Skip to content

Commit 8bc624d

Browse files
Maffoochcneill
Maffooch
and
cneill
authored
New Parser: Qualys Hacker Guardian (#10937)
* New Parser: Qualys Hacker Guardian * Restore unit tests * Fix ruff * Update docs/content/en/integrations/parsers/file/qualys_hacker_guardian.md Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com> --------- Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
1 parent 90785ac commit 8bc624d

7 files changed

Lines changed: 141 additions & 0 deletions

File tree

‎docs/content/en/integrations/parsers/file/qualys_hacker_guardian.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: "Qualys Hacker Guardian Scan"
3+
toc_hide: true
4+
---
5+
Qualys Hacker Guardian CSV export
6+
7+
### Sample Scan Data
8+
9+
Sample Qualys Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/qualys_hacker_guardian).

‎dojo/tools/qualys_hacker_guardian/__init__.py‎

Whitespace-only changes.

‎dojo/tools/qualys_hacker_guardian/parser.py‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
import csv
2+
import io
3+
4+
from dateutil import parser as date_parser
5+
6+
from dojo.models import Endpoint, Finding
7+
8+
9+
class QualysHackerGuardianParser:
10+
"""Parser for Qualys HackerGuardian"""
11+
12+
# Severity mapping taken from
13+
# https://qualysguard.qg2.apps.qualys.com/portal-help/en/malware/knowledgebase/severity_levels.htm
14+
qualys_severity_lookup = {
15+
"1": "Low",
16+
"2": "Low",
17+
"3": "Medium",
18+
"4": "High",
19+
"5": "High",
20+
}
21+
22+
def get_scan_types(self):
23+
return ["Qualys Hacker Guardian Scan"]
24+
25+
def get_label_for_scan_types(self, scan_type):
26+
return "Qualys Hacker Guardian Scan"
27+
28+
def get_description_for_scan_types(self, scan_type):
29+
return "Qualys Hacker Guardian report file can be imported in CSV format."
30+
31+
def get_endpoint(self, row):
32+
host = row.get("HOSTNAME", row.get("IP"))
33+
if (port := row.get("PORT")) is not None:
34+
host += f":{port}"
35+
if (protocol := row.get("PROTOCOL")) is not None:
36+
host = f"{protocol}://{host}"
37+
38+
return host
39+
40+
def get_findings(self, filename, test):
41+
if filename is None:
42+
return ()
43+
content = filename.read()
44+
if isinstance(content, bytes):
45+
content = content.decode("utf-8")
46+
reader = csv.DictReader(io.StringIO(content), delimiter=",", quotechar='"')
47+
dupes = {}
48+
for row in reader:
49+
endpoint = Endpoint.from_uri(self.get_endpoint(row))
50+
finding = Finding(
51+
title=row.get("VULN TITLE"),
52+
severity=self.qualys_severity_lookup[row.get("Q_SEVERITY", 1)],
53+
description=(
54+
f'**Category**: {row.get("CATEGORY", "Unknown")}\n'
55+
f'**Threat**: {row.get("THREAT", "No threat detected")}\n'
56+
f'**Result**: {row.get("RESULT", "No threat detected")}\n'
57+
),
58+
date=date_parser.parse(row.get("LAST SCAN")),
59+
impact=row.get("IMPACT"),
60+
mitigation=row.get("SOLUTION"),
61+
unique_id_from_tool=row.get("QID"),
62+
dynamic_finding=True,
63+
active=True,
64+
nb_occurences=1,
65+
)
66+
finding.unsaved_endpoints.append(endpoint)
67+
68+
dupe_key = finding.unique_id_from_tool
69+
if dupe_key in dupes:
70+
finding = dupes[dupe_key]
71+
if endpoint not in finding.unsaved_endpoints:
72+
finding.unsaved_endpoints.append(endpoint)
73+
finding.nb_occurences += 1
74+
else:
75+
dupes[dupe_key] = finding
76+
77+
return list(dupes.values())

