risu 1.7.4 → 1.7.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ed1f7b219ebb25c728109b214d7b1f6f2b4aabd5
-  data.tar.gz: 91e12a4dd836bbe7b9573c6d9b2f53f7f0fc3146
+  metadata.gz: f6936958320d0f5a66b83446740f767902c0a8aa
+  data.tar.gz: 037950d5f6ef7524e8062ae080d69d0c493c62ba
 SHA512:
-  metadata.gz: 4452938f9fdbc00b1a692e9e7e771f51655a44b550a8a8145f6a71cd905f9cc8a1d40c7fda5d8d59a4ace8e3f5d371177bc7adadd619f6c49b360fbfb2bbfd8e
-  data.tar.gz: 40cc53b89b40b5c855b9713e9f6371e5062d3ff819d6328e69f50e9b9e4fd5121012b9c4c82f966536303a67a112453cc8d0289ae12528fc0343b619b2fe76ed
+  metadata.gz: e166f6769fd4f88a96a494fab589c84e9900e88dd939fda23f21efd12c817d8bed1e6c8245ea5fb0536c668e2c74053b3348492a41dfb2f9f05de1931754541e
+  data.tar.gz: c7a5d992b4445cce24900e4f990e438d2debfe346ea57eed42b9cd7ac8555543de6c0da59b6e994c9b304819fe361134ef63f18609e6ca3f924b3f3e09557cbc

data/NEWS.markdown

@@ -1,5 +1,40 @@
 # News
 
+# 1.7.5 (November, 2015)
+- Added initial test for HostProperties
+- Added fixture for HostProperties testing
+- Added VMware vCenter Post Processing
+- Added VMware Player Post Processing
+- Added WinSCP Post Processing
+- Added non rounded risk % text methods
+- Added SigPlus Pro post process
+- Added epo HostProperty
+- Updated Flash Player plugin list
+- Updated Adobe Reader plugin list
+- Updated Root Cause post processing
+- Updated Windows Post Processing
+- Updated Apache Post Processing
+- Updated Java Post Processing
+- Updated Item.notable_order_by_cvss_raw to pull in high findings if there are less than 10 critical findings
+- Added new tags in_the_news, exploited_by_nessus, unsupported_by_vendor, default_account
+- Downgraded FTP Privileged Port Bounce Scan to 0
+- Added vSphere client post processing
+- Added PCanywhere Post Processing
+- Added Foxit Reader Post Processing
+- Added Firefox Postprocessing
+- Added VLC Post Processing
+- Added a postprocess for downgrading plugins
+- Added blackberry enterprise server Post Processing
+- More support for windows 2003 unsupported
+- Added DNS to the cvs output
+- Added potentinal_vulnerability field
+- Added support for unsupported windows 2003
+- Test for potential_vunerability field
+- Fixture for new field test
+- Added docker container [jkordish]
+- Added support for the agent field
+- Added a default creds plugin
+
 # 1.7.4 (January 25, 2015)
 - Added New tags to the model Item
 	- cm:compliance-reference

data/README.markdown

@@ -6,7 +6,7 @@
 
 Risu is [Nessus](http://www.nessus.org) parser, that converts the generated reports into a [ActiveRecord](http://api.rubyonrails.org/classes/ActiveRecord/Base.html) database, this allows for easy report generation and vulnerability verification.
 
-Version **1.7.2** is the current release.
+Version **1.7.4** is the current release.
 
 ## Requirements
 

data/lib/risu.rb

@@ -21,12 +21,12 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	APP_NAME = "risu"
-	VERSION = "1.7.4"
+	VERSION = "1.7.5"
 	GRAPH_WIDTH = 750
 	#                  red     orange  yellow  green    blue   purple        grey           pink
 	GRAPH_COLORS = %w(#d2403f #ec9241 #fcc343 #50ad51 #397bbb #8E6B8E black #cccccc brown #e52d89)

data/lib/risu/base/host_template_helper.rb

@@ -67,9 +67,10 @@ module Risu
 				unsupported_os("Unsupported Windows NT Installations", "Microsoft Windows NT 4.0 Unsupported Installation Detection")
 				unsupported_os("Unsupported Windows 2000 Installations", "Microsoft Windows 2000 Unsupported Installation Detection")
 				unsupported_os("Unsupported Windows XP Installations", "Microsoft Windows XP Unsupported Installation Detection")
+				unsupported_os("Unsupported Windows 2003 Installations", "Microsoft Windows Server 2003 Unsupported Installation Detection")
 
 				text "\n"
-			end			
+			end
 		end
 	end
-end
+end

data/lib/risu/base/schema.rb

@@ -151,6 +151,12 @@ module Risu
 					t.integer :risk_score
 					t.string :compliance
 					t.string :root_cause
+					t.string :agent
+					t.boolean :potential_vulnerability
+					t.boolean :in_the_news
+					t.boolean :exploited_by_nessus
+					t.boolean :unsupported_by_vendor
+					t.boolean :default_account
 				end
 
 				create_table :individual_plugin_selections do |t|

data/lib/risu/base/template_helper.rb

@@ -69,7 +69,7 @@ module Risu
 				if text == nil
 					text = ""
 				end
-				
+
 				@output.text text, options
 			end
 
