cbless.de

Traffic Analysis with tshark

2020-03-25T21:15:00+01:00

Basic usage

The first option we can use is to read packets from a pcap file. The filename must be specified by parameter -r.

tshark -r file.pcap

Another option is to read packets direcly from a live capture. Therefore you need to specify the interface by using the parameter -i.

tshark -i eth0

Additionally you can use tshark to produce a capture file. The name of the output filemust be specified by parameter -w.

tshark -i eth0 -w file.pcap

Display statistics about PCAP files

To get a brief overview what kind of traffic has been captured the protocol hierarchy can be used.

tshark -Q -r file.pcap -z io,phs

===================================================================
Protocol Hierarchy Statistics
Filter: 

eth                                      frames:170574 bytes:165271675
  ip                                     frames:167829 bytes:165118368
    tcp                                  frames:166836 bytes:164972597
      http                               frames:1169 bytes:1113141
        data-text-lines                  frames:141 bytes:68030
          tcp.segments                   frames:121 bytes:55944
        media                            frames:13 bytes:8526
          tcp.segments                   frames:13 bytes:8526
[...]

Another useful feature is the endpoint statistic. The following example displays all IPv4 endpoints within the given capture file.

tshark -Q -r file.pcap -z endpoints,ip

Result:

================================================================================
IPv4 Endpoints
Filter:<No Filter>
                        |  Packets  | |  Bytes  | | Tx Packets | | Tx Bytes | | Rx Packets | | Rx Bytes |
10.16.31.1              142285     145306928     107742       142895090       34543         2411838   
10.16.31.4              142285     145306928      34543         2411838      107742       142895090   
[...]
================================================================================

The next example can be used to display all IPv4 and IPv6 endpoints within the given capture file.

tshark -Q -r file.pcap -z endpoints,ipv6 -z endpoints,ip

Result:

================================================================================
IPv4 Endpoints
Filter:<No Filter>
                        |  Packets  | |  Bytes  | | Tx Packets | | Tx Bytes | | Rx Packets | | Rx Bytes |
10.16.31.1              142285     145306928     107742       142895090       34543         2411838   
10.16.31.4              142285     145306928      34543         2411838      107742       142895090   
[...]
================================================================================
================================================================================
IPv6 Endpoints
Filter:<No Filter>
                        |  Packets  | |  Bytes  | | Tx Packets | | Tx Bytes | | Rx Packets | | Rx Bytes |
ff02::1:2                     19          2857          0               0          19            2857   
fe80::cd42:fe8a:AAAA:1234          14          2072         14            2072           0               0   
[...]

Extract files from pcaps files

The following example shows how to extract objects from a pcap containing SMB traffic.

tshark -Q -r file.pcap  --export-objects smb,outdir

The following example shows how to extract objects from a pcap which were transmitted via HTTP.

tshark -Q -r file.pcap  --export-objects http,outdir

Analyze traffic within pcap files

Analyze HTTP traffic

The following example can be used to display information from HTTP responses. In this case the server ip as well as the server header are displayed. To remove duplicated entries the tools sort and uniq are used.

tshark -r file.pcap -Y "http.response" -T fields -e ip.src -e http.server | sort |uniq

To analyze HTTP request you can use the filter "http.request". In this case we display the source ip, destination ip, destination port, request method, hostname, requested URI as well as the user agent.

tshark -r file.pcap -Y "http.request" -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.request.method -e http.host -e http.request.uri -e http.user_agent | sort |uniq

Modbus Traffic

The next example displays die IP addresses of the Modbus-Master, Modbus slave and the requested Modbus function code.

tshark -r file.pcap -Y "modbus && tcp.dstport == 502" -T fields -e ip.src -e ip.dst -e modbus.func_code

10.21.10.10 10.21.10.24 15
10.21.10.10 10.21.10.24 15

Telnet

The following example can be used to display all data transmitted via Telnet.

tshark -r file.pcap -Y "telnet" -T fields -e telnet.data

DNS traffic

Display IP addresses from all DNS requests within a pcap file. Since we filter for DNS traffic with destination port 53 all DNS clients can be identified by the source address. We pass the results to sort and uniq to remove duplicate entries.

tshark -r file.pcap -Y "dns.qry.name && udp.dstport==53 " -T fields -e ip.src -e ip.dst  | sort | uniq

192.168.1.24    192.168.1.1
[...]

To display requested hostnames from DNS queries. If you are reading from pcap you can use sort and uniq to remove duplicate entries.

tshark -r file.pcap -Y "dns.qry.name && udp.dstport==53" -T fields -e dns.qry.name  | sort | uniq

www.heise.de
www.google.com
[...]

Kismet analyzer

2018-11-25T10:20:00+01:00

Kismet-analyzer is a python library which can be used to analyze the results of the new Kismet version. The library is available on bitbucket.org/cbless.

Curently the following scripts will be installed:

kismet_analyzer_aplist: This script can be used to extract access points from the SQLite database .kismet and export these results to csv and kml

License

This script is licensed under the GNU General Public License in version 3. See http://www.gnu.org/licenses/ for further details.

