scanfuse 0.2.0__py3-none-any.whl

scanfuse/parsers/nuclei.py

@@ -0,0 +1,157 @@
+import json
+
+from scanfuse.models import Evidence, Finding, Host
+from scanfuse.parsers.base import (
+    BaseParser,
+    PartialImportError,
+    clean_ids,
+    cve_ids,
+    cwe_id,
+    extract_urls,
+)
+
+
+class NucleiParser(BaseParser):
+    def parse(self, file_path: str) -> list[Finding]:
+        findings = []
+        invalid_lines: list[int] = []
+
+        with open(file_path, encoding="utf-8") as f:
+            for line_idx, line in enumerate(f, start=1):
+                line = line.strip()
+                if not line:
+                    continue
+
+                try:
+                    data = json.loads(line)
+                    if not self._looks_like_nuclei(data):
+                        continue
+                    findings.append(self._parse_dict(data))
+                except json.JSONDecodeError:
+                    invalid_lines.append(line_idx)
+
+        if not findings or invalid_lines:
+            # Fallback: maybe it's a JSON array instead of JSONL
+            with open(file_path, encoding="utf-8") as f:
+                try:
+                    data = json.load(f)
+                    if isinstance(data, list):
+                        findings = []
+                        for item in data:
+                            if self._looks_like_nuclei(item):
+                                findings.append(self._parse_dict(item))
+                    elif self._looks_like_nuclei(data):
+                        findings = [self._parse_dict(data)]
+                    invalid_lines = []
+                except json.JSONDecodeError:
+                    pass
+            if not findings:
+                raise ValueError("Not a valid Nuclei JSON/JSONL file.")
+
+        if invalid_lines:
+            raise PartialImportError(f"Invalid JSON on line {invalid_lines[0]}", findings)
+
+        return findings
+
+    @staticmethod
+    def _looks_like_nuclei(data: object) -> bool:
+        """A Nuclei result has at least one of these keys. Other JSON objects are not findings."""
+        return isinstance(data, dict) and any(
+            key in data for key in ("template-id", "info", "matched-at")
+        )
+
+    def _parse_dict(self, data: dict) -> Finding:
+        info = data.get("info")
+        if not isinstance(info, dict):
+            info = {}
+        template_id = data.get("template-id", "unknown")
+        name = info.get("name") or template_id
+
+        severity_raw = info.get("severity") or "info"
+        if not isinstance(severity_raw, str):
+            severity_raw = str(severity_raw)
+        severity_raw = severity_raw.lower()
+
+        # Map Nuclei severity to Finding severity model
+        severity_map = {
+            "critical": "Critical",
+            "high": "High",
+            "medium": "Medium",
+            "low": "Low",
+            "info": "Info",
+            "unknown": "Info"
+        }
+        severity = severity_map.get(severity_raw, "Info")
+
+        description = info.get("description") or f"Nuclei template {template_id} matched."
+        remediation = info.get("remediation")
+
+        classification = info.get("classification")
+        if not isinstance(classification, dict):
+            classification = {}
+        cvss_score_raw = classification.get("cvss-score")
+        try:
+            cvss_score = float(cvss_score_raw) if cvss_score_raw is not None else None
+        except (ValueError, TypeError):
+            cvss_score = None
+
+        cvss_vector = classification.get("cvss-metrics")
+        if not isinstance(cvss_vector, str):
+            cvss_vector = None
+
+        # Handle host extraction
+        ip = data.get("ip")
+        host_val = data.get("host")
+        hostname = None
+
+        # If ip is missing but host is an IP, we could try to guess,
+        # but let's stick to using ip as ip and host as hostname if different.
+        if not ip and host_val:
+            ip = host_val
+        elif host_val and ip and host_val != ip:
+            hostname = host_val
+        elif host_val and not ip:
+            ip = host_val
+
+        if not ip:
+            ip = "unknown"
+
+        host_model = Host(ip=ip, hostname=hostname)
+
+        # Handle evidence
+        evidence_list = []
+        req = data.get("request")
+        resp = data.get("response")
+        matched_at = data.get("matched-at")
+
+        if req or resp:
+            ev_text = ""
+            if req:
+                ev_text += f"Request:\n{req}\n"
+            if resp:
+                ev_text += f"\nResponse:\n{resp}"
+            evidence_list.append(Evidence(type="http-request", data=ev_text.strip()))
+        elif matched_at:
+            evidence_list.append(Evidence(type="match", data=f"Matched at: {matched_at}"))
+
+        cwe_raw = classification.get("cwe-id")
+        cwes = [cwe_id(c) for c in cwe_raw] if isinstance(cwe_raw, list) else [cwe_id(cwe_raw)]
+        identifiers = clean_ids(
+            f"nuclei-template:{template_id}" if data.get("template-id") else None,
+            cve_ids(classification.get("cve-id")),
+            cwes,
+        )
+
+        return Finding(
+            title=name,
+            severity=severity,
+            cvss_score=cvss_score,
+            cvss_vector=cvss_vector,
+            description=description,
+            remediation=remediation,
+            hosts=[host_model],
+            evidence=evidence_list,
+            identifiers=identifiers,
+            references=extract_urls(info.get("reference")),
+            source_tool="nuclei"
+        )

