Add support for Invicti parser through Netsparker (#10894)

* Add support for Invicti parser through Netsparker * update settings sha * Rename unit test files * Update docs/content/en/integrations/parsers/file/netsparker.md Co-authored-by: Charles Neill <[email protected]> --------- Co-authored-by: Charles Neill <[email protected]>
DefectDojo · Sep 16, 2024 · 5d2e728 · 5d2e728
1 parent 885029c
commit 5d2e728
Show file tree

Hide file tree

Showing 12 changed files with 5,255 additions and 1 deletion.
diff --git a/docs/content/en/integrations/parsers/file/invicti.md b/docs/content/en/integrations/parsers/file/invicti.md
@@ -0,0 +1,9 @@
+---
+title: "Invicti"
+toc_hide: true
+---
+Vulnerabilities List - JSON report
+
+### Sample Scan Data
+
+Sample Invicti scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/invicti).
diff --git a/docs/content/en/integrations/parsers/file/netsparker.md b/docs/content/en/integrations/parsers/file/netsparker.md
@@ -4,5 +4,8 @@ toc_hide: true
 ---
 Vulnerabilities List - JSON report
 
+[Netsparker has now become Invicti](https://www.invicti.com/blog/news/netsparker-is-now-invicti-signaling-a-new-era-for-modern-appsec/). Please plan to migrate automation scripts to use the [Invicti Scan](../invicti.md)
+
 ### Sample Scan Data
+
 Sample Netsparker scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/netsparker).
diff --git a/dojo/settings/.settings.dist.py.sha256sum b/dojo/settings/.settings.dist.py.sha256sum
@@ -1 +1 @@
-5adedc433a342d675492b86dc18786f72e167115f9718a397dc9b91c5fdc9c94
+1a74292fc58b2bd05c763c8c126b0b35888e2a6f8ef9ab2588bb6c8589987c9c
diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py
@@ -1279,6 +1279,7 @@ def saml2_attrib_map_format(dict):
     "AppCheck Web Application Scanner": ["title", "severity"],
     "Legitify Scan": ["title", "endpoints", "severity"],
     "ThreatComposer Scan": ["title", "description"],
+    "Invicti Scan": ["title", "description", "severity"],
 }
 
 # Override the hardcoded settings here via the env var
@@ -1503,6 +1504,7 @@ def saml2_attrib_map_format(dict):
     "AppCheck Web Application Scanner": DEDUPE_ALGO_HASH_CODE,
     "Legitify Scan": DEDUPE_ALGO_HASH_CODE,
     "ThreatComposer Scan": DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE,
+    "Invicti Scan": DEDUPE_ALGO_HASH_CODE,
 }
 
 # Override the hardcoded settings here via the env var

diff --git a/dojo/tools/invicti/__init__.py b/dojo/tools/invicti/__init__.py
diff --git a/dojo/tools/invicti/parser.py b/dojo/tools/invicti/parser.py
@@ -0,0 +1,20 @@
+from dojo.tools.netsparker.parser import NetsparkerParser
+
+
+class InvictiParser(NetsparkerParser):
+    def get_scan_types(self):
+        return ["Invicti Scan"]
+
+    def get_label_for_scan_types(self, scan_type):
+        return "Invicti Scan"
+
+    def get_description_for_scan_types(self, scan_type):
+        return "Invicti JSON format."
+
+    def get_findings(self, filename, test):
+        """Extended the NetSparker Parser since the Invicti is the a renamed version of Netsparker.
+
+        If there are deviations from the two report formats in the future, then this
+        function can be implemented then.
+        """
+        return super().get_findings(filename, test)
diff --git a/unittests/scans/invicti/invicti_many_findings.json b/unittests/scans/invicti/invicti_many_findings.json
diff --git a/unittests/scans/invicti/invicti_one_finding.json b/unittests/scans/invicti/invicti_one_finding.json
@@ -0,0 +1,85 @@
+{
+  "Generated": "25/06/2021 09:59 AM",
+  "Target": {
+    "Duration": "00:00:41.3968969",
+    "Initiated": "25/06/2021 09:53 AM",
+    "ScanId": "663eb6e88d9e4f4d9e00ad52017aa66d",
+    "Url": "http://php.testsparker.com/"
+  },
+  "Vulnerabilities": [
+    {
+      "Certainty": 100,
+      "Classification": {
+        "Iso27001": "A.14.2.5",
+        "Capec": "107",
+        "Cvss": {
+          "BaseScore": {
+            "Severity": 2,
+            "Type": "Base",
+            "Value": "5.7"
+          },
+          "EnvironmentalScore": {
+            "Severity": 2,
+            "Type": "Environmental",
+            "Value": "5.5"
+          },
+          "TemporalScore": {
+            "Severity": 2,
+            "Type": "Temporal",
+            "Value": "5.5"
+          },
+          "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C"
+        },
+        "Cvss31": null,
+        "Cwe": "16",
+        "Hipaa": "",
+        "Owasp": "A5",
+        "OwaspProactiveControls": "",
+        "Pci32": "",
+        "Wasc": "15"
+      },
+      "Confirmed": true,
+      "Description": "<p>Netsparker Enterprise identified a cookie not marked as HTTPOnly.</p>\n<p>HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.</p>",
+      "ExploitationSkills": "",
+      "ExternalReferences": "<div><ul><li><a target='_blank' href='https://www.netsparker.com/security-cookies-whitepaper/#httpOnlyFlag'><i class='icon-external-link'></i>Netsparker - Security Cookies - HTTPOnly Flag</a></li><li><a target='_blank' href='https://wiki.owasp.org/index.php/HttpOnly'><i class='icon-external-link'></i>OWASP HTTPOnly Cookies</a></li><li><a target='_blank' href='https://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly%28VS.80%29.aspx'><i class='icon-external-link'></i>MSDN - ASP.NET HTTPOnly Cookies</a></li></ul></div>",
+      "ExtraInformation": [
+        {
+          "Name": "Identified Cookie(s)",
+          "Value": "PHPSESSID"
+        },
+        {
+          "Name": "Cookie Source",
+          "Value": "HTTP Header"
+        },
+        {
+          "Name": "Page Type",
+          "Value": "Login"
+        }
+      ],
+      "FirstSeenDate": "16/06/2021 12:30 PM",
+      "HttpRequest": {
+        "Content": "GET /auth/login.php HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nReferer: http://php.testsparker.com/auth/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n",
+        "Method": "GET",
+        "Parameters": []
+      },
+      "HttpResponse": {
+        "Content": "HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d; path=/\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nContent-Length: 3061\r\nX-Powered-By: PHP/5.2.6\r\nPragma: no-cache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT<!-- end #footer -->\n</body>\n</html>\n",
+        "Duration": 41.4849,
+        "StatusCode": 200
+      },
+      "LookupId": "735f4503-e9eb-4b4c-4306-ad49020a4c4b",
+      "Impact": "<div>During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.</div>",
+      "KnownVulnerabilities": [],
+      "LastSeenDate": "25/06/2021 01:52 AM",
+      "Name": "Cookie Not Marked as HttpOnly",
+      "ProofOfConcept": "",
+      "RemedialActions": "<div>\n<ol>\n<li>See the remedy for solution.</li>\n<li>Consider marking all of the cookies used by the application as HTTPOnly. (<em>After these changes javascript code will not be able to read cookies.</em>)</li>\n</ol>\n</div>",
+      "RemedialProcedure": "<div>Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as <a href=\"https://labs.portcullis.co.uk/tools/xss-tunnel/\">XSS Tunnel</a> to bypass HTTPOnly protection.</div>",
+      "RemedyReferences": "",
+      "Severity": "Medium",
+      "State": "Present",
+      "Type": "CookieNotMarkedAsHttpOnly",
+      "Url": "http://php.testsparker.com/auth/login.php"
+    }
+  ]
+}
diff --git a/unittests/scans/invicti/invicti_zero_finding.json b/unittests/scans/invicti/invicti_zero_finding.json
@@ -0,0 +1,10 @@
+{
+  "Generated": "25/06/2021 09:57 AM",
+  "Target": {
+    "Duration": "00:01:16.6130466",
+    "Initiated": "25/06/2021 01:42 AM",
+    "ScanId": "0a110f61b1f949ff30c8ad5104dfd9f5",
+    "Url": "http://php.testsparker.com/"
+  },
+  "Vulnerabilities": []
+}
diff --git a/unittests/scans/invicti/issue_10311.json b/unittests/scans/invicti/issue_10311.json
@@ -0,0 +1,173 @@
+{
+	"Generated": "03/02/2019 15:50:29 (UTC-06:00)",
+	"Target": {
+		"ScanId": "fg49hk5",
+		"Url": "https://www.sampleweb.org/",
+		"Initiated": "03/02/2019 15:48:23 (UTC-06:00)",
+		"Duration": "00:01:20.4322725"
+	},
+	"Vulnerabilities": [
+		{
+			"Url": "https://www.sampleweb.org/",
+			"Type": "CookieNotMarkedAsSecure",
+			"Name": "Cookie Not Marked as Secure",
+			"Severity": "High",
+			"Certainty": 100,
+			"Confirmed": true,
+			"Classification": {
+				"Owasp": "A6",
+				"Owasp2017": "A3",
+				"Wasc": "15",
+				"Cwe": "614",
+				"Capec": "102",
+				"Pci31": "6.5.10",
+				"Pci32": "6.5.10",
+				"Hipaa": null
+			},
+			"HttpRequest": {
+				"Method": "GET",
+				"Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n",
+				"Parameters": [ ]
+			},
+			"HttpResponse": {
+				"StatusCode": 200,
+				"Duration": 644.6389,
+				"Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n"
+			},
+			"ExtraInformation": [
+				{
+					"Name": "Identified Cookie(s)",
+					"Value": "cookieconsent_status"
+				},
+				{
+					"Name": "Cookie Source",
+					"Value": "JavaScript"
+				}
+			],
+			"KnownVulnerabilities": [ ],
+			"Description": "<p>Netsparker identified a cookie not marked as secure, and transmitted over HTTPS.</p><p>This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic, or following a successful man-in-the-middle attack.</p>",
+			"Impact": "<div>This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (<em>such as a session cookie</em>), an attacker might intercept it and hijack a victim's session. If the attacker can carry out a man-in-the-middle attack, he/she can force the victim to make an HTTP request to steal the cookie.</div>",
+			"RemedialActions": "<div><ol><li>See the remedy for solution.</li><li>Mark all cookies used within the application as secure. <em>(If the cookie is not related to authentication or does not carry any personal information, you do not have to mark it as secure.)</em></li></ol></div>",
+			"ExploitationSkills": "<div>To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or to the victim's network. Attackers need to be understand layer 2, have physical access to systems either as waypoints for the traffic, or have locally gained access to to a system between the victim and the web server.</div>",
+			"RemedialProcedure": "<div>Mark all cookies used within the application as secure.</div>",
+			"RemedyReferences": "",
+			"ExternalReferences": "<div><ul><li><a href='https://msdn.microsoft.com/en-us/library/system.net.cookie.secure.aspx'>.NET Cookie.Secure Property</a></li><li><a href='http://blog.teamtreehouse.com/how-to-create-totally-secure-cookies'>How to Create Totally Secure Cookies</a></li></ul></div>",
+			"ProofOfConcept": ""
+		},
+		{
+			"Url": "https://www.sampleweb.org/",
+			"Type": "BootstrapjsOutOfDate",
+			"Name": "Out-of-date Version (Bootstrap)",
+			"Severity": "Medium",
+			"Certainty": 90,
+			"Confirmed": false,
+			"Classification": {
+				"Owasp": "A9",
+				"Owasp2017": "A9",
+				"Wasc": null,
+				"Cwe": null,
+				"Capec": "310",
+				"Pci31": "6.2",
+				"Pci32": "6.2",
+				"Hipaa": null
+			},
+			"HttpRequest": {
+				"Method": "GET",
+				"Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n",
+				"Parameters": [ ]
+			},
+			"HttpResponse": {
+				"StatusCode": 200,
+				"Duration": 644.6389,
+				"Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n"
+			},
+			"ExtraInformation": [
+				{
+					"Name": "Identified Version",
+					"Value": "4.0.0"
+				},
+				{
+					"Name": "Latest Version",
+					"Value": "4.3.1"
+				},
+				{
+					"Name": "Vulnerability Database",
+					"Value": "Result is based on 3/1/2019 vulnerability database content."
+				}
+			],
+			"KnownVulnerabilities": [
+				{
+					"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
+					"Severity": "Medium"
+				},
+				{
+					"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
+					"Severity": "Medium"
+				},
+				{
+					"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
+					"Severity": "Medium"
+				},
+				{
+					"Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability",
+					"Severity": "Medium"
+				}
+			],
+			"Description": "<p>Netsparker identified that the target web site is using Bootstrap and detected that it is out of date.</p>",
+			"Impact": "<div>Since this is an old version of the software, it may be vulnerable to attacks.</div>",
