}", nil, query )
+    self.request.get( {:path => "/scans/#{scan_id}", :query => query, :headers => self.headers} )
+  end
+
+  # Lauch a scan by its id
+  # @param [Integer] scan_id The ID of a alredy created scan.
+  # @param [Array<String>] targets comma separeted new target to be scanned.
+  # @return [JSON]
+  def launch( scan_id, targets=[])
+    payload = { :alt_targets => targets } unless targets.empty?
+    self.request.post( {:path => "/scans/#{scan_id}/launch", :payload => payload, :headers => self.headers} )
   end
 
   # Lauch a scan by its name
   # @param [String] scan_name The name of a alredy created scan.
-  # @param [Array<String>] targets Comma separeted new target to be scanned.
+  # @param [Array<String>] targets comma separeted new target to be scanned.
   # @return [JSON]
   def launch_by_name( scan_name, targets=[] )
     scan_id = get_scan_by_name( scan_name )
-    params = { :alt_targets => targets } unless targets.empty?
-    self.request.post( "/scans/#{scan_id}/launch", params )
+    launch( scan_id, targets )   
   end
 
   # Get a scan by its name

data/lib/modules/session.rb

@@ -1,56 +1,68 @@
 require 'oj'
-# require_relative 'request'
-# require_relative 'exception'
-
-# Abstract base class for NessusClient Session. 
+# Abstract Session class for NessusClient. 
 # @since 0.1.0
 # @attr_reader [String] token Autentication session token.
 # @attr_reader [String] api_token Autentication API token.
 module NessusClient::Session
 
-  attr_reader :token, :api_token
+  attr_reader :session
 
-  @token = @api_token  = nil
+  @@api_token = nil
+  @session = false
 
   # Autenticate into Nessus endpoint.
   # @param [String] username
   # @param [String] password
+  # @return [nil]
   # @raise [NessusClient::Error] Unable to authenticate.
   # @todo Validate response token format
   def set_session( username, password )
     
     payload = {
       username: username,
-      password: password,
+      password: password
     }
 
-    response = self.request.post( '/session', payload )
+    response = self.request.post( {:path => '/session', :payload => payload, :headers => self.headers} )
+
     response = Oj.load(response) if response.length > 0
 
     raise NessusClient::Error.new( "Unable to authenticate. The response did not include a session token." ) unless response['token']
-    
-    @token = response['token']
+
+    begin
+      self.headers.update( 'X-Cookie' => 'token=' + response['token'] )
+      @session = true
+      self.headers.update( 'X-API-Token' => set_api_token() ) 
+    rescue NessusClient::Error => err
+      puts err.message
+    else
+      @@api_token = true
+    ensure
+      return
+    end
   
   end
   alias_method :session_create, :set_session
 
+   # Destroy the current session from Nessus endpoint
+   def destroy
+    self.request.delete( '/session', nil, self.headers )
+    @session = false
+  end
+  alias_method :logout , :destroy
+
+  private
+
   # Set the API Token from legacy Nessus version
   # @raise [NessusClient::Error] Unable to get API Token.
   def set_api_token
-    response = self.request.get( "/nessus6.js" )
+    response = self.request.get( {:path => "/nessus6.js", :headers => self.headers} )
     response.match( %r{return"(\w{8}-(?:\w{4}-){3}\w{12})"\}} )
     
-    raise NessusClient::Error.new( "Unable to get API Token. Some features won't work." ) unless $1#.nil?
+    raise NessusClient::Error.new( "Unable to get API Token. Some features won't work." ) unless $1
     
-    @api_token = $1 
+    return $1 
     
   end
 
-  # Destroy the current session from Nessus endpoint
-  def destroy
-    self.request.delete( '/session', nil )
-    @token = nil
-  end
-  alias_method :logout , :destroy
-
 end

data/lib/nessus_client.rb

@@ -5,7 +5,7 @@ Dir[File.join(__dir__, 'modules', '*.rb')].each { |file| require file }
 
 class NessusClient
 
-  attr_reader :request, :session
+  attr_reader :request, :session, :headers
   
   include NessusClient::Session
   include NessusClient::Scans
@@ -14,7 +14,6 @@ class NessusClient
   include NessusClient::Policies
 
   autoload :Request, "nessus_client/request"
-  # autoload :Session, "nessus_client/session"
 
   # @param [Hash] params the options to create a NessusClient with.
   # @option params [String] :uri ('https://localhost:8834/') Nessus endpoint to connect with
@@ -22,46 +21,33 @@ class NessusClient
   # @option params [String] :password Password (nil) to use in the connection
   # @option params [String] :ssl_verify_peer (false) should check whether valid SSL certificate
   def initialize( params = {} )
-    @has_session = false
+    
     default_params = { 
       uri: 'https://localhost:8834/', 
       username: nil, 
       password: nil, 
-      ssl_verify_peer: false
+      ssl_verify_peer: true
     }
     params = default_params.merge( params )
     req_params = params.select {|key, value| [:uri, :ssl_verify_peer].include?(key) } 
 
