Skip to content

Commit b62307a

Browse files
jvzjvz
authored
Add basic parser for Outpost24 scan format (#1750)
Parser for Outpost24 scan format
1 parent 7464348 commit b62307a

File tree

10 files changed

+1459
-0
lines changed

10 files changed

+1459
-0
lines changed

‎dojo/fixtures/test_type.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,13 @@
528528
},
529529
"model": "dojo.test_type",
530530
"pk": 167
531+
},
532+
{
533+
"fields": {
534+
"name": "Outpost24 Scan"
535+
},
536+
"model": "dojo.test_type",
537+
"pk": 168
531538
}
532539
]
533540

‎dojo/forms.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,7 @@ class ImportScanForm(forms.Form):
361361
("Aqua Scan", "Aqua Scan"),
362362
("HackerOne Cases", "HackerOne Cases"),
363363
("Xanitizer Scan", "Xanitizer Scan"),
364+
("Outpost24 Scan", "Outpost24 Scan"),
364365
("Trivy Scan", "Trivy Scan"))
365366

366367
SORTED_SCAN_TYPE_CHOICES = sorted(SCAN_TYPE_CHOICES, key=lambda x: x[1])

‎dojo/templates/dojo/import_scan_results.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ <h3> Add Tests</h3>
6969
<li><b>NPM Audit</b> - NPM Audit Scan output file can be imported in JSON format.</li>
7070
<li><b>IBM AppScan DAST</b> - XML file from IBM App Scanner.</li>
7171
<li><b>Openscap Vulnerability Scan</b> - Import Openscap Vulnerability Scan in XML formats.</li>
72+
<li><b>Outpost24 Scan</b> - Import Outpost24 endpoint vulnerability scan in XML format.</li>
7273
<li><b>OpenVAS CSV</b> - Import OpenVAS Scan in CSV format. Export as CSV Results on OpenVAS.</li>
7374
<li><b>PHP Security Audit v2</b> - Import PHP Security Audit v2 Scan in JSON format.</li>
7475
<li><b>PHP Symfony Security Check</b> - Import results from the PHP Symfony Security Checker by Sensioslabs.</li>

‎dojo/tools/factory.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@
6868
from dojo.tools.h1.parser import HackerOneJSONParser
6969
from dojo.tools.xanitizer.parser import XanitizerXMLParser
7070
from dojo.tools.trivy.parser import TrivyParser
71+
from dojo.tools.outpost24.parser import Outpost24Parser
7172

7273

7374

@@ -224,6 +225,8 @@ def import_parser_factory(file, test, active, verified, scan_type=None):
224225
parser = XanitizerXMLParser(file, test)
225226
elif scan_type == 'Trivy Scan':
226227
parser = TrivyParser(file, test)
228+
elif scan_type == 'Outpost24 Scan':
229+
parser = Outpost24Parser(file, test)
227230
else:
228231
raise ValueError('Unknown Test Type')
229232

‎dojo/tools/outpost24/__init__.py‎

Whitespace-only changes.

‎dojo/tools/outpost24/parser.py‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
from defusedxml import ElementTree
2+
from dojo.models import Finding, Endpoint
3+
4+
5+
class Outpost24Parser:
6+
def __init__(self, file, test):
7+
tree = ElementTree.parse(file)
8+
items = list()
9+
for detail in tree.iterfind('//detaillist/detail'):
10+
# finding details
11+
title = detail.findtext('name')
12+
# date = detail.findtext('date') # can be used for Finding.date?
13+
cve = detail.findtext('./cve/id')
14+
url = detail.findtext('./referencelist/reference/[type=\'solution\']/../url')
15+
description = detail.findtext('description')
16+
mitigation = detail.findtext('solution')
17+
impact = detail.findtext('information')
18+
cvss_score = detail.findtext('cvss_v3_score') or detail.findtext('cvss_score')
19+
if cvss_score:
20+
score = float(cvss_score)
21+
if score < 4:
22+
severity = 'Low'
23+
elif score < 7:
24+
severity = 'Medium'
25+
elif score < 9:
26+
severity = 'High'
27+
else:
28+
severity = 'Critical'
29+
else:
30+
risk = int(detail.findtext('risk'))
31+
if risk == 0:
32+
severity = 'Low'
33+
elif risk == 1:
34+
severity = 'Medium'
35+
elif risk == 2:
36+
severity = 'High'
37+
else:
38+
severity = 'Critical'
39+
cvss_description = detail.findtext('cvss_vector_description')
40+
cvss_vector = detail.findtext('cvss_v3_vector') or detail.findtext('cvss_vector')
41+
severity_justification = "{}\n{}".format(cvss_score, cvss_description)
42+
finding = Finding(title=title, test=test, cve=cve, url=url, description=description, mitigation=mitigation,
43+
impact=impact, severity=severity, numerical_severity=cvss_score,
44+
severity_justification=severity_justification)
45+
# endpoint details
46+
host = detail.findtext('ip')
47+
if host:
48+
protocol = detail.findtext('./portinfo/service')
49+
port = int(detail.findtext('./portinfo/portnumber'))
50+
finding.unsaved_endpoints.append(Endpoint(protocol=protocol, host=host, port=port))
51+
items.append(finding)
52+
self._items = items
53+
54+
@property
55+
def items(self):
56+
return self._items