Installation:

This library requires simplekml for exporting extracted information to kml. You can use pip to install the neccessary requirement.

pip install -r requirements.txt

The setup script can be used to install the library and requirements. It will create the above listed console commands.

python setup.py install

Usage:

(venv)[kismet-analyzer]$ kismet_analyzer_aplist -h
usage: kismet_analyzer_aplist [-h] --in INFILE [--out OUTFILE] [--title TITLE]
                              [--ssid SSID] [--exclude-ssid EXCLUDESSID]
                              [--strongest-point] [--encryption ENCRYPTION]
                              [--csv] [--kml] [--verbose]

Kismet to KML Log Converter

optional arguments:
  -h, --help            Show this help message and exit
  --in INFILE           Input file (.kismet) 
  --out OUTFILE         Output filename (optional)
  --title TITLE         Title embedded in KML file
  --ssid SSID           Only plot networks which match the SSID (or SSID
                        regex)
  --exclude-ssid EXCLUDESSID
                        Exclude networks which match the SSID (or SSID
                        regex)
  --strongest-point     Plot points based on strongest signal
  --encryption ENCRYPTION
                        Show only networks with given encryption type
  --csv                 Export results to csv
  --kml                 Export results to kml
  --verbose             Print MAC, SSID, encryption type to stdout

Export only access points with encryption type "Open" to csv and kml files:

kismet_analyzer_aplist --in input.kismet --out test --encryption "Open" --kml --csv 
Exported 11 devices to test.csv
Exported 11 devices to test.kml

Output example for kml exports

The script generates colored notes for exported access points. The color depends on the identified encryption type. WPA encrypted access points will be added with a green color, WEP encrypted networks will be displayed in orange and Open network are displayed in red. Networks were the encryption type could not be detected will be added as a yellow note. Each note contains detailed meta information about the access point (SSID, MAC address, frequency, channel, manufacturer, and a list of clients MAC addresses).

parse-nmap.py

2016-05-03T10:20:00+02:00

Parse-nmap ist ein Tool zum parsen von nmap Scanergebnissen (nur XML), welches es ermöglicht die Scanergebnisse zu filtern (z.B.: nach Plattform oder IP), Target-Listen zu erstellen oder die Ergebisse als LaTeX Tabelle zu exportieren (diese Option habe ich verwendet um die Tabellen für den OSCP-Report zu erzeugen). In diesem Beitrag werde ich einige dieser Optionen etwas genauer vorstellen. Das Script ist in meinem Account auf bitbucket.org zu finden.

Für die folgenden Beispiele wird davon ausgegangen, dass ein nmap-Scan über die TOP 20 TCP Ports gemacht und dieses Ergebnis in der Datei lab-top-ports gespeichert wurde (siehe erstes Code-Beispiel).

prompt$ nmap -sS -sV --top-ports 20 -oA lab-top-ports <IPs>

Display Optionen

Übersicht

Das folgende Beispiel zeigt, wie mit Hilfe von parse-nmap eine Übersicht aller in der XML-Datei enthaltenen Hosts angeizeigt wird. Die ersten vier Zeilen zeigen lediglich Informationen zur Anzahl der in der Datei vorhandenen Hosts und der Anzahl an Hosts nach Anwendung der Filter. Diese Übersicht enthält drei Spalten pro Host. Die erste ist die IP, gefolgt von Hostnamen (localhost, falls dieser nicht Verfügbar ist) und einer Spalte mit Informationen zum Betriebssystem (falls vorhanden).

prompt$ parse-nmap.py lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 6
# number of hosts after OS, IP and port filter: 6
192.168.56.10 localhost Microsoft Windows XP SP2 or SP3
192.168.56.101 localhost Linux 2.6.32 - 3.10
192.168.56.102 localhost Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8
192.168.56.103 localhost Linux 2.4.9 - 2.4.18 (likely embedded)
192.168.56.200 localhost Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8
192.168.56.250 localhost Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8

print-ports

Die Option -p zeigt neben IP, Hostname und Betriebssysteminformationen auch die offenen Ports für jeden Host.

prompt$ parse-nmap.py -p lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 6
# number of hosts after OS, IP and port filter: 6
#===============================================================================
IP:     192.168.56.10
Hostname:   localhost
OS:     Microsoft Windows XP SP2 or SP3
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp microsoft-ds product: Microsoft Windows XP microsoft-ds ostype: Windows

#===============================================================================
IP:     192.168.56.101
Hostname:   localhost
OS:     Linux 2.6.32 - 3.10
#-------------------------------------------------------------------------------
22 tcp ssh product: OpenSSH version: 6.6.1 extrainfo: protocol 2.0
80 tcp http product: Apache httpd version: 2.4.6 extrainfo: (CentOS) PHP/5.4.16
8080 tcp tcpwrapped

Filter Optionen

Filter open TCP and UDP ports

Mit parse-nmap ist es möglich nach offenen TCP (Option -t oder --tcp) oder UDP (Option -u oder --udp) Ports zu filtern. Das folgende Beispiel zeigt, die Verwendung eines TCP-Filters, der dafür sorgt, dass nur Hosts mit einem offenen TCP-Port 22 angezeigt werden.

prompt$ parse-nmap.py -p -t 22 lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 6
# number of hosts after OS, IP and port filter: 2
#===============================================================================
IP:     192.168.56.101
Hostname:   localhost
OS:     Linux 2.6.32 - 3.10
#-------------------------------------------------------------------------------
22 tcp ssh product: OpenSSH version: 6.6.1 extrainfo: protocol 2.0
80 tcp http product: Apache httpd version: 2.4.6 extrainfo: (CentOS) PHP/5.4.16
8080 tcp tcpwrapped 

#===============================================================================
IP:     192.168.56.103
Hostname:   localhost
OS:     Linux 2.4.9 - 2.4.18 (likely embedded)
#-------------------------------------------------------------------------------
22 tcp ssh product: OpenSSH version: 3.1p1 extrainfo: protocol 1.99

