File Coverage

blib/lib/Parse/Nessus/ENX.pm

Criterion	Covered	Total	%
statement	21	152	13.8
branch	0	48	0.0
condition	0	6	0.0
subroutine	7	17	41.1
pod	0	10	0.0
total	28	233	12.0

package Parse::Nessus::ENX;

use strict;
use vars qw/ $VERSION @ISA @EXPORT_OK %EXPORT_TAGS /;

require Exporter;

@ISA       = qw/ Exporter /;
@EXPORT_OK =
  qw/ ebanners eports eplugin ewebdirs enfs eos esnmp estatos estatservices estatvulns /;
%EXPORT_TAGS = (all => [qw/ ebanners eports eplugin ewebdirs enfs eos esnmp estatos estatservices estatvulns /] );
$VERSION = '1.1';

use constant WEBDIR => 11032;  # nessus plugin id for web directories discovered
use constant NFS    => 10437;  # nessus plugin id for nfs shares discovered
use constant NMAP1  => 10336;  # nessus plugin id for Nmap OS guess
use constant NMAP2  => 11268;  # nessus plugin id for Nmap OS guess
use constant QUESO  => 10337;  # nessus plugin id for QueSO OS guess

sub ebanners {
    my (@ndata) = @_;
    my (@banners);
    foreach my $nbanner (@ndata) {
        if ( $nbanner =~ /emote(.*)server (banner|type)/ ) {
            my @result = split ( /\|/, $nbanner );
            $result[4] =~ s/^(.*?) \:\;|Solution (.*)$|r\;|\;|This is(.*)$//g;
            push @banners, join "|", $result[0], $result[4];
        }
    }
    return @banners;
}

sub eports {
    my (@ndata) = @_;
    my (@ports);
    my $nport = pop (@ndata);
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( $result[3] || $ndata =~ /\[NessusWX|\$DATA/ ) {
            next;
        }
        elsif ( $result[1] =~ /\($nport\// ) {
            push @ports, join "|", $result[0], $result[1];
        }
    }
    return @ports;
}

sub eplugin {
    my (@ndata) = @_;
    my (@plugins);
    my $eplugin = pop (@ndata);
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( !$result[4] ) {
            next;
        }
        elsif ( $result[2] =~ /$eplugin/ ) {
            push @plugins, join "|", $result[0], $result[1], $result[4];
        }
    }
    return @plugins;
}

sub ewebdirs {
    my (@ndata) = @_;
    my (@webdirs);
    my $webdirplugin = WEBDIR;
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( !$result[4] ) {
            next;
        }
        elsif ( $result[2] =~ /$webdirplugin/ ) {
            $result[4] =~ s/(^(.*)discovered\:\;|\;|\,)//g;
            $result[4] =~ s/The following(.*)authentication:/\|/;
            push @webdirs, join "|", $result[0], $result[1], $result[4];
        }
    }
    return @webdirs;
}

sub enfs {
    my (@ndata) = @_;
    my (@nfs);
    my $nfsplugin = NFS;
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( !$result[4] ) {
            next;
        }
        elsif ( $result[2] =~ /$nfsplugin/ ) {
            $result[4] =~ s/(^(.*?) \: \;|\;\;CVE(.*)$)//g;
            $result[4] =~ s/\;/,/g;
            push @nfs, join "|", $result[0], $result[1], $result[4];
        }
    }
    return @nfs;
}