‎dojo/unittests/scans/outpost24/none.xml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!DOCTYPE main SYSTEM "https://outscan.outpost24.com/dtd/XMLReport.dtd">
3+
<main>
4+
<report>OUTSCAN Security Report</report>
5+
<reportinfo>
6+
<type>Vulnerability</type>
7+
<id>1234567891234567891234567890ab</id>
8+
<reportdate>2019-10-04 19:00</reportdate>
9+
<timezone>GMT+0:00</timezone>
10+
<creator>Matt Sicker</creator>
11+
<date>2019-10-01 19:01 - 2019-10-01 19:01</date>
12+
<test>1</test>
13+
<threat>0</threat>
14+
</reportinfo>
15+
<hostlist>
16+
<host>
17+
<ip>localhost</ip>
18+
<name/>
19+
<platform/>
20+
<high>0</high>
21+
<medium>0</medium>
22+
<low>0</low>
23+
<info>0</info>
24+
<port>1</port>
25+
<start>2019-10-01 19:01</start>
26+
<end>2019-10-01 19:11</end>
27+
<updated>2019-10-03 23:35</updated>
28+
<template>Normal with webapp</template>
29+
<completescan>true</completescan>
30+
</host>
31+
</hostlist>
32+
<portlist>
33+
<portlist-host>
34+
<ip>localhost</ip>
35+
<name/>
36+
<date>2019-10-01 19:01</date>
37+
<portinfo>
38+
<portnumber>443</portnumber>
39+
<protocol>TCP</protocol>
40+
<service>http</service>
41+
<history>
42+
<firstseen>2019-09-10 19:01</firstseen>
43+
</history>
44+
</portinfo>
45+
</portlist-host>
46+
</portlist>
47+
<detaillist/>
48+
</main>

‎dojo/unittests/scans/outpost24/one.xml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!DOCTYPE main SYSTEM "https://outscan.outpost24.com/dtd/XMLReport.dtd">
3+
<main>
4+
<report>OUTSCAN Security Report</report>
5+
<reportinfo>
6+
<type>Vulnerability</type>
7+
<id>1234567891234567891234567890ab</id>
8+
<reportdate>2019-10-04 19:00</reportdate>
9+
<timezone>GMT+0:00</timezone>
10+
<creator>Matt Sicker</creator>
11+
<date>2019-10-01 19:01 - 2019-10-01 19:01</date>
12+
<test>1</test>
13+
<threat>0</threat>
14+
</reportinfo>
15+
<hostlist>
16+
<host>
17+
<ip>localhost</ip>
18+
<name/>
19+
<platform/>
20+
<high>0</high>
21+
<medium>1</medium>
22+
<low>0</low>
23+
<info>0</info>
24+
<port>1</port>
25+
<start>2019-10-01 19:01</start>
26+
<end>2019-10-01 19:11</end>
27+
<updated>2019-10-03 23:35</updated>
28+
<template>Normal with webapp</template>
29+
<completescan>true</completescan>
30+
</host>
31+
</hostlist>
32+
<portlist>
33+
<portlist-host>
34+
<ip>localhost</ip>
35+
<name/>
36+
<date>2019-10-01 19:01</date>
37+
<portinfo>
38+
<portnumber>443</portnumber>
39+
<protocol>TCP</protocol>
40+
<service>http</service>
41+
<history>
42+
<firstseen>2019-09-10 19:01</firstseen>
43+
</history>
44+
</portinfo>
45+
</portlist-host>
46+
</portlist>
47+
<detaillist>
48+
<detail>
49+
<ip>localhost</ip>
50+
<hostname/>
51+
<platform/>
52+
<date>2019-10-01 19:01</date>
53+
<virtualhost>127.0.0.1</virtualhost>
54+
<targetopco>PT</targetopco>
55+
<id>1377090</id>
56+
<name>Fake vulnerability in fake product</name>
57+
<portinfo>
58+
<portnumber>443</portnumber>
59+
<protocol>TCP</protocol>
60+
<service>http</service>
61+
</portinfo>
62+
<cvss_score>5.1</cvss_score>
63+
<cvss_vector>(AV:N/AC:H/Au:N/C:P/I:P/A:P) (cdp:ND/td:ND/cr:ND/ir:ND/ar:ND)</cvss_vector>
64+
<cvss_vector_description>This vulnerability can be exploited with advanced skills and network access to the
65+
system by an attacker who does not have access to credentials with some impact on confidentiality, some
66+
impact to the integrity of information and some impact on system or information availability. There are
67+
currently no exploits in the public domain. However, attacks may be well described or privately held.
68+
</cvss_vector_description>
69+
<cvss_v3_score>7.5</cvss_v3_score>
70+
<cvss_v3_vector>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</cvss_v3_vector>
71+
<risk>2</risk>
72+
<family>example</family>
73+
<product>Fake Product</product>
74+
<description>CSRF tokens are useful. This application did not think that was the case. Now they do.</description>
75+
<information>This vulnerability was identified because (1) the detected version of Fake Product,
76+
1.1.0, is less than 1.1.1
77+
Paths:
78+
/
79+
</information>
80+
<falsepositive>0</falsepositive>
81+
<solutiontitle>Upgrade to the latest version of Fake Product</solutiontitle>
82+
<solution>Upgrade to the latest version of Fake Product.</solution>
83+
<category>Update</category>
84+
<referencelist>
85+
<reference>
86+
<type>url</type>
87+
<url>https://www.example.com/products/fake</url>
88+
</reference>
89+
<reference>
90+
<type>advisory</type>
91+
<url>https://www.example.com/security/advisories/2019-09-09/</url>
92+
</reference>
93+
</referencelist>
94+
<cve>
95+
<id>CVE-2019-9315</id>
96+
</cve>
97+
<bug>
98+
<id>109373</id>
99+
</bug>
100+
<verify/>
101+
<history>
102+
<firstseen>2019-09-10 19:01</firstseen>
103+
<lastseen>2019-10-01 19:01</lastseen>
104+
</history>
105+
</detail>
106+
</detaillist>
107+
</main>

0 commit comments

Comments
 (0)