Beispiel #1
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True,
                      namelookup=True,
                      vfeedlookup=True,
                      capeclookup=True,
                      subscorelookup=True,
                      misplookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',
                               status={
                                   'except': 'cve-not-found',
                                   'info': {
                                       'cve': cveid
                                   }
                               })
    cve = markCPEs(cve)
    if current_user.is_authenticated():
        db.addSeenCVEs(current_user.get_id(), cveid)
        bookmarked = "yes" if cveid in db.bookmarks(
            current_user.get_id()) else "no"
    else:
        bookmarked = None
    return render_template('cve.html', cve=cve, bookmarked=bookmarked)
Beispiel #2
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True,
                      namelookup=True,
                      vfeedlookup=True,
                      capeclookup=True,
                      subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',
                               status={
                                   'except': 'cve-not-found',
                                   'info': {
                                       'cve': cveid
                                   }
                               })
    cve = markCPEs(cve)
    if current_user.is_authenticated():
        l = getSeenCVEs()
        if not cveid in l:
            col = db.mgmt_seen
            col.update({"user": current_user.get_id()},
                       {"$addToSet": {
                           "seen_cves": cveid
                       }})
    return render_template('cve.html', cve=cve)
Beispiel #3
0
def cve(cveid):
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return page_not_found(404)
    cve = markCPEs(cve)
    return render_template('cve.html', cve=cve)
Beispiel #4
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',status={'except':'cve-not-found','info':{'cve':cveid}},minimal=True)
    return render_template('cve.html', cve=cve, minimal=True)
Beispiel #5
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',status={'except':'cve-not-found','info':{'cve':cveid}},minimal=True)
    return render_template('cve.html', cve=cve, minimal=True)
Beispiel #6
0
    def _enhance(self, scan):
        cvesp = cves.last(rankinglookup=False,
                          namelookup=False,
                          vfeedlookup=True,
                          capeclookup=False)
        for system in scan['systems']:
            cpe = system['cpes'] if 'cpes' in system else None