Filter hosts by platform

Zusätzlich zum Port-Filter ist es auch möglich Hosts auf Basis der Plattform (z.B.: Windows oder Linux) zu filtern. Diese Plattform oder Betriebssystemfamilie kann durch Angabe der Option -f oder --os-familiy spezifiziert werden.

prompt$ parse-nmap.py -p -f Windows lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 4
# number of hosts after OS, IP and port filter: 4
#===============================================================================
IP:     192.168.56.10
Hostname:   localhost
OS:     Microsoft Windows XP SP2 or SP3
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp microsoft-ds product: Microsoft Windows XP microsoft-ds ostype: Windows

#===============================================================================
IP:     192.168.56.102
Hostname:   localhost
OS:     Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp netbios-ssn 
1025 tcp msrpc product: Microsoft Windows RPC ostype: Windows

...

Filter by IP

Um Hosts anhand der IP zu filtern, kann der Remote-Host mit der Option -r angegeben werden.

prompt$ parse-nmap.py -p -r 192.168.56.10 lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 1
# number of hosts after OS and IP filter: 1
# number of hosts after OS, IP and port filter: 1
#===============================================================================
IP:     192.168.56.10
Hostname:   localhost
OS:     Microsoft Windows XP SP2 or SP3
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp microsoft-ds product: Microsoft Windows XP microsoft-ds ostype: Windows

parse-nmap mit anderen Tools nutzen

Target-Listen generieren

Mit parse-nmap ist es möglich Target-Listen für andere Tools zu erzeugen. Das Standard-Trennzeichen zwischen den IPs ist ein Leerzeichen, dieses lässt sich allerdings mit der Option -d oder --list-delimiter ändern. Die folgenden Beispiele zeigen, wie eine Target-Liste für alle Windows Rechner mit einem offenen TCP-Port 445 erzeugt wird. Das erste Beispiel nutzt das Standard-Trennzeuchen, das zweite Beispiel nutzt ein Komma als Trennzeichen.

prompt$ parse-nmap.py -f Windows -t 445 --list lab-top-ports.xml
192.168.56.10 192.168.56.102 192.168.56.200 192.168.56.250

prompt$ parse-nmap.py -f Windows -t 445 --list -d "," lab-top-ports.xml
192.168.56.10,192.168.56.102,192.168.56.200,192.168.56.250

Target-Listen als Datei speichern

Wenn eine Target-Liste benötigt wird, die für jede IP eine seperate Zeile nutzt (z.B.: bei Verwendung von onesixtyone), kann die Option --list-file genutzt werden. Angenommen ein Nmap-Scan über UDP-Port 161 wurde in der Datei udp.xml gespeichert und es soll für onesixtyone eine Target-Liste mit allen Hosts erstellt werden, bei denen der Port offen ist. Dies ist mit folgendem Kommando möglich.

prompt$ parse-nmap.py -u 161 --list-file targetlist udp.xml

parse-nmap als Eingabe für nmap

Das folgende Beispiel nutzt parse-nmap als Input für nmap um einen vulnscan bei allen Windows Rechnern auf Port 445 durchzuführen.

prompt$ nmap -sV -p 445 --script=vuln --script-args=unsafe=1 $(parse-nmap.py -f Windows -t 445 --list lab-top-ports.xml)

parse-nmap.py

2016-05-03T10:20:00+02:00

Parse-nmap is a tool which parses nmap scan results (only XML) from a file. By using parse-nmap it is possible to filter the results by platform or ip. It is also possible to generate a target-list whith the resulting IPs or export the results as a LaTeX table (I used this feature to generate some tables for my OSCP-Report). In this post I will give you some examples to demonstrate the available options of parse-nmap. The script is available in my account on bitbucket.org.

For the following examples we assume that we run a nmap scan to scan the top rated TCP ports and perform a version scan on these ports. The results will be stored in a file called lab-top-ports.xml (see the first code example).

prompt$ nmap -sS -sV --top-ports 20 -oA lab-top-ports <IPs>

Display Options

brief list

The following example shows a brief list of all hosts in the specified nmap file. The first four lines display some information about the number of hosts in the file and the number of hosts after filtering. The brief output lists three colomns per host. The first column contains the IP, the second column contains the hostname (or localhost if the name is not available). The last column contains the OS String (if available).

prompt$ parse-nmap.py lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 6
# number of hosts after OS, IP and port filter: 6
192.168.56.10 localhost Microsoft Windows XP SP2 or SP3
192.168.56.101 localhost Linux 2.6.32 - 3.10
192.168.56.102 localhost Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8
192.168.56.103 localhost Linux 2.4.9 - 2.4.18 (likely embedded)
192.168.56.200 localhost Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8
192.168.56.250 localhost Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8

print-ports

If you want to know which ports are open you can use the parameter -p. This option displays the open ports for each host.

prompt$ parse-nmap.py -p lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 6
# number of hosts after OS, IP and port filter: 6
#===============================================================================
IP:     192.168.56.10
Hostname:   localhost
OS:     Microsoft Windows XP SP2 or SP3
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp microsoft-ds product: Microsoft Windows XP microsoft-ds ostype: Windows

#===============================================================================
IP:     192.168.56.101
Hostname:   localhost
OS:     Linux 2.6.32 - 3.10
#-------------------------------------------------------------------------------
22 tcp ssh product: OpenSSH version: 6.6.1 extrainfo: protocol 2.0
80 tcp http product: Apache httpd version: 2.4.6 extrainfo: (CentOS) PHP/5.4.16
8080 tcp tcpwrapped

