Commit 46cca817 authored by Alexandre Dulaunoy's avatar Alexandre Dulaunoy Committed by GitHub
Browse files

Merge pull request #127 from PidgeyL/master 

Plug-in manager fixes, updates etc
parents 90dc33a5 8028ec6d

README.md

+9 −7
Original line number Diff line number Diff line 
cve-search

==========



[![Join the chat at https://gitter.im/cve-search/cve-search](https://badges.gitter.im/cve-search/cve-search.svg)](https://gitter.im/cve-search/cve-search?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)



![cve-search logo](https://avatars3.githubusercontent.com/u/15033728?v=3&s=200)



[![Build Status](https://travis-ci.org/cve-search/cve-search.svg?branch=master)](https://travis-ci.org/cve-search/cve-search)
@@ -152,11 +154,11 @@ or department within your organization or any meaningful name for you. 
As an example, you can add a partial CPE name like "sap:netweaver" which is very

critical for your accounting department.



    ./python3.3 sbin/db_ranking.py  -c "sap:netweaver" -g "accounting" -r 3

    ./sbin/db_ranking.py  -c "sap:netweaver" -g "accounting" -r 3



and then you can lookup the ranking (-r option) for a specific CVE-ID:



    ./python3.3 bin/search.py -c CVE-2012-4341  -r  -n

    ./bin/search.py -c CVE-2012-4341  -r  -n



Advanced usage

--------------
@@ -192,15 +194,15 @@ Fulltext indexing 


If you want to index all the CVEs from your current MongoDB collection:



    ./python3.3 sbin/db_fulltext.py

    ./sbin/db_fulltext.py



and you query the fulltext index (to get a list of matching CVE-ID):



    ./python3.3 bin/search_fulltext.py -q NFS -q Linux

    ./bin/search_fulltext.py -q NFS -q Linux



or to query the fulltext index and output the JSON object for each CVE-ID:



    ./python3.3 bin/search_fulltext.py -q NFS -q Linux -j

    ./bin/search_fulltext.py -q NFS -q Linux -j



Fulltext visualization

----------------------
@@ -211,7 +213,7 @@ required to generate the keywords with the most common English 
stopwords and lemmatize the output. [NTLK for Python 3](http://nltk.org/nltk3-alpha/)

exists but you need to use the alpha version of NLTK.



    ./python3.3 bin/search_fulltext.py  -g -s >cve.json

    ./bin/search_fulltext.py  -g -s >cve.json



![cve-search visualization](https://farm9.staticflickr.com/8109/8603509755_c7690c2de4_n.jpg "CVE Keywords Visualization Using Data From cve-search")
@@ -225,7 +227,7 @@ query a specific CVE. You'll need flask in order to run the website and [Flask-P 
the web interface:



    cd ./web

    ./python3.3 index.py

    ./index.py



Then you can connect on http://127.0.0.1:5000/ to browser the last CVE.

bin/cve_doc.py

100644 → 100755
+1 −1
Original line number Diff line number Diff line
@@ -17,7 +17,7 @@ import re 


from optparse import OptionParser



from lib.Query import lastentries, apigetcve, apibrowse, apisearch

from lib.Query import apigetcve



optp = OptionParser()

optp.add_option('-c', '--cve', dest='cve', default='CVE-2015-0001', help='CVE id to convert')

bin/db_dump.py

+5 −1
Original line number Diff line number Diff line
@@ -37,4 +37,8 @@ for cveid in db.getCVEIDs(limit=args.l): 
    if 'cvss' in item:

        if type(item['cvss']) == str:

            item['cvss'] = float(item['cvss'])

    date_fields = ['cvss-time', 'Modified', 'Published']

    for field in date_fields:

        if field in item:

            item[field] = str(item[field])

    print(json.dumps(item, sort_keys=True, default=json_util.default))

bin/dump_last.py

+1 −1
Original line number Diff line number Diff line
@@ -69,7 +69,7 @@ for x in cvelist.get(limit=last): 
        print ("<tr class=\"alt\">")

