def process_nmap_data2(nmap_report, workspace, target=None):
for scanned_host in nmap_report.hosts:
#print(scanned_host)
ip = scanned_host.id
#print(ip)
if (IPAddress(ip) == target) or (target is None):
#has_vhost_been_scanned = db.get_unique_inscope_vhosts_for_ip(ip,workspace)
has_vhost_been_scanned = db.get_inscope_submitted_vhosts_for_ip(
ip, workspace)
if has_vhost_been_scanned:
answer = raw_input(
"[!] {0} has already been scanned. Scan again? [Y\\n] ".
format(ip))
if (answer == "Y") or (answer == "y") or (answer == ""):
db.update_vhosts_submitted(ip, ip, workspace, 0)
else:
db_vhost = (ip, ip, 1, 0, workspace
) # in this mode all vhosts are in scope
#print(db_vhost)
db.create_vhost(db_vhost)
for scanned_service_item in scanned_host.services:
if scanned_service_item.state == "open":
scanned_service_port = scanned_service_item.port
scanned_service_name = scanned_service_item.service
scanned_service_protocol = scanned_service_item.protocol
if scanned_service_item.tunnel == 'ssl':
scanned_service_name = 'https'
db_service = db.get_service(ip, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
db_string = (ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
db.create_service(db_string)
else:
db.update_service(ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
#Not using this yet, but I'd like to do send this to searchsploit
try:
scanned_service_product = scanned_service_item.service_dict[
'product']
except:
scanned_service_product = ''
try:
scanned_service_version = scanned_service_item.service_dict[
'version']
except:
scanned_service_version = ''
try:
scanned_service_extrainfo = scanned_service_item.service_dict[
'extrainfo']
except:
scanned_service_extrainfo = ''
def process_nmap_data(nmap_report, workspace, target=None):
workspace_mode = lib.db.get_workspace_mode(workspace)[0][0]
services_file = open('/etc/services', mode='r')
services_file_data = services_file.readlines()
services_file.close()
for scanned_host in nmap_report.hosts:
ip = scanned_host.id
unique_db_ips = lib.db.is_vhost_in_db(
ip, workspace) #Returns data if IP is in database
#print(unique_db_ips)
vhosts = scanned_host.hostnames
#print("process_nmap_data: " + str(vhosts))
for vhost in vhosts:
print("process_nmap_data: " + vhost)
vhost_explicitly_out_of_scope = lib.db.is_vhost_explicitly_out_of_scope(
vhost, workspace)
if not vhost_explicitly_out_of_scope: # if the vhost is not explicitly out of scope, add it to db
is_vhost_in_db = lib.db.is_vhost_in_db(
vhost, workspace) # Returns data if IP is in database
if not is_vhost_in_db:
db_vhost = (ip, vhost, 1, 0, 0, workspace)
lib.db.create_vhost(db_vhost)
else:
if not lib.db.get_in_scope_ip(
ip, workspace
): # if it is in the DB but not in scope...
print(
"[+] IP is in the DB, but not in scope. Adding to scope:\t[{0}]"
.format(ip))
lib.db.update_vhosts_in_scope(
ip, vhost, workspace, 1
) # update the host to add it to scope, if it was already in scope, do nothing
else:
print(
"[!] {0} is explicitly marked as out of scope. Skipping..."
.format(ip))
if unique_db_ips: #If this IP was in the db...
vhost_explicitly_out_of_scope = lib.db.is_vhost_explicitly_out_of_scope(
ip, workspace)
if not vhost_explicitly_out_of_scope: #and if the vhost is not explicitly out of scope
if not lib.db.get_in_scope_ip(
ip, workspace): # and if it is not in scope...
print(
"[+] IP is in the DB, but not in scope. Adding to scope:\t[{0}]"
.format(ip))
lib.db.update_vhosts_in_scope(
ip, ip, workspace, 1
) # update the host to add it to scope, if it was already in scope, do nothing
# else:
# print("[+] [{0}] is already in the DB and considered in scope".format(ip))
else:
print(
"[!] {0} is explicitly marked as out of scope. Skipping..."