Filter options

Filter open TCP and UDP ports

With parse-nmap it is possible to filter hosts by open TCP (Option -t or --tcp) or UDP (option -u or --udp) ports. The following example will only display ports with an open TCP port 22.

prompt$ parse-nmap.py -p -t 22 lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 6
# number of hosts after OS, IP and port filter: 2
#===============================================================================
IP:     192.168.56.101
Hostname:   localhost
OS:     Linux 2.6.32 - 3.10
#-------------------------------------------------------------------------------
22 tcp ssh product: OpenSSH version: 6.6.1 extrainfo: protocol 2.0
80 tcp http product: Apache httpd version: 2.4.6 extrainfo: (CentOS) PHP/5.4.16
8080 tcp tcpwrapped 

#===============================================================================
IP:     192.168.56.103
Hostname:   localhost
OS:     Linux 2.4.9 - 2.4.18 (likely embedded)
#-------------------------------------------------------------------------------
22 tcp ssh product: OpenSSH version: 3.1p1 extrainfo: protocol 1.99

Filter hosts by platform

In addition to the port filter it is possible to filter hosts by a specifiy platform, such as Windows or Linux. If you want to do this you need to the option -f or --os-familiy.

prompt$ parse-nmap.py -p -f Windows lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 6
# number of hosts after OS and IP filter: 4
# number of hosts after OS, IP and port filter: 4
#===============================================================================
IP:     192.168.56.10
Hostname:   localhost
OS:     Microsoft Windows XP SP2 or SP3
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp microsoft-ds product: Microsoft Windows XP microsoft-ds ostype: Windows

#===============================================================================
IP:     192.168.56.102
Hostname:   localhost
OS:     Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp netbios-ssn 
1025 tcp msrpc product: Microsoft Windows RPC ostype: Windows

...

Filter by IP

To filter hosts by IP yout can use the option -r.

prompt$ parse-nmap.py -p -r 192.168.56.10 lab-top-ports.xml
# number of hosts in the report: 6
# number of hosts after IP filter: 1
# number of hosts after OS and IP filter: 1
# number of hosts after OS, IP and port filter: 1
#===============================================================================
IP:     192.168.56.10
Hostname:   localhost
OS:     Microsoft Windows XP SP2 or SP3
#-------------------------------------------------------------------------------
135 tcp msrpc product: Microsoft Windows RPC ostype: Windows
139 tcp netbios-ssn 
445 tcp microsoft-ds product: Microsoft Windows XP microsoft-ds ostype: Windows

Using parse-nmap with other tools

generating target lists

You can use parse-nmap to generate target lists for use as input for other tools. The default delimiter is a space, but this can be changed by using option -d or --list-delimiter. The following examples show all hosts which are running a Windows OS with an open TCP port 445. The first one uses the default delimeter the second one uses the delimiter "," to separate the hosts.

prompt$ parse-nmap.py -f Windows -t 445 --list lab-top-ports.xml
192.168.56.10 192.168.56.102 192.168.56.200 192.168.56.250

prompt$ parse-nmap.py -f Windows -t 445 --list -d "," lab-top-ports.xml
192.168.56.10,192.168.56.102,192.168.56.200,192.168.56.250

write target lists to file

If you need the target list as file with one target per line (e.g. if you use onesixtyone), you can use option --list-file. We assume that you perfomed a namp scan for open UDP port 161 and want to generate a target file for onesixtyone. You can do this with the following command:

prompt$ parse-nmap.py -u 161 --list-file targetlist udp.xml

parse-nmap as input for nmap

The following example uses parse-nmap as input for nmap to perform a vulnscan on port 445 on all host which are running on a Windows platform.

prompt$ nmap -sV -p 445 --script=vuln --script-args=unsafe=1 $(parse-nmap.py -f Windows -t 445 --list lab-top-ports.xml)

winenum.py

2016-01-02T11:13:00+01:00

winenum ist ein Tool zur Automatisierung einiger Privilege Escalation Aufgaben. Inspieriert durch den Artikel Windows Privilege Escalation Fundamentals wurden einige dieser Kommandos mit Hilfe von winenum automatisiert. Da auf den meisten Windows-Systemen vermutlich kein Python-Interpreter verfügbar ist, kann mit Hilfe von pyinstaller eine exe erstellt werden, die dann auf einem Windows-System lauffähig ist. Ein Kompilieren einer solchen eigenständigen Anwendung mit pyinstaller, kann mit folgendem Befehl erfolgen:

pyinstaller winenum.py --onefile

Da alle Kommandos, die ausgeführt werden sollen, in Listen (default_cmds, wmic_cmds, password_cmds) gespeichert werden, lassen sich neue Kommandos einfach hinzufügen. Hierzu muss lediglich ein neuer Befehl als String in einer dieser Listen gespeichert werden.

# list of default commands which will always be executed
default_cmds = [
    "hostname",
    "systeminfo",
    "set",
    "arp -a",
    "ipconfig /all",
    "ipconfig /displaydns",
    "route print",
    "netstat -ano",
    "net user",
    ...
]

Kommandos in der Liste default_cmds werden immer ausgeführt, Kommandos aus den Listen wmic_cmds und password_cmds hingegen nur wenn der Nutzer dieses per Parameter aktiviert. Zum aktivieren der wmic_cmds können die Parameter -w oder --wmic-cmds und zur Aktivierung der password_cmds die Optionen -p oder --password-cmds genutzt werden. Sollen beide Aktiviert werden, kann dieses auch durch Angabe der Option -a bzw. --all-cmds geschehen. Die Option -f oder --file kann dazu genutzt werden eine Ausgabedatei zu spezifizieren, in der dann die Ausgeführten Kommandos und deren Ausgaben gespeichert werden.