scanfuse/parsers/trivy.py

@@ -0,0 +1,187 @@
+import json
+
+from scanfuse.models import Evidence, Finding, Host
+from scanfuse.parsers.base import BaseParser, clean_ids, cve_ids, cwe_id, extract_urls
+
+
+class TrivyParser(BaseParser):
+    def parse(self, file_path: str) -> list[Finding]:
+        findings = []
+
+        with open(file_path, encoding="utf-8") as f:
+            try:
+                data = json.load(f)
+            except json.JSONDecodeError as e:
+                raise ValueError(f"Invalid JSON in {file_path}: {e}")
+
+        # Older Trivy versions write a bare list of results. Current versions write an object.
+        if isinstance(data, list):
+            if not data or not all(isinstance(item, dict) and "Target" in item for item in data):
+                raise ValueError(f"Not a valid Trivy JSON file: {file_path}")
+            data = {"ArtifactName": str(data[0].get("Target") or "unknown-artifact"), "Results": data}
+
+        # Basic check to see if it looks like a Trivy report
+        if not isinstance(data, dict) or ("SchemaVersion" not in data and "ArtifactName" not in data):
+            raise ValueError(f"Not a valid Trivy JSON file: {file_path}")
+
+        artifact_name = data.get("ArtifactName", "unknown-artifact")
+        host_model = Host(ip="unknown", hostname=artifact_name)
+
+        severity_map = {
+            "CRITICAL": "Critical",
+            "HIGH": "High",
+            "MEDIUM": "Medium",
+            "LOW": "Low",
+            "UNKNOWN": "Info"
+        }
+
+        results = data.get("Results") or []
+        if not isinstance(results, list):
+            results = []
+
+        for result in results:
+            if not isinstance(result, dict):
+                continue
+
+            target = result.get("Target", "Unknown Target")
+
+            # Parse Vulnerabilities (CVEs)
+            vulns = result.get("Vulnerabilities") or []
+            if not isinstance(vulns, list):
+                vulns = []
+            for vuln in vulns:
+                if not isinstance(vuln, dict):
+                    continue
+                vuln_id = vuln.get("VulnerabilityID", "Unknown ID")
+                pkg_name = vuln.get("PkgName", "")
+                title_raw = vuln.get("Title")
+                title = str(title_raw).strip() if title_raw else f"{vuln_id} in {pkg_name}"
+
+                desc_raw = vuln.get("Description")
+                desc = str(desc_raw).strip() if desc_raw else ""
+                sev_raw = (vuln.get("Severity") or "UNKNOWN").upper()
+                severity = severity_map.get(sev_raw, "Info")
+
+                installed_ver = vuln.get("InstalledVersion", "")
+                fixed_ver = vuln.get("FixedVersion", "")
+
+                remediation = f"Update {pkg_name} from {installed_ver} to {fixed_ver}." if fixed_ver else None
+
+                # Extract CVSS if present
+                cvss_score = None
+                cvss_vector = None
+                cvss_data = vuln.get("CVSS", {})
+                if isinstance(cvss_data, dict) and cvss_data:
+                    # Prefer NVD V3, fallback to whatever is there
+                    for provider, scores in cvss_data.items():
+                        if isinstance(scores, dict) and "V3Score" in scores:
+                            cvss_score = scores["V3Score"]
+                            cvss_vector = scores.get("V3Vector")
+                            if provider == "nvd":
+                                break
+
+                evidence_list = [Evidence(type="target", data=target)]
+                if pkg_name:
+                    evidence_list.append(Evidence(type="package", data=f"Package: {pkg_name}\nInstalled: {installed_ver}"))
+
+                cwe_ids = vuln.get("CweIDs")
+                vuln_identifiers = clean_ids(
+                    cve_ids(vuln_id) or (vuln_id if vuln_id != "Unknown ID" else None),
+                    [cwe_id(c) for c in cwe_ids] if isinstance(cwe_ids, list) else None,
+                )
+
+                finding = Finding(
+                    title=title,
+                    severity=severity,
+                    description=desc,
+                    remediation=remediation,
+                    identifiers=vuln_identifiers,