@@ -141,7 +141,7 @@ module Risu
 					return Item.where(:plugin_id => Plugin.where(:plugin_name => plugin_name).first.id).count
 				rescue => e
 					return 0
-				end				
+				end
 			end
 
 			def item_count_by_plugin_id (plugin_id)
@@ -149,16 +149,17 @@ module Risu
 					return Item.where(:plugin_id => plugin_id).count
 				rescue => e
 					return 0
-				end				
-			end	
+				end
+			end
 
 			# @todo comment
 			def default_credential_plugins
 				[
-					10862, 25927, 32315, 65950, 39364, 33852, 11454, 51369, 
-					26918, 76073, 24745, 11245, 23938, 46786, 46789, 
+					10862, 25927, 32315, 65950, 39364, 33852, 11454, 51369,
+					26918, 76073, 24745, 11245, 23938, 46786, 46789, 10483,
+					81375
 				].uniq
-			end		
+			end
 
 			# @todo comment
 			def has_default_credentials?

data/lib/risu/base/template_manager.rb

@@ -107,10 +107,11 @@ module Risu
 			# Displays a list of all the templates to STDOUT
 			def display_templates
 				puts "Available Templates"
-			  @registered_templates.each do |x|
-			      p = x.new
-			      puts "\t#{p.template_info[:name]} - #{p.template_info[:description]}\n"
-			    end
+
+				@registered_templates.each do |x|
+					p = x.new
+					puts "\t#{p.template_info[:name]} - #{p.template_info[:description]}\n"
+				end
 			end
 		end
 	end

data/lib/risu/cli.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module CLI

data/lib/risu/cli/application.rb

@@ -377,9 +377,7 @@ module Risu
 				end
 
 				if @options[:test_connection] != nil
-					result = test_connection?
-
-					puts "#{result[1]}"
+					puts "#{test_connection?[1]}"
 					exit
 				end
 

data/lib/risu/exceptions.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Exceptions

data/lib/risu/exceptions/invaliddocument.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Exceptions

data/lib/risu/models.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/models/host.rb

@@ -622,12 +622,15 @@ module Risu
 					win_nt_text = ""
 					win_2000_text = ""
 					win_xp_text = ""
+					win_2003_text = ""
+
 					win_95 = Host.os_windows_95
 					win_98 = Host.os_windows_98
 					win_me = Host.os_windows_me
 					win_nt = Plugin.where(:plugin_name => "Microsoft Windows NT 4.0 Unsupported Installation Detection")
 					win_2000 = Plugin.where(:plugin_name => "Microsoft Windows 2000 Unsupported Installation Detection")
 					win_xp = Plugin.where(:plugin_name => "Microsoft Windows XP Unsupported Installation Detection")
+					win_2003 = Plugin.where(:plugin_name => "Microsoft Windows Server 2003 Unsupported Installation Detection")
 
 					#Host.os_windows.not_os_windows_7.not_os_windows_2008.not_os_windows_vista.not_os_windows_2003.not_os_windows_xp
 
@@ -649,7 +652,10 @@ module Risu
 					win_xp_text = "Windows XP is an unsupported operating system; Microsoft has stopped support as of April 2014. " +
 					"Please see http://windows.microsoft.com/en-us/windows/products/lifecycle for more information.\n\n" if win_xp.count >= 1
 
-					return "#{win_95_text}#{win_98_text}#{win_me_text}#{win_nt_text}#{win_2000_text}#{win_xp_text}"
+					win_2003_text = "Windows 2003 is an unsupported operating system; Microsoft has stopped support as of July 2015. " +
+					"Please see http://windows.microsoft.com/en-us/windows/products/lifecycle for more information.\n\n" if win_2003.count >= 1
+
+					return "#{win_95_text}#{win_98_text}#{win_me_text}#{win_nt_text}#{win_2000_text}#{win_xp_text}#{win_2003_text}"
 				end
 
