risu 1.5.3 → 1.6.0

data/Gemfile.ci

@@ -11,3 +11,4 @@ gem "mysql2"
 gem "rmagick"
 gem "sqlite3"
 gem "simplecov"
+gem "nokogiri"

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2010-2012 Arxopia LLC.
+Copyright (c) 2010-2013 Arxopia LLC.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

data/NEWS.markdown

@@ -1,5 +1,82 @@
 # News
 
+# 1.6 (2013)
+***Official support for Ruby versions less than 1.9.3 has been dropped due to Rails 4***
+
+- Changed all copyright to Arxopia LLC. instead of myself for legal protection, **Nothing changes** the project will always be open source and free (as in cost)
+- Fixed several missing requires for Sqlite3 and Rails
+- Default template font size is now 10pt
+- Added TemplateHelper mixin for templates to use. The goal is to abstract Prawn in-line code out of the templates over the next few releases to allow for dynamic output to different formats.Currently it adds the following methods to each template it is included in:
+	- report_title(title, newline=false) #font size 24 + bold + center
+	- report_subtitle(title, newline=false) #font size 18 + bold + center
+	- report_author(author, newline=false) #font size 24 + bold + center
+	- report_classification(classification=Report.classification.upcase, newline=true)
+	- report_text(text, options={})
+	- heading1 #font size 24 + bold
+	- heading2 #font size 18 + bold
+	- heading3 #font size 14 + bold
+	- heading4 #font size 12 + bold
+	- heading5 #font size 10 + bold
+	- heading6 #font size 8 + bold
+- Models
+	- Reference Model
+		- Added methods
+			- reference_string #Returns a full string of all the references
+			- reference_string_by(type) #Returns a string of all the references by type, Where type is the output of a Reference.type(ex. Reference.cve)
+	- Host Model
+		- Added methods
+			- ip_list #Generates a list of hosts from the database, returns a string \n delimited
+			- unsupported_os? #Checks to see if there was any unsupported OS in the scan
+			- os_windows_8
+			- not_os_windows_8
+			- os_windows_2k12
+			- not_is_windows_2k12
+		- Changed the wording `other_os_graph_text` to indicate that its just a percentage of the non windows computers
+		- Added 'bios_uuid' Property 
+	- Reference Model
+		- Added cert-cc, 
+		- Added apple-sa
+		- Added icsa 
+		- Added msvr
+	- Plugin Model
+		- cvss_base_score is now a float in the schema, this change should be transparent
+			- When assigning to it, the value is converted to a float and when retrieving it, it is converted to a string.
+	- Item Model
+		- Added methods
+			- medium_risks_by_host
+			- low_risks_by_host
+			- plugin
+		- Rewrote the notable_order_by_cvss_raw
+- Schema Changes
+	- Added owner and visibility to the Policy Table
+	- Added traceroute_hop_0-2 to the Host Properties
+- Templates
+	- notable
+		- cleaned up and updated to use the TemplateHelper mixin
+	- notable_detailed
+		- cleaned up and updated to use the TemplateHelper mixin
+		- the new reference helpers
+		- host names are now show with ip addresses
+	- technical_findings
+		- cleaned up and updated to use the TemplateHelper mixin
+		- new reference helpers
+		- also fixed a bug with a trailing blank page
+		- host names are now show with ip addresses
+	- findings_summary
+		- cleaned up and updated to use the TemplateHelper mixin
+		- simplified the repeated code
+	- ms_patch_summary
+		- cleaned up and updated to use the TemplateHelper mixin
+	- pci_compliance
+		- cleaned up and updated to use the TemplateHelper mixin
+	- template
+		- cleaned up and updated to use the TemplateHelper mixin
+- Wiki Pages
+	- New page for installing on [Fedora](https://github.com/arxopia/risu/wiki/Fedora-Installation-Guide)
+	- New page for installing on [CentOS](https://github.com/arxopia/risu/wiki/CentOS-Installation-Guide)
+	- New page for installing on [Gentoo](https://github.com/arxopia/risu/wiki/Gentoo-Installation-Guide)
+	- New page for installing on [ArchLinux](https://github.com/arxopia/risu/wiki/Arch-Linux-Install-Guide)
+
 #1.5.3 (August 29, 2012)
 - New Parsed Tags
 	- cm_compliance_info
@@ -137,14 +214,14 @@
 - Fixed a bug on the exec_summary_detailed detailed report
 - A quick reference for Microsoft findings can now be found in the Patch model,
 You are able to get host_id, name(patch name, ie MS01-001), value (plugin_id)
-- Please report any missing tags that risu outputs to jacob[dot]hammackj[@]hammackj[.]com, I expect a ton of Microsoft Patch tags missing
+- Please report any missing tags that risu outputs to risu[@]arxopia[.]com, I expect a ton of Microsoft Patch tags missing
 