            if cpe:
                cpes = []
                for c in cpe:
                    c = c.lower()
                    cpes.append({
                        'cpe':
                        c,
                        'cves': [
                            cvesp.getcve(x['id'])
                            for x in db.cvesForCPE(toStringFormattedCPE(c))
                        ]
                    })
                system['cpes'] = cpes
            for service in system['services']:
                if 'cpe' in service:
                    service['cves'] = db.cvesForCPE(service['cpe'])
        scan['enhanced'] = {"time": int(datetime.now().strftime('%s'))}
        return scan
Beispiel #7
0
def apiCVEFor(cpe):
    cpe=urllib.parse.unquote_plus(cpe)
    cpe=toStringFormattedCPE(cpe)
    r = []
    cvesp = cves.last(rankinglookup=False, namelookup=False, vfeedlookup=True, capeclookup=False)
    for x in db.cvesForCPE(cpe):
        r.append(cvesp.getcve(x['id']))
    return json.dumps(r)
Beispiel #8
0
def apiCVEFor(cpe):
    cpe=urllib.parse.unquote_plus(cpe)
    cpe=toStringFormattedCPE(cpe)
    r = []
    cvesp = cves.last(rankinglookup=False, namelookup=False, vfeedlookup=True, capeclookup=False)
    for x in dbLayer.cvesForCPE(cpe):
        r.append(cvesp.getcve(x['id']))
    return json.dumps(r)
Beispiel #9
0
 def api_cve(self, cveid):
     cvesp = cves.last(rankinglookup=True,
                       namelookup=True,
                       via4lookup=True,
                       capeclookup=True)
     cve = cvesp.getcve(cveid=cveid.upper())
     if cve is None: cve = {}
     return cve
Beispiel #10
0
 def api_last(self, limit=None):
     limit = limit if limit else 30
     cvesp = cves.last(rankinglookup=True,
                       namelookup=True,
                       via4lookup=True,
                       capeclookup=True)
     cve = cvesp.get(limit=limit)
     return cve
Beispiel #11
0
def apilast():
    limit = 30
    cvesp = cves.last(rankinglookup=True,
                      namelookup=True,
                      vfeedlookup=True,
                      capeclookup=True)
    cve = cvesp.get(limit=limit)
    return (jsonify({"results": cve}))
Beispiel #12
0
 def api_cve(self, cveid):
     cvesp = cves.last(rankinglookup=True,
                       namelookup=True,
                       via4lookup=True,
                       capeclookup=True)
     cve = cvesp.getcve(cveid=cveid.upper())
     if not cve: raise (APIError('cve not found', 404))
     return cve
Beispiel #13
0
def cvesForCPE(cpe):
  cpe  = tk.toStringFormattedCPE(cpe)
  data = []
  if cpe:
    cvesp = cves.last(rankinglookup=False, namelookup=False, via4lookup=True, capeclookup=False)
    for x in db.cvesForCPE(cpe):
        data.append(cvesp.getcve(x['id']))
  return data
Beispiel #14
0
def cvesForCPE(cpe):
  cpe  = tk.toStringFormattedCPE(cpe)
  data = []
  if cpe:
    cvesp = cves.last(rankinglookup=False, namelookup=False, via4lookup=True, capeclookup=False)
    for x in db.cvesForCPE(cpe):
        data.append(cvesp.getcve(x['id']))
  return cves
Beispiel #15
0
def bookmarked():
    cvesp = cves.last(rankinglookup=True,
                      namelookup=True,
                      vfeedlookup=True,
                      capeclookup=True,
                      subscorelookup=True)
    cve = [cvesp.getcve(cveid=x) for x in db.bookmarks(current_user.get_id())]
    return render_template('bookmarked.html', cve=cve)
Beispiel #16
0
def apiCVE(cveid):
    cvesp = cves.last(rankinglookup=True,
                      namelookup=True,
                      vfeedlookup=True,
                      capeclookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        cve = {}
    return (jsonify(cve))
Beispiel #17
0
def apiCVEFor(cpe):
    cpe=urllib.parse.unquote_plus(cpe)
    cpe=toStringFormattedCPE(cpe)
    if not cpe: cpe='None'
    r = []
    cvesp = cves.last(rankinglookup=False, namelookup=False, reflookup=True, capeclookup=False)
    for x in dbLayer.cvesForCPE(cpe):
        r.append(cvesp.getcve(x['id']))
    return json.dumps(r, default=json_util.default)
Beispiel #18
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',status={'except':'cve-not-found','info':{'cve':cveid}}) 
    cve = markCPEs(cve)
    if current_user.is_authenticated():
        dbLayer.addSeenCVEs(current_user.get_id(), cveid)
    return render_template('cve.html', cve=cve)
Beispiel #19
0
def cve(cveid):
    cvesp = cves.last(rankinglookup=True,
                      namelookup=True,
                      vfeedlookup=True,
                      capeclookup=True,
                      subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return page_not_found(404)
    return render_template('cve-minimal.html', cve=cve)
def apiCVEFor(cpe):
    col = db['cves']
    cpe=urllib.parse.unquote_plus(cpe)
    cpe=toStringFormattedCPE(cpe)
    if not cpe: cpe='None'
    vulns = col.find({"vulnerable_configuration": {'$regex': cpe}}).sort("Modified", -1)
    r = []
    cvesp = cves.last(rankinglookup=False, namelookup=False, vfeedlookup=True, capeclookup=False)
    for x in vulns:
        r.append(cvesp.getcve(x['id']))
    return json.dumps(r)
Beispiel #21
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',status={'except':'cve-not-found','info':{'cve':cveid}})
    cve = markCPEs(cve)
    
    plugManager.onCVEOpen(cveid, current_user=current_user)
    pluginData = plugManager.cvePluginInfo(cveid, current_user=current_user)
    return render_template('cve.html', cve=cve, plugins=pluginData)
Beispiel #22
0
def summarycvesForCPE(cpe):
    cpe = tk.toStringFormattedCPE(cpe)
    data = []
    if cpe:
        cvesp = cves.last(rankinglookup=False,
                          namelookup=False,
                          via4lookup=True,
                          capeclookup=False)
        r = db.summarycvesForCPE(cpe)
        data = r['results']
    return data
Beispiel #23
0
 def getPage(self, **args):
     cvesp = cves.last(rankinglookup=True,
                       namelookup=True,
                       vfeedlookup=True,
                       capeclookup=True,
                       subscorelookup=True)
     data = db.p_queryOne(self.collectionName,
                          {"user": args["current_user"].get_id()})
     bookmarks = data.get("bookmarks", []) if data else []
     cve = [cvesp.getcve(cveid=x) for x in bookmarks]
     page = "bookmarks.html"
     return (page, {"cve": cve})
Beispiel #24
0
def cvesForCPE(cpe):
    cpe = tk.toStringFormattedCPE(cpe)
    data = []
    if cpe:
        cvesp = cves.last(rankinglookup=False,
                          namelookup=False,
                          via4lookup=True,
                          capeclookup=False)
        r = db.cvesForCPE(cpe)
        for x in r["results"]:
            data.append(cvesp.getcve(x["id"]))
    return data
Beispiel #25
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True, subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template("error.html", status={"except": "cve-not-found", "info": {"cve": cveid}})
    cve = markCPEs(cve)
    if current_user.is_authenticated():
        db.addSeenCVEs(current_user.get_id(), cveid)
        bookmarked = "yes" if cveid in db.bookmarks(current_user.get_id()) else "no"
    else:
        bookmarked = None
    return render_template("cve.html", cve=cve, bookmarked=bookmarked)
Beispiel #26
0
def cve(cveid):
    cveid = cveid.upper()
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        return render_template('error.html',status={'except':'cve-not-found','info':{'cve':cveid}}) 
    cve = markCPEs(cve)
    if current_user.is_authenticated():
        l = getSeenCVEs()
        if not cveid in l:
            col=db.mgmt_seen
            col.update({"user":current_user.get_id()},{"$addToSet":{"seen_cves":cveid}})
    return render_template('cve.html', cve=cve)
Beispiel #27
0
    def api_last_time(self, time_type='hour', time=1):
        time_types = ['hour', 'minute']
        if time_type not in time_types:
            return """{"error": "invalid type"}""", 400

