Codebase list faraday-plugins / 65f0e52
Import upstream version 1.6.2 Kali Janitor 2 years ago
25 changed file(s) with 146 addition(s) and 49 deletion(s). Raw diff Collapse all Expand all
+1
-0
CHANGELOG/1.5.10/Nuclei_metadata.md less more
0 support cve,cwe,cvss and metadata
+1
-0
CHANGELOG/1.5.10/date.md less more
0 Jan 13th, 2022
+1
-0
CHANGELOG/1.6.0/add_packaging.md less more
0 Add packaging to requierments in setup.py
+1
-0
CHANGELOG/1.6.0/add_severity_to_shodan.md less more
0 Add severity to shodan's plugins using cvss⏎
+1
-0
CHANGELOG/1.6.0/date.md less more
0 Feb 3rd, 2022
+1
-0
CHANGELOG/1.6.0/fix_cve.md less more
0 check if cve exist on cve-id field
+1
-0
CHANGELOG/1.6.0/fix_fortify.md less more
0 Fix Fortify's plugin
+1
-0
CHANGELOG/1.6.0/fix_to_qualysguard.md less more
0 Change qualysguard's plugin severity_dict to refer level 2 severities as low
+1
-0
CHANGELOG/1.6.1/add_references_to_burp.md less more
0 Add references tu burp plugin
+1
-0
CHANGELOG/1.6.1/date.md less more
0 Mar 18th, 2022
+1
-0
CHANGELOG/1.6.1/fix_burp_plugin.md less more
0 Move item.detail from data to desc
+1
-0
CHANGELOG/1.6.1/update_open_status.md less more
0 update open status
+1
-0
CHANGELOG/1.6.2/add_line_indicator_to_appscan.md less more
0 Now Appscan plugin saves line and highlight of the vulns in desc and data
+1
-0
CHANGELOG/1.6.2/date.md less more
0 Apr 4th, 2022
+23
-1
RELEASE.md less more
0 1.6.2 [Apr 4th, 2022]:
1 ---
2 * Now Appscan plugin saves line and highlight of the vulns in desc and data
3
4 1.6.1 [Mar 18th, 2022]:
5 ---
6 * Add references tu burp plugin
7 * Move item.detail from data to desc
8 * update open status
9
10 1.6.0 [Feb 3rd, 2022]:
11 ---
12 * Add packaging to requierments in setup.py
13 * Add severity to shodan's plugins using cvss
14 * check if cve exist on cve-id field
15 * Fix Fortify's plugin
16 * Change qualysguard's plugin severity_dict to refer level 2 severities as low
17
18 1.5.10 [Jan 13th, 2022]:
19 ---
20 * support cve,cwe,cvss and metadata
21
022 1.5.9 [Dec 27th, 2021]:
123 ---
2 * ADD cve in faraday_csv plugin
24 * Add cve in faraday_csv plugin
325 * ADD Grype plugin
426
527 1.5.8 [Dec 13th, 2021]:
+1
-1
faraday_plugins/__init__.py less more
0 __version__ = '1.5.9'
0 __version__ = '1.6.2'
+4
-4
faraday_plugins/plugins/plugin.py less more
278278 command that it's going to be executed.
