Skip to content

Commit d1da8aa

Browse files
Maffoochcneill
Maffooch
and
cneill
authored
Add support for Invicti parser through Netsparker (#10894)
* Add support for Invicti parser through Netsparker * update settings sha * Rename unit test files * Update docs/content/en/integrations/parsers/file/netsparker.md Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com> --------- Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
1 parent 2b5c9b6 commit d1da8aa

12 files changed

Lines changed: 5255 additions & 1 deletion

File tree

‎docs/content/en/integrations/parsers/file/invicti.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: "Invicti"
3+
toc_hide: true
4+
---
5+
Vulnerabilities List - JSON report
6+
7+
### Sample Scan Data
8+
9+
Sample Invicti scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/invicti).

‎docs/content/en/integrations/parsers/file/netsparker.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,8 @@ toc_hide: true
44
---
55
Vulnerabilities List - JSON report
66

7+
[Netsparker has now become Invicti](https://www.invicti.com/blog/news/netsparker-is-now-invicti-signaling-a-new-era-for-modern-appsec/). Please plan to migrate automation scripts to use the [Invicti Scan](../invicti.md)
8+
79
### Sample Scan Data
10+
811
Sample Netsparker scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/netsparker).

‎dojo/settings/.settings.dist.py.sha256sum‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5adedc433a342d675492b86dc18786f72e167115f9718a397dc9b91c5fdc9c94
1+
1a74292fc58b2bd05c763c8c126b0b35888e2a6f8ef9ab2588bb6c8589987c9c

‎dojo/settings/settings.dist.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1279,6 +1279,7 @@ def saml2_attrib_map_format(dict):
12791279
"AppCheck Web Application Scanner": ["title", "severity"],
12801280
"Legitify Scan": ["title", "endpoints", "severity"],
12811281
"ThreatComposer Scan": ["title", "description"],
1282+
"Invicti Scan": ["title", "description", "severity"],
12821283
}
12831284

12841285
# Override the hardcoded settings here via the env var
@@ -1503,6 +1504,7 @@ def saml2_attrib_map_format(dict):
15031504
"AppCheck Web Application Scanner": DEDUPE_ALGO_HASH_CODE,
15041505
"Legitify Scan": DEDUPE_ALGO_HASH_CODE,
15051506
"ThreatComposer Scan": DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE,
1507+
"Invicti Scan": DEDUPE_ALGO_HASH_CODE,
15061508
}
15071509

15081510
# Override the hardcoded settings here via the env var

‎dojo/tools/invicti/__init__.py‎

Whitespace-only changes.

‎dojo/tools/invicti/parser.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
from dojo.tools.netsparker.parser import NetsparkerParser
2+
3+
4+
class InvictiParser(NetsparkerParser):
5+
def get_scan_types(self):
6+
return ["Invicti Scan"]
7+
8+
def get_label_for_scan_types(self, scan_type):
9+
return "Invicti Scan"
10+
11+
def get_description_for_scan_types(self, scan_type):
12+
return "Invicti JSON format."
13+
14+
def get_findings(self, filename, test):
15+
"""Extended the NetSparker Parser since the Invicti is the a renamed version of Netsparker.
16+
17+
If there are deviations from the two report formats in the future, then this
18+
function can be implemented then.
19+
"""
20+
return super().get_findings(filename, test)

‎unittests/scans/invicti/invicti_many_findings.json‎

Lines changed: 4681 additions & 0 deletions
Large diffs are not rendered by default.