.format(ip))
else: #if this ip was not already in the db, create a new host and mark it as in scope
#note to self: i dont need to check to see if it is out of scope beccause i already know its not in db at all...
print("[+] IP not in DB. Adding it to DB and to scope:\t [{0}]".
format(ip))
db_vhost = (ip, ip, 1, 0, 0, workspace)
db.create_vhost(db_vhost)
for scanned_service_item in scanned_host.services:
if scanned_service_item.state == "open":
scanned_service_port = scanned_service_item.port
scanned_service_name = scanned_service_item.service
scanned_service_protocol = scanned_service_item.protocol
#print(str(scanned_service_port))
if scanned_service_item.tunnel == 'ssl':
scanned_service_name = 'https'
if scanned_service_name == "tcpwrapped":
try:
port_proto = "\t" + str(
scanned_service_port) + "/" + str(
scanned_service_protocol) + "\t"
for line in services_file_data:
if port_proto in line:
scanned_service_name = line.split("\t")[0]
except:
pass
#Not using this yet, but I'd like to do send this to searchsploit
try:
scanned_service_product = scanned_service_item.service_dict[
'product']
except:
scanned_service_product = ''
try:
scanned_service_version = scanned_service_item.service_dict[
'version']
except:
scanned_service_version = ''
try:
scanned_service_extrainfo = scanned_service_item.service_dict[
'extrainfo']
except:
scanned_service_extrainfo = ''
#print "Port: {0}\tService: {1}\tProduct & Version: {3} {4} {5}".format(scanned_service_port,scanned_service_name,scanned_service_product,scanned_service_version,scanned_service_extrainfo)
db_service = db.get_service(ip, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
db_string = (ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, scanned_service_product,
scanned_service_version,
scanned_service_extrainfo, workspace)
db.create_service(db_string)
else:
db.update_service(ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
for vhost in vhosts:
#print("process_nmap_data - add service: " + vhost)
db_service = db.get_service(vhost, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
#print("service didnt exist, adding: " + vhost + str(scanned_service_port))
db_string = (vhost, scanned_service_port,
scanned_service_protocol,
scanned_service_name,
scanned_service_product,
scanned_service_version,
scanned_service_extrainfo, workspace)
db.create_service(db_string)
else:
#print("service does exist, updating: " + vhost + str(scanned_service_port))
db.update_service(vhost, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
def process_qualys_data(qualys_port_services, workspace, target=None):
with open(qualys_port_services) as f:
for i, line in enumerate(csv.reader(f, delimiter=','), 1):
# Skip the header sections. The first entry is on the 7th line
if i > 6:
ip = line[0]
vhost = line[1]
service = line[2]
protocol = line[3]
port = line[4]
default_service = line[5]
date_first_seen = line[6]
date_last_seen = line[7]
unique_db_ips = lib.db.is_vhost_in_db(
ip, workspace) # Returns data if IP is in database
# print(unique_db_ips)
# print("process_nmap_data: " + str(vhosts))
vhost_explicitly_out_of_scope = lib.db.is_vhost_explicitly_out_of_scope(
vhost, workspace)
if not vhost_explicitly_out_of_scope: # if the vhost is not explicitly out of scope, add it to db
is_vhost_in_db = lib.db.is_vhost_in_db(
vhost, workspace) # Returns data if IP is in database
if not is_vhost_in_db:
db_vhost = (ip, vhost, 1, 0, 0, workspace)
lib.db.create_vhost(db_vhost)
else:
if not lib.db.get_in_scope_ip(
ip, workspace
): # if it is in the DB but not in scope...
print(
"[+] IP is in the DB, but not in scope. Adding to scope:\t[{0}]"
.format(ip))
lib.db.update_vhosts_in_scope(
ip, vhost, workspace, 1
) # update the host to add it to scope, if it was already in scope, do nothing
else:
print(
"[!] {0} is explicitly marked as out of scope. Skipping..."