‎unittests/scans/qualys_hacker_guardian/many_finding.csv‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
"IP","HOSTNAME","LAST SCAN","QID","VULN TITLE","TYPE","SEVERITY","PORT","PROTOCOL","OPERATING SYSTEM","IS_PCI","FALSE POSITIVE STATUS","CVSS_BASE","Q_SEVERITY","THREAT","IMPACT","SOLUTION","CVSS_TEMPORAL","CATEGORY","RESULT","BUGTRAQID","CVEID"
2+
"18.238.109.17","help.example.co","2024-09-16 04:00:30","150059","Reference to Windows file path is present in HTML","POTENTIAL","M","80","tcp","","Y","-","5.3","1","Windows specific file path was detected in the response.","The response may be an error response that disclosed a local file path. This may potentially be a sensitive information.","The content should be reviewed to determine whether it could be masked or removed.","4.7","Web Application","url: https://help.example.co/ matched: .toLowerCase().split(\ -\ ) c=b.join(\ _\ );return c}} {key:\ fetchQuery\ value:function i(a){var b=this c=this.props d=c.org e=c.domain f=this.getTransformedNavigatorLang() g=f?\ &lang=\ +f:\ \ h=\ https://\ +d.name+\ .api.\ +e+\ /p/v1/kb/deflection/search?term=\ +encodeURIComponent(a)+g;return fetch(h).then(function(a){return a.json()}).then(function(a){var c=a.data;if(c){var d=c.slice(0 5);b.setState({articl url: https://help.example.co/. matched: .toLowerCase().split(\ -\ ) c=b.join(\ _\ );return c}} {key:\ fetchQuery\ value:function i(a){var b=this c=this.props d=c.org e=c.domain f=this.getTransformedNavigatorLang() g=f?\ &lang=\ +f:\ \ h=\ https://\ +d.name+\ .api.\ +e+\ /p/v1/kb/deflection/search?term=\ +encodeURIComponent(a)+g;return fetch(h).then(function(a){return a.json()}).then(function(a){var c=a.data;if(c){var d=c.slice(0 5);b.setState({articl","-",""
3+
"18.238.109.17","help.example.co","2024-09-16 04:00:30","150059","Reference to Windows file path is present in HTML","POTENTIAL","M","443","tcp","","Y","-","5.3","1","Windows specific file path was detected in the response.","The response may be an error response that disclosed a local file path. This may potentially be a sensitive information.","The content should be reviewed to determine whether it could be masked or removed.","4.7","Web Application","url: https://help.example.co/ matched: .toLowerCase().split(\ -\ ) c=b.join(\ _\ );return c}} {key:\ fetchQuery\ value:function i(a){var b=this c=this.props d=c.org e=c.domain f=this.getTransformedNavigatorLang() g=f?\ &lang=\ +f:\ \ h=\ https://\ +d.name+\ .api.\ +e+\ /p/v1/kb/deflection/search?term=\ +encodeURIComponent(a)+g;return fetch(h).then(function(a){return a.json()}).then(function(a){var c=a.data;if(c){var d=c.slice(0 5);b.setState({articl","-",""
4+
"44.207.58.177","jt.example.co","2024-09-15 09:00:18","11827","HTTP Security Header Not Detected","CONFIRMED","M","443","tcp","","Y","-","5.3","2","This QID reports the absence of the following <A HREF= https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#tab=Headers TARGET= _blank >HTTP headers</A> according to <A HREF= https://cwe.mitre.org/data/definitions/693.html TARGET= _blank >CWE-693: Protection Mechanism Failure</A>:<BR> X-Content-Type-Options: This HTTP header will prevent the browser from interpreting files as a different MIME type to what is specified in the Content-Type HTTP header. <BR> Strict-Transport-Security: The HTTP Strict-Transport-Security response header (HSTS) allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections and never via the insecure HTTP protocol.<P> <P>QID Detection Logic:<BR> This unauthenticated QID looks for the presence of the following HTTP responses:<BR> The Valid directives are as belows: X-Content-Type-Options: nosniff<P> Strict-Transport-Security: max-age=&lt; [;includeSubDomains]<P> ","Depending on the vulnerability being exploited an unauthenticated remote attacker could conduct cross-site scripting clickjacking or MIME-type sniffing attacks.","<B>Note:</B> To better debug the results of this QID it is requested that customers execute commands to simulate the following functionality: curl -lkL --verbose.<P> CWE-693: Protection Mechanism Failure mentions the following - The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. A &quot;missing&quot; protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An &quot;insufficient&quot; protection mechanism might provide some defenses - for example against the most common attacks - but it does not protect against everything that is intended. Finally an &quot;ignored&quot; mechanism occurs when a mechanism is available and in active use within the product but the developer has not applied it in some code path.<P> Customers are advised to set proper <A HREF= https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options TARGET= _blank >X-Content-Type-Options</A> and <A HREF= https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security TARGET= _blank >Strict-Transport-Security</A> HTTP response headers.<P> Depending on their server software customers can set directives in their site configuration or Web.config files. Few examples are:<P> X-Content-Type-Options:<BR> Apache: Header always set X-Content-Type-Options: nosniff<P> HTTP Strict-Transport-Security:<BR> Apache: Header always set Strict-Transport-Security &quot;max-age=31536000; includeSubDomains&quot;<BR> Nginx: add_header Strict-Transport-Security max-age=31536000;<P> <B>Note: Network devices that include a HTTP/HTTPS console for administrative/management purposes often do not include all/some of the security headers. This is a known issue and it is recommend to contact the vendor for a solution. </B><P>","4.7","CGI","X-Content-Type-Options HTTP Header missing on port 443. GET / HTTP/1.1 Host: jt.example.co Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0 <html><head><title>jt edge server ver v1.42.0-1-g7a7022e4 / 2022-06-09T21:08:14.000000Z</title></head><body> <small> jt edge server ver v1.42.0-1-g7a7022e4 / 2022-06-09T21:08:14.000000Z. Configure jt (/configurator) </small> </body></html>Strict-Transport-Security HTTP Header missing on port 443. HTTP/1.1 200 OK Date: Sun 15 Sep 2024 09:12:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 274 Connection: keep-alive Server: nginx/1.21.6","-",""
5+
"44.220.118.158","data.example.co","2024-09-16 04:00:30","150004","Predictable Resource Location Via Forced Browsing","CONFIRMED","M","80","tcp","","Y","-","5.3","2","A file directory or directory listing was discovered on the Web server. These resources are confirmed to be present based on our logic. Some of the content on these files might have sensitive information. <P>NOTE: Links found in 150004 are found by forced crawling so will not automatically be added to 150009 Links Crawled or the application site map. If links found in 150004 need to be tested they must be added as Explicit URI so they are included in scope and then will be reported in 150009. Once the link is added to be in scope (i.e. Explicit URI) this same link will no longer be reported for 150004.","The contents of this file or directory may disclose sensitive information.","It is advised to review the contents of the disclosed files. If the contents contain sensitive information please verify that access to this file or directory is permitted. If necessary remove it or apply access controls to it.","4.7","Web Application","url: https://data.example.co/wp-content/uploads/2023/01/image.png Payload: https://data.example.co/feed/image/ comment: Found this Vulnerability for redirect link: https://data.example.co/wp-content/uploads/2023/01/image.png. It was redirected from: https://data.example.co/feed/image/. Original URL is: https://data.example.co/feed/ matched: HTTP/1.1 200 OK url: https://data.example.co/wp-content/uploads/2023/08/download.svg Payload: https://data.example.co/feed/download/ comment: Found this Vulnerability for redirect link: https://data.example.co/wp-content/uploads/2023/08/download.svg. It was redirected from: https://data.example.co/feed/download/. Original URL is: https://data.example.co/feed/ matched: HTTP/1.1 200 OK url: https://data.example.co/test-flow-shopify-bw/ Payload: https://data.example.co:443/test/ comment: Found this Vulnerability for redirect link: https://data.example.co/test-flow-shopify-bw/. It was redirected from: https://data.example.co:443/test/. Original URL is: https://data.example.co:443/. matched: HTTP/1.1 200 OK url: https://data.example.co/wp-content/uploads/2023/08/users.svg Payload: https://data.example.co/feed/users/ comment: Found this Vulnerability for redirect link: https://data.example.co/wp-content/uploads/2023/08/users.svg. It was redirected from: https://data.example.co/feed/users/. Original URL is: https://data.example.co/feed/ matched: HTTP/1.1 200 OK","-",""