Eine Ausführung des Tools könnte somit mit dem folgenden Kommandos erfolgen:

python winenum.py -a

Falls eine mit pyinstaller vorkompilierte Version der Datei vorliegt kann diese wie folgt gestartet werden.

winenum -a

VulnScan-OpenVAS Adapter

2015-11-05T13:00:00+01:00

VulnScan-OpenVAS

VulnScan-OpenVAS ist eine Java Bibliothek, die die vorgeschriebenen Methoden der VulnScan-API implementiert und somit einen einfachen Zugriff auf des OpenVAS Server gewährt. Die Sourcen zu dieser Bibliothek sind in meinem Account auf bitbucket.org zu finden. Selbiges gilt auch für die Abhängigkeiten in Form der Schnittstellen-Definitionen, der VulnScan-API und den gewrappten OpenVASClient. Diese Bibliotheken sowie ein Adapter für Nessus sind während eines Studien-Projekts entstanden.

Usage

Das erste Beispiel zeigt wie ein Client instantiiert und wie sich am Server authentisiert wird. Der Konstruktor nimmt drei Argumente an. Das Erste ist der Host des OpenVAS Servers, das Zweite ist der Port auf dem der Server lauscht. Der dritte Parameter ist das trustAll-Flag. Wenn dieses Flag gesetzt ist, wird ein TrustManager gesetzt der alle SSL-Zertifikate akzeptiert. Diese Option kann auf true gesetzt werden wenn der Server mit einem selbst signierten Zertifikat läuft. Anderen Falls sollte dieser Wert auf false gesetzt werden.

try {
    // create the Client 
    AbstractClient client = new OpenVASClient("127.0.0.1", 9390, true);
    // authenticate 
    client.login("testuser", "testuser");

    // now you can do some magic stuff with the client ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

Nach einer erfolgreichen Authentifizierung können weitere Methoden ausgeführt werden. Das nächste Beispiel zeigt die beispielhafte Verwendung der Methoden getScans(), getScanDetails(id), getScanStatus(id). Der Übersichtlichkeit geschuldet, wird in den folgenden Beispielen auf die Instantiierung und Authentifizierung verzichtet.

try {
    // create client and authenticate

    // get all availabe scans
    for (Scan s : client.getScans()){
        // Do something with the scan
        System.out.println(s); 
    }
    // Scan{id=c966cbad-cfc4-4629-a34b-567fda665e26, name=UNI-LAB, status=Done}
    // Scan{id=095dd09f-a958-4630-9df3-5172ebb36ae2, name=Windows 7 Scan, status=Stopped}
    // ...

    // you can also get the details of a scan, which contains the targets
    ScanDetails scanDetails = client.getScanDetails("095dd09f-a958-4630-9df3-5172ebb36ae2");
    System.out.println(scanDetails);
    // ScanDetails{id=c966cbad-cfc4-4629-a34b-567fda665e26, name=UNI-LAB, status=Done, targets=UNI-LAB}

    String status = client.getScanStatus("095dd09f-a958-4630-9df3-5172ebb36ae2");
    System.out.println(status);
    // Done
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

Weiterhin ist es möglich existierende Scans zu starten, stoppen, pausieren oder wieder aufzunehmen. Das folgende Beispiel zeigt die Verwendung der launch Methode, die dazu dient einen Scan zu starten.

try {
    // create client and authenticate ...

    // Start scan with id 095dd09f-a958-4630-9df3-5172ebb36ae2
    SString id = client.launch("095dd09f-a958-4630-9df3-5172ebb36ae2");

    // we can use the method *getScanStatus* to check the current state of the scan. 
    while(!"Done".equals(client.getScanStatus(id))){
        try {
        Thread.sleep(5000);
    } catch (InterruptedException ex) {
        // Handle Exception
    }
    }
    System.out.println("Scan completed");
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

Wenn ein Scan fertig ist können die während der Ausführung gefundenen Schwachstellen abgerufen werden. Um diese abzufragen kann die Methode getResults verwendet werden, die die ID des Scans als Parameter erwartet.

try {
    // create client and authenticate ...

    // get a list of vulnerabilities found by the scan
    List<Vulnerability> vulns = client.getResults("095dd09f-a958-4630-9df3-5172ebb36ae2");
    for (Vulnerability v : vulns){
        System.out.println(v); 
    }
    // ...
    // Vulnerability{id=4eba09e2-a65f-49d3-9742-3257a1c631de, name=Anonymous FTP Checking, severity=0.0, pluginId=1.3.6.1.4.1.25623.1.0.900600}
    // Vulnerability{id=bec429e9-62d7-4c51-ad07-487cb0dcdcb2, name=Apache 'mod_deflate' Denial Of Service Vulnerability - July09, severity=7.1, pluginId=1.3.6.1.4.1.25623.1.0.800837}
    // Vulnerability{id=3f800da3-030f-4326-be38-e02d6561bc73, name=Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux), severity=7.5, pluginId=1.3.6.1.4.1.25623.1.0.900842}
    // ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

If the scan contains more than one target host you can use the method getResultByHost to get a list of vulnerabilities for each host. The result of this method is a map with the host as key an a list of vulnerabilities as value.

try {
    // create client and authenticate ...

