odle-m 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 800485a35d15ab752e25eb7674789d55d5088b426b81d8ade19e9208d9ad5f96
+  data.tar.gz: 5a6c62f31f4b151915d0956664af7266d8f027ed52343b26109936f3f449013d
+SHA512:
+  metadata.gz: bdd83324fd4da125739552100bcb71711aec892ac7aef948d8a3817075090eaea9921adb7fccf3db38efd0761d7c6b4dc554dd294bc59e2c593555ca5339cd1d
+  data.tar.gz: 63fd19799c46cc92643b877454104cf2e1eb21b509bc7bc3a4820bf2db00165c6ca8bc337baf115b54a32dcf4e597a3ea666b57bce1299ff8f2cd47ab48d78e7

data/bin/odle-m

@@ -0,0 +1,38 @@
+#!/usr/bin/env ruby
+require 'odle-m'
+
+def list_types()
+	return ["","--burp","--burp2","--nessus","--msf","--nmap"].join("\n")
+end
+
+# data flags are required
+flags = ARGV.shift
+
+unless flags 
+	puts "[!] A data type is required e.g.\n cat MYDATA_FILE | odle --burp \n\n Available types:"+list_types()
+	exit(0)
+end
+
+# flags come in the form --type or --type,arg1=val1,arg2=val2
+if flags =~ /,/
+	# complicated flags, not implemented yet
+	all = flags.gsub("--","").split(",")
+
+	type = all[0]
+else
+	type = flags.gsub("--","")
+end
+
+if type.downcase == "burp"
+	puts Burp.new().parse(ARGF.read,"0")
+elsif type.downcase == "burp2"
+	puts Burp2.new().parse(ARGF.read,"0")
+elsif type.downcase == "nessus"
+	puts Nessus.new().parse(ARGF.read,"0")
+elsif type.downcase == "msf"
+	puts Metasploit.new().parse(ARGF.read,"0")
+elsif type.downcase == "nmap"
+	puts Nmap.new().parse(ARGF.read,"0")
+else
+	puts "[!] Unknown data type \n\n Available types:"+list_types()
+end

data/lib/model/data.rb

@@ -0,0 +1,18 @@
+require 'json'
+
+class Host
+    attr_accessor :ip, :port
+end
+
+class Finding
+    attr_accessor :title,:id,:description,:effort,:type,:dread_total,:overview,:poc,:remediation,:notes,:assessment_type,:references,:risk,:damage,:reproducability,:exploitability,:affected_users,:discoverability,:av,:ac,:au,:c,:i,:a,:e,:rl,:rc,:cdp,:td,:cr,:ir,:ar,:cvss_base,:cvss_impact,:cvss_exploitability,:cvss_temporal,:cvss_environmental,:cvss_modified_impact,:cvss_total,:ease,:c2_vs,:attack_vector,:attack_complexity,:privileges_required,:user_interaction,:scope_cvss,:confidentiality,:integrity,:availability,:exploit_maturity,:remeditation_level,:report_confidence,:confidentiality_requirement,:integrity_requirement,:availability_requirement,:mod_attack_vector,:mod_attack_complexity,:mod_privileges_required,:mod_user_interaction,:mod_scope,:mod_confidentiality,:mod_integrity,:mod_availability,:cvss_base_score,:cvss_impact_score,:cvss_mod_impact_score,:c3_vs,:severity,:likelihood,:severity_rationale,:likelihood_rationale,:affected_hosts
+
+    def to_hash
+        hash = {}
+        self.instance_variables.each do |var|
+        	#p var.to_s.gsub("@","")
+            hash[var.to_s.gsub("@","").gsub("\"","")] = self.instance_variable_get var
+        end
+        return hash
+    end
+end

data/lib/odle-m.rb

@@ -0,0 +1,11 @@
+require 'nokogiri'
+require 'json'
+
+module Odle
+	# load the parsers
+	Dir[File.join(File.dirname(__FILE__), "parsers", "*.rb")].each { |lib| require lib }
+
+	# load the data model
+	Dir[File.join(File.dirname(__FILE__), "model", "*.rb")].each { |lib| require lib }
+
+end

