odle 0.0.6 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 948ef30d9f7dc55d450d33cab9843c0185e68791
-  data.tar.gz: aabe677ecd8dd3409707769dbc9e59d7111eff6d
+  metadata.gz: 303f5b0e063099a999a59f7c28a77bcc70f7ff52
+  data.tar.gz: 5a0db321f57ac8ac697a980f4df7195d5160f7b3
 SHA512:
-  metadata.gz: f10fb223677fbed605092b651f3f6f1df85a9ddae8ef88af69f15dc6d30437a0b27ad4212ee3b538981831942c271181b5063a37ed94cfecb4442986925e8c69
-  data.tar.gz: 90d9a6a72eec331e2b61774dd762413514f0195b40fcba68c36289553c9a8f591ab869984c117773f1651cc31647ab816355a500a8cdccc0524113e0d37d4e5b
+  metadata.gz: 7f378dcf8b3e7a6cf7f61042621a5df8ecb1bd3ba20077d5ecc4654afd1220fb98fd8640c6ab9ad18b54149663097e286c220dfcd06a40de8f0d4503e356de01
+  data.tar.gz: 0cd5f2573e85ada175556629aded5886ea37fb7b12f3057687219b1bc6c2e99e27e40a7a7f2d7169c7bd79e0a2a5e714f1edfc3d94fdabc6693ebc5e6e5974a8

data/bin/odle

@@ -26,6 +26,8 @@ elsif type.downcase == "nessus"
 	puts Nessus.new().parse(ARGF.read,"0")
 elsif type.downcase == "msf"
 	puts Metasploit.new().parse(ARGF.read,"0")
+elsif type.downcase == "nmap"
+	puts Nmap.new().parse(ARGF.read,"0")
 else
 	puts "[!] Unknown data type \n\n Available types:"#+list_types()
 end

data/lib/parsers/nmap.rb

@@ -0,0 +1,100 @@
+require 'json'
+
+class Nmap
+
+  def parse(xml,threshold)
+    vulns = Hash.new
+    findings = Array.new
+    items = Array.new
+
+    doc = Nokogiri::XML(xml)
+
+    #p doc
+    doc.css("//host").each do |hostnode|
+      address = hostnode.css("address")
+      host = address.attr("addr")
+      host = " " unless host
+      vulns[host] = []
+      affected_hosts = ""
+
+      hostnode.css("/hostnames").each do |hname|
+        hostname = hname.attr("hostname")
+
+        hname.traverse do |x|
+          if x.values[0] 
+            if affected_hosts == ""
+              affected_hosts = x.values[0] 
+            else
+              affected_hosts = affected_hosts + " " + x.values[0]         
+            end
+          end
+      end
+
+      # finding is one per host
+      finding = Finding.new()
+      finding.affected_hosts = affected_hosts
+      vulns[host] << finding.to_hash                
+
+      # finding is one per open port
+      hostnode.css("/ports/port").each do |port|
+        proto = port.attr("protocol")
+        portid = port.attr("portid")
+        state = port.css("/state").attr("state").value 
+        service = port.css("/service").attr("name").value 
+
+        # iterate the state
+        finding = Finding.new()
+        finding.affected_hosts = affected_hosts
+
+        if port.css("/script").size > 0 
+          finding.title = "Script Result:"+port.css("/script").attr("id").value+" [#{state} #{portid} (#{service})]"
+          finding.overview = port.css("/script").attr("output").value
+          vulns[host] << finding.to_hash                
+        else
+          if state == "open"
+            finding.title = "Open port [#{state} #{portid} (#{service})]"
+            vulns[host] << finding.to_hash                
+          end
+        end
+
+      end
+
+
+
+
+      # check if findings done, otherwise one finding per 'host'
+
+=begin    
+        if (itemnode["port"].to_s != "0" && itemnode["severity"] >= threshold)
+
+          # create a temporary finding object
+          finding = Finding.new()
+          finding.title = itemnode['pluginName'].to_s()
+          finding.overview = itemnode.css("description").to_s()
+          finding.remediation = itemnode.css("solution").to_s()
+
+          # can this be inherited from an import properly?
+          finding.type = "Imported"
+          finding.risk = itemnode["severity"]
+          finding.affected_hosts = hostnode["name"]
+          if itemnode.css("plugin_output")
+            finding.notes = hostnode["name"]+" ("+itemnode["protocol"]+ " port " + itemnode["port"]+"):"+itemnode.css("plugin_output").to_s()
+          end
+
+          finding.references = itemnode.css("see_also").to_s
+          finding.id = itemnode['pluginID'].to_s()
+
+          vulns[host] << finding.to_hash
+          items << itemnode['pluginID'].to_s()
+        end
+=end
+      end
+
+#      vulns[host] = findings
+      items = []
+    end
+
+    return vulns.to_json
+  end
+
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: odle
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - Will Vandevanter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-04-26 00:00:00.000000000 Z
+date: 2018-05-13 00:00:00.000000000 Z
 dependencies: []
 description: An easy to use security data parsing tool. Takes in data from different
   tools and outputs standardized JSON.
@@ -24,6 +24,7 @@ files:
 - lib/parsers/burp.rb
 - lib/parsers/msfv5.rb
 - lib/parsers/nessus.rb
+- lib/parsers/nmap.rb
 homepage: http://rubygems.org/gems/odle
 licenses:
 - BSD-3-Clause-Attribution