risu 1.4.4 → 1.4.5

data/NEWS.markdown

@@ -1,7 +1,20 @@
 # News
 
+#1.4.5 (July 4, 2011)
+- Implemented an modular template system, **breaks all existing templates**.
+	- All templates are now implemented as Ruby classes this allows them to be dynamically loaded and removes the need to type the entire path to the template
+	- This allows me to implement rendering systems that will be able to write pdf/html/rtf/csv in the future without having to have templates for each type
+- Updated the Severity Graph and added some auto generated text based on the graph percentages
+- Added a method to generate text for the other_os_graph
+- Added a method to generate text for the windows_os_graph
+- Added some auto generated text for unsupported operating systems to put into a report.
+- Added AIX named_scopes on the Host model (os_aix and not_os_aix)
+- Unified the colors to be the same for all the graphs
+- Added validation of the XML files for Nessus Documents
+- Added 'system_type' field to the Nessus parser
+
 #1.4.4 (May 28, 2011)
-- NessusDB has been renamed to risu
+- NessusDB has been renamed to risu, NessusDB gem now install risu and warns you.
 - Fixed a bug in --create-config, where tabs were being inserted with spaces
 - Fixed a bug in load_config where the exception was not printed.
 - Added more banners to the console for fun

data/README.markdown

@@ -2,7 +2,7 @@
 
 Risu is [Nessus](http://www.nessus.org) parser, that converts the generated reports into a  [ActiveRecord](http://api.rubyonrails.org/classes/ActiveRecord/Base.html) database, this allows for easy report generation and vulnerability verification. 
 
-Version 1.4.4 is the current release.
+Version 1.4.5 is the current release.
 
 ## Requirements
 
@@ -59,7 +59,7 @@ The data can be viewed with a query browser available for your database. A Rails
 ## Generating Reports
 To generate a report please execute the following after the the data is parsed into the database.
 
-	% risu -t "TEMPLATE_PATH" -o "REPORT_NAME.pdf"
+	% risu -t <TEMPLATE_NAME> -o "REPORT_NAME.pdf"
 	
 ## Risu Console
 
@@ -74,51 +74,33 @@ Using the risu Console is just like using Rails. You can access all of the Activ
 	|_|  |_|___/\__,_|
 
 
-	risu Console v1.4.4
+	risu Console v1.4.5
 	>> Host.first
 	=> #<Risu::Models::Host id: 1, report_id: 1, name: "10.69.69.74", os: "Linux Kernel 2.6 on Debian 4.0 (etch)", mac: "XX:XX:XX:XX:XX:XX", start: "2011-04-20 16:29:37", end: "2011-04-20 16:32:14", ip: "10.69.69.74", fqdn: "redada.hammackj.net", netbios: "REDADA", local_checks_proto: nil, smb_login_used: nil, ssh_auth_meth: nil, ssh_login_used: nil, pci_dss_compliance: nil, notes: nil>
 	