279279 """
280280 self._current_path = current_path
281 if command_string.startswith(("sudo","python","python3")):
281 if command_string.startswith(("sudo", "python", "python3")):
282282 params = " ".join(command_string.split()[2:])
283283 else:
284284 params = " ".join(command_string.split()[1:])
392392 if ref is None:
393393 ref = []
394394 if status == "":
395 status = "opened"
395 status = "open"
396396 if impact is None:
397397 impact = {}
398398 if policyviolations is None:
426426 if ref is None:
427427 ref = []
428428 if status == "":
429 status = "opened"
429 status = "open"
430430 if impact is None:
431431 impact = {}
432432 if policyviolations is None:
484484 if ref is None:
485485 ref = []
486486 if status == "":
487 status = "opened"
487 status = "open"
488488 if impact is None:
489489 impact = {}
490490 if policyviolations is None:
+10
-2
faraday_plugins/plugins/repo/appscan/plugin.py less more
3434 try:
3535 tree = ET.fromstring(xml_output)
3636 except SyntaxError as err:
37 print('SyntaxError In xml: %s. %s' % (err, xml_output))
37 print(f'SyntaxError In xml: {err}. {xml_output}')
3838 return None
3939 return tree
4040
181181 sast_issues = []
182182 for item in tree:
183183 name = self.issue_types[item.find("issue-type/ref").text]
184 source_file = item.attrib["filename"].replace('\\','/')
184 source_file = item.attrib["filename"].replace('\\', '/')
185185 severity = 0 if item.find("severity-id") is None else int(item.find("severity-id").text)
186186 description = item.find("fix/item/general/text").text
187187 resolution = "" if item.find("variant-group/item/issue-information/fix-resolution-text") is None \
239239 data.append(f"Method: {item.find('variant-group/item/issue-information/method-signature').text}")
240240 if item.find("variant-group/item/issue-information/method-signature2") is not None:
241241 data.append(f"Location: {item.find('variant-group/item/issue-information/method-signature2').text}")
242 line = item.find("location")
243 highlight = item.find("variant-group/item/issue-information/call-trace/call-invocation/context/highlight")
244 if highlight is not None:
245 data.append(f" {highlight.text}")
246 issue_data["desc"] += "\n" + highlight.text
247 if line is not None and len(line.text.split(':')) > 1 and line.text.split(':')[-1].isdigit():
248 data.append(f"line {line.text.split(':')[-1]}")
249 issue_data["desc"] += f"line {line.text.split(':')[-1]}"
242250 issue_data['data'] = "\n".join(data)
243251 sast_issues.append(issue_data)
244252 return sast_issues
+37
-12
faraday_plugins/plugins/repo/burp/plugin.py less more
5959 try:
6060 tree = ET.fromstring(xml_output)
6161 except SyntaxError as err:
62 print("SyntaxError: %s. %s" % (err, xml_output))
62 print(f"SyntaxError: {err}. {xml_output}")
6363 return None
6464
6565 return tree
104104 external_id = item_node.findall('type')[0]
105105 request = self.decode_binary_node('./requestresponse/request')
106106 response = self.decode_binary_node('./requestresponse/response')
107
108107 detail = self.do_clean(item_node.findall('issueDetail'))
109108 remediation = self.do_clean(item_node.findall('remediationBackground'))
110109 background = self.do_clean(item_node.findall('issueBackground'))
110 self.references = self.do_clean(item_node.findall('references'))
111 self.vulnClass = self.do_clean(item_node.findall('vulnerabilityClassifications'))
111112 self.cve = []
112113 if background:
113114 cve = CVE_regex.search(background)
143144 def do_clean(value):
144145
145146 myreturn = ""
146 if value is not None:
147 if len(value) > 0:
148 myreturn = value[0].text
147 if value is not None and len(value) > 0:
148 myreturn = value[0].text
149149 return myreturn
150150
151151 def decode_binary_node(self, path):
209209 ports=[str(item.port)],
210210 status="open")
211211
212 desc = ""
212213 if item.background:
213 desc = item.background
214 else:
215 desc = ""