        cvesp = cves.last(rankinglookup=True,
                          namelookup=True,
                          via4lookup=True,
                          capeclookup=True,
                          sort_time=True,
                          time_type=time_type,
                          time=time)
        cve = cvesp.get()
        return cve
Beispiel #28
0
  def _enhance(self, scan):
    cvesp = cves.last(rankinglookup=False, namelookup=False, via4lookup=True, capeclookup=False)
    for system in scan['systems']:
      cpe=system['cpes'] if 'cpes' in system else None

      if cpe:
        cpes=[]
        for c in cpe:
          c=c.lower()
          cpes.append({'cpe':c, 'cves':[cvesp.getcve(x['id'])
                       for x in db.cvesForCPE(toStringFormattedCPE(c))]})
        system['cpes']=cpes
      for service in system['services']:
        if 'cpe' in service:
          service['cves']=db.cvesForCPE(service['cpe'])
    scan['enhanced']={"time": int(datetime.now().strftime('%s'))}
    return scan
Beispiel #29
0
def apiCVEFor(cpe):
    col = db['cves']
    cpe = urllib.parse.unquote_plus(cpe)
    cpe = toStringFormattedCPE(cpe)
    if not cpe: cpe = 'None'
    vulns = col.find({
        "vulnerable_configuration": {
            '$regex': cpe
        }
    }).sort("Modified", -1)
    r = []
    cvesp = cves.last(rankinglookup=False,
                      namelookup=False,
                      vfeedlookup=True,
                      capeclookup=False)
    for x in vulns:
        r.append(cvesp.getcve(x['id']))
    return json.dumps(r)
Beispiel #30
0
    def cve(self, cveid):
        cveid = cveid.upper()
        cvesp = cves.last(
            rankinglookup=True,
            namelookup=True,
            via4lookup=True,
            capeclookup=True,
            subscorelookup=True,
        )
        cve = cvesp.getcve(cveid=cveid)
        if cve is None:
            return render_template("error.html",
                                   status={
                                       "except": "cve-not-found",
                                       "info": {
                                           "cve": cveid
                                       }
                                   })
        cve = self.markCPEs(cve)

        self.plugManager.onCVEOpen(cveid, **self.pluginArgs)
        pluginData = self.plugManager.cvePluginInfo(cveid, **self.pluginArgs)
        return render_template("cve.html", cve=cve, plugins=pluginData)
Beispiel #31
0
args = argParser.parse_args()

vSearch = args.p
relaxSearch = args.lax
cveSearch = [x.upper() for x in args.c] if args.c else None
vOutput = args.o
vFreeSearch = args.f
sLatest = args.l
namelookup = args.n
rankinglookup = args.r
capeclookup = args.a
last_ndays = args.t
summary_text= args.s
nlimit =args.i

cves = CVEs.last(rankinglookup=rankinglookup, namelookup=namelookup, capeclookup=capeclookup)

# replace special characters in vSearch with encoded version.
# Basically cuz I'm to lazy to handle conversion on DB creation ...
if vSearch:
    vSearch = re.sub(r'\(', '%28', vSearch)
    vSearch = re.sub(r'\)', '%29', vSearch)

# define which output to generate.
if vOutput == "csv":
    csvOutput = 1
elif vOutput == "html":
    htmlOutput = 1
elif vOutput == "xml":
    xmlOutput = 1
    from xml.etree.ElementTree import Element, SubElement, tostring
argParser.add_argument('-f', action='store_true', help='output matching CVE(s) in JSON')
argParser.add_argument('-m', type=int, default=False, help='most frequent terms in CVE description (m is top-m values)')
argParser.add_argument('-l', action='store_true', default=False, help='dump all terms encountered in CVE description')
argParser.add_argument('-g', action='store_true', default=False, help='graph of most frequent terms with each matching CVE (JSON output)')
argParser.add_argument('-s', action='store_true', default=False, help='enable stemming on graph JSON output (default is False)')
argParser.add_argument('-n', action='store_true', help='lookup complete cpe (Common Platform Enumeration) name for vulnerable configuration')
argParser.add_argument('-r', action='store_true', help='lookup ranking of vulnerable configuration')
args = argParser.parse_args()