 ## Templates
 Several templates are included:
 
-1. graphs.rb - several graphs written to disk as png's and as a complete pdf
-2. technical_findings.rb - a detailed pdf of the high and medium findings from the assessment
-3. finding_statistics.rb - this is a pdf summary of the assessment
-4. assets.rb - this is a summary of all the hosts found during the scan
-5. pci_compliance.rb - this generates of list of hosts that pass or failed pci/dss auditing
-6. exec_summary.rb - A sample executive summary report
-7. executive_summary.rb - A more detailed sample executive summary report
-8. findings_summary.rb - A summary of all the findings report
-9. ms_update_summary.rb - a summary of all the windows update enable hosts
-10. ms_patch_summary.rb - a summary of all the missing windows patches
-11. cover_sheet.rb - a example coversheet report
-12. findings_host.rb - list of findings per host
-	
-The templates are located in the risu/templates folder, where ever the gem was installed. On a typical Mac OSX install the path is:
-
-	[hammackj@taco:~]$ ruby -v
-	ruby 1.8.7 (2009-06-12 patchlevel 174) [universal-darwin10.0]
-	[hammackj@taco:~]$ l /Library/Ruby/Gems/1.8/gems/risu-1.4.0/lib/risu/templates/
-	total 40
-	drwxr-xr-x  7 hammackj  admin   238B Oct 21 19:24 ./
-	drwxr-xr-x  8 hammackj  admin   272B Oct 21 19:24 ../
-	-rw-r--r--   1 hammackj  staff   695B Mar  9 15:59 assets.rb
-	-rw-r--r--   1 hammackj  staff   691B Mar  9 15:59 cover_sheet.rb
-	drwxr-xr-x   3 hammackj  staff   102B Mar  9 15:59 data/
-	-rw-r--r--   1 hammackj  staff   2.0K Mar  9 15:59 exec_summary.rb
-	-rw-r--r--   1 hammackj  staff   6.7K Mar  9 15:59 executive_summary.rb
-	-rw-r--r--   1 hammackj  staff   724B Mar  9 15:59 finding_statistics.rb
-	-rw-r--r--@  1 hammackj  staff   1.2K Mar 17 14:55 findings_host.rb
-	-rw-r--r--   1 hammackj  staff   1.5K Mar  9 15:59 findings_summary.rb
-	-rw-r--r--   1 hammackj  staff   831B Mar  9 15:59 graphs.rb
-	-rw-r--r--   1 hammackj  staff   1.2K Mar  9 15:59 host_summary.rb
-	-rw-r--r--   1 hammackj  staff   663B Mar  9 15:59 ms_patch_summary.rb
-	-rw-r--r--   1 hammackj  staff   924B Mar  9 15:59 ms_update_summary.rb
-	-rw-r--r--   1 hammackj  staff   1.6K Mar  9 15:59 pci_compliance.rb
-	-rw-r--r--   1 hammackj  staff   2.8K Mar  9 15:59 technical_findings.rb
-	[hammackj@taco:~]$ 
-
-The templates are written in ruby using [prawn](http://prawn.majesticseacreature.com/), they are fairly easy to make. I will add any templates as requested.
+	[hammackj@taco:~/Projects/public/risu]$ ./bin/risu -l
+	Available Templates
+		assets - Generates a Assets Summary Report
+		cover_sheet - Generates a coversheet with a logo (Example Template)
+		exec_summary - Generates a simple executive summary.
+		exec_summary_detailed - Generates a detailed executive summary report
+		finding_statistics - Generates report finding statistics
+		findings_host - Generates a findings report by host
+		findings_summary - Generates a findings summary report
+		findings_summary_with_pluginid - Geneates a Findings Summary with Nessus Plugin ID
+		graphs - Generates a report with all the graphs in it
+		host_summary - Generates a Host Summary Report
+		ms_patch_summary - Generates a Microsoft Patch Summary Report
+		ms_update_summary - Generates a Microsoft Update Summary Report
+		pci_compliance - Generates a PCI Compliance Overview Report
+		technical_findings - Generates a Technical Findings Report
+		template - template
+	[hammackj@taco:~/Projects/public/risu]$ 
+
+The templates are written in ruby using [prawn](http://prawn.majesticseacreature.com/), they are fairly easy to make. I will add any templates as requested. See 'template' for creating your own template.
 
 # Issues
 If you have any problems, bugs or feature requests please use the [github issue tracker](http://github.com/hammackj/risu/issues).

data/TODO.markdown

@@ -2,62 +2,71 @@
 
 **Release dates are estimates, and features can be changed at any time.**
 
-## 1.4.5 (May)
-
-- Add a CVSS risk factor graph
-- Update Assets templates to use this if possible plugin: http://www.nessus.org/plugins/index.php?view=single&id=54615 for extra data
-
 ## 1.5 (7/4/2011)
-- Clean up / Bug fixes before 2.0
-- Create rSpec tests for everything (100% code coverage goal)
+- Comment all named scope from 1.2
+- Clean up code
+- Create rSpec tests for everything (95%+ code coverage goal)
 	- Parser tests
 		- Add test for new xml element
 		- Add test for new host properties tag
-	- application specs
+	- Model Specs
+		- Report
+		- Item
+		- Host
+	- Application specs
 		- Add a failed load_config() test
 		- add test for load config from file
 		- add test for non existent config file
-	- models tests
-		- policy
-		- family selection
-		- individualpluginselection
-		- reference
-		- version
-		- report
-		- plugin
-		- plugin preference
-		- server preference
-- Create test fixtures
-- Comment all named scope from 1.2
-- Create a Nessus document generator, for testing the parser
-- 100% code coverage for testing
-- Rework the blacklisting stuff
-	- Add blacklisting to config
-- Add Schema checks to make sure the schema is compatible with the version of risu
-	- Check to see that the xml is version 2
-		- Version 1 = NessusClientData
-		- Version 2 = NessusClientData_V2
+	- Template specs
+		- Assets
+		- Coversheet
+		- exec summary
+		- executive summary(detailed)
+		- finding stats
+		- findings host
+		- findings summary
+		- findings summary with plugin id
+		- host summary
+		- ms patch summary
+		- ms update summary
+		- pci compliance
+		- tech findings
+- Rework the blacklisting of plugins/hosts add to the config file
 