data/lib/parsers/burp.rb

@@ -0,0 +1,57 @@
+require 'json'
+
+  class Burp
+    
+    def parse(xml,threshold)
+    vulns = Hash.new
+    findings = Array.new
+    vulns["findings"] = []
+
+    doc = Nokogiri::XML(xml)
+    doc.css('//issues/issue').each do |issue|
+      if issue.css('severity').text
+        # create a temporary finding object
+        finding = Finding.new()
+        finding.title = issue.css('name').text.to_s()
+        puts "#{finding.title}"
+        finding.overview = issue.css('issueBackground').text.to_s()+issue.css('issueDetail').text.to_s()
+        finding.remediation = issue.css('remediationBackground').text.to_s() + issue.css('remediationDetail').text.to_s()
+        finding.references=issue.css('references').text.to_s() + issue.css('vulnerabilityClassifications').text.to_s()
+
+        if issue.css('severity').text == 'Low'
+          finding.risk = 1
+        elsif issue.css('severity').text == 'Medium'
+          finding.risk = 2
+        elsif issue.css('severity').text =='High'
+          finding.risk = 3
+        else
+          finding.risk = 1
+        end
+
+    
+        finding.type = "Web Application"
+
+        findings << finding
+
+        host = issue.css('host').text
+        ip = issue.css('host').attr('ip')
+        id = issue.css('type').text
+        hostname = "#{host}"
+
+        finding.affected_hosts = "#{host}" + issue.css('location').text.to_s()
+
+        finding.id = id
+        if vulns[hostname]
+          vulns[hostname] << finding.to_hash
+        else
+          vulns[hostname] = []
+          vulns[hostname] << finding.to_hash
+        end
+      end
+    end
+
+    #vulns["findings"] = uniq_findings(findings)
+    return vulns.to_json
+    end
+
+  end

data/lib/parsers/burp2.rb

@@ -0,0 +1,55 @@
+require 'json'
+
+  class Burp2
+    
+    def parse(xml,threshold)
+    vulns = Hash.new
+    findings = Array.new
+    vulns["findings"] = []
+
+    doc = Nokogiri::XML(xml)
+    doc.css('//issues/issue').each do |issue|
+      if issue.css('severity').text
+        # create a temporary finding object
+        finding = Finding.new()
+        finding.title = issue.css('name').text.to_s()
+        finding.overview = issue.css('issueBackground').text.to_s()+issue.css('issueDetail').text.to_s()
+        finding.remediation = issue.css('remediationBackground').text.to_s() + issue.css('remediationDetail').text.to_s()
+        finding.references=issue.css('references').text.to_s()
+        if issue.css('severity').text == 'Low'
+          finding.risk = 1
+        elsif issue.css('severity').text == 'Medium'
+          finding.risk = 2
+        elsif issue.css('severity').text =='High'
+          finding.risk = 3
+        else
+          finding.risk = 1
+        end
+
+    
+        finding.type = "Web Application"
+
+        findings << finding
+
+        host = issue.css('host').text
+        ip = issue.css('host').attr('ip')
+        id = issue.css('type').text
+        hostname = "#{host}"
+
+        finding.affected_hosts = "#{host}" + issue.css('location').text.to_s()
+
+        finding.id = id
+        if vulns[hostname]
+          vulns[hostname] << finding.to_hash
+        else
+          vulns[hostname] = []
+          vulns[hostname] << finding.to_hash
+        end
+      end
+    end
+
+    #vulns["findings"] = uniq_findings(findings)
+    return vulns.to_json
+    end
+
+  end

data/lib/parsers/msfv5.rb

@@ -0,0 +1,32 @@
+require 'json'
+
+class Metasploit
+
+  def parse(xml,threshold)
+    vulns = Hash.new
+    vulns["findings"] = []
+
+    doc = Nokogiri::XML(xml)
+    doc.css('//hosts/host').each do |hostnode|
+      findings = Array.new
+
+      host = hostnode.css('/name').text.to_s
+
+      hostnode.css('/vulns/vuln').each do |issue|
+        # create a temporary finding object
+        finding = Finding.new()
+        finding.title = issue.css('name').text.to_s()
+        finding.overview = issue.css('info').text.to_s()
+        finding.risk = 0 # this needs to be fixed
+        finding.remediation = "" 
+        finding.id = issue.css('id').text.to_s()
+        findings << finding.to_hash
+      end
+      vulns[host] = findings
+    end
+
+    #vulns["findings"] = uniq_findings(findings)
+    return vulns.to_json
+  end
+
+end