‎unittests/scans/invicti/invicti_one_finding.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"Generated": "25/06/2021 09:59 AM",
3+
"Target": {
4+
"Duration": "00:00:41.3968969",
5+
"Initiated": "25/06/2021 09:53 AM",
6+
"ScanId": "663eb6e88d9e4f4d9e00ad52017aa66d",
7+
"Url": "http://php.testsparker.com/"
8+
},
9+
"Vulnerabilities": [
10+
{
11+
"Certainty": 100,
12+
"Classification": {
13+
"Iso27001": "A.14.2.5",
14+
"Capec": "107",
15+
"Cvss": {
16+
"BaseScore": {
17+
"Severity": 2,
18+
"Type": "Base",
19+
"Value": "5.7"
20+
},
21+
"EnvironmentalScore": {
22+
"Severity": 2,
23+
"Type": "Environmental",
24+
"Value": "5.5"
25+
},
26+
"TemporalScore": {
27+
"Severity": 2,
28+
"Type": "Temporal",
29+
"Value": "5.5"
30+
},
31+
"Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C"
32+
},
33+
"Cvss31": null,
34+
"Cwe": "16",
35+
"Hipaa": "",
36+
"Owasp": "A5",
37+
"OwaspProactiveControls": "",
38+
"Pci32": "",
39+
"Wasc": "15"
40+
},
41+
"Confirmed": true,
42+
"Description": "<p>Netsparker Enterprise identified a cookie not marked as HTTPOnly.</p>\n<p>HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.</p>",
43+
"ExploitationSkills": "",
44+
"ExternalReferences": "<div><ul><li><a target='_blank' href='https://www.netsparker.com/security-cookies-whitepaper/#httpOnlyFlag'><i class='icon-external-link'></i>Netsparker - Security Cookies - HTTPOnly Flag</a></li><li><a target='_blank' href='https://wiki.owasp.org/index.php/HttpOnly'><i class='icon-external-link'></i>OWASP HTTPOnly Cookies</a></li><li><a target='_blank' href='https://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly%28VS.80%29.aspx'><i class='icon-external-link'></i>MSDN - ASP.NET HTTPOnly Cookies</a></li></ul></div>",
45+
"ExtraInformation": [
46+
{
47+
"Name": "Identified Cookie(s)",
48+
"Value": "PHPSESSID"
49+
},
50+
{
51+
"Name": "Cookie Source",
52+
"Value": "HTTP Header"
53+
},
54+
{
55+
"Name": "Page Type",
56+
"Value": "Login"
57+
}
58+
],
59+
"FirstSeenDate": "16/06/2021 12:30 PM",
60+
"HttpRequest": {
61+
"Content": "GET /auth/login.php HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nReferer: http://php.testsparker.com/auth/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n",
62+
"Method": "GET",
63+
"Parameters": []
64+
},
65+
"HttpResponse": {
66+
"Content": "HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d; path=/\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nContent-Length: 3061\r\nX-Powered-By: PHP/5.2.6\r\nPragma: no-cache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT<!-- end #footer -->\n</body>\n</html>\n",
67+
"Duration": 41.4849,
68+
"StatusCode": 200
69+
},
70+
"LookupId": "735f4503-e9eb-4b4c-4306-ad49020a4c4b",
71+
"Impact": "<div>During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.</div>",
72+
"KnownVulnerabilities": [],
73+
"LastSeenDate": "25/06/2021 01:52 AM",
74+
"Name": "Cookie Not Marked as HttpOnly",
75+
"ProofOfConcept": "",
76+
"RemedialActions": "<div>\n<ol>\n<li>See the remedy for solution.</li>\n<li>Consider marking all of the cookies used by the application as HTTPOnly. (<em>After these changes javascript code will not be able to read cookies.</em>)</li>\n</ol>\n</div>",
77+
"RemedialProcedure": "<div>Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as <a href=\"https://labs.portcullis.co.uk/tools/xss-tunnel/\">XSS Tunnel</a> to bypass HTTPOnly protection.</div>",
78+
"RemedyReferences": "",
79+
"Severity": "Medium",
80+
"State": "Present",
81+
"Type": "CookieNotMarkedAsHttpOnly",
82+
"Url": "http://php.testsparker.com/auth/login.php"
83+
}
84+
]
85+
}

‎unittests/scans/invicti/invicti_zero_finding.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"Generated": "25/06/2021 09:57 AM",
3+
"Target": {
4+
"Duration": "00:01:16.6130466",
5+
"Initiated": "25/06/2021 01:42 AM",
6+
"ScanId": "0a110f61b1f949ff30c8ad5104dfd9f5",
7+
"Url": "http://php.testsparker.com/"
8+
},
9+
"Vulnerabilities": []
10+
}