 				# @todo comments

data/lib/risu/models/item.rb

@@ -330,29 +330,29 @@ module Risu
 				#
 				# @return [FixNum] Percentage of vulnerable hosts
 				def calculate_vulnerable_host_percent
-					#patch to fix double counting 
+					#patch to fix double counting
 					#unique_hosts_with_critical_and_high = Host.unique_hosts_with_critical.count + Host.unique_hosts_with_high.count
 					unique_hosts_with_critical_and_high = Host.unique_hosts_with_critical_and_high_count
 					host_percent = (unique_hosts_with_critical_and_high.to_f / Host.count.to_f) * 100
 				end
 
-				#
+				# @todo w t f
 				def calculate_vulnerable_host_percent_with_patches_applied
 
 					exclude_list = []
 					hosts = []
 
-					Item.notable_order_by_cvss_raw.each do |h, k|
-						exclude_list << h
-					end
+					risks = Item.top_10_sorted_raw[0..9]
 
-					criticals = Item.critical_risks.where.not(:plugin_id => exclude_list)
+					risks.each do |risk|
+						exclude_list << risk[0]
+					end
 
-					criticals.each do |item|
+					Item.critical_risks.where.not(:plugin_id => exclude_list).each do |item|
 						hosts << item.host_id
 					end
 
-					Item.high_risks.each do |item|
+					Item.high_risks.where.not(:plugin_id => exclude_list).each do |item|
 						hosts << item.host_id
 					end
 
@@ -383,7 +383,7 @@ module Risu
 				# Builds a sentence based on the risk_percent to describe the risk
 				#
 				# @param risk_percent Calculated percentage of risk based on {Item::calculate_vulnerable_host_percent}
-				# 
+				#
 				# @return [String] Sentence describing the implied significance of the risk_percent
 				def risk_text risk_percent
 					percent_text = case risk_percent
@@ -445,7 +445,15 @@ module Risu
 
 				def risk_percent_patched_rounded_text
 					"#{calculate_vulnerable_host_percent_with_patches_applied().round}%"
-				end				
+				end
+
+				def risk_percent_text
+					"%.2f%" % calculate_vulnerable_host_percent()
+				end
+
+				def risk_percent_patched_text
+					"%.2f%" % calculate_vulnerable_host_percent_with_patches_applied()
+				end
 
 				#
 				# @todo comment
@@ -455,11 +463,20 @@ module Risu
 					#MIGHT NOT BE CORRECT @TODO
 
 					#return Item.joins(:plugin).where(:severity => 4).order("plugins.cvss_base_score").count(:all, :group => :plugin_id)
-					return Item.joins(:plugin).where(:severity => 4).order("plugins.cvss_base_score").group(:plugin_id).distinct.count
+					#return Item.joins(:plugin).where(:severity => 4).order("plugins.cvss_base_score").group(:plugin_id).distinct.count
+
+					critical = Item.joins(:plugin).where(:severity => 4).order("plugins.cvss_base_score").group(:plugin_id).distinct.count
+
+					if critical.size < 10
+						high = Item.joins(:plugin).where(:severity => 3).order("plugins.cvss_base_score").group(:plugin_id).distinct.count
+						critical = critical.merge high
+					end
+
+					return critical
 				end
 
 				# Scrubs a plugin_name to remove all pointless data
-				# 
+				#
 				# @return [String] Scrubbed plugin name
 				def scrub_plugin_name (name)
 					return name.gsub("(remote check)", "").gsub("(uncredentialed check)", "").gsub(/(\(\d.*\))/, "")
@@ -467,7 +484,7 @@ module Risu
 
 				# Returns an array of plugin_id and plugin_name for the top 10
 				# findings unsorted
-				# 
+				#
 				# @return [Array] Unsorted top 10 findings
 				def top_10_sorted_raw
 					raw = notable_order_by_cvss_raw
@@ -493,7 +510,7 @@ module Risu
 
 				# Returns an array of plugin_id and plugin_name for the top 10
 				# findings sorted by CVSS score
-				# 
+				#
 				# @return [Array] Sorted top 10 findings
 				def top_10_sorted
 					raw = notable_order_by_cvss_raw
@@ -572,7 +589,7 @@ module Risu
 						results.push [name, total, core, metasploit, canvas, exploithub, d2elliot]
 					end
 
-					return results			
+					return results
 				end
 			end
 		end

data/lib/risu/models/pluginspreference.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/models/policy.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/models/reference.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/models/report.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/models/serverpreference.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/models/version.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Models

data/lib/risu/parsers.rb

@@ -21,8 +21,8 @@
 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 # OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-#OF THE POSSIBILITY OF SUCH DAMAGE.
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
 
 module Risu
 	module Parsers