nexpose 0.8.3 → 0.8.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ef26ec8744d21085dbb8b96509cc0f4b339ca7a7
-  data.tar.gz: 75abb058fee789fec9ded99082b6465a93fff39f
+  metadata.gz: dba4421357b0475f091f72cd2fd61ced926fb6ad
+  data.tar.gz: e7d37e55dcf159045a3249932c9dfa426e8f0705
 SHA512:
-  metadata.gz: 34cb580b9d69d3211513d3d5be0b58afe0e62b63278326adc8435c912aa7d09d2f984452bd458e7727589c1263ab204c073b0150f9c4c6b11d0e8c9da9777258
-  data.tar.gz: f79b3341e2536410659de763012473fd45a4fd23ec53db78e8d9e1ab444be7e650e52619caf5d74d8a2250749e9e493092b1e4a5740fbb0e93f53c6aafacae35
+  metadata.gz: abdef9b08034c3fce94402180e33af5dc7c01a05c4a48bb8a8a877e21f8599a19abfc0710fea5b22a5562ae24884198ebaaa4b19849e6b7e3cdf2713bc4adf14
+  data.tar.gz: 12f470900347b5cac2927cf3138f561f110fdab1246b232dd12dd1167035fd872db9dc9fcab2d87282c9ac8e71345dda73b2f8d76c0ac3e1b618eecadf081257

data/lib/nexpose.rb

@@ -3,7 +3,7 @@
 #
 =begin
 
-Copyright (C) 2009-2013, Rapid7 LLC
+Copyright (C) 2009-2014, Rapid7 LLC
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,

data/lib/nexpose/ajax.rb

@@ -110,7 +110,7 @@ module Nexpose
     # @param [Hash] parameters Hash of attributes that need to be sent
     #    to the controller.
     # @return [Hash] The parameterized URI.
-
+    #
     def parameterize_uri(uri, parameters)
       params = Hash.try_convert(parameters)
       unless params.nil? || params.empty?

data/lib/nexpose/scan.rb

@@ -209,6 +209,101 @@ module Nexpose
       end
     end
 
+    # Export the data associated with a single scan, and optionally store it in
+    # a zip-compressed file under the provided name.
+    #
+    # @param [Fixnum] scan_id Scan ID to remove data for.
+    # @param [String] zip_file Filename to export scan data to.
+    # @return [Fixnum] On success, returned the number of bytes written to
+    #   zip_file, if provided. Otherwise, returns raw ZIP binary data.
+    #
+    def export_scan(scan_id, zip_file = nil)
+      http = AJAX._https(self)
+      headers = { 'Cookie' => "nexposeCCSessionID=#{@session_id}",
+                  'Accept-Encoding' => 'identity' }
+      resp = http.get("/data/scan/#{scan_id}/export", headers)
+
+      case resp
+      when Net::HTTPSuccess
+        if zip_file
+          File.open(zip_file, 'wb') { |file| file.write(resp.body) }
+        else
+          resp.body
+        end
+      when Net::HTTPForbidden
+        raise Nexpose::PermissionError.new(resp)
+      else
+        raise Nexpose::APIError.new(resp, "#{resp.class}: Unrecognized response.")
+      end
+    end
+
+    # Import scan data into a site. WARNING: Experimental!
+    #
+    # This code currently depends on a gem not in the gemspec. In order to use
+    # this method, you will need to add the following line to your script:
+    #   require 'rest-client'
+    #
+    # This method is designed to work with export_scan to migrate scan data
+    # from one console to another. This method will import the data as if run
+    # from a local scan engine.
+    #
+    # Scan importing is restricted to only importing scans in chronological
+    # order. It assumes that it is the latest scan for a given site, and will
+    # abort if attempting to import an older scan.
+    #
+    # @param [Fixnum] site_id Site ID of the site to import the scan into.
+    # @param [String] zip_file Path to a previously exported scan archive.
+    # @return [String] An empty string on success.
+    #
+    def import_scan(site_id, zip_file)
+
+      # ## Ideally, this code should not depend upon rest-client, but should be
+      # #  able to use the Rex library to generate the MIME message. I haven't
+      # #  been able to figure out how, though. Leaving it here, commented out,
+      # #  pending discovery of what to do.
+
+      # data = Rex::MIME::Message.new
+      # data.add_part(site_id.to_s, nil, nil, 'form-data; name="siteid"')
+      # data.add_part(self.session_id, nil, nil, 'form-data; name="nexposeCCSessionID"')
+
+      # scan = File.new(zip_file, 'rb')
+      # data.add_part(scan.read, 'application/zip', nil,
+      #               "form-data; name=\"scan\"; filename=\"#{zip_file}\"")
+
+      # post = Net::HTTP::Post.new('/data/scan/import')
+      # ## rex 2.0.3 has a bug that requires this monkey-patch for Message#to_s
+      # # class String
+      # #   def blank?
+      # #     self !~ /\S/
+      # #   end
+      # # end
+      # post.body = data.to_s
+      # post.set_content_type("multipart/form-data; boundary=#{data.bound}")
+      # AJAX._headers(nsc, post)
+
+      # http = AJAX._https(nsc)
+      # http.request(post)
+
+      scan = File.new(zip_file, 'rb')
+      url = "https://#{self.host}:#{self.port}/data/scan/import"
+      payload = { :siteid => site_id,
+                  :scan => scan,
+                  'nexposeCCSessionID' => self.session_id }
+      request = RestClient::Request.new(:method     => :post,
+                                        :url        => url,
+                                        :verify_ssl => OpenSSL::SSL::VERIFY_NONE,
+                                        :payload    => payload,
+                                        :cookies    => { 'nexposeCCSessionID' => self.session_id })
+
+      begin
+        request.execute
+      rescue RestClient::Forbidden => fourOhThree
+        raise Nexpose::PermissionError.new(fourOhThree)
+      rescue RestClient::InternalServerError => e
+        raise Nexpose::APIError.new(request, e)
+      end
+    end
+
     # Delete a scan and all its data from a console.
     # Warning, this method is destructive and not guaranteed to leave a site
     # in a valid state. DBCC may need to be run to correct missing or empty