 #1.4.8 (August 21, 2011)
 - Fixed a gemspec dependency error reported by mlpotgieter
 - Fixed a parser error related to Microsoft Bulletins report by stevelodin
 - Added a Table for all host related patches, currently only has Microsoft Bulletins
 You can access it via `Host.first.patches` or `Patch.all`
-- Please report any missing tags that risu outputs to jacob[dot]hammackj[@]hammackj[.]com, I expect a ton of Microsoft Patch tags missing
+- Please report any missing tags that risu outputs to risu[@]arxopia[.]com, I expect a ton of Microsoft Patch tags missing
 
 #1.4.7 (August 13, 2011)
 - Fixed issue #39 Ruby 1.8.7 Syntax error reported by mlpotgieter
@@ -177,7 +254,7 @@ You can access it via `Host.first.patches` or `Patch.all`
 
 #1.4.3 (May 23, 2011)
 
-**This is the last release under the NessusDB name, I received a legal notice to change the name. They gave me a few weeks to change the name but I do not have a new name yet. If you have any suggestions please submit them to jacob.hammack[@]hammackj.com**
+**This is the last release under the NessusDB name, I received a legal notice to change the name. They gave me a few weeks to change the name but I do not have a new name yet. If you have any suggestions please submit them to risu[@]arxopia[.]com**
 
 - Fixed small bug in Windows/Other OS graphs
 - Increased the verboseness of Error messages Ticket #29

data/README.markdown

@@ -2,12 +2,12 @@
 
 Risu is [Nessus](http://www.nessus.org) parser, that converts the generated reports into a [ActiveRecord](http://api.rubyonrails.org/classes/ActiveRecord/Base.html) database, this allows for easy report generation and vulnerability verification.
 
-Version **1.5.3** is the current release.
+Version **1.6.0** is the current release.
 
 ## Requirements
 
 ### Ruby
-Risu has been tested with ruby-1.8.7-p334, ruby-1.9.2-p180, ruby-1.9.3-p125. Please try to use one of these versions if possible. I recommend using RVM to setup your ruby environment you can get it [here](https://rvm.beginrescueend.com/).
+Risu has been tested with ruby-1.9.3-p392 and ruby-2.0.0-p0. Please try to use one of these versions if possible. I recommend using RVM to setup your ruby environment you can get it [here](https://rvm.beginrescueend.com/).
 
 ### RubyGems
 Risu relies heavily on [RubyGems](http://rubygems.org/) to install other dependencies I highly recommend using it. RubyGems is included by default in the 1.9.x versions of [Ruby](http://ruby-lang.org/).
@@ -20,12 +20,13 @@ Risu relies heavily on [RubyGems](http://rubygems.org/) to install other depende
 - gruff
 - prawn
 - mysql2
+- nokogiri
 
 ## Developmental Requirements
 
 These are all available through [RubyGems](http://rubygems.org/). The should be installed automatically when you install risu, If not this command will install them all:
 
-	% gem install rmagick gruff prawn yard mysql2 libxml-ruby rails sqlite3 logger yaml
+	% gem install rmagick gruff prawn yard mysql2 libxml-ruby rails sqlite3 logger yaml nokogiri
 
 **You my need sudo/root access depending on your system setup**
 
@@ -74,9 +75,9 @@ Using the risu Console is just like using Rails. You can access all of the Activ
 	|_|  |_|___/\__,_|
 
