Comparing Common Vulnerability Result Sets

One of the major things I've been working on is bring together vulnerability result information. I found that it was a major pain in ass to be able to remove duplicate entries from result sets. I was finally able to come up with listing for based on CVE / BID tracking numbers:

An example corresponding file could be something like this

Tenable Nessus 3.0 - to - Harris Guardian Scanner [download txt]

Just extracting Nessus Information can be a huge problem. Because of the lack of structure within the nasl scripting language, there are many many variations on the output generated by the plugins. I've made some additional changes to an old tool.

nessus_extract.pl (version 1.7) [download perl]

I added pipes into the fray, generating a recursive style csv to separate BID and CVE numbers as well as a more robust double-quote word qualifier.

One huge help is the Open Source Vulnerability Data Base (osvdb) which has come a long way.

Dirty Listing of Nessus Dangerous Plugins

Tenable Nessus .. needed dangerous plugins descriptions

cd \progra~1\tenable\nessus\plugins\scripts\
egrep -l egrep -l "(ACT_DESTRUCT|ACT_DENIAL)" *.nasl>c:\temp\dangerous_list.txt

Quick vbs file..
Copy files from list in files to temp.

Dim objFileSystem, objInputFile, fso, aFile, afilename
Dim strInputFile, inputData, strData, strListFile, i

Const OPEN_FILE_FOR_READING = 1

' generate a filename base on the script name, here readfile.in
strListFile = "c:\temp\dangerous_list.txt"

Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objInputFile = objFileSystem.OpenTextFile(strListFile, OPEN_FILE_FOR_READING)

' read everything in an array
afilename = "c:\progra~1\tenable\nessus\plugins\scripts\"

Do While Not objInputFile.AtEndOfStream
Dim Line
Line = objInputFile.readline
' Do something with "Line"
Set fso = CreateObject("Scripting.FileSystemObject")
Set aFile = fso.GetFile(afilename & trim(Line))
aFile.Copy("c:\temp\scripts\" & trim(Line))
Set aFile = Nothing
Set fso = Nothing
Loop

objInputFile.Close
Set objFileSystem = Nothing

WSCRIPT.QUIT(0)

Grab nessus extract tool via wget
Dump info to file .. done.

wget http://cvsweb.nessus.org/cgi-bin/viewcvs.cgi/
*checkout*/nessus-tools/nessus-extract/
nessus-extract.pl?rev=1.4.2.10&content-type=text/plain

perl nessus_extract.pl -p "c:\temp\scripts" >c:\temp\Dangerous_Plugins.txt