.format(ip))
if unique_db_ips: # If this IP was in the db...
vhost_explicitly_out_of_scope = lib.db.is_vhost_explicitly_out_of_scope(
ip, workspace)
if not vhost_explicitly_out_of_scope: # and if the vhost is not explicitly out of scope
if not lib.db.get_in_scope_ip(
ip, workspace): # and if it is not in scope...
print(
"[+] IP is in the DB, but not in scope. Adding to scope:\t[{0}]"
.format(ip))
lib.db.update_vhosts_in_scope(
ip, ip, workspace, 1
) # update the host to add it to scope, if it was already in scope, do nothing
# else:
# print("[+] [{0}] is already in the DB and considered in scope".format(ip))
else:
print(
"[!] {0} is explicitly marked as out of scope. Skipping..."
.format(ip))
else: # if this ip was not already in the db, create a new host and mark it as in scope
# note to self: i dont need to check to see if it is out of scope beccause i already know its not in db at all...
print(
"[+] IP not in DB. Adding it to DB and to scope:\t [{0}]"
.format(ip))
db_vhost = (ip, ip, 1, 0, 0, workspace)
db.create_vhost(db_vhost)
if not service:
service = default_service
db_service = db.get_service(ip, port, protocol, workspace)
if not db_service:
db_string = (ip, port, protocol, service, "", "", "",
workspace)
db.create_service(db_string)
else:
db.update_service(ip, port, protocol, service, workspace)
if vhost:
db_service = db.get_service(vhost, port, protocol,
workspace)
if not db_service:
db_string = (vhost, port, protocol, service, "", "",
"", workspace)
db.create_service(db_string)
else:
db.update_service(vhost, port, protocol, service,
workspace)
def process_nessus_data(nessus_report, workspace, target=None):
for scanned_host in nessus_report.hosts:
#print scanned_host.address
ip = scanned_host.address
unique_db_ips = lib.db.is_vhost_in_db(
ip, workspace) #Returns data if IP is in database
#print(unique_db_ips)
if unique_db_ips: #If this IP was in the db...
vhost_explicitly_out_of_scope = lib.db.is_vhost_explicitly_out_of_scope(
ip, workspace)
if not vhost_explicitly_out_of_scope: # and if the vhost is not explicitly out of scope
if not lib.db.get_in_scope_ip(
ip, workspace): # but if it is not in scope...
print(
"[+] IP is in the DB, but not in scope. Adding to scope:\t[{0}]"
.format(ip))
lib.db.update_vhosts_in_scope(
ip, ip, workspace, 1
) # update the host to add it to scope, if it was already in scope, do nothing
# else:
# print("[+] [{0}] is already in the DB and considered in scope".format(ip))
else:
print(
"[!] {0} is explicitly marked as out of scope. Skipping..."
.format(ip))
else: #if this ip was not already in the db, create a new host and mark it as in scope
#note to self: i dont need to check to see if it is explicitly out of scope beccause i already know its not in db at all...
print("[+] IP not in DB. Adding it to DB and to scope:\t [{0}]".
format(ip))
db_vhost = (ip, ip, 1, 0, 0, workspace)
db.create_vhost(db_vhost)