214 desc += item.background
216215 desc = self.removeHtml(desc)
216 data = ""
217217 if item.detail:
218 data = item.detail
219 else:
220 data = ""
221 data = self.removeHtml(data)
218 desc += self.removeHtml(item.detail)
219 data = self.removeHtml(item.detail)
220 ref = []
221 if item.references:
222 ref += self.get_url(item.references)
223 if item.vulnClass:
224 ref += self.get_ref(item.vulnClass)
225
222226 resolution = self.removeHtml(item.remediation) if item.remediation else ""
223227
224228 self.createAndAddVulnWebToService(
233237 request=item.request,
234238 response=item.response,
235239 resolution=resolution,
240 ref=ref,
236241 external_id=item.external_id,
237242 cve=item.cve
238243 )
266271
267272 return str(soup)
268273
274 def get_ref(self, markup):
275 soup = BeautifulSoup(markup, "html.parser")
276
277 for tag in soup.find_all("ul"):
278 for item in tag.find_all("li"):
279 for a in item.find_all("a"):
280 a.unwrap()
281 item.unwrap()
282 tag.unwrap()
283 ref = str(soup).strip().split("\n")
284 return ref
285
286 def get_url(self, markup):
287 soup = BeautifulSoup(markup, "html.parser")
288 ref = []
289 for tag in soup.find_all("ul"):
290 for item in tag.find_all("li"):
291 for a in item.find_all("a"):
292 ref += [a['href'].strip()]
293 return ref
269294
270295 def createPlugin(ignore_info=False):
271296 return BurpPlugin(ignore_info=ignore_info)
+10
-12
faraday_plugins/plugins/repo/fortify/plugin.py less more
5757 service_name,
5858 protocol=protocol_name,
5959 ports=[vuln_data['service']['port']])
60
6160 self.createAndAddVulnWebToService(
6261 host_id, service_id,
6362 vuln_data['name'],
8483
8584
8685 class FortifyParser:
87 """
86 """
8887 Parser for fortify on demand
8988 """
9089
221220 references.append(classification.text)
222221
223222 # Build description
224 description = u''
223 description = ''
225224 for report_section in issue_data.findall('./ReportSection'):
226 description += u'{} \n'.format(report_section.Name.text)
227 description += u'{} \n'.format(report_section.SectionText.text)
228 description += u'{} \n'.format(issue_data.get('id'))
225 description += f'{report_section.Name.text} \n'
226 description += f'{report_section.SectionText.text} \n'
227 description += f'{issue_data.get("id")} \n'
229228
230229 h = html2text.HTML2Text()
231230 description = h.handle(description)
232231
233232 for repro_step in issue_data.findall('./ReproSteps'):
234233 step = repro_step.ReproStep
235
234
236235 if step is not None:
237236 try:
238237 params = step.PostParams.text
258257 "method": method,
259258 "query": query,
260259 "response": response,
261 "request": request,
260 "request": request.decode('utf-8'),
262261 "path": path,
263262 "params": params,
264263 "status_code": status_code,
371370 idx = match.group(1)
372371 if match.group(3):
373372 idx = match.group(3)
374 _filekey = "{}.file".format(idx)
375 _linekey = "{}.line".format(idx)
373 _filekey = f"{idx}.file"
374 _linekey = f"{idx}.line"
376375 text = text.replace(placeholder, "").replace(
377376 torepl.format(_filekey), replacements[_filekey]).replace(
378377 torepl.format(_linekey), replacements[_linekey])
386385
387386 text = text.replace(placeholder, replace_with)
388387
389 text += '{}\n Instance ID: {} \n'.format(text, vulnID)
388 text += f'{text}\n Instance ID: {vulnID} \n'
390389 h = html2text.HTML2Text()
391390 return text
392391
393392
394393 def createPlugin(ignore_info=False):
395394 return FortifyPlugin(ignore_info=ignore_info)
396
+35
-8
faraday_plugins/plugins/repo/nuclei/plugin.py less more
3232 super().__init__(*arg, **kwargs)
3333 self.id = "nuclei"
3434 self.name = "Nuclei"
35 self.plugin_version = "1.0.2"
36 self.version = "2.5.3"
35 self.plugin_version = "1.0.3"
36 self.version = "2.5.5"
3737 self.json_keys = {"matched-at", "template-id", "host"}
3838 self._command_regex = re.compile(r'^(sudo nuclei|nuclei|\.\/nuclei|^.*?nuclei)\s+.*?')