data/lib/parsers/nessus.rb

@@ -0,0 +1,54 @@
+require 'json'
+
+class Nessus
+
+  def parse(xml,threshold)
+    vulns = Hash.new
+    findings = Array.new
+    items = Array.new
+
+    doc = Nokogiri::XML(xml)
+
+    doc.css("//ReportHost").each do |hostnode|
+      host = hostnode['name'] unless hostnode['name'].nil?
+      host = " " unless host
+      vulns[host] = []
+      
+      hostnode.css("ReportItem").each do |itemnode|
+  
+        if (itemnode["port"].to_s != "0" && itemnode["severity"] >= threshold)
+
+          # create a temporary finding object
+          finding = Finding.new()
+          finding.title = itemnode['pluginName'].to_s()
+          finding.poc = itemnode.css("description").to_s()
+          finding.remediation = itemnode.css("solution").to_s()
+
+          finding.cvss_total = itemnode.css("cvss3_base_score").to_s()
+          finding.c3_vs=itemnode.css("cvss3_vector").to_s()
+          finding.description = itemnode.css("synopsis").to_s()
+
+          # can this be inherited from an import properly?
+          finding.type = "Imported"
+          finding.risk = itemnode["severity"]
+          if itemnode.css("plugin_output")
+            finding.notes = hostnode["name"]+" ("+itemnode["protocol"]+ " port " + itemnode["port"]+"):"+itemnode.css("plugin_output").to_s()
+            finding.affected_hosts = hostnode["name"] + " [" + itemnode["port"] + "/" +itemnode["protocol"] + "]"
+            finding.references = itemnode.css("cvss3_vector").to_s() + " " + itemnode.css("see_also").to_s 
+          end
+
+          finding.id = itemnode['pluginID'].to_s()
+
+          vulns[host] << finding.to_hash
+          items << itemnode['pluginID'].to_s()
+        end
+      end
+
+  #    vulns[host] = findings
+      items = []
+    end
+
+    return vulns.to_json
+  end
+
+end

data/lib/parsers/nmap.rb

@@ -0,0 +1,70 @@
+require 'json'
+
+class Nmap
+
+  def parse(xml,threshold)
+    vulns = Hash.new
+    findings = Array.new
+    items = Array.new
+
+    doc = Nokogiri::XML(xml)
+
+    #p doc
+    doc.css("//host").each do |hostnode|
+      address = hostnode.css("address")
+      host = address.attr("addr")
+      host = " " unless host
+      vulns[host] = []
+      affected_hosts = ""
+
+      hostnode.css("/hostnames").each do |hname|
+        hostname = hname.attr("hostname")
+
+        hname.traverse do |x|
+          if x.values[0] 
+            if affected_hosts == ""
+              affected_hosts = x.values[0] 
+            else
+              affected_hosts = affected_hosts + " " + x.values[0]         
+            end
+          end
+      end
+
+      # finding is one per host
+      finding = Finding.new()
+      finding.affected_hosts = affected_hosts
+      vulns[host] << finding.to_hash                
+
+      # finding is one per open port
+      hostnode.css("/ports/port").each do |port|
+        proto = port.attr("protocol")
+        portid = port.attr("portid")
+        state = port.css("/state").attr("state").value 
+        service = port.css("/service").attr("name").value 
+
+        # iterate the state
+        finding = Finding.new()
+        finding.affected_hosts = affected_hosts
+
+        # if a script was run, grab the results
+        if port.css("/script").size > 0 
+          finding.title = "Script Scan:"+port.css("/script").attr("id").value+" [#{state} #{portid} (#{service})]"
+          finding.overview = port.css("/script").attr("output").value
+          vulns[host] << finding.to_hash                
+        else
+          if state == "open"
+            finding.title = "Open port [#{state} #{portid} (#{service})]"
+            vulns[host] << finding.to_hash                
+          end
+        end
+
+      end
+      end
+
+      items = []
+    end
+
+    return vulns.to_json
+  end
+
+end

metadata

@@ -0,0 +1,54 @@
+--- !ruby/object:Gem::Specification
+name: odle-m
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Shyam Ganesh
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2022-11-05 00:00:00.000000000 Z
+dependencies: []
+description: An easy to use security data parsing tool. Takes in data from different
+  tools and outputs standardized JSON with extra parsing
+email: ''
+executables:
+- odle-m
+extensions: []
+extra_rdoc_files: []
+files:
+- bin/odle-m
+- lib/model/data.rb
+- lib/odle-m.rb
+- lib/parsers/burp.rb
+- lib/parsers/burp2.rb
+- lib/parsers/msfv5.rb
+- lib/parsers/nessus.rb
+- lib/parsers/nmap.rb
+homepage: http://rubygems.org/gems/odle
+licenses:
+- BSD-3-Clause-Attribution
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+- lib/parsers
+- lib/model
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key:
+specification_version: 4
+summary: odle-m
+test_files: []