if not args.q and not args.l and not args.g and not args.m:
    argParser.print_help()
    exit(1)

if args.f or args.t:
    from lib import CVEs
    cves = CVEs.last(rankinglookup=args.r, namelookup=args.n)

if args.q:
    with ix.searcher() as searcher:
        query = QueryParser("content", ix.schema).parse(" ".join(args.q))
        results = searcher.search(query, limit=None)
        for x in results:
            if not args.f:
                print (x['path'])
            else:
                print(json.dumps(cves.getcve(x['path']), sort_keys=True, default=json_util.default))
            if args.t and not args.f:
                print (" -- " + x['title'])
elif args.m:
    xr = ix.searcher().reader()
    for x in xr.most_frequent_terms("content", number=args.m):
Beispiel #33
0
import argparse
import json
from bson import json_util

import lib.CVEs as cves
import lib.DatabaseLayer as db

argParser = argparse.ArgumentParser(description='Dump database in JSON format')
argParser.add_argument('-r', default=False, action='store_true', help='Include ranking value')
argParser.add_argument('-v', default=False, action='store_true', help='Include via4 map')
argParser.add_argument('-c', default=False, action='store_true', help='Include CAPEC information')
argParser.add_argument('-l', default=False, type=int, help='Limit output to n elements (default: unlimited)')
args = argParser.parse_args()

rankinglookup = args.r
via4lookup = args.v
capeclookup = args.c

l = cves.last(rankinglookup=rankinglookup, via4lookup=via4lookup, capeclookup=capeclookup)

for cveid in db.getCVEIDs(limit=args.l):
    item = l.getcve(cveid=cveid)
    if 'cvss' in item:
        if type(item['cvss']) == str:
            item['cvss'] = float(item['cvss'])
    date_fields = ['cvss-time', 'Modified', 'Published']
    for field in date_fields:
        if field in item:
            item[field] = str(item[field])
    print(json.dumps(item, sort_keys=True, default=json_util.default))
Beispiel #34
0
 def api_cve(self, cveid):
   cvesp = cves.last(rankinglookup=True, namelookup=True, via4lookup=True, capeclookup=True)
   cve = cvesp.getcve(cveid=cveid.upper())
   if not cve: raise(APIError('cve not found', 404))
   return cve
Beispiel #35
0
def search_func(args, output=sys.__stdout__):
    "Implement main cve-search function."
    # set output pipe
    # output is set back to sys.__stdout__ at the end of
    # the function
    sys.stdout = output

    # init control variables
    csvOutput = 0
    htmlOutput = 0
    jsonOutput = 0
    xmlOutput = 0
    last_ndays = 0
    nlimit = 0

    # init various variables :-)
    vSearch = ""
    vOutput = ""
    vFreeSearch = ""
    summary_text = ""

    vSearch = args["p"]
    cveSearch = [x.upper() for x in args["c"]] if args["c"] else None
    vOutput = args["o"]
    vFreeSearch = args["f"]
    sLatest = args["l"]
    namelookup = args["n"]
    rankinglookup = args["r"]
    capeclookup = args["a"]
    last_ndays = args["t"]
    summary_text = args["s"]
    nlimit = args["i"]

    cves = CVEs.last(rankinglookup=rankinglookup,
                     namelookup=namelookup,
                     capeclookup=capeclookup)

    # replace special characters in vSearch with encoded version.
    # Basically cuz I'm to lazy to handle conversion on DB creation ...
    if vSearch:
        vSearch = re.sub(r"\(", "%28", vSearch)
        vSearch = re.sub(r"\)", "%29", vSearch)

    # define which output to generate.
    if vOutput == "csv":
        csvOutput = 1
    elif vOutput == "html":
        htmlOutput = 1
    elif vOutput == "xml":
        xmlOutput = 1
        r = Element("cve-search")
    elif vOutput == "json":
        jsonOutput = 1
    elif vOutput == "cveid":
        cveidOutput = 1
    else:
        cveidOutput = False

    # Print first line of html output
    if htmlOutput and args["p"] is not None:
        print("<html><body><h1>CVE search " + args["p"] + " </h1>")
    elif htmlOutput and args["c"] is not None:
        print("<html><body><h1>CVE-ID " + str(args["c"]) + " </h1>")