‎unittests/scans/qualys_hacker_guardian/one_finding.csv‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
"IP","HOSTNAME","LAST SCAN","QID","VULN TITLE","TYPE","SEVERITY","PORT","PROTOCOL","OPERATING SYSTEM","IS_PCI","FALSE POSITIVE STATUS","CVSS_BASE","Q_SEVERITY","THREAT","IMPACT","SOLUTION","CVSS_TEMPORAL","CATEGORY","RESULT","BUGTRAQID","CVEID"
2+
"18.238.109.17","help.example.co","2024-09-16 04:00:30","150059","Reference to Windows file path is present in HTML","POTENTIAL","M","80","tcp","","Y","-","5.3","1","Windows specific file path was detected in the response.","The response may be an error response that disclosed a local file path. This may potentially be a sensitive information.","The content should be reviewed to determine whether it could be masked or removed.","4.7","Web Application","url: https://help.example.co/ matched: .toLowerCase().split(\ -\ ) c=b.join(\ _\ );return c}} {key:\ fetchQuery\ value:function i(a){var b=this c=this.props d=c.org e=c.domain f=this.getTransformedNavigatorLang() g=f?\ &lang=\ +f:\ \ h=\ https://\ +d.name+\ .api.\ +e+\ /p/v1/kb/deflection/search?term=\ +encodeURIComponent(a)+g;return fetch(h).then(function(a){return a.json()}).then(function(a){var c=a.data;if(c){var d=c.slice(0 5);b.setState({articl url: https://help.example.co/. matched: .toLowerCase().split(\ -\ ) c=b.join(\ _\ );return c}} {key:\ fetchQuery\ value:function i(a){var b=this c=this.props d=c.org e=c.domain f=this.getTransformedNavigatorLang() g=f?\ &lang=\ +f:\ \ h=\ https://\ +d.name+\ .api.\ +e+\ /p/v1/kb/deflection/search?term=\ +encodeURIComponent(a)+g;return fetch(h).then(function(a){return a.json()}).then(function(a){var c=a.data;if(c){var d=c.slice(0 5);b.setState({articl","-",""
3+
"18.238.109.17","help.example.co","2024-09-16 04:00:30","150059","Reference to Windows file path is present in HTML","POTENTIAL","M","443","tcp","","Y","-","5.3","1","Windows specific file path was detected in the response.","The response may be an error response that disclosed a local file path. This may potentially be a sensitive information.","The content should be reviewed to determine whether it could be masked or removed.","4.7","Web Application","url: https://help.example.co/ matched: .toLowerCase().split(\ -\ ) c=b.join(\ _\ );return c}} {key:\ fetchQuery\ value:function i(a){var b=this c=this.props d=c.org e=c.domain f=this.getTransformedNavigatorLang() g=f?\ &lang=\ +f:\ \ h=\ https://\ +d.name+\ .api.\ +e+\ /p/v1/kb/deflection/search?term=\ +encodeURIComponent(a)+g;return fetch(h).then(function(a){return a.json()}).then(function(a){var c=a.data;if(c){var d=c.slice(0 5);b.setState({articl","-",""