data/lib/nexpose/scan_template.rb

@@ -146,6 +146,20 @@ module Nexpose
       gen.attributes['disableWebSpider'] = enable ? '0' : '1'
     end
 
+    # Adjust the number of threads to use per scan engine for this template
+    # @param [Integer] threads the number of threads to use per engine
+    def scan_threads=(threads)
+      scan_threads = REXML::XPath.first(@xml, 'ScanTemplate/General/scanThreads')
+      scan_threads.text = threads.to_s
+    end
+
+    # Adjust the number of threads to use per asset for this template
+    # @param [Integer] threads the number of threads to use per asset
+    def host_threads=(threads)
+      host_threads = REXML::XPath.first(@xml, 'ScanTemplate/General/hostThreads')
+      host_threads.text = threads.to_s
+    end
+
     # Add custom TCP ports to scan for services
     # @param [Array] ports to scan
     def tcp_service_ports=(ports)

data/lib/nexpose/silo_profile.rb

@@ -159,7 +159,7 @@ module Nexpose
 
       unless @global_scan_engines.empty?
         engines = xml.add_element('GlobalScanEngines')
-        @global_report_templates.each do |engine|
+        @global_scan_engines.each do |engine|
           engines.add_element('GlobalScanEngine', {'name' => engine})
         end
       end

data/lib/nexpose/site.rb

@@ -414,7 +414,7 @@ module Nexpose
     #  ## TODO What is returned on failure?
     #
     def self.parse(rexml)
-      rexml.elements.each('SiteConfigResponse/Site') do |s|
+      rexml.elements.each('//Site') do |s|
         site = Site.new(s.attributes['name'])
         site.id = s.attributes['id'].to_i
         site.description = s.attributes['description']

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nexpose
 version: !ruby/object:Gem::Version
-  version: 0.8.3
+  version: 0.8.4
 platform: ruby
 authors:
 - HD Moore
@@ -11,28 +11,28 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-08 00:00:00.000000000 Z
+date: 2014-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: librex
+  name: rex
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.0'
+        version: 2.0.3
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.0.68
+        version: 2.0.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.0'
+        version: 2.0.3
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.0.68
+        version: 2.0.3
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -131,4 +131,3 @@ signing_key:
 specification_version: 4
 summary: Ruby API for Rapid7 Nexpose
 test_files: []
-has_rdoc: