File Coverage

blib/lib/Parse/Nessus/NBE.pm

Criterion	Covered	Total	%
statement	21	153	13.7
branch	0	48	0.0
condition			n/a
subroutine	7	17	41.1
pod	0	10	0.0
total	28	228	12.2

package Parse::Nessus::NBE;

use strict;
use vars qw/ $VERSION @ISA @EXPORT_OK %EXPORT_TAGS /;

require Exporter;

@ISA       = qw/ Exporter /;
@EXPORT_OK =
  qw/ nbanners nports nplugin nwebdirs nnfs nos nsnmp nstatos nstatservices nstatvulns /;
%EXPORT_TAGS = (all => [qw/ nbanners nports nplugin nwebdirs nnfs nos nsnmp nstatos nstatservices nstatvulns /] );
$VERSION = '1.1';

use constant WEBDIR => 11032;  # nessus plugin id for web directories discovered
use constant NFS    => 10437;  # nessus plugin id for nfs shares discovered
use constant NMAP1  => 10336;  # nessus plugin id for Nmap OS guess
use constant NMAP2  => 11268;  # nessus plugin id for Nmap OS guess
use constant QUESO  => 10337;  # nessus plugin id for QueSO OS guess

sub nbanners {
    my (@ndata) = @_;
    my (@banners);
    foreach my $nbanner (@ndata) {
        if ( $nbanner =~ /emote(.*)server (banner|type)/ ) {
            my @result = split ( /\|/, $nbanner );
            $result[6] =~ s/^(.*)\:\\n|Solution (.*)$|\\r|\\n//g;
            push @banners, join "|", $result[2], $result[6];
        }
    }
    return @banners;
}

sub nports {
    my (@ndata) = @_;
    my (@ports);
    my $nport = pop (@ndata);
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( $result[4] ) {
            next;
        }
        elsif ( $result[3] =~ /\($nport\// ) {
            push @ports, join "|", $result[2], $result[3];
        }
    }
    return @ports;
}

sub nplugin {
    my (@ndata) = @_;
    my (@plugins);
    my $nplugin = pop (@ndata);
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( !$result[4] ) {
            next;
        }
        elsif ( $result[4] =~ /$nplugin/ ) {
            $result[6] =~ s/\\n//;
            push @plugins, join "|", $result[2], $result[3], $result[6];
        }
    }
    return @plugins;
}

sub nwebdirs {
    my (@ndata) = @_;
    my (@webdirs);
    my $webdirplugin = WEBDIR;
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( !$result[4] ) {
            next;
        }
        elsif ( $result[4] =~ /$webdirplugin/ ) {
            $result[6] =~ s/(^(.*)discovered\:|\\n|,)//g;
            $result[6] =~ s/The following(.*)authentication:/\|/;
            push @webdirs, join "|", $result[2], $result[3], $result[6];
        }
    }
    return @webdirs;
}

sub nnfs {
    my (@ndata) = @_;
    my (@nfs);
    my $nfsplugin = NFS;
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( !$result[4] ) {
            next;
        }
        elsif ( $result[4] =~ /$nfsplugin/ ) {
            $result[6] =~ s/^(.*) \: \\n|\\n\\n(.*)$//g;
            $result[6] =~ s/\\n/,/g;
            push @nfs, join "|", $result[2], $result[3], $result[6];
        }
    }
    return @nfs;
}

sub nos {
    my (@ndata) = @_;
    my (@os);
    foreach my $ndata (@ndata) {
        if ( $ndata =~
            m/10336\|Security Note|11268\|Security Note|10337\|Security Note/ )
        {
            my @result = split ( /\|/, $ndata );
            if ( $result[4] eq NMAP1 ) {
                $result[6] =~ s/(Nmap(.*)running |(\;|\\n))//g;
                push @os, join "|", $result[2], $result[6];
            }
            elsif ( $result[4] eq NMAP2 ) {
                $result[6] =~ s/(Remote OS guess : |\\n\\n(.*)$)//g;
                push @os, join "|", $result[2], $result[6];
            }
            elsif ( $result[4] eq QUESO ) {
                $result[6] =~
                  s/(QueSO has(.*)\\n\*|\\n\\n\\nCVE (.*)$| \(by (.*)$)//g;
                push @os, join "|", $result[2], $result[6];
            }
        }
    }
    return @os;
}

sub nsnmp {
    my (@ndata) = @_;
    my (@snmp);
    foreach my $ndata (@ndata) {
        if ( $ndata =~ m/10264\|Security Hole\|/ ) {
            my @result = split ( /\|/, $ndata );
            $result[6] =~ s/\\nSNMP Agent(.*?)community name: //;
            $result[6] =~
              s/(\\nSNMP Agent (.*?)community name: |\\nCVE(.*)$)/ /g;
            push @snmp, join "|", $result[2], $result[6];
        }
    }
    return @snmp;
}

sub nstatos {
    my (@ndata) = @_;
    my (@allos);
    foreach my $ndata (@ndata) {
        if ( $ndata =~
            m/10336\|Security Note|11268\|Security Note|10337\|Security Note/ )
        {
            my @result = split ( /\|/, $ndata );
            chomp $result[6];
            if ( $result[4] eq NMAP1 ) {
                $result[6] =~ s/(Nmap(.*)running |(\;|\\n))//g;
                push @allos, $result[6];
            }
            elsif ( $result[4] eq NMAP2 ) {
                $result[6] =~ s/(Remote OS guess : |\\n\\n(.*)$)//g;
                push @allos, $result[6];
            }
            elsif ( $result[4] eq QUESO ) {
                $result[6] =~
                  s/(QueSO has(.*)\\n\*|\\n\\n\\nCVE (.*)$| \(by (.*)$)//g;
                push @allos, $result[6];
            }
        }
    }
    my %count;
    map { $count{$_}++ } @allos;
    my @rearranged = sort { $count{$b} <=> $count{$a} } keys %count;
    my @graphos;
    foreach (@rearranged) {
        push @graphos, join "|", $_, "$count{$_}\n";
    }
    return @graphos;
}

sub nstatservices {
    my (@ndata) = @_;
    my (@allports);
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( $result[4] ) {
            next;
        }
        else {
            chomp $result[3];
            push @allports, $result[3];
        }
    }
    my %count;
    map { $count{$_}++ } @allports;
    my @rearranged = sort { $count{$b} <=> $count{$a} } keys %count;
    my @graphservices;
    foreach (@rearranged) {
        push @graphservices, join "|", $_, "$count{$_}\n";
    }
    return @graphservices;
}

sub nstatvulns {
    my (@ndata) = @_;
    my (@allvuln);
    my $nsevval = pop (@ndata);
    my $nseverity;
    if ($nsevval == 1) {
	    $nseverity = "Hole";
    }
    elsif ($nsevval == 2) {
	    $nseverity = "Warning";
    }
    elsif ($nsevval == 3) {
	    $nseverity = "Note";
    }
    foreach my $ndata (@ndata) {
            my @result = split ( /\|/, $ndata );
	    if (! $result[5]) {
		    next;
	    }
            elsif ( $result[5] =~ /Security $nseverity/ ) {
                push @allvuln, $result[4];
            }
    }
    my %count;
    map { $count{$_}++ } @allvuln;
    my @rearranged = sort { $count{$b} <=> $count{$a} } keys %count;
    my @graphvuln;
    foreach (@rearranged) {
        push @graphvuln, join "|", $_, "$count{$_}\n";
    }
    return @graphvuln;
}

1;

__END__