    // get a list of vulnerabilities sorted by hosts
    Map<String, List<Vulnerability>> resultsByHost = client.getResultsByHost("095dd09f-a958-4630-9df3-5172ebb36ae2");
    for (String host : resultsByHost.keySet()){
        List<Vulnerability> hostVulns = resultsByHost.get(host);
        for (Vulnerability v : hostVulns){
            System.out.println("Host: " + host + " => " + v);
        }
    }
    // Host: 192.168.56.101 => Vulnerability{id=107bd163-27c7-4cd5-b90f-5eaf43167213, name=vsftpd Compromised Source Packages Backdoor Vulnerability, severity=7.5, pluginId=1.3.6.1.4.1.25623.1.0.103185}
    // Host: 192.168.56.101 => Vulnerability{id=72433449-cc58-4a36-9bec-5d2fe3a252e5, name=vsftpd Compromised Source Packages Backdoor Vulnerability, severity=7.5, pluginId=1.3.6.1.4.1.25623.1.0.103185}
    // Host: 192.168.56.101 => Vulnerability{id=d19d393a-22fd-4b03-a4ef-7e9df984cdc5, name=wapiti (NASL wrapper), severity=0.0, pluginId=1.3.6.1.4.1.25623.1.0.80110}

} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

To get more detailed about a vulnerability you can get information about the plugin which found it. To get the information about a plugin you have to use the method getPlugin which needs an id of the plugin.

try {
    // ...

    // Abrufen der Informationen zu einem Plugin
    Plugin plugin = client.getPlugin("1.3.6.1.4.1.25623.1.0.80110");
    System.out.println(plugin);
    //  Plugin{id=1.3.6.1.4.1.25623.1.0.80110, name=wapiti (NASL wrapper), family=Web application abuses, cvss=null, description=NOSUMMARY, references=[]}
} catch(SessionException ex){ 
    // fehlerhafter Login
} catch (ClientException ex) { 
    // Anderer Fehler bei der Kommunikation mit dem Server
}

VulnScan-OpenVAS Adapter

2015-11-05T13:00:00+01:00

VulnScan-OpenVAS

VulnScan-OpenVAS is a Java library, which implements the VulnScan-API to provide a common and simple way to use some features of OpenVAS in a Java-Application. The sources are available in my account on bitbucket.org. The necesary dependencies are also available in my bitbucket account. The dependencies are the VulnScan-API und the wrapped OpenVASClient. This library and the adapter for Nessus were developed during an academic studies project.

Usage

The first example shows how to create the client and authenticate to the server. The constructor takes three parameters. The first one is the host of the OpenVAS server, the second one is the port the server is listen to. The last parameter is the trustAll flag. This flag is used to set a TrustManager which accepts all SSL certificates. You can set this flag to true if your server runs with a self signed certificate. Otherwise you should set it to false.

try {
    // create the Client 
    AbstractClient client = new OpenVASClient("127.0.0.1", 9390, true);
    // authenticate 
    client.login("testuser", "testuser");

    // now you can do some magic stuff with the client ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

After you are authenticated you can execute other methods. The next example shows the usage of getScans(), getScanDetails(id), getScanStatus(id).

try {
    // create client and authenticate

    // get all availabe scans
    for (Scan s : client.getScans()){
        // Do something with the scan
        System.out.println(s); 
    }
    // Scan{id=c966cbad-cfc4-4629-a34b-567fda665e26, name=UNI-LAB, status=Done}
    // Scan{id=095dd09f-a958-4630-9df3-5172ebb36ae2, name=Windows 7 Scan, status=Stopped}
    // ...

    // you can also get the details of a scan, which contains the targets
    ScanDetails scanDetails = client.getScanDetails("095dd09f-a958-4630-9df3-5172ebb36ae2");
    System.out.println(scanDetails);
    // ScanDetails{id=c966cbad-cfc4-4629-a34b-567fda665e26, name=UNI-LAB, status=Done, targets=UNI-LAB}

    String status = client.getScanStatus("095dd09f-a958-4630-9df3-5172ebb36ae2");
    System.out.println(status);
    // Done
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

It is possible to start, stop, pause or resume existing scans. The following example shows the usage of the launch method, which is used to start a scan.

try {
    // create client and authenticate ...

    // Start scan with id 095dd09f-a958-4630-9df3-5172ebb36ae2
    SString id = client.launch("095dd09f-a958-4630-9df3-5172ebb36ae2");

    // we can use the method *getScanStatus* to check the current state of the scan. 
    while(!"Done".equals(client.getScanStatus(id))){
        try {
        Thread.sleep(5000);
    } catch (InterruptedException ex) {
        // Handle Exception
    }
    }
    System.out.println("Scan completed");
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

If the scan is completed you can get a list of vulnerabilities which were found during the execution of the scan. To request this list you have to use the method getResults which requires the scan id as parameter.

try {
    // create client and authenticate ...

    // get a list of vulnerabilities found by the scan
    List<Vulnerability> vulns = client.getResults("095dd09f-a958-4630-9df3-5172ebb36ae2");
    for (Vulnerability v : vulns){
        System.out.println(v); 
    }
    // ...
    // Vulnerability{id=4b519e0e-3d75-4a6b-ade7-a73c88757e34, name=/doc directory browsable ?, severity=5.0, pluginId=1.3.6.1.4.1.25623.1.0.10056}
    // Vulnerability{id=4eba09e2-a65f-49d3-9742-3257a1c631de, name=Anonymous FTP Checking, severity=0.0, pluginId=1.3.6.1.4.1.25623.1.0.900600}
    // Vulnerability{id=bec429e9-62d7-4c51-ad07-487cb0dcdcb2, name=Apache 'mod_deflate' Denial Of Service Vulnerability - July09, severity=7.1, pluginId=1.3.6.1.4.1.25623.1.0.800837}
    // Vulnerability{id=3f800da3-030f-4326-be38-e02d6561bc73, name=Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux), severity=7.5, pluginId=1.3.6.1.4.1.25623.1.0.900842}

    // ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate ...