-
-- DSL for report creation to abstract the reports to have different output types
+##1.5.1 (8/4/2011) - Template work
 - Provide more templates
 	- Virtual Machine Summary
 	- Fix list Report?
+- Add a CVSS risk factor graph
+- Update Assets templates to use this if possible plugin: http://www.nessus.org/plugins/index.php?view=single&id=54615 for extra data
+- Sort Technical Findings Report by count/score
 - Add template validation and more error checking
 - Colorize the reports with better style
-- Sort Technical Findings Report by count/score	
+	
+##1.5.2 (9/4/2011) - Parser work
+- Add Schema checks to make sure the schema is compatible with the version of risu
+- Create a Nessus document generator, for testing the parser
+
+#1.5.3 (10/4/2011) - Template Work
+- Implement different renderers
+	- pdf
+	- cvs
+	- html
+	- rtf
+- Abstract the api for prawn to support different renders
+- DSL for report creation to abstract the reports to have different output types
 
-## 1.6 (9/4/2011)
-- Remove rmagick 
+## 1.6 (11/4/2011)
+- Remove rmagick (GRRRR!)
 - Move to ruby 1.9.2 only support
-- Add Parser for NBE Format
-- Add Parser for NSR Format
-- Add Parser for V1 of the XML Format
+- Add Parser for Nessus NBE Format
+- Add Parser for Nessus NSR Format
+- Add Parser for Nessus V1 of the XML Format
 - Add Parser for OpenVas Output
 - Add Parser for SecurityCenter Output
-- Add Parser for Nexpose
-- Add Parser for Qualys
+- Add Parser for Nexpose xml
+- Add Parser for Qualys xml
 - Look at moving to nokogiri for xml parsing, current benchmarks so it faster than libxml-ruby; http://nokogiri.org
 
-## 2.0 (12/4/2011)
+## 2.0 (?)
 - Rails FrontEnd to Risu

data/lib/risu.rb

@@ -2,10 +2,11 @@
 
 module Risu
 	APP_NAME = "risu"
-	VERSION = "1.4.4"
+	VERSION = "1.4.5"
 	GRAPH_WIDTH = 750
 	EMAIL = "jacob.hammack@hammackj.com"
 	CONFIG_FILE = "./risu.cfg"
+	USER_TEMPLATES_DIR = "~/.risu/templates/"
 end
 
 require 'active_record'
@@ -23,16 +24,10 @@ require 'irb'
 
 require 'optparse'
 
-if ActiveRecord::Base.connected? == true
-	require 'risu/schema'
-end
-
-require 'risu/listener'
-require 'risu/prawn_templater'
-require 'risu/nessusdocument'
-
+require 'risu/base'
 require 'risu/cli'
 require 'risu/exceptions'
 require 'risu/models'
+require 'risu/parsers'
 
 include Risu::Models

data/lib/risu/base.rb

@@ -0,0 +1,15 @@
+# encoding: utf-8
+
+module Risu
+	module Base
+	end
+end
+
+#if ActiveRecord::Base.connected? == true
+#	require 'risu/base/schema'
+#end
+
+require 'risu/base/template_base'
+require 'risu/base/template_manager'
+require 'risu/base/prawn_templater'
+require 'risu/base/templater'