 
-	risu Console v1.5.3
+	risu Console v1.6.0
 	>> Host.first
-	=> #<Risu::Models::Host id: 1, report_id: 1, name: "10.69.69.74", os: "Linux Kernel 2.6 on Debian 4.0 (etch)", mac: "XX:XX:XX:XX:XX:XX", start: "2011-04-20 16:29:37", end: "2011-04-20 16:32:14", ip: "10.69.69.74", fqdn: "redada.hammackj.net", netbios: "REDADA", local_checks_proto: nil, smb_login_used: nil, ssh_auth_meth: nil, ssh_login_used: nil, pci_dss_compliance: nil, notes: nil>
+	=> #<Risu::Models::Host id: 1, report_id: 1, name: "10.69.69.74", os: "Linux Kernel 2.6 on Debian 4.0 (etch)", mac: "XX:XX:XX:XX:XX:XX", start: "2011-04-20 16:29:37", end: "2011-04-20 16:32:14", ip: "10.69.69.74", fqdn: "redada.arxopia.net", netbios: "REDADA", local_checks_proto: nil, smb_login_used: nil, ssh_auth_meth: nil, ssh_login_used: nil, pci_dss_compliance: nil, notes: nil>
 
 ## Templates
 Several templates are included:
@@ -107,12 +108,12 @@ Several templates are included:
 The templates are written in ruby using [prawn](http://prawn.majesticseacreature.com/), they are fairly easy to make. I will add any templates as requested. See the 'template' example for creating your own template.
 
 # Contributing
-If you would like to contribute templates/bug fixes/etc to risu. The easiest way is to fork the project on [github](http://github.com/hammackj/risu) and make the changes in your fork and the submit a pull request to the project.
+If you would like to contribute templates/bug fixes/etc to risu. The easiest way is to fork the project on [github](http://github.com/arxopia/risu) and make the changes in your fork and the submit a pull request to the project.
 
 # Issues
-If you have any problems, bugs or feature requests please use the [github issue tracker](http://github.com/hammackj/risu/issues).
+If you have any problems, bugs or feature requests please use the [github issue tracker](http://github.com/arxopia/risu/issues).
 
 # Contact
-You can reach me at jacob[dot]hammack[at]hammackj[dot]com.
+You can reach me at risu[at]arxopia[dot]com.
 
 You can also contact me on IRC as hammackj on irc.freenode.net, #risu

data/Rakefile

@@ -1,4 +1,4 @@
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -32,7 +32,7 @@ require 'rake'
 require 'rake/testtask'
 
 task :build do
-  system "gem build #{Risu::APP_NAME}.gemspec"
+	system "gem build #{Risu::APP_NAME}.gemspec"
 end
 
 task :tag_and_bag do
@@ -41,8 +41,8 @@ task :tag_and_bag do
 end
 
 task :release => [:tag_and_bag, :build] do
-  system "gem push #{Risu::APP_NAME}-#{Risu::VERSION}.gem"
-	puts "Just released #{Risu::APP_NAME} v#{Risu::VERSION}. #{Risu::APP_NAME} is an Nessus XML parser/database. More information at http://hammackj.com/projects/risu/"
+ 	system "gem push #{Risu::APP_NAME}-#{Risu::VERSION}.gem"
+	puts "Just released #{Risu::APP_NAME} v#{Risu::VERSION}. #{Risu::APP_NAME} is an Nessus XML parser/database. More information at http://arxopia.com/projects/risu/"
 end
 
 task :clean do
@@ -65,13 +65,13 @@ end
 
 Rake::TestTask.new("run_tests") do |t|
 	t.libs << "test"
-  t.pattern = 'test/*/*_test.rb'
-  t.verbose = true
+	t.pattern = 'test/*/*_test.rb'
+	t.verbose = true
 end
 
 task :merge do
 	system "git checkout master"
-	system "get merge #{Risu::VERSION}"
+	system "git merge #{Risu::VERSION}"
 	system "git push"
 end
 

data/bin/risu

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without

data/lib/risu.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -26,13 +26,14 @@
 
 module Risu
 	APP_NAME = "risu"
-	VERSION = "1.5.3"
+	VERSION = "1.6.0"
 	GRAPH_WIDTH = 750
-	EMAIL = "jacob.hammack@hammackj.com"
+	EMAIL = "risu@arxopia.com"
 	CONFIG_FILE = "./risu.cfg"
 	USER_TEMPLATES_DIR = "~/.risu/templates/"
 end
 