    # search default is ascending mode
    sorttype = 1
    if sLatest:
        sorttype = -1

    if cveSearch:
        results = db.getCVEs(cves=cveSearch)
        for index, item in enumerate(results):
            if csvOutput:
                printCVE_csv(item, namelookup, rankinglookup, cves)
            elif htmlOutput:
                printCVE_html(item, rankinglookup, cves)
            # bson straight from the MongoDB db - converted to JSON default
            # representation
            elif jsonOutput:
                printCVE_json(item, namelookup, rankinglookup, capeclookup,
                              cves)
                if index != len(results) - 1:
                    print(",", end="")
            elif xmlOutput:
                printCVE_xml(item, rankinglookup, cves, r)
            elif cveidOutput:
                printCVE_id(item)
            else:
                printCVE_human(item, namelookup, rankinglookup, cves)

        if htmlOutput:
            print("</body></html>")
        sys.stdout = sys.__stdout__
        return 1
    # Basic freetext search (in vulnerability summary).
    # Full-text indexing is more efficient to search across all CVEs.
    if vFreeSearch:
        try:
            results = db.getFreeText(vFreeSearch)
            for index, item in enumerate(results):
                if jsonOutput:
                    printCVE_json(item,
                                  namelookup,
                                  rankinglookup,
                                  capeclookup,
                                  cves,
                                  indent=2)
                    if index != len(results) - 1:
                        print(",", end="")
                else:
                    printCVE_human(item, namelookup, rankinglookup, cves)
        except:
            sys.exit("Free text search not enabled on the database!")

        sys.stdout = sys.__stdout__
        return 1

    # Search Product (best to use CPE notation, e.g. cisco:ios:12.2
    if vSearch:
        results = db.cvesForCPE(vSearch)
        for index, item in enumerate(results):
            if not last_ndays:
                if csvOutput:
                    printCVE_csv(item, namelookup, rankinglookup, cves)
                elif htmlOutput:
                    printCVE_html(item, rankinglookup, cves)
                # bson straight from the MongoDB db - converted to JSON default
                # representation
                elif jsonOutput:
                    printCVE_json(item, namelookup, rankinglookup, capeclookup,
                                  cves)
                    if index != len(results) - 1:
                        print(",", end="")
                elif xmlOutput:
                    printCVE_xml(item, rankinglookup, cves, r)
                elif cveidOutput:
                    printCVE_id(item)
                else:
                    printCVE_human(item, namelookup, rankinglookup, cves)
            else:
                date_n_days_ago = datetime.now() - timedelta(days=last_ndays)
                if item["Published"] > date_n_days_ago:

                    if csvOutput:
                        printCVE_csv(item, namelookup, rankinglookup, cves)
                    elif htmlOutput:
                        printCVE_html(item, rankinglookup, cves)
                    # bson straight from the MongoDB db - converted to JSON default
                    # representation
                    elif jsonOutput:
                        printCVE_json(item, namelookup, rankinglookup,
                                      capeclookup, cves)
                    elif xmlOutput:
                        printCVE_xml(item, rankinglookup, cves, r)
                    elif cveidOutput:
                        printCVE_id(item)
                    else:
                        printCVE_human(item, namelookup, rankinglookup, cves)
        if htmlOutput:
            print("</body></html>")

        sys.stdout = sys.__stdout__
        return 1
    # Search text in summary
    if summary_text:
        import lib.CVEs as cves

        l = cves.last(rankinglookup=rankinglookup,
                      namelookup=namelookup,
                      capeclookup=capeclookup)

        for cveid in db.getCVEIDs(limit=nlimit):
            item = l.getcve(cveid=cveid)
            if "cvss" in item:
                if type(item["cvss"]) == str:
                    item["cvss"] = float(item["cvss"])
            date_fields = ["cvss-time", "Modified", "Published"]
            for field in date_fields:
                if field in item:
                    item[field] = str(item[field])
            if summary_text.upper() in item["summary"].upper():
                if not last_ndays:
                    if vOutput:
                        printCVE_id(item)
                    else:
                        print(
                            json.dumps(item,
                                       sort_keys=True,
                                       default=json_util.default))
                else:

                    date_n_days_ago = datetime.now() - timedelta(
                        days=last_ndays)
                    # print(item['Published'])
                    # print(type (item['Published']))
                    # print("Last n day " +str(last_ndays))
                    try:
                        if (datetime.strptime(item["Published"],
                                              "%Y-%m-%d %H:%M:%S.%f") >
                                date_n_days_ago):
                            if vOutput:
                                printCVE_id(item)
                            else:
                                print(
                                    json.dumps(item,
                                               sort_keys=True,
                                               default=json_util.default))
                    except:
                        pass
        if htmlOutput:
            print("</body></html>")

        sys.stdout = sys.__stdout__
        return 1

    if xmlOutput:
        # default encoding is UTF-8. Should this be detected on the terminal?
        s = tostring(r).decode("utf-8")
        print(s)
        sys.stdout = sys.__stdout__
        return 1

    else:
        sys.stdout = sys.__stdout__
        return 0

    sys.stdout = sys.__stdout__
    return 1
Beispiel #36
0
args = argParser.parse_args()

vSearch = args.p
cveSearch = [x.upper() for x in args.c] if args.c else None
vOutput = args.o
vFreeSearch = args.f
sLatest = args.l
namelookup = args.n
rankinglookup = args.r
capeclookup = args.a
last_ndays = args.t
summary_text = args.s
nlimit = args.i

cves = CVEs.last(rankinglookup=rankinglookup,
                 namelookup=namelookup,
                 capeclookup=capeclookup)

