-
Notifications
You must be signed in to change notification settings - Fork 100
/
nesd.go
101 lines (84 loc) · 2.23 KB
/
nesd.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
// Copyright (c) 2018 PT Defender Nusa Semesta and contributors, All rights reserved.
//
// This file is part of Dsiem.
//
// Dsiem is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation version 3 of the License.
//
// Dsiem is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Dsiem. If not, see <https://www.gnu.org/licenses/>.
package nesd
import (
"context"
"encoding/json"
"io"
"net/http"
"strconv"
"strings"
"github.com/defenxor/dsiem/pkg/vuln"
)
func init() {
vuln.RegisterExtension(new(Nesd), "Nesd")
}
// Config defins
type Config struct {
URL string `json:"url"`
}
type nesdResult struct {
Cve string `json:"cve"`
Risk string `json:"risk"`
Name string `json:"name"`
}
// Initialize implement iface
func (n *Nesd) Initialize(b []byte) error {
return json.Unmarshal(b, &n.Cfg)
}
// Nesd is a vuln plugin
type Nesd struct {
Cfg Config `json:"cfg"`
}
// CheckIPPort implement iface
func (n Nesd) CheckIPPort(ctx context.Context, ip string, port int) (found bool, results []vuln.Result, err error) {
url := strings.Replace(n.Cfg.URL, "${ip}", ip, 1)
url = strings.Replace(url, "${port}", strconv.Itoa(port), 1)
c := http.Client{}
req, _ := http.NewRequest(http.MethodGet, url, nil)
req = req.WithContext(ctx)
res, err := c.Do(req)
if err != nil {
return
}
body, err := io.ReadAll(res.Body)
if err != nil {
return
}
defer res.Body.Close()
str := string(body)
if str == "no vulnerability found\n" {
return
}
var result = []nesdResult{}
err = json.Unmarshal([]byte(str), &result)
if err != nil {
return
}
for _, v := range result {
if v.Risk != "Medium" && v.Risk != "High" && v.Risk != "Critical" {
continue
}
s := v.Risk + " - " + v.Name
if v.Cve != "" {
s = s + " (" + v.Cve + ")"
}
term := ip + ":" + strconv.Itoa(port)
results = append(results, vuln.Result{Provider: "Nesd", Term: term, Result: s})
found = true
}
return
}