+require 'rails'
 require 'active_record'
 require "active_support"
 require 'libxml'
@@ -45,6 +46,8 @@ require 'prawn/layout'
 require 'stringio'
 require 'mysql2'
 require 'irb'
+require 'sqlite3'
+require 'nokogiri'
 
 require 'optparse'
 

data/lib/risu/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -32,3 +32,4 @@ end
 require 'risu/base/template_base'
 require 'risu/base/template_manager'
 require 'risu/base/templater'
+require 'risu/base/template_helper'

data/lib/risu/base/schema.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -28,15 +28,15 @@ module Risu
 	module Base
 
 		# Risu database Schema
-		#
 		class Schema < ActiveRecord::Migration
 
 			# Creates all of the database tables required by the parser
-			#
 			def self.up
 				create_table :policies do |t|
 					t.string :name
 					t.string :comments
+					t.string :owner
+					t.string :visibility
 				end
 
 				create_table :server_preferences do |t|
@@ -101,6 +101,10 @@ module Risu
 					t.string :pcidss_www_sql_injection
 					t.string :pcidss_backup_files
 					t.string :system_type
+					t.string :bios_uuid
+					t.string :traceroute_hop_0
+					t.string :traceroute_hop_1
+					t.string :traceroute_hop_2
 					t.text :notes
 				end
 
@@ -133,7 +137,7 @@ module Risu
 					t.datetime :plugin_modification_date
 					t.datetime :vuln_publication_date
 					t.string :cvss_vector
-					t.string :cvss_base_score
+					t.float :cvss_base_score
 					t.string :cvss_temporal_score
 					t.string :cvss_temporal_vector
 					t.string :exploitability_ease

data/lib/risu/base/template_base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -30,6 +30,8 @@ module Risu
 		# Base template class, all report templates must be a subclass of this.
 		#
 		class TemplateBase
+			attr_accessor :output
+
 			@possible_templates = []
 
 			class << self

data/lib/risu/base/template_helper.rb

@@ -0,0 +1,115 @@
+# Copyright (c) 2012 Arxopia LLC.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above copyright
+#       notice, this list of conditions and the following disclaimer in the
+#       documentation and/or other materials provided with the distribution.
+#     * Neither the name of the Arxopia LLC nor the names of its contributors
+#     	may be used to endorse or promote products derived from this software
+#     	without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL ARXOPIA LLC BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+# OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+#OF THE POSSIBILITY OF SUCH DAMAGE.
+
+module Risu
+	module Templates
+		module TemplateHelper
+
+			#
+			def report_classification classification=Report.classification.upcase, newline=true
+				@output.font_size(12) do
+					@output.text classification, :align => :center
+					@output.text "\n" if newline
+				end
+			end
+
+			#
+			def report_title title, newline=false
+				@output.font_size(24) do
+					@output.text title, :align => :center
+					@output.text "\n" if newline
+				end
+			end
+
+			#
+			def report_subtitle title, newline=false
+				@output.font_size(18) do
+					@output.text title, :align => :center
+					@output.text "\n" if newline
+				end
+			end
+
+			#
+			def report_author author, newline=false
+				@output.font_size(14) do
+					@output.text author, :align => :center
+					@output.text "\n" if newline
+				end
+			end
+
+			#
+			def text(text, options = {})
+				if text == nil
+					text = ""
+				end
+				
+				@output.text text, options
+			end
+
+			#
+			def heading1 title
+				@output.font_size(24) do
+					@output.text title, :style => :bold
+				end
+			end
+
+			#
+			def heading2 title
+				@output.font_size(18) do
+					@output.text title, :style => :bold
+				end
+			end
+
+			#
+			def heading3 title
+				@output.font_size(14) do
+					@output.text title, :style => :bold
+				end
+			end
+
+			#
+			def heading4 title
+				@output.font_size(12) do
+					@output.text title, :style => :bold
+				end
+			end
+
+			#
+			def heading5 title
+				@output.font_size(10) do
+					@output.text title, :style => :bold
+				end
+			end
+
+			#
+			def heading6 title
+				@output.font_size(8) do
+					@output.text title, :style => :bold
+				end
+			end
+		end
+	end
+end

data/lib/risu/base/template_manager.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2010-2012 Arxopia LLC.
+# Copyright (c) 2010-2013 Arxopia LLC.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without