# replace special characters in vSearch with encoded version.
# Basically cuz I'm to lazy to handle conversion on DB creation ...
if vSearch:
    vSearch = re.sub(r'\(', '%28', vSearch)
    vSearch = re.sub(r'\)', '%29', vSearch)

# define which output to generate.
if vOutput == "csv":
    csvOutput = 1
elif vOutput == "html":
    htmlOutput = 1
elif vOutput == "xml":
    xmlOutput = 1
Beispiel #37
0
 def api_cve(self, cveid):
   cvesp = cves.last(rankinglookup=True, namelookup=True, via4lookup=True, capeclookup=True)
   cve = cvesp.getcve(cveid=cveid.upper())
   if cve is None: cve = {}
   return cve
Beispiel #38
0
                       action='store_true',
                       default=False,
                       help='Verbose logging')
argParser.add_argument('-l',
                       default=None,
                       help='Number of last entries to index')
argParser.add_argument(
    '-n',
    action='store_true',
    default=False,
    help=
    'lookup complete cpe (Common Platform Enumeration) name for vulnerable configuration to add in the index'
)
args = argParser.parse_args()

c = cves.last(namelookup=args.n)

indexpath = Configuration.getIndexdir()

from whoosh.index import create_in, exists_in, open_dir
from whoosh.fields import Schema, TEXT, ID

schema = Schema(title=TEXT(stored=True),
                path=ID(stored=True, unique=True),
                content=TEXT)

if not os.path.exists(indexpath):
    os.mkdir(indexpath)

if not exists_in(indexpath):
    ix = create_in(indexpath, schema)
Beispiel #39
0
                       action='store_true',
                       help='Include vfeed map')  # TODO change
argParser.add_argument('-c',
                       default=False,
                       action='store_true',
                       help='Include CAPEC information')
argParser.add_argument('-l',
                       default=False,
                       type=int,
                       help='Limit output to n elements (default: unlimited)')
args = argParser.parse_args()

rankinglookup = args.r
reflookup = args.v
capeclookup = args.c

l = cves.last(rankinglookup=rankinglookup,
              reflookup=reflookup,
              capeclookup=capeclookup)

for cveid in db.getCVEIDs(limit=args.l):
    item = l.getcve(cveid=cveid)
    if 'cvss' in item:
        if type(item['cvss']) == str:
            item['cvss'] = float(item['cvss'])
    date_fields = ['cvss-time', 'Modified', 'Published']
    for field in date_fields:
        if field in item:
            item[field] = str(item[field])
    print(json.dumps(item, sort_keys=True, default=json_util.default))
Beispiel #40
0
argParser = argparse.ArgumentParser(description='Dump last CVE entries in RSS/Atom format or in HTML tables')
argParser.add_argument('-f', type=str, help='Output format (rss1,rss2,atom,html)', default='rss1')
argParser.add_argument('-l', type=int, help='Last n items (default:10)', default=10)
argParser.add_argument('-n', action='store_false', help='Disable lookup CPE name (default is True)')
argParser.add_argument('-r', action='store_true', help='Enable CVE ranking (default is False) and only print entries with ranking')
argParser.add_argument('-c', default=False, action='store_true', help='Display CAPEC values')

args = argParser.parse_args()

if args.l:
    last = args.l
else:
    last = 10

ref = "http://adulau.github.com/cve-search/"
cvelist = cves.last(rankinglookup=args.r, namelookup=args.n, capeclookup=args.c)

if not(args.f == "html"):
    from feedformatter import Feed
    feed = Feed()

    feed.feed['title'] = "cve-search Last " + str(last) + " CVE entries generated on " + str(datetime.datetime.now())
    feed.feed['link'] = "http://adulau.github.com/cve-search/"
    feed.feed['author'] = "Generated with cve-search available at http://adulau.github.com/cve-search/"
    feed.feed['description'] = ""
else:
    print ("<html><head>")
    print ("<style>.cve table { border-collapse: collapse; text-align: left; width: 100%; } .cve {font: normal 12px/150% Geneva, Arial, Helvetica, sans-serif; background: #fff; overflow: hidden; border: 1px solid #006699; -webkit-border-radius: 3px; -moz-border-radius: 3px; border-radius: 3px; }.cve table td, .cve table th { padding: 3px 10px; }.cve table tbody td { color: #00496B; border-left: 1px solid #E1EEF4;font-size: 12px;font-weight: normal; }.cve table tbody .alt td { background: #E1EEF4; color: #00496B; }.cve table tbody td:first-child { border-left: none; }.cve table tbody tr:last-child td { border-bottom: none; }.cve table tfoot td div { border-top: 1px solid #006699;background: #E1EEF4;} .cve table tfoot td { padding: 0; font-size: 12px } .cve table tfoot td div{ padding: 0px; }</style>")
    print ("<title>Last " + str(args.l) + " CVE entries</title>")
    print ("</head><body>")
for x in cvelist.get(limit=last):
Beispiel #41
0
def apiCVE(cveid):
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True)
    cve = cvesp.getcve(cveid=cveid)
    if cve is None:
        cve = {}
    return (jsonify(cve))
Beispiel #42
0
    argParser.add_argument('-c', type=str, help='Access complexity')
    argParser.add_argument('-l', default=False, action='store_true', help='Print fix-related links')