# Step 1: pull all report items in the port scanner family to get every port. The services names are IANA
# default as this point, which is why we need the next two loops.
for report_item in scanned_host.get_report_items:
if report_item.plugin_family == "Port scanners":
if report_item.port != "0":
scanned_service_port = report_item.port
scanned_service_protocol = report_item.protocol
scanned_service_name = report_item.service
db_service = db.get_service(ip, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
db_string = (ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, '', '', '',
workspace)
db.create_service(db_string)
# Step 2: Cycle through the service detection items and update the services where we have a better idea of
# the real running service on the port. These are a subset of open ports which is why we need loop 1
for report_item in scanned_host.get_report_items:
if report_item.plugin_family == "Service detection":
scanned_service_port = report_item.port
scanned_service_protocol = report_item.protocol
scanned_service_name = report_item.service
db_service = db.get_service(ip, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
db_string = (ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, '', '', '', workspace)
db.create_service(db_string)
#print("new service2: " + ip,scanned_service_port,scanned_service_name)
else:
db.update_service(ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
#print("updating service servicename2: " + ip, scanned_service_port, scanned_service_name)
#print("old service servicename2 : " + ip, scanned_service_port,str(db_service[0][4]))
# Step 3: This is needed to split up HTTPS from HTTP
for report_item in scanned_host.get_report_items:
if (report_item.plugin_name
== "TLS Version 1.0 Protocol Detection"
or report_item.plugin_name == "OpenSSL Detection"
or report_item.plugin_name
== "SSL Version 2 and 3 Protocol Detection"):
scanned_service_port = report_item.port
scanned_service_protocol = report_item.protocol
scanned_service_name = 'https'
try:
db.update_service(ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
except:
print(
"if this errors that means there was no service to update as https which is a bigger problem"
)
def process_nessus_data2(nessus_report, workspace, target=None):
for scanned_host in nessus_report.hosts:
#print scanned_host.address
ip = scanned_host.address
# this if takes care of only acting on the targets specififed at hte command line, if the target
# this if takes care of only acting on the targets specififed at hte command line, if the target
# param is used. This is a very simple comparison now. In the future, i'd like to be able to use
# the target splitter function and be able to handle ranges and cidr's in the target option
if (IPAddress(ip) == target) or (target is None):
has_vhost_been_scanned = db.get_inscope_submitted_vhosts_for_ip(
ip, workspace)
if has_vhost_been_scanned:
answer = raw_input(
"[!] {0} has already been scanned. Scan again? [Y\\n] ".
format(ip))
if (answer == "Y") or (answer == "y") or (answer == ""):
db.update_vhosts_submitted(ip, ip, workspace, 0)
else:
db_vhost = (ip, ip, 1, 0, workspace
) # in this mode all vhosts are in scope
#print(db_vhost)
db.create_vhost(db_vhost)
# Step 1: pull all report items in the port scanner family to get every port. The services names are IANA
# default as this point, which is why we need the next two loops.
for report_item in scanned_host.get_report_items:
if report_item.plugin_family == "Port scanners":
scanned_service_port = report_item.port
scanned_service_protocol = report_item.protocol
scanned_service_name = report_item.service
db_service = db.get_service(ip, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
db_string = (ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
db.create_service(db_string)
# Step 2: Cycle through the service detection items and update the services where we have a better idea of
# the real running service on the port. These are a subset of open ports which is why we need loop 1
for report_item in scanned_host.get_report_items:
if report_item.plugin_family == "Service detection":
scanned_service_port = report_item.port
scanned_service_protocol = report_item.protocol
scanned_service_name = report_item.service
db_service = db.get_service(ip, scanned_service_port,
scanned_service_protocol,
workspace)
if not db_service:
db_string = (ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
db.create_service(db_string)
#print("new service2: " + ip,scanned_service_port,scanned_service_name)
else:
db.update_service(ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
#print("updating service servicename2: " + ip, scanned_service_port, scanned_service_name)
#print("old service servicename2 : " + ip, scanned_service_port,str(db_service[0][4]))
# Step 3: This is needed to split up HTTPS from HTTP
for report_item in scanned_host.get_report_items:
if (report_item.plugin_name
== "TLS Version 1.0 Protocol Detection"
or report_item.plugin_name == "OpenSSL Detection"
or report_item.plugin_name
== "SSL Version 2 and 3 Protocol Detection"):
scanned_service_port = report_item.port
scanned_service_protocol = report_item.protocol
scanned_service_name = 'https'
try:
db.update_service(ip, scanned_service_port,
scanned_service_protocol,
scanned_service_name, workspace)
except:
print(
"if this errors that means there was no service to update as https which is a bigger problem"
)