    // get a list of vulnerabilities sorted by hosts
    Map<String, List<Vulnerability>> resultsByHost = client.getResultsByHost("095dd09f-a958-4630-9df3-5172ebb36ae2");
    for (String host : resultsByHost.keySet()){
        List<Vulnerability> hostVulns = resultsByHost.get(host);
        for (Vulnerability v : hostVulns){
            System.out.println("Host: " + host + " => " + v);
        }
    }
    // Host: 192.168.56.101 => Vulnerability{id=107bd163-27c7-4cd5-b90f-5eaf43167213, name=vsftpd Compromised Source Packages Backdoor Vulnerability, severity=7.5, pluginId=1.3.6.1.4.1.25623.1.0.103185}
    // Host: 192.168.56.101 => Vulnerability{id=72433449-cc58-4a36-9bec-5d2fe3a252e5, name=vsftpd Compromised Source Packages Backdoor Vulnerability, severity=7.5, pluginId=1.3.6.1.4.1.25623.1.0.103185}
    // Host: 192.168.56.101 => Vulnerability{id=d19d393a-22fd-4b03-a4ef-7e9df984cdc5, name=wapiti (NASL wrapper), severity=0.0, pluginId=1.3.6.1.4.1.25623.1.0.80110}

} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // ...

    // Abrufen der Informationen zu einem Plugin
    Plugin plugin = client.getPlugin("1.3.6.1.4.1.25623.1.0.80110");
    System.out.println(plugin);
    //  Plugin{id=1.3.6.1.4.1.25623.1.0.80110, name=wapiti (NASL wrapper), family=Web application abuses, cvss=null, description=NOSUMMARY, references=[]}
} catch(SessionException ex){ 
    // fehlerhafter Login
} catch (ClientException ex) { 
    // Anderer Fehler bei der Kommunikation mit dem Server
}

VulnScan-Nessus Adapter

2015-11-03T10:20:00+01:00

VulnScan-Nessus

VulnScan-Nessus ist eine Java Bibliothek, die die vorgeschriebenen Methoden der VulnScan-API implementiert und somit einen einfachen Zugriff auf des Nessus Server gewährt. Die Sourcen zu dieser Bibliothek sind in meinem Account auf bitbucket.org zu finden. Selbiges gilt auch für die Abhängigkeiten in Form der Schnittstellen-Definitionen, der VulnScan-API und den gewrappten NessusClient. Diese Bibliotheken sowie ein Adapter für OpenVAS sind während eines Studien-Projekts entstanden.

Usage

Das erste Beispiel zeigt wie ein Client instantiiert und wie sich am Server authentisiert wird. Der Konstruktor nimmt drei Argumente an. Das Erste ist der Host des Nessus Servers, das Zweite ist der Port auf dem der Server lauscht. Der dritte Parameter ist das trustAll-Flag. Wenn dieses Flag gesetzt ist, wird ein TrustManager gesetzt der alle SSL-Zertifikate akzeptiert. Diese Option kann auf true gesetzt werden wenn der Server mit einem selbst signierten Zertifikat läuft. Anderen Falls sollte dieser Wert auf false gesetzt werden.

try {
    // create the Client 
    AbstractClient client = new NessusClient("127.0.0.1", 8834, true);
    // authenticate 
    client.login("testuser", "testuser");

    // now you can do some magic stuff with the client ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate

    // get all availabe scans
    for (Scan s : client.getScans()){
        // Do something with the scan
        System.out.println(s); 
    }
    // Scan{id=110, name=XP_Basic, status=canceled}
    // Scan{id=209, name=UNI-LAB, status=completed}
    // ...

    // you can also get the details of a scan, which contains the targets
    ScanDetails scanDetails = client.getScanDetails("209");
    System.out.println(scanDetails);
    // ScanDetails{id=209, name=UNI-LAB, status=completed, targets=192.168.56.10,192.168.56.11,192.168.56.101,192.168.56.200,192.168.56.250.}

    String status = client.getScanStatus("209");
    System.out.println(status);
    // completed
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate ...

    // Start scan with id 110
    String id = client.launch("110");

    // we can use the method *getScanStatus* to check the current state of the scan. 
    while(!"completed".equals(client.getScanStatus(id))){
        try {
            Thread.sleep(5000);
        } catch (InterruptedException ex) {
            // Handle Exception
        }
    }
    System.out.println("Scan completed");
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate ...

    // get a list of vulnerabilities found by the scan
    List<Vulnerability> vulns = client.getResults("209");
    for (Vulnerability v : vulns){
        System.out.println(v); 
    }
    // ...
    // Vulnerability{id=42263, name=Unencrypted Telnet Server, severity=Medium, pluginId=42263}
    // ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate ...

    // get a list of vulnerabilities sorted by hosts
    Map<String, List<Vulnerability>> resultsByHost = client.getResultsByHost("209");
    for (String host : resultsByHost.keySet()){
        List<Vulnerability> hostVulns = resultsByHost.get(host);
        for (Vulnerability v : hostVulns){
            System.out.println("Host: " + host + " => " + v);
        }
    }
    // ...
    // Host: 192.168.56.11 => Vulnerability{id=11936, name=OS Identification, severity=High, pluginId=11936}
    // ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // ...