    args = argParser.parse_args()

    cvss_lower_bound = args.s if args.s else 0.0
    product = args.p
    keyword = args.k if args.k else '.*'

    start_year = args.b if args.b else 1997
    end_year = args.e if args.e else 2050
    start_year = date_parser.parse(str(start_year) + '-01-01').isoformat()
    end_year = date_parser.parse(str(end_year+1) + '-01-01').isoformat()

    cves = CVEs.last(rankinglookup='', namelookup='', capeclookup='')
    printer = CVEFilePrinter(cves=cves, rankinglookup='', namelookup='', capeclookup='')

    if args.p:
        if args.d:
            # print_distinct_cves_to_excel(product, keyword, cvss_lower_bound)
            dump_fixes(product, keyword)
        elif args.y:
            print_cve_counts_by_year_to_excel(product, keyword, cvss_lower_bound)
        elif args.m:
            access_complexity = args.c if args.c != None else ".*"
            print_cve_counts_by_month_to_excel(product, keyword, cvss_lower_bound, access_complexity)
        elif args.t:
            (total, hits) = query.count_keywords(product_pattern=args.p, cvss_lower_bound=cvss_lower_bound, start_year=start_year, end_year=end_year)
            print_summary(total, hits)
        elif args.l:
Beispiel #43
0
runPath = os.path.dirname(os.path.realpath(__file__))
sys.path.append(os.path.join(runPath, ".."))

import argparse
import json
from bson import json_util

import lib.CVEs as cves
import lib.DatabaseLayer as db
from lib.Config import Configuration

argParser = argparse.ArgumentParser(description='Dump database in JSON format')
argParser.add_argument('-r', default=False, action='store_true', help='Include ranking value')
argParser.add_argument('-v', default=False, action='store_true', help='Include vfeed map')
argParser.add_argument('-c', default=False, action='store_true', help='Include CAPEC information')
argParser.add_argument('-l', default=False, type=int, help='Limit output to n elements (default: unlimited)')
args = argParser.parse_args()

rankinglookup = args.r
vfeedlookup = args.v
capeclookup = args.c

l = cves.last(rankinglookup=rankinglookup, vfeedlookup=vfeedlookup, capeclookup=capeclookup)

for cveid in db.getCVEIDs(limit=args.l):
    item = l.getcve(cveid=cveid)
    if 'cvss' in item:
        if type(item['cvss']) == str:
            item['cvss'] = float(item['cvss'])
    print (json.dumps(item, sort_keys=True, default=json_util.default))
Beispiel #44
0
def apilast():
    limit = 30
    cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True)
    cve = cvesp.get(limit=limit)
    return (jsonify({"results": cve} ))
Beispiel #45
0
 def view_cve_slack(self, cve=None):
   cveid = request.form.get('text')
   self.status_code = 200
   cvesp = cves.last(rankinglookup=True, namelookup=True, via4lookup=True, capeclookup=True)
   cve = cvesp.getcve(cveid=cveid.upper())
   return cve
    action='store_true',
    help=
    'lookup complete cpe (Common Platform Enumeration) name for vulnerable configuration'
)
argParser.add_argument('-r',
                       action='store_true',
                       help='lookup ranking of vulnerable configuration')
args = argParser.parse_args()

if not args.q and not args.l and not args.g and not args.m:
    argParser.print_help()
    exit(1)

if args.f or args.t:
    from lib import CVEs
    cves = CVEs.last(rankinglookup=args.r, namelookup=args.n)

if args.q:
    with ix.searcher() as searcher:
        if not args.o:
            query = QueryParser("content", ix.schema).parse(" ".join(args.q))
        else:
            query = QueryParser("content",
                                schema=ix.schema,
                                group=qparser.OrGroup).parse(" ".join(args.q))