‎unittests/scans/invicti/issue_10311.json‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
{
2+
"Generated": "03/02/2019 15:50:29 (UTC-06:00)",
3+
"Target": {
4+
"ScanId": "fg49hk5",
5+
"Url": "https://www.sampleweb.org/",
6+
"Initiated": "03/02/2019 15:48:23 (UTC-06:00)",
7+
"Duration": "00:01:20.4322725"
8+
},
9+
"Vulnerabilities": [
10+
{
11+
"Url": "https://www.sampleweb.org/",
12+
"Type": "CookieNotMarkedAsSecure",
13+
"Name": "Cookie Not Marked as Secure",
14+
"Severity": "High",
15+
"Certainty": 100,
16+
"Confirmed": true,
17+
"Classification": {
18+
"Owasp": "A6",
19+
"Owasp2017": "A3",
20+
"Wasc": "15",
21+
"Cwe": "614",
22+
"Capec": "102",
23+
"Pci31": "6.5.10",
24+
"Pci32": "6.5.10",
25+
"Hipaa": null
26+
},
27+
"HttpRequest": {
28+
"Method": "GET",
29+
"Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n",
30+
"Parameters": [ ]
31+
},
32+
"HttpResponse": {
33+
"StatusCode": 200,
34+
"Duration": 644.6389,
35+
"Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n"
36+
},
37+
"ExtraInformation": [
38+
{
39+
"Name": "Identified Cookie(s)",
40+
"Value": "cookieconsent_status"
41+
},
42+
{
43+
"Name": "Cookie Source",
44+
"Value": "JavaScript"
45+
}
46+
],
47+
"KnownVulnerabilities": [ ],
48+
"Description": "<p>Netsparker identified a cookie not marked as secure, and transmitted over HTTPS.</p><p>This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic, or following a successful man-in-the-middle attack.</p>",
49+
"Impact": "<div>This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (<em>such as a session cookie</em>), an attacker might intercept it and hijack a victim's session. If the attacker can carry out a man-in-the-middle attack, he/she can force the victim to make an HTTP request to steal the cookie.</div>",
50+
"RemedialActions": "<div><ol><li>See the remedy for solution.</li><li>Mark all cookies used within the application as secure. <em>(If the cookie is not related to authentication or does not carry any personal information, you do not have to mark it as secure.)</em></li></ol></div>",
51+
"ExploitationSkills": "<div>To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or to the victim's network. Attackers need to be understand layer 2, have physical access to systems either as waypoints for the traffic, or have locally gained access to to a system between the victim and the web server.</div>",
52+
"RemedialProcedure": "<div>Mark all cookies used within the application as secure.</div>",
53+
"RemedyReferences": "",
54+
"ExternalReferences": "<div><ul><li><a href='https://msdn.microsoft.com/en-us/library/system.net.cookie.secure.aspx'>.NET Cookie.Secure Property</a></li><li><a href='http://blog.teamtreehouse.com/how-to-create-totally-secure-cookies'>How to Create Totally Secure Cookies</a></li></ul></div>",
55+
"ProofOfConcept": ""
56+
},
57+
{
58+
"Url": "https://www.sampleweb.org/",
59+
"Type": "BootstrapjsOutOfDate",
60+
"Name": "Out-of-date Version (Bootstrap)",
61+
"Severity": "Medium",
62+
"Certainty": 90,
63+
"Confirmed": false,
64+
"Classification": {
65+
"Owasp": "A9",
66+
"Owasp2017": "A9",
67+
"Wasc": null,
68+
"Cwe": null,
69+
"Capec": "310",
70+
"Pci31": "6.2",
71+
"Pci32": "6.2",
72+
"Hipaa": null
73+
},
74+
"HttpRequest": {
75+
"Method": "GET",
76+
"Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n",
77+
"Parameters": [ ]
78+
},
79+
"HttpResponse": {
80+
"StatusCode": 200,
81+
"Duration": 644.6389,
82+
"Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n"
83+
},
84+
"ExtraInformation": [
85+
{
86+
"Name": "Identified Version",
87+
"Value": "4.0.0"
88+
},
89+
{
90+
"Name": "Latest Version",
91+
"Value": "4.3.1"
92+
},
93+
{
94+
"Name": "Vulnerability Database",
95+
"Value": "Result is based on 3/1/2019 vulnerability database content."
96+
}
97+
],
98+
"KnownVulnerabilities": [
99+
{
100+
"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
101+
"Severity": "Medium"
102+
},
103+
{
104+
"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
105+
"Severity": "Medium"
106+
},
107+
{
108+
"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
109+
"Severity": "Medium"
110+
},
111+
{
112+
"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
113+
"Severity": "Medium"
114+
}
115+
],
116+
"Description": "<p>Netsparker identified that the target web site is using Bootstrap and detected that it is out of date.</p>",
117+
"Impact": "<div>Since this is an old version of the software, it may be vulnerable to attacks.</div>",
118+
"RemedialActions": "",
119+
"ExploitationSkills": "",
120+
"RemedialProcedure": "<div>\n<p>Please upgrade your installation of Bootstrap to the latest stable version.</p>\n</div>",
121+
"RemedyReferences": "<div><ul><li><a href='https://getbootstrap.com/'>Downloading Bootstrap</a></li></ul></div>",
122+
"ExternalReferences": "",
123+
"ProofOfConcept": ""
124+
},
125+
{
126+
"Url": "https://www.sampleweb.org/",
127+
"Type": "CookieNotMarkedAsHttpOnly",
128+
"Name": "Cookie Not Marked as HttpOnly",
129+
"Severity": "Low",
130+
"Certainty": 100,
131+
"Confirmed": true,
132+
"Classification": {
133+
"Owasp": "A5",
134+
"Owasp2017": "A6",
135+
"Wasc": "15",
136+
"Cwe": "16",
137+
"Capec": "107",
138+
"Pci31": null,
139+
"Pci32": null,
140+
"Hipaa": null
141+
},
142+
"HttpRequest": {
143+
"Method": "GET",
144+
"Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n",
145+
"Parameters": [ ]
146+
},
147+
"HttpResponse": {
148+
"StatusCode": 200,
149+
"Duration": 644.6389,
150+
"Content": null
151+
},
152+
"ExtraInformation": [
153+
{
154+
"Name": "Identified Cookie(s)",
155+
"Value": "cookieconsent_status"
156+
},
157+
{
158+
"Name": "Cookie Source",
159+
"Value": "JavaScript"
160+
}
161+
],
162+
"KnownVulnerabilities": [ ],
163+
"Description": "<p>Netsparker identified a cookie not marked as HTTPOnly.</p><p>HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.</p>",
164+
"Impact": "<div>During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.</div>",
165+
"RemedialActions": "<div><ol><li>See the remedy for solution.</li><li>Consider marking all of the cookies used by the application as HTTPOnly. (<em>After these changes javascript code will not be able to read cookies.</em>)</li></ol></div>",
166+
"ExploitationSkills": "",
167+
"RemedialProcedure": "<div>Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as <a href=\"https://labs.portcullis.co.uk/tools/xss-tunnel/\" data-mce-href=\"https://labs.portcullis.co.uk/tools/xss-tunnel/\">XSS Tunnel</a> to bypass HTTPOnly protection.</div>",
168+
"RemedyReferences": "",
169+
"ExternalReferences": "<div><ul><li><a href='https://www.owasp.org/index.php/HTTPOnly'>OWASP HTTPOnly Cookies</a></li><li><a href='https://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly%28VS.80%29.aspx'>MSDN - ASP.NET HTTPOnly Cookies</a></li></ul></div>",
170+
"ProofOfConcept": ""
171+
}
172+
]
173+
}

0 commit comments

Comments
 (0)