3939 self.xml_arg_re = re.compile(r"^.*(-o\s*[^\s]+).*$")
8787 references = [references]
8888 else:
8989 references = []
90 cwe = vuln_dict['info'].get('cwe', [])
91 capec = vuln_dict['info'].get('capec', [])
92 refs = sorted(list(set(reference + references + cwe + capec)))
90
91 cve = vuln_dict['info'].get('classification', {}).get('cve-id', [])
92 if cve:
93 cve = [x.upper() for x in cve]
94
95 # TODO CVSSv2, CVSSv3, CWE and CAPEC
96 #cvssv2 = vuln_dict['info'].get('classification', {}).get('cvss-score')
97 #cvssv3 = vuln_dict['info'].get('classification', {}).get('cvss-metrics')
98 #cwe = vuln_dict['info'].get('classification', {}).get('cwe-id', [])
99 #cwe = [x.upper() for x in cwe]
100 #capec = vuln_dict['info'].get('metadata', {}).get('capec', [])
101 #if isinstance(capec, str):
102 # capec = capec.upper().split(',')
103
104 refs = sorted(list(set(reference + references)))
105 refs = list(filter(None, refs))
106
93107 tags = vuln_dict['info'].get('tags', [])
94108 if isinstance(tags, str):
95109 tags = tags.split(',')
96 impact = vuln_dict['info'].get('impact')
97 resolution = vuln_dict['info'].get('resolution', '')
98 easeofresolution = vuln_dict['info'].get('easeofresolution')
110
111 impact = {}
112 impacted = vuln_dict['info'].get('metadata', {}).get('impact')
113 if isinstance(impacted, str):
114 for x in impacted.split(','):
115 impact[x] = True
116
117 resolution = vuln_dict['info'].get('metadata', {}).get('resolution', '')
118 easeofresolution = vuln_dict['info'].get('metadata', {}).get('easeofresolution', None)
119
99120 request = vuln_dict.get('request', '')
100121 if request:
101122 method = request.split(" ")[0]
121142 impact=impact,
122143 resolution=resolution,
123144 easeofresolution=easeofresolution,
145 cve=cve,
146 # TODO CVSSv2, CVSSv3, CWE and CAPEC
147 #cvssv2=cvssv2,
148 #cvssv3=cvssv3,
149 #cwe=cwe,
150 #capec=capec,
124151 website=host,
125152 request=request,
126153 response=vuln_dict.get('response', ''),
+4
-4
faraday_plugins/plugins/repo/qualysguard/plugin.py less more
145145
146146 self.severity_dict = {
147147 '1': 'info',
148 '2': 'info',
148 '2': 'low',
149149 '3': 'med',
150150 '4': 'high',
151151 '5': 'critical'}
179179 self.cve.append(cve_id)
180180
181181 if self.cvss:
182 self.ref.append('CVSS SCORE: {}'.format(self.cvss))
182 self.ref.append(f'CVSS SCORE: {self.cvss}')
183183
184184 if self.pci:
185 self.ref.append('PCI: {}'.format(self.pci))
185 self.ref.append(f'PCI: {self.pci}')
186186
187187 def get_text_from_glossary(self, tag):
188188 """
285285
286286 self.severity_dict = {
287287 '1': 'info',
288 '2': 'info',
288 '2': 'low',
289289 '3': 'med',
290290 '4': 'high',
291291 '5': 'critical'}
+4
-2
faraday_plugins/plugins/repo/shodan/plugin.py less more
1212 import shutil
1313
1414 from faraday_plugins.plugins.plugin import PluginMultiLineJsonFormat
15
15 from faraday_plugins.plugins.plugins_utils import get_severity_from_cvss
1616 __author__ = "Valentin Vila"
1717 __copyright__ = "Copyright (c) 2021, Faraday"
1818 __credits__ = ["Valentin Vila"]
7171 for name, vuln_info in vulns.items():
7272 description = vuln_info.get('summary')
7373 references = vuln_info.get('references')
74 self.createAndAddVulnToService(h_id, s_id, name, desc=description, severity=0, ref=references, cve=name)
74 cvss = vuln_info.get('cvss')
75 severity = get_severity_from_cvss(cvss) if cvss else "info"
76 self.createAndAddVulnToService(h_id, s_id, name, desc=description, severity=severity, ref=references, cve=name)
7577
7678 def processCommandString(self, username, current_path, command_string):
7779 """
+1
-1
faraday_plugins/plugins/repo/sonarqubeapi/plugin.py less more
2121 }
2222 STATUSES = {
2323 'OPEN': 'open',
24 'CONFIRMED': 'opened',
24 'CONFIRMED': 'open',
2525 'REOPENED': 're-opened',
2626 'CLOSED': 'closed',
2727 'RESOLVED': 'closed'
+3
-2
setup.py less more
00 from setuptools import setup, find_packages
11 from re import search
22
3 with open('faraday_plugins/__init__.py', 'rt', encoding='utf8') as f:
3 with open('faraday_plugins/__init__.py', encoding='utf8') as f:
44 version = search(r'__version__ = \'(.*?)\'', f.read()).group(1)
55
66
1414 'pytz',
1515 'python-dateutil',
1616 'colorama',
17 'tabulate'
17 'tabulate',
18 'packaging'
1819 ]
1920
2021