sub eos {
    my (@ndata) = @_;
    my (@os);
    foreach my $ndata (@ndata) {
        if ( $ndata =~
            m/10336\|(INFO|NOTE)|11268\|(INFO|NOTE)|10337\|(INFO|NOTE)/ )
        {
            my @result = split ( /\|/, $ndata );
            if ( $result[2] eq NMAP1 ) {
                $result[4] =~ s/(Nmap(.*)running |\;)//g;
                push @os, join "|", $result[0], $result[4];
            }
            elsif ( $result[2] eq NMAP2 ) {
                $result[4] =~ s/(Remote OS guess : |\;\;(.*)$)//g;
                push @os, join "|", $result[0], $result[4];
            }
            elsif ( $result[2] eq QUESO ) {
                $result[4] =~
                  s/(QueSO has(.*) \;\* |\;\;\;CVE (.*)$| \(by (.*)$)//g;
                push @os, join "|", $result[0], $result[4];
            }
        }
    }
    return @os;
}

sub esnmp {
    my (@ndata) = @_;
    my (@snmp);
    foreach my $ndata (@ndata) {
        if ( $ndata =~ m/10264\|REPORT\|/ ) {
            my @result = split ( /\|/, $ndata );
            $result[4] =~ s/\;SNMP Agent(.*?)community name: //;
            $result[4] =~ s/(\;SNMP Agent (.*?)community name: |\;CVE(.*)$)/ /g;
            push @snmp, join "|", $result[0], $result[4];
        }
    }
    return @snmp;
}

sub estatos {
    my (@ndata) = @_;
    my (@allos);
    foreach my $ndata (@ndata) {
        if ( $ndata =~
            m/10336\|(INFO|NOTE)|11268\|(INFO|NOTE)|10337\|(INFO|NOTE)/ )
        {
            my @result = split ( /\|/, $ndata );
            chomp $result[4];
            if ( $result[2] eq NMAP1 ) {
                $result[4] =~ s/(Nmap(.*)running |\;)//g;
                push @allos, $result[4];
            }
            elsif ( $result[2] eq NMAP2 ) {
                $result[4] =~ s/(Remote OS guess : |\;\;(.*)$)//g;
                push @allos, $result[4];
            }
            elsif ( $result[2] eq QUESO ) {
                $result[4] =~
                  s/(QueSO has(.*) \;\* |\;\;\;CVE (.*)$| \(by (.*)$)//g;
                push @allos, $result[4];
            }
        }
    }
    my %count;
    map { $count{$_}++ } @allos;
    my @rearranged = sort { $count{$b} <=> $count{$a} } keys %count;
    my @graphos;
    foreach (@rearranged) {
        push @graphos, join "|", $_, "$count{$_}\n";
    }
    return @graphos;
}

sub estatservices {
    my (@ndata) = @_;
    my (@allports);
    foreach my $ndata (@ndata) {
        my @result = split ( /\|/, $ndata );
        if ( $result[3] || $ndata =~ /\[NessusWX|\$DATA/ ) {
            next;
        }
        else {
            chomp $result[1];
            push @allports, $result[1];
        }
    }
    my %count;
    map { $count{$_}++ } @allports;
    my @rearranged = sort { $count{$b} <=> $count{$a} } keys %count;
    my @graphservices;
    foreach (@rearranged) {
        push @graphservices, join "|", $_, "$count{$_}\n";
    }
    return @graphservices;
}

sub estatvulns {
    my (@edata) = @_;
    my (@allvuln);
    my $esevval = pop (@edata);
    my $eseverity;
    if ($esevval == 1) {
	    $eseverity = "REPORT";
    }
    elsif ($esevval == 2) {
	    $eseverity = "INFO";
    }
    elsif ($esevval == 3) {
	    $eseverity = "NOTE";
    }
    foreach my $edata (@edata) {
            my @result = split ( /\|/, $edata );
	    if (! $result[3]) {
		    next;
	    }
            elsif ( $result[3] =~ /$eseverity/ ) {
                push @allvuln, $result[2];
            }
    }
    my %count;
    map { $count{$_}++ } @allvuln;
    my @rearranged = sort { $count{$b} <=> $count{$a} } keys %count;
    my @graphvuln;
    foreach (@rearranged) {
        push @graphvuln, join "|", $_, "$count{$_}\n";
    }
    return @graphvuln;
}

1;

__END__