     @request = NessusClient::Request.new( req_params )
+    @headers = NessusClient::Request::DEFAULT_HEADERS.dup
     self.set_session( params.fetch(:username), params.fetch(:password) )
-    
-    if self.token
-      begin
-        @has_session = true
-        @request.headers.update( 'X-Cookie' => 'token=' + self.token )
-        self.set_api_token
-      rescue NessusClient::Error => err
-        puts err.message
-      else
-        request.headers.update( 'X-API-Token' => self.api_token )
-      ensure
-        return
-      end
 
-    end
 
   end
 
   # Gets NessusClient::Session authentication status.
   # @return [Boolean]
   def has_session?
-    @has_session
+    self.session
   end
 
   # Gets the server status.
   # @return [Json] Returns the server status (loading, ready, corrupt-db, feed-expired, eval-expired, locked, register, register-locked, download-failed, feed-error).
   def status
-    self.request.get( "/server/status" )
+    self.request.get( {:path => "/server/status", :headers => self.headers} )
   end
 
 end

data/lib/nessus_client/request.rb

@@ -3,51 +3,51 @@ require 'json'
 
 class NessusClient
 
-  # Abstract base class for NessusClient. Provides some helper methods for
+  # Abstract request class for NessusClient. Provides some helper methods for
   class Request
 
-    attr_reader   :url, :headers
+    attr_reader :url
 
     # Default HTTP header to be used on the requests.
     DEFAULT_HEADERS = {
       "User-Agent" => "Mozilla/5.0 (Linux x86_64)",
       "Content-Type" => "application/json"
-    }
+    }.freeze
 
     def initialize( params )
-      params = {:uri => nil, :ssl_verify_peer => false, :headers => {} }.merge( params )
-      @@ssl_verify_peer = params.fetch(:ssl_verify_peer)
+      # @headers = params[:headers] ||  DEFAULT_HEADERS 
+      params = {:uri => nil }.merge( params )
+      @@ssl_verify_peer = params[:ssl_verify_peer] ? true : false
       @url = @@url = NessusClient::Request.uri_parse( params.fetch(:uri) )
-      @headers = params.fetch( :headers ).merge( DEFAULT_HEADERS )
     end
 
     # @raise [NotImplementedError] Use update from Hash insted.
-    def headers=(value)
-      raise NotImplementedError.new("Use update from Hash insted.")
-    end
+    # def headers=(value)
+    #   raise NotImplementedError.new("Use update from Hash insted.")
+    # end
 
     # Perform a HTTP GET to the endpoint.
     # @param [String] path The URI path to perform the request.
     # @param [String] payload The HTTP body to send.
     # @param [String] query The URI query to send.
-    def get( path=nil, payload=nil, query=nil )
-      http_request( :get, path, payload, query )
+    def get( opts={} )
+      http_request( :get, opts )
     end
 
     # Perform a HTTP POST to the endpoint.
     # @param [String] path The URI path to perform the request.
     # @param [String] payload The HTTP body to send.
     # @param [String] query The URI query to send.
-    def post( path=nil, payload=nil, query=nil )
-      http_request( :post, path, payload, query )
+    def post( opts={} )
+      http_request( :post, opts )
     end
 
     # Perform a HTTP DELETE to the endpoint.
     # @param [String] path The URI path to perform the request.
     # @param [String] payload The HTTP body to send.
     # @param [String] query The URI query to send.
-    def delete( path=nil, payload=nil, query=nil )
-      http_request( :delete, path, payload, query )
+    def delete( opts={} )
+      http_request( :delete, opts )
     end
     # Parse a receiveid URI
     # @param [String] uri A valid URI.
@@ -65,18 +65,23 @@ class NessusClient
     # @param [String] path The URI path to perform the request.
     # @param [String] payload The HTTP body to send.
     # @param [String] query The URI query to send.
-    def http_request( method=:get, path, payload, query )
-      
-      connection = Excon.new( @@url )
+    def http_request( method=:get, args )
+      opts = {
+        :path => nil,
+        :payload => nil,
+        :query => nil,
+        :headers => nil
+      }.merge( args )
+
+      connection = Excon.new( @@url, {ssl_verify_peer: @@ssl_verify_peer} )
       
-      body = payload ? payload.to_json : ''
+      body = opts[:payload] ? opts[:payload].to_json : ''
       options = {
         method: method,
-        path: path,
+        path: opts.fetch(:path),
         body: body,
-        query: query,
-        headers: @headers,
-        ssl_verify_peer: @@ssl_verify_peer,
+        query: opts.fetch(:query),
+        headers: opts.fetch(:headers),
         expects: [200, 201]
       }
       response = connection.request( options )

data/lib/nessus_client/version.rb

@@ -1,4 +1,4 @@
 class NessusClient
   # The current version of the libary.
-  VERSION = '0.1.2'
+  VERSION = '0.1.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nessus_client
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Heyder
@@ -38,20 +38,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.7'
-- !ruby/object:Gem::Dependency
-  name: json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.1'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -150,7 +136,9 @@ extensions: []
 extra_rdoc_files:
 - README.md
 - CONTRIBUTING.md
+- CODE_OF_CONDUCT.md
 files:
+- CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
 - README.md
 - lib/modules/exports.rb