    // Abrufen der Informationen zu einem Plugin
    Plugin plugin = client.getPlugin("35362");
    System.out.println(plugin);
    //  Plugin{id=35362, name=MS09-001: Microsoft Windows SMB Vulnerabilities Remote Code Execution (958687) (uncredentialed check), family=Windows, cvss=10.0, description=, references=[Reference{type=CVE, reference=CVE-2008-4834}, Reference{type=CVE, reference=CVE-2008-4835}, Reference{type=CVE, reference=CVE-2008-4114}, Reference{type=XREF, reference=OSVDB:48153}, Reference{type=OSVDB, reference=48153}, Reference{type=XREF, reference=OSVDB:52691}, Reference{type=OSVDB, reference=52691}, Reference{type=XREF, reference=OSVDB:52692}, Reference{type=OSVDB, reference=52692}, Reference{type=XREF, reference=MSFT:MS09-001}, Reference{type=XREF, reference=CWE:399}, Reference{type=XREF, reference=CWE:399}]}
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

VulnScan-Nessus Adapter

2015-11-03T10:20:00+01:00

VulnScan-Nessus

VulnScan-Nessus is a Java library, which implements the VulnScan-API to provide a common and simple way to use some features of Nessus in a Java-Application. The sources are available in my account on bitbucket.org. The necesary dependencies are also available in my bitbucket account. The dependencies are the VulnScan-API und the wrapped NessusClient. This library and the adapter for OpenVAS were developed during an academic studies project.

Usage

The first example shows how to create the client and authenticate to the server. The constructor takes three parameters. The first one is the host of the Nessus server, the second one is the port the server is listen to. The last parameter is the trustAll flag. This flag is used to set a TrustManager which accepts all SSL certificates. You can set this flag to true if your server runs with a self signed certificate. Otherwise you should set it to false.

try {
    // create the Client 
    AbstractClient client = new NessusClient("127.0.0.1", 8834, true);
    // authenticate 
    client.login("testuser", "testuser");

    // now you can do some magic stuff with the client ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

After you are authenticated you can execute other methods. The next example shows the usage of getScans(), getScanDetails(id), getScanStatus(id).

try {
    // create client and authenticate

    // get all availabe scans
    for (Scan s : client.getScans()){
        // Do something with the scan
        System.out.println(s); 
    }
    // Scan{id=110, name=XP_Basic, status=canceled}
    // Scan{id=209, name=UNI-LAB, status=completed}
    // ...

    // you can also get the details of a scan, which contains the targets
    ScanDetails scanDetails = client.getScanDetails("209");
    System.out.println(scanDetails);
    // ScanDetails{id=209, name=UNI-LAB, status=completed, targets=192.168.56.10,192.168.56.11,192.168.56.101,192.168.56.200,192.168.56.250.}

    String status = client.getScanStatus("209");
    System.out.println(status);
    // completed
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

It is possible to start, stop, pause or resume existing scans. The following example shows the usage of the launch method, which is used to start a scan.

try {
    // create client and authenticate ...

    // Start scan with id 110
    String id = client.launch("110");

    // we can use the method *getScanStatus* to check the current state of the scan. 
    while(!"completed".equals(client.getScanStatus(id))){
        try {
            Thread.sleep(5000);
        } catch (InterruptedException ex) {
            // Handle Exception
        }
    }
    System.out.println("Scan completed");
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate ...

    // get a list of vulnerabilities found by the scan
    List<Vulnerability> vulns = client.getResults("209");
    for (Vulnerability v : vulns){
        System.out.println(v); 
    }
    // ...
    // Vulnerability{id=42263, name=Unencrypted Telnet Server, severity=Medium, pluginId=42263}
    // ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // create client and authenticate ...

    // get a list of vulnerabilities sorted by hosts
    Map<String, List<Vulnerability>> resultsByHost = client.getResultsByHost("209");
    for (String host : resultsByHost.keySet()){
        List<Vulnerability> hostVulns = resultsByHost.get(host);
        for (Vulnerability v : hostVulns){
            System.out.println("Host: " + host + " => " + v);
        }
    }
    // ...
    // Host: 192.168.56.11 => Vulnerability{id=11936, name=OS Identification, severity=High, pluginId=11936}
    // ...
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}

try {
    // ...

    // Abrufen der Informationen zu einem Plugin
    Plugin plugin = client.getPlugin("35362");
    System.out.println(plugin);
    //  Plugin{id=35362, name=MS09-001: Microsoft Windows SMB Vulnerabilities Remote Code Execution (958687) (uncredentialed check), family=Windows, cvss=10.0, description=, references=[Reference{type=CVE, reference=CVE-2008-4834}, Reference{type=CVE, reference=CVE-2008-4835}, Reference{type=CVE, reference=CVE-2008-4114}, Reference{type=XREF, reference=OSVDB:48153}, Reference{type=OSVDB, reference=48153}, Reference{type=XREF, reference=OSVDB:52691}, Reference{type=OSVDB, reference=52691}, Reference{type=XREF, reference=OSVDB:52692}, Reference{type=OSVDB, reference=52692}, Reference{type=XREF, reference=MSFT:MS09-001}, Reference{type=XREF, reference=CWE:399}, Reference{type=XREF, reference=CWE:399}]}
} catch(SessionException ex){ 
    // login wasn't successful
} catch (ClientException ex) { 
    // any other error during the communication with the Server
}