+                    cvss_score=cvss_score,
+                    cvss_vector=cvss_vector,
+                    references=extract_urls(vuln.get("PrimaryURL"), vuln.get("References")),
+                    hosts=[host_model],
+                    evidence=evidence_list,
+                    source_tool="trivy"
+                )
+                findings.append(finding)
+
+            # Parse Misconfigurations (IaC)
+            misconfs = result.get("Misconfigurations") or []
+            if not isinstance(misconfs, list):
+                misconfs = []
+            for misconf in misconfs:
+                if not isinstance(misconf, dict):
+                    continue
+                misconf_id = misconf.get("ID", "Unknown ID")
+                title_raw = misconf.get("Title")
+                title = str(title_raw).strip() if title_raw else misconf_id
+
+                desc_raw = misconf.get("Description")
+                desc = str(desc_raw).strip() if desc_raw else ""
+
+                sev_raw = (misconf.get("Severity") or "UNKNOWN").upper()
+                severity = severity_map.get(sev_raw, "Info")
+
+                rem_raw = misconf.get("Resolution")
+                remediation = str(rem_raw).strip() if rem_raw else ""
+
+                evidence_list = [Evidence(type="target", data=target)]
+                cause = misconf.get("CauseMetadata", {})
+                if isinstance(cause, dict) and cause:
+                    cause_text = f"Provider: {cause.get('Provider', '')}\nService: {cause.get('Service', '')}"
+                    code_data = cause.get("Code")
+                    if isinstance(code_data, dict) and "Lines" in code_data:
+                        lines = code_data.get("Lines") or []
+                        if isinstance(lines, list):
+                            code_str = "\n".join([str(line.get("Content", "")) for line in lines if isinstance(line, dict)])
+                            if code_str:
+                                cause_text += f"\nCode snippet:\n{code_str}"
+                    elif code_data:
+                        cause_text += f"\nCode snippet:\n{code_data}"
+                    evidence_list.append(Evidence(type="cause", data=cause_text.strip()))
+                elif cause:
+                    evidence_list.append(Evidence(type="cause", data=str(cause).strip()))
+
+                finding = Finding(
+                    title=title,
+                    severity=severity,
+                    description=desc,
+                    remediation=remediation if remediation else None,
+                    identifiers=clean_ids(f"trivy-id:{misconf_id}" if misconf.get("ID") else None),
+                    references=extract_urls(misconf.get("PrimaryURL"), misconf.get("References")),
+                    hosts=[host_model],
+                    evidence=evidence_list,
+                    source_tool="trivy"
+                )
+                findings.append(finding)
+
+            # Parse Secrets
+            secrets = result.get("Secrets") or []
+            if not isinstance(secrets, list):
+                secrets = []
+            for secret in secrets:
+                if not isinstance(secret, dict):
+                    continue
+                sec_id = secret.get("RuleID", "Unknown Secret")
+                title_raw = secret.get("Title")
+                title = str(title_raw).strip() if title_raw else sec_id
+                desc = f"Secret detected: {sec_id}"
+                sev_raw = (secret.get("Severity") or "CRITICAL").upper()
+                severity = severity_map.get(sev_raw, "Critical")
+
+                evidence_list = [Evidence(type="target", data=target)]
+                if secret.get("Match"):
+                    evidence_list.append(Evidence(type="match", data=f"Match: {secret.get('Match')}"))
+
+                finding = Finding(
+                    title=title,
+                    severity=severity,
+                    description=desc,
+                    identifiers=clean_ids(f"trivy-rule:{sec_id}" if secret.get("RuleID") else None),
+                    hosts=[host_model],
+                    evidence=evidence_list,
+                    source_tool="trivy"
+                )
+                findings.append(finding)
+
+        return findings