        results = searcher.search(query, limit=None)
        for x in results:
            if not args.f:
                print(x['path'])
            else:
Beispiel #47
0
 def api_last(self, limit=None):
   limit = limit if limit else 30
   cvesp = cves.last(rankinglookup=True, namelookup=True, via4lookup=True, capeclookup=True)
   cve = cvesp.get(limit=limit)
   return cve
Beispiel #48
0
                       action='store_true',
                       help='Include via4 map')
argParser.add_argument('-c',
                       default=False,
                       action='store_true',
                       help='Include CAPEC information')
argParser.add_argument('-l',
                       default=False,
                       type=int,
                       help='Limit output to n elements (default: unlimited)')
args = argParser.parse_args()

rankinglookup = args.r
via4lookup = args.v
capeclookup = args.c

l = cves.last(rankinglookup=rankinglookup,
              via4lookup=via4lookup,
              capeclookup=capeclookup)

for cveid in db.getCVEIDs(limit=args.l):
    item = l.getcve(cveid=cveid)
    if 'cvss' in item:
        if type(item['cvss']) == str:
            item['cvss'] = float(item['cvss'])
    date_fields = ['cvss-time', 'Modified', 'Published']
    for field in date_fields:
        if field in item:
            item[field] = str(item[field])
    print(json.dumps(item, sort_keys=True, default=json_util.default))
sys.path.append(os.path.join(runPath, ".."))

import argparse

from lib.Config import Configuration
from lib.ProgressBar import progressbar
import lib.CVEs as cves
import lib.DatabaseLayer as db

argParser = argparse.ArgumentParser(description='Fulltext indexer for the MongoDB CVE collection')
argParser.add_argument('-v', action='store_true', default=False, help='Verbose logging')
argParser.add_argument('-l', default=5, help='Number of last entries to index (Default: 5) - 0 to index all documents')
argParser.add_argument('-n', action='store_true', default=False, help='lookup complete cpe (Common Platform Enumeration) name for vulnerable configuration to add in the index')
args = argParser.parse_args()

c = cves.last(namelookup=args.n)

indexpath = Configuration.getIndexdir()

from whoosh.index import create_in, exists_in, open_dir
from whoosh.fields import Schema, TEXT, ID

schema = Schema(title=TEXT(stored=True), path=ID(stored=True, unique=True), content=TEXT)

if not os.path.exists(indexpath):
    os.mkdir(indexpath)

if not exists_in(indexpath):
    ix = create_in(indexpath, schema)
else:
    ix = open_dir(indexpath)
Beispiel #50
0
                       action='store_true',
                       help='Include vfeed map')
argParser.add_argument('-c',
                       default=False,
                       action='store_true',
                       help='Include CAPEC information')
argParser.add_argument('-l',
                       default=False,
                       type=int,
                       help='Limit output to n elements (default: unlimited)')
args = argParser.parse_args()

rankinglookup = args.r
vfeedlookup = args.v
capeclookup = args.c

l = cves.last(rankinglookup=rankinglookup,
              vfeedlookup=vfeedlookup,
              capeclookup=capeclookup)

for cveid in db.getCVEIDs(limit=args.l):
    item = l.getcve(cveid=cveid)
    if 'cvss' in item:
        if type(item['cvss']) == str:
            item['cvss'] = float(item['cvss'])
    date_fields = ['cvss-time', 'Modified', 'Published']
    for field in date_fields:
        if field in item:
            item[field] = str(item[field])
    print(json.dumps(item, sort_keys=True, default=json_util.default))
Beispiel #51
0
def bookmarked():
  cvesp = cves.last(rankinglookup=True, namelookup=True, vfeedlookup=True, capeclookup=True,subscorelookup=True)
  cve=[cvesp.getcve(cveid=x) for x in dbLayer.bookmarks(current_user.get_id())]
  return render_template('bookmarked.html', cve=cve)
Beispiel #52
0
import argparse
import json
from bson import json_util

import lib.CVEs as cves
import lib.DatabaseLayer as db

argParser = argparse.ArgumentParser(description='Dump database in JSON format')
argParser.add_argument('-r', default=False, action='store_true', help='Include ranking value')
argParser.add_argument('-v', default=False, action='store_true', help='Include vfeed map') # TODO change
argParser.add_argument('-c', default=False, action='store_true', help='Include CAPEC information')
argParser.add_argument('-l', default=False, type=int, help='Limit output to n elements (default: unlimited)')
args = argParser.parse_args()

rankinglookup = args.r
reflookup = args.v
capeclookup = args.c

l = cves.last(rankinglookup=rankinglookup, reflookup=reflookup, capeclookup=capeclookup)

for cveid in db.getCVEIDs(limit=args.l):
    item = l.getcve(cveid=cveid)
    if 'cvss' in item:
        if type(item['cvss']) == str:
            item['cvss'] = float(item['cvss'])
    date_fields = ['cvss-time', 'Modified', 'Published']
    for field in date_fields:
        if field in item:
            item[field] = str(item[field])
    print(json.dumps(item, sort_keys=True, default=json_util.default))