‎unittests/scans/qualys_hacker_guardian/zero_finding.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"IP","HOSTNAME","LAST SCAN","QID","VULN TITLE","TYPE","SEVERITY","PORT","PROTOCOL","OPERATING SYSTEM","IS_PCI","FALSE POSITIVE STATUS","CVSS_BASE","Q_SEVERITY","THREAT","IMPACT","SOLUTION","CVSS_TEMPORAL","CATEGORY","RESULT","BUGTRAQID","CVEID"

‎unittests/tools/test_qualys_hacker_guardian_parser.py‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
from os import path
2+
3+
from dojo.models import Test
4+
from dojo.tools.qualys_hacker_guardian.parser import QualysHackerGuardianParser
5+
from unittests.dojo_test_case import DojoTestCase
6+
7+
8+
class TestQualysHackerGuardianParser(DojoTestCase):
9+
10+
def test_qualys_hacker_guardian_parser_with_no_findings(self):
11+
with open(path.join(path.dirname(__file__), "../scans/qualys_hacker_guardian/zero_finding.csv"), encoding="utf-8") as testfile:
12+
parser = QualysHackerGuardianParser()
13+
findings = parser.get_findings(testfile, Test())
14+
self.assertEqual(0, len(findings))
15+
16+
def test_qualys_hacker_guardian_parser_with_one_findings(self):
17+
with open(path.join(path.dirname(__file__), "../scans/qualys_hacker_guardian/one_finding.csv"), encoding="utf-8") as testfile:
18+
parser = QualysHackerGuardianParser()
19+
findings = parser.get_findings(testfile, Test())
20+
self.assertEqual(1, len(findings))
21+
finding = findings[0]
22+
self.assertEqual("Low", finding.severity)
23+
self.assertEqual("Reference to Windows file path is present in HTML", finding.title)
24+
self.assertIsNotNone(finding.description)
25+
self.assertEqual(len(finding.unsaved_endpoints), 2)
26+
27+
def test_qualys_hacker_guardian_parser_with_many_findings(self):
28+
with open(path.join(path.dirname(__file__), "../scans/qualys_hacker_guardian/many_finding.csv"), encoding="utf-8") as testfile:
29+
parser = QualysHackerGuardianParser()
30+
findings = parser.get_findings(testfile, Test())
31+
self.assertEqual(3, len(findings))
32+
finding = findings[0]
33+
self.assertEqual("Low", finding.severity)
34+
self.assertEqual("Reference to Windows file path is present in HTML", finding.title)
35+
self.assertIsNotNone(finding.description)
36+
self.assertEqual(len(finding.unsaved_endpoints), 2)
37+
finding = findings[1]
38+
self.assertEqual("HTTP Security Header Not Detected", finding.title)
39+
self.assertEqual("Low", finding.severity)
40+
self.assertIsNotNone(finding.description)
41+
self.assertEqual(len(finding.unsaved_endpoints), 1)
42+
finding = findings[2]
43+
self.assertEqual("Predictable Resource Location Via Forced Browsing", finding.title)
44+
self.assertEqual("Low", finding.severity)
45+
self.assertIsNotNone(finding.description)
46+
self.assertEqual(len(finding.unsaved_endpoints), 1)

0 commit comments

Comments
 (0)