def get_cves(self):
from packaging import version
from ares import CVESearch
# use product and version to search via api
# get cve ids from response
# query local db for cve_id
#
# return
base_url = 'https://cve.circl.lu/api/cvefor/'
cpe_string = 'cpe:2.3:o:' + str(
self.vendor) + ':' + self.product + ':' + self.version
cve = CVESearch()
# result = cve.search(str(self.vendor) + '/' + self.product)
result = cve.cvefor(base_url + cpe_string)
return result
def get_cves(self):
from vulnerabilities.models import NISTCVE
from packaging import version
v = None
# use product and version to search via api
# get cve ids from response
# query local db for cve_id
#
# return
base_url = 'https://cve.circl.lu/api/cvefor/'
cpe_string = 'cpe:2.3:a:' + str(
self.vendor) + ':' + self.product + ':' + self.version
cve = CVESearch()
# result = cve.search(str(self.vendor) + '/' + self.product)
result = cve.cvefor(base_url + cpe_string)
# https://cve.circl.lu/api/cvefor/cpe:2.3:a:apache:http_server:2.4.37
return result
class TestCVEAPI(unittest.TestCase):
def setUp(self):
self.cve = CVESearch()
def tearDown(self):
self.cve.session.close()
def test_init(self):
self.assertTrue(isinstance(self.cve, CVESearch))
def test_session_headers(self):
user_agent = 'ares - python wrapper around cve.circl.lu (github.com/barnumbirr/ares)'
self.assertEqual(self.cve.session.headers["Content-Type"],
"application/json")
self.assertEqual(self.cve.session.headers["User-agent"], user_agent)
@unittest.skip("Test too aggressive for provider.")
def test_empty_browse(self):
response = self.cve.browse()
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertIsNone(response["product"])
self.assertIsInstance(response["vendor"], list)
self.assertTrue(len(response["vendor"]) > 1000)
def test_browse(self):
response = self.cve.browse(param="python-requests")
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertEqual(response["vendor"], "python-requests")
def test_capec(self):
response = self.cve.capec(param="13")
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertEqual(response["name"],
"Subverting Environment Variable Values")
@unittest.skip("Endpoint disabled on cve.circl.lu")
def test_cpe22(self):
response = self.cve.cpe22(
'cpe:2.3:o:microsoft:windows_vista:6.0:sp1:-:-:home_premium:-:-:x64:-'
)
self.assertIsNotNone(response)
self.assertIsInstance(response, str)
self.assertEqual(
response,
"cpe:/o:microsoft:windows_vista:6.0:sp1:~~home_premium~~x64~")
@unittest.skip("Endpoint disabled on cve.circl.lu")
def test_cpe23(self):
response = self.cve.cpe23(
'cpe:/o:microsoft:windows_vista:6.0:sp1:~-~home_premium~-~x64~-')
self.assertIsNotNone(response)
self.assertIsInstance(response, str)
self.assertEqual(
response,
"cpe:2.3:o:microsoft:windows_vista:6.0:sp1:-:-:home_premium:-:-:x64"
)
@unittest.skip("Endpoint disabled on cve.circl.lu")
def test_cvefor(self):
response = self.cve.cvefor(
'cpe:/o:microsoft:windows_vista:6.0:sp1:~-~home_premium~-~x64~-')
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertEqual(response["id"], "CVE-2005-0100")
@unittest.skip("Test too aggressive for provider.")
def test_cwe(self):
response = self.cve.cwe()
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
def test_db_info(self):
response = self.cve.dbinfo()
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
def test_id(self):
response = self.cve.id(param="CVE-2015-2296")
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertEqual(response["Published"], "2015-03-18T16:59:00")
def test_bad_id(self):
response = self.cve.id(param="CVE-not-real")
self.assertIsNone(response)
def test_last(self):
response = self.cve.last()
self.assertIsNotNone(response)
self.assertIsInstance(response, list)
self.assertEqual(len(response), 30)
@unittest.skip("Endpoint disabled on cve.circl.lu")
def test_link(self):
response = self.cve.link(param="refmap.ms/CVE-2016-3309")
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertEqual(response["cves"]["cwe"], "CWE-264")
@unittest.skip("Endpoint disabled on cve.circl.lu")
def test_search_vendor(self):
response = self.cve.search(param="python-requests")
self.assertIsNotNone(response)
self.assertIsInstance(response, dict)
self.assertIsInstance(response["data"], list)
cpeconc = ""
for a in lport:
b = str(b) + ',' + str(a)
print nm[host][proto][a]['state'], nm[host][proto][a]['name']
name = str(name) + ',' + str(nm[host][proto][a]['name'])
portstate = str(portstate) + ',' + str(nm[host][proto][a]['state'])
productconca = str(productconca) + ',' + str(
nm[host][proto][a]['product'])
cpeconc = str(cpeconc) + ',' + str(nm[host][proto][a]['cpe'])
print cpeconc
form = b.split(',', 1)
serv = name.split(',', 1)
stat = portstate.split(',', 1)
prod = productconca.split(',', 1)
cpe = cpeconc.split(',', 1)
request = "INSERT INTO data(time,address,state,port,service,portstat,product,cpe) VALUES ('" + temp.strftime(
'%Y/%m/%d %H:%M:%S') + "','" + str(host) + "','" + nm[host].state(
) + "','" + form[1] + "','" + serv[1] + "','" + stat[
1] + "','" + prod[1] + "','" + cpe[1] + "')"
print request
conn = mysql.connector.connect(user='******',
password='******',
host='localhost',
database='datamap')
curseur = conn.cursor()
curseur.execute(request)
conn.commit()
cve = CVESearch()
print cve.cvefor(cpe)
print request
