def populate_openvas_data(data):
""" Fetch OpenVAS data """
try:
data['ovs'] = {}
data['ovs']['host'] = {}
data['ovs']['project'] = {}
data['ovs']['data'] = {}
ovc = data['config']['openvas']
ovs_report = None
if DEBUG and os.path.isfile(DEBUG_OPENVAS_DATA):
print("Warning: DEBUG is enabled, reading opemvas data from %s" %
DEBUG_OPENVAS_DATA)
ovs_report = ET.ElementTree().parse(DEBUG_OPENVAS_DATA)
else:
scanner = VulnscanManager(ovc['host'], ovc['user'],
ovc['password'], int(ovc['port']), 30)
finished_scans = scanner.get_finished_scans
for entry in finished_scans:
if ovc['scan'] is None or entry == ovc['scan']:
report_id = scanner.get_report_id(finished_scans[entry])
ovs_report = ET.ElementTree(
scanner.get_report_xml(report_id))
if DEBUG:
ovs_report.write(DEBUG_OPENVAS_DATA)
except VulnscanException as e:
print(e)
if ovs_report:
for results in ovs_report.iter('results'):
for result in results:
ret = {}
host = result.find('host').text
details = result.findall('./detection/result/details/detail')
for detail in details:
# typically product, location, source_oid and source_name
label = detail.find('name').text
value = detail.find('value').text
ret[label] = value
if host not in data['os']['hosts']:
print("IP '%s' is unknown" % host)
else:
project_id = data['os']['hosts'][host]
project = data['os']['projects'][project_id]['name']
projects = data['ovs']['project']
if project not in projects:
projects[project] = {}
projects[project].update({'host': {}, 'emails': {}})
projects[project]['emails'].update(
data['os']['projects'][project_id]['emails'])
hosts = projects[project]['host']
if host not in hosts:
hosts[host] = {}
hosts[host]['ports'] = {}
hosts[host]['threat'] = ''
hosts[host]['severity'] = ''
if ret['location'] not in hosts[host]['ports']:
hosts[host]['ports'].update({ret['location']: []})
ret['severity'] = result.find('severity').text
ret['threat'] = result.find('threat').text
ret['description'] = result.find('description').text
hosts[host]['ports'][ret['location']].append(ret)
def launch_scanner(server, username, password, target, profile, args):
global pbar
try:
sem = Semaphore(0)
# configure the scan
print_loading("Connecting to openVAS\r")
manager = VulnscanManager(server, username, password)
stdout.write("\033[K")
print_ok("Connected to openVAS\n")
# print_loading("Launching Scan\r")
stdout.flush()
pbar = ChargingBar("Scanning", max=100, suffix='%(percent)d%%')
pbar.next(n=0)
# pbar.next()
scan_id, target_id = manager.launch_scan(
target,
profile=profile,
callback_end=partial(lambda x: x.release(), sem),
callback_progress=print_status)
# wait
sem.acquire()
sleep(2)
pbar.finish()
stdout.write("\033[A")
stdout.write("\033[K")
stdout.flush()
# print()
# stdout.write("\033[K")
# stdout.flush()
print_ok("Finished Scan\n")
# print_loading("Getting Report ID")
report_id = manager.get_report_id(scan_id)
# check if it has been specified to save the file as an xml
if args.save_xml or args.save_all:
print_loading("Getting XML Report ")
report = manager.get_report_xml(report_id)
# print(report)
stdout.write("\r\033[K")
stdout.flush()
print_ok("Loaded XML Report\n")
name = args.save_xml
if not name.lower().endswith(".xml"):
name += ".xml"
print_loading("Attempting to save XML Report ")
with open(name, "wb") as f:
f.write(
ElementTree.tostring(report,
encoding="utf-8",
method="xml"))
stdout.write("\r\033[K")
stdout.flush()
print_ok("Saved XML Report as : {}\n".format(name))
# check if it has been specified to save the file as an html
if args.save_html or args.save_all:
print_loading("Getting HTML Report ")
report = manager.get_report_html(report_id)
html_text = report.find("report").text
if not html_text:
html_text = report.find("report").find("report_format").tail
stdout.write("\r\033[K")
stdout.flush()
print_ok("Loaded HTML Report\n")
name = args.save_html
if not name.lower().endswith(".html"):
name += ".html"
print_loading("Attempting to save HTML Report ")
with open(name, "wb") as f:
f.write(base64.b64decode(html_text))
stdout.write("\r\033[K")
stdout.flush()
print_ok("Saved HTML Report as : {}\n".format(name))
print_ok("Scan ID : {}\n".format(scan_id))
print_ok("Target ID : {}\n".format(target_id))
print_ok("Report ID : {}\n".format(report_id))
# finished scan
print_ok("Finished\n")
except Exception as e:
print_error(e)
os._exit(-1)
def put(self, request, id, format=None):
task = openvas_requests.objects.get(id=id)
print(task.id)
e = request.data['state']
task.state = e
task.save()
if e == "Finished":
result = openvas_results.objects.get(id=id)
# Parsejar XML per treure High Medium i Low
scanner = VulnscanManager("localhost", openvas_username,
openvas_password)
auxReport = scanner.get_report_xml(str(result.report))
auxReportString = ElementTree.tostring(
auxReport.find("report").find("report").find("results"),
encoding='utf-8',
method='xml')
auxReportXML = ElementTree.fromstring(auxReportString)
print(auxReportString)
high = 0
medium = 0
low = 0
log = 0
for v in auxReportXML:
print(str(v.find("threat").text))
if v.find("threat").text == "High":
high += 1
elif v.find("threat").text == "Medium":
medium += 1
elif v.find("threat").text == "Low":
low += 1
elif v.find("threat").text == "Log":
log += 1
parsed = "High: " + str(high) + " / Medium: " + str(
medium) + " / Low: " + str(low) + " / Log: " + str(log)
print(parsed)
# Inserting finish date and results
result.finish_date = timezone.now()
result.output = parsed
result.save()
if task.mail:
report = scanner.get_report_pdf(str(result.report))
fileName = "Report_" + task.name + "_" + datetime.strftime(
result.finish_date, "%Y%m%d%H%M") + ".pdf"
reportXML = ElementTree.tostring(report.find("report"),
encoding='utf-8',
method='xml')
fullReport = ElementTree.fromstring(reportXML)
pdf = base64.b64decode(fullReport.find("in_use").tail)
username = User.objects.get(id=task.user.id).username
print("Username: "******"*****@*****.**",
To=[task.mail],
Subject=u'[AAPT] OpenVAS Report')
message.Body = body.encode('utf-8')
sender = Mailer('localhost')
message.attach(filename=fileName,
content=pdf,
mimetype="application/pdf")
sender.send(message)
return Response(status=204)