scanfuse/parsers/zap.py

@@ -0,0 +1,124 @@
+import xml.etree.ElementTree as ET
+
+import defusedxml.ElementTree as defused_et
+
+from scanfuse.models import Evidence, Finding, Host
+from scanfuse.parsers.base import (
+    BaseParser,
+    clean_ids,
+    cve_ids,
+    cwe_id,
+    extract_urls,
+    html_to_text,
+)
+
+
+def _instance_text(elem: ET.Element) -> str:
+    """Request, parameter, attack, evidence and extra info of one alert instance."""
+    uri = elem.findtext("uri", default="").strip()
+    method = elem.findtext("method", default="").strip()
+    lines = []
+    if uri or method:
+        lines.append(f"Request: {method} {uri}".replace("Request:  ", "Request: ").strip())
+    for label, tag in (("Parameter", "param"), ("Attack", "attack"), ("Evidence", "evidence")):
+        value = html_to_text(elem.findtext(tag, default=""))
+        if value:
+            lines.append(f"{label}: {value}")
+    if elem.tag == "instance":
+        other = html_to_text(elem.findtext("otherinfo", default=""))
+        if other:
+            lines.append(f"Other info: {other}")
+    return "\n".join(lines)
+
+
+class ZapParser(BaseParser):
+    def parse(self, file_path: str) -> list[Finding]:
+        findings = []
+        try:
+            context = iter(defused_et.iterparse(file_path, events=("start", "end")))
+
+            try:
+                event, root = next(context)
+            except StopIteration:
+                raise ValueError("Empty XML file")
+
+            if root.tag != "OWASPZAPReport":
+                raise ValueError("Not a valid ZAP XML file (missing <OWASPZAPReport> root tag)")
+
+            risk_map = {
+                "0": "Info",
+                "1": "Low",
+                "2": "Medium",
+                "3": "High"
+            }
+
+            for event, site_elem in context:
+                if event == "end" and site_elem.tag == "site":
+                    host_val = site_elem.get("host", "unknown")
+                    host_model = Host(ip=host_val)
+
+                    alerts_elem = site_elem.find("alerts")
+                    if alerts_elem is None:
+                        site_elem.clear()
+                        root.clear()
+                        continue
+
+                    for alert_elem in alerts_elem.findall("alertitem"):
+                        # Newer reports have <name>; ZAP 1.x reports only have <alert>.
+                        name = html_to_text(
+                            alert_elem.findtext("name") or alert_elem.findtext("alert") or ""
+                        ) or "Unknown Vulnerability"
+                        riskcode = alert_elem.findtext("riskcode", default="0")
+                        severity = risk_map.get(riskcode, "Info")
+
+                        desc = html_to_text(alert_elem.findtext("desc", default=""))
+                        solution = html_to_text(alert_elem.findtext("solution", default=""))
+                        reference_text = alert_elem.findtext("reference", default="")
+
+                        evidence_list = []
+                        instances_elem = alert_elem.find("instances")
+                        if instances_elem is not None:
+                            for inst in instances_elem.findall("instance"):
+                                text = _instance_text(inst)
+                                if text:
+                                    evidence_list.append(Evidence(type="http-request", data=text))
+                        else:
+                            # ZAP 1.x: uri, param and attack are children of the alert itself.
+                            text = _instance_text(alert_elem)
+                            if text:
+                                evidence_list.append(Evidence(type="http-request", data=text))
+                        other_info = html_to_text(alert_elem.findtext("otherinfo", default=""))
+                        if other_info:
+                            evidence_list.append(Evidence(type="other-info", data=other_info))
+
+                        plugin_id = alert_elem.findtext("pluginid", default="").strip()
+                        wasc = alert_elem.findtext("wascid", default="").strip()
+                        identifiers = clean_ids(
+                            f"zap-plugin:{plugin_id}" if plugin_id else None,
+                            cwe_id(alert_elem.findtext("cweid", default="")),
+                            f"WASC-{wasc}" if wasc.isdigit() and int(wasc) > 0 else None,
+                            cve_ids(reference_text),
+                        )
+
+                        finding = Finding(
+                            title=name,
+                            severity=severity,
+                            description=desc,
+                            remediation=solution if solution else None,
+                            hosts=[host_model],
+                            evidence=evidence_list,
+                            identifiers=identifiers,
+                            references=extract_urls(reference_text),
+                            source_tool="zap"
+                        )
+                        findings.append(finding)
+
+                    site_elem.clear()
+                    root.clear()
+
+        except ET.ParseError as e:
+            raise ValueError(f"Invalid XML in {file_path}: {e}")
+        except OSError as e:
+            raise ValueError(f"File I/O error reading {file_path}: {e}")
+
+        return findings