data/lib/risu/base/prawn_templater.rb

@@ -0,0 +1,37 @@
+module Risu
+	module Base
+		# Templater class for generating a report from a erb template
+		#
+		# @author Jacob Hammack
+		class PrawnTemplater
+			attr_accessor :template, :template_source, :findings, :output_file
+		
+			# Setups of the Templater class initalizing all of the variables
+			#
+			# @return [PrawnTemplater] New Instance
+			def initialize(template, findings, output)
+				@template = template
+				@findings = findings
+				@output_file = output
+
+				@template_source = File.new(@template).read
+			end
+		
+			# Generates a report based on the erb template
+			#
+			# @return [String] html output of the erb template
+			def generate
+				begin				
+					source = @template_source
+					template = @template
+					Prawn::Document.generate(@output_file, :margin => [75, 50, 75, 50]) do
+						font_size 12
+						eval source
+					end
+				rescue => e
+					puts "Error: #{e.message} \n #{e.backtrace.join("\n\t")}\n"
+				end
+			end
+		end
+	end
+end

data/lib/risu/{schema.rb → base/schema.rb}

@@ -1,26 +1,26 @@
 # encoding: utf-8
 
 module Risu
-	
+
 	# Risu Schema
 	#
 	# @author Jacob Hammack <jacob.hammack@hammackj.com>
 	class Schema < ActiveRecord::Migration
 
 		# Creates all of the database tables required by the parser
-		# 
+		#
 		def self.up
 			create_table :policies do |t|
 				t.string :name
 				t.string :comments
 			end
-		
+
 			create_table :server_preferences do |t|
 				t.integer :policy_id
 				t.string :name
 				t.string :value
-			end		
-		
+			end
+
 			create_table :plugins_preferences do |t|
 				t.integer :policy_id
 				t.integer :plugin_id
@@ -36,13 +36,13 @@ module Risu
 				t.integer :policy_id
 				t.string :family_name
 				t.string :status
-			end		
-				
+			end
+
 			create_table :reports do |t|
 				t.integer :policy_id
 				t.string :name
 			end
-		
+
 			create_table :hosts do |t|
 				t.integer :report_id
 				t.string :name
@@ -66,7 +66,8 @@ module Risu
 				t.string :pcidss_high_risk_flaw
 				t.string :pcidss_medium_risk_flaw
 				t.string :pcidss_reachable_db
-				t.string :pcidss_www_xss				
+				t.string :pcidss_www_xss
+				t.string :system_type
 				t.text :notes
 			end
 
@@ -79,8 +80,8 @@ module Risu
 				t.string :protocol
 				t.integer :severity
 				t.boolean :verified
-			end 
-		
+			end
+
 			create_table :plugins do |t|
 				t.string :plugin_name
 				t.string :family_name
@@ -105,7 +106,7 @@ module Risu
 				t.text :synopsis
 				t.string :plugin_type
 			end
-			
+
 			create_table :individual_plugin_selections do |t|
 				t.string :policy_id
 				t.integer :plugin_id
@@ -113,18 +114,35 @@ module Risu
 				t.string :family
 				t.string :status
 			end
-		
+
 			create_table :references do |t|
 				t.integer :plugin_id
 				t.string :reference_name
 				t.string :value
 			end
-	
+
 			create_table :versions do |t|
 				t.string :version
 			end
+			
+			create_table :service_descriptions do |t|
+				t.string :name
+				t.integer :port
+				t.string :description
+			end
+			
+			ServiceDescription.create :name => "www", :description => ""
+			ServiceDescription.create :name => "cifs", :description => ""
+			ServiceDescription.create :name => "smb", :description => ""
+			ServiceDescription.create :name => "netbios-ns", :description => ""
+			ServiceDescription.create :name => "snmp", :description => ""
+			ServiceDescription.create :name => "ftp", :description => ""
+			ServiceDescription.create :name => "epmap", :description => ""
+			ServiceDescription.create :name => "ntp", :description => ""
+			ServiceDescription.create :name => "dce-rpc", :description => ""
+			ServiceDescription.create :name => "telnet", :description => ""
 		end
-	
+
 		# Deletes all of the database tables created
 		#
 		def self.down
@@ -139,6 +157,7 @@ module Risu
 			drop_table :plugins
 			drop_table :references
 			drop_table :versions
+			drop_table :service_descriptions
 		end
 
 	end

data/lib/risu/base/template_base.rb

@@ -0,0 +1,23 @@
+module Risu
+	module Base
+  	#
+		#
+		class TemplateBase			
+	    @possible_templates = []
+	
+	    class << self
+	      attr_reader :possible_templates
+	    end
+    	
+			#
+			#
+			attr_accessor :template_info
+			
+			#
+			#
+	    def self.inherited(child)
+	      possible_templates << child
+	    end
+	  end
+	end
+end