        print ("<td>" + str(x['id']) + " - " + x['summary'][:90] + "...</td>")

        print ("</tr>")

        print ("<tr><td>CVSS: " + str(x['cvss']) + " Published: " + x['Published'] + "</td></tr>")

        print ("<tr><td>CVSS: " + str(x['cvss']) + " Published: " + str(x['Published']) + "</td></tr>")

        print ("<tr>")

        print ("<td> Summary: " + x['summary'] + "</td>")

        print ("</tr>")

bin/search.py

+13 −9
Original line number Diff line number Diff line
@@ -94,9 +94,13 @@ if sLatest: 
    sorttype = -1





def printCVE(item):

def printCVE(item, indent=None):

    date_fields = ['cvss-time', 'Modified', 'Published']

    for field in date_fields:

        if field in item:

            item[field] = str(item[field])

    if not namelookup and not rankinglookup and not capeclookup:

        print(json.dumps(item, sort_keys=True, default=json_util.default))

        print(json.dumps(item, sort_keys=True, default=json_util.default, indent=indent))

    else:

        if "vulnerable_configuration" in item:

            vulconf = []
@@ -115,7 +119,7 @@ def printCVE(item): 
            if "cwe" in item and capeclookup:

                if item['cwe'].lower() != 'unknown':

                    item['capec'] = cves.getcapec(cweid=(item['cwe'].split('-')[1]))

            print(json.dumps(item, sort_keys=True, default=json_util.default))

            print(json.dumps(item, sort_keys=True, default=json_util.default, indent=indent))



if cveSearch:

    for cveid in db.getCVEs(cves=cveSearch):
@@ -126,7 +130,7 @@ if cveSearch: 
if vFreeSearch:

    try:

        for item in db.getFreeText(vFreeSearch):

            print(item)

            printCVE(item, indent=2)

    except:

        sys.exit("Free text search not enabled on the database!")

    sys.exit(0)
@@ -150,11 +154,11 @@ if vSearch: 
                nl = " ".join(item['vulnerable_configuration'])

            csvoutput = csv.writer(sys.stdout, delimiter='|', quotechar='|', quoting=csv.QUOTE_MINIMAL)

            if not namelookup:

                csvoutput.writerow([item['id'], item['Published'], item['cvss'], item['summary'], refs])

                csvoutput.writerow([item['id'], str(item['Published']), item['cvss'], item['summary'], refs])

            else:

                csvoutput.writerow([item['id'], item['Published'], item['cvss'], item['summary'], refs, nl])

                csvoutput.writerow([item['id'], str(item['Published']), item['cvss'], item['summary'], refs, nl])

        elif htmlOutput:

            print("<h2>" + item['id'] + "<br></h2>CVSS score: " + str(item['cvss']) + "<br>" + "<b>" + item['Published'] + "<b><br>" + item['summary'] + "<br>")

            print("<h2>" + item['id'] + "<br></h2>CVSS score: " + str(item['cvss']) + "<br>" + "<b>" + str(item['Published']) + "<b><br>" + item['summary'] + "<br>")

            print("References:<br>")

            for entry in item['references']:

                print(entry + "<br>")
@@ -167,7 +171,7 @@ if vSearch: 
            c = SubElement(r, 'id')

            c.text = item['id']

            c = SubElement(r, 'Published')

            c.text = item['Published']

            c.text = str(item['Published'])

            c = SubElement(r, 'cvss')

            c.text = str(item['cvss'])

            c = SubElement(r, 'summary')
@@ -182,7 +186,7 @@ if vSearch: 
            print(item['id'])

        else:

            print("CVE\t: " + item['id'])

            print("DATE\t: " + item['Published'])

            print("DATE\t: " + str(item['Published']))

            print("CVSS\t: " + str(item['cvss']))

            print(item['summary'])

            print("\nReferences:")

CRA Git | Maintained and supported by SUSTech CRA and CCSE