merged dev to master, fixed README.md

kopolindo · Apr 4, 2018 · 24feff0 · 24feff0
2 parents 5e529c4 + 6fe382d
commit 24feff0
Show file tree

Hide file tree

Showing 4,331 changed files with 400,691 additions and 0 deletions.
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,4 @@
+# Ignore database sources
+.sources/
+.local/vuln_db
+vuln_db
diff --git a/.local/README b/.local/README
@@ -0,0 +1,2 @@
+CREATE TABLE cve (id text primary key,cve text,cve_description text,cwe text,cwe_description text,exploit integer,refs text,cvssv2 text,cvssv3 text);
+CREATE TABLE sw (id text primary key,software text,version text);
diff --git a/README.md b/README.md
@@ -14,3 +14,16 @@ todo:
    - output:
 	   - csv
 		- raw text table
+	- cercare le issue "security"
+	  per quei pacchetti che non
+	  rilasciano CVE
+fonte db mitre:
+    http://cve.mitre.org/data/downloads/allitems.xml
+
+Creo un file cveDB.go, per la gestione del db (sqlite) in modo da creare, riempire ed aggiornare il db. I dati sono presi da mitre e nvd, poiché l'uno contiene CVE che non sono presenti nell'altro.
+
+su rapid7 c'è il modulo msf che viene citato ma non esplicitato su nessus
+rapid7 può essere un'altra fonte di CVE
+
+╰─$ <sw.list § grep -Ev "`echo $line | cut -d';' -f1`" <(cat mitre_cve_to_insert.txt | cut -f5- -d' ' | sort -u) ° | wc -l
+
diff --git a/controller.go b/controller.go
@@ -0,0 +1,133 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"reflect"
+	"regexp"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/alecthomas/template"
+	"github.com/jweir/csv"
+	"github.com/kopolindo/cve-scraper/db"
+)
+
+func Printbanner() {
+	tmpl := template.New("banner")
+	template.Must(tmpl.Parse(banner))
+	_ = tmpl.Execute(os.Stderr, ActualVersion)
+}
+
+func Usage() {
+	Printbanner()
+	fmt.Println("\nUsage flags:")
+	flag.PrintDefaults()
+	return
+}
+
+func Init() {
+	flag.Parse()
+	if flag.NFlag() == 0 {
+		Usage()
+		os.Exit(0)
+	}
+	if *version {
+		Printbanner()
+	}
+	if *fields != "" {
+		if *fields != "help" {
+			fieldsToPrint = ValidateFields()
+		}
+		if *fields == "help" {
+			fmt.Println("Cve\t\tCVE Identification (CVE-YYYY-ID)")
+			fmt.Println("CveDesc\t\tVulnerability Description")
+			fmt.Println("Cwe\t\tCommon Weakness Enumeration ID")
+			fmt.Println("CweDesc\t\tCWE Description (type of vulnerability)")
+			fmt.Println("Exploit\t\tExistence of known exploits")
+			fmt.Println("Refs\t\tReferences")
+			fmt.Println("Cvssv2\t\tCommon Vulnerability Scoring System Vector (v2)")
+			fmt.Println("Cvssv3\t\tCommon Vulnerability Scoring System Vector (v3)")
+			fmt.Println("Software\tSoftware name")
+			fmt.Println("Version\t\tSoftware version")
+			os.Exit(0)
+		}
+	}
+	if *fields == "" {
+		fieldsToPrint = strings.Split("Cve,CveDesc,Cwe,CweDesc,Exploit,Refs,Cvssv2,Cvssv3,Software,Version", ",")
+	}
+	if *write != "" {
+		if _, err := os.Stat(*write); err == nil {
+			fmt.Println("This file exists")
+			os.Exit(1)
+		}
+	}
+}
+
+func ValidateFields() []string {
+	var out []string
+	checkArray := strings.Split(*fields, ",")
+	for _, toCheck := range checkArray {
+		for _, allowed := range AllowedFields {
+			if allowed == toCheck {
+				out = append(out, toCheck)
+			}
+		}
+	}
+	return out
+}
+
+func ValidateCve() []string {
+	var out []string
+	for _, cves := range strings.Split(*cve, ",") {
+		cveRegexp := regexp.MustCompile("[0-9]+")
+		regexpArray := cveRegexp.FindAllString(cves, -1)
+		cves = strings.Join(regexpArray, "")
+		if len(cves) < 5 {
+			fmt.Println("Please, insert at least year (YYYY) and ID number")
+			Usage()
+			os.Exit(71)
+		}
+		id := cves[4:]
+		cves := strings.Join([]string{"CVE", cves[0:4], id}, "-")
+		out = append(out, cves)
+	}
+	return out
+}
+
+func PrintResults(resArray []db.Results, fields []string) {
+	const padding = 2
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, padding, ' ', tabwriter.Debug)
+	if *header {
+		for _, f := range fields {
+			fmt.Fprint(w, f, "\t")
+		}
+	}
+	w.Flush()
+	for i, res := range resArray {
+		r := reflect.ValueOf(res)
+		for _, f := range fields {
+			fmt.Fprint(w, reflect.Indirect(r).FieldByName(f), "\t")
+		}
+		if i != 0 {
+			fmt.Println()
+		}
+		w.Flush()
+	}
+}
+
+func WriteCsv(resArray []db.Results) {
+	if *write != "" {
+		csvout, err := csv.Marshal(resArray)
+		if err != nil {
+			fmt.Println("Error durin marshalling [", err, "]")
+		}
+		//fmt.Println(string(*write))
+		errWrite := ioutil.WriteFile(*write, csvout, 0644)
+		if errWrite != nil {
+			fmt.Println("Error during writing to file [", err, "]")
+		}
+	}
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		CREATE TABLE cve (id text primary key,cve text,cve_description text,cwe text,cwe_description text,exploit integer,refs text,cvssv2 text,cvssv3 text);
		CREATE TABLE sw (id text primary key,software text,version text);