scanfuse/templates/finding.md.j2

@@ -0,0 +1,67 @@
+# {{ finding.title | md }}
+
+**Severity**: {{ finding.severity | md }}
+{% if finding.cvss_score is not none %}
+
+**CVSS Score**: {{ finding.cvss_score }}{% if finding.cvss_vector %} ({{ finding.cvss_vector | md }}){% endif %}
+{% endif %}
+
+**Source**: {{ finding.source_tool | md }}
+{% if finding.port %}
+
+**Port**: {{ finding.port | md }}
+{% endif %}
+{% if finding.identifiers %}
+
+**Identifiers**: {% for ident in finding.identifiers %}{{ ident | md }}{% if not loop.last %}, {% endif %}{% endfor %}
+{% endif %}
+
+## Description
+{{ finding.description | mdtext }}
+
+{% if finding.remediation %}
+## Remediation
+{{ finding.remediation | mdtext }}
+{% endif %}
+
+{% if finding.references %}
+## References
+{% for url in finding.references %}
+- <{{ url }}>
+{% endfor %}
+
+{% endif %}
+{% if finding.sources %}
+## Reported by
+{% for s in finding.sources %}
+
+### {{ s.source_tool | md }}
+
+**Severity**: {{ s.severity | md }}{% if s.cvss_score is not none %}, **CVSS Score**: {{ s.cvss_score }}{% if s.cvss_vector %} ({{ s.cvss_vector | md }}){% endif %}{% endif %}
+
+{{ s.description | mdtext }}
+{% if s.remediation %}
+
+**Remediation**: {{ s.remediation | mdtext }}
+{% endif %}
+{% endfor %}
+{% endif %}
+
+## Hosts
+{% for host in finding.hosts %}
+- {{ host.ip | md }}{% if host.hostname %} ({{ host.hostname | md }}){% endif %}{% if host.os %} - OS: {{ host.os | md }}{% endif %}
+{% else %}
+No host information.
+{% endfor %}
+
+## Evidence
+{% for ev in finding.evidence %}
+### {{ ev.type | md }}{% if ev.source %} ({{ ev.source | md }}){% endif %}
+
+{% set fence = ev.data | fence %}
+{{ fence }}
+{{ ev.data }}
+{{ fence }}
+{% else %}
+No evidence provided.
+{% endfor %}

scanfuse/templates/index.md.j2

@@ -0,0 +1,44 @@
+# Pentest Report Summary
+
+## Import status
+{% if complete %}
+Complete. All inputs were read.
+{% else %}
+**INCOMPLETE.** {{ errors|length }} input problem(s). The findings below come only from inputs that could be read.
+{% for e in errors %}
+- {{ e.file | md }}: {{ e.message | md }}
+{% endfor %}
+{% endif %}
+
+## Executive Summary
+Total Findings: {{ findings|length }}
+
+### Risk Matrix
+| Severity | Count |
+|----------|-------|
+| Critical | {{ findings|selectattr('severity', 'equalto', 'Critical')|list|length }} |
+| High     | {{ findings|selectattr('severity', 'equalto', 'High')|list|length }} |
+| Medium   | {{ findings|selectattr('severity', 'equalto', 'Medium')|list|length }} |
+| Low      | {{ findings|selectattr('severity', 'equalto', 'Low')|list|length }} |
+| Info     | {{ findings|selectattr('severity', 'equalto', 'Info')|list|length }} |
+
+## Findings Overview
+{% for finding in findings_sorted %}
+- [{{ finding.severity | md }}] [{{ finding.title | md }}]({{ finding.slug }}.md) (Source: {{ finding.source_tool | md }}, {{ finding.hosts | length }} host{{ "" if finding.hosts | length == 1 else "s" }})
+{% endfor %}
+
+## Affected Hosts
+{% set hosts = {} %}
+{% for finding in findings %}
+  {% for host in finding.hosts %}
+    {% if host.ip not in hosts %}
+      {% set _ = hosts.update({host.ip: 1}) %}
+    {% endif %}
+  {% endfor %}
+{% endfor %}
+
+{% for ip in hosts %}
+- {{ ip | md }}
+{% else %}
+No host data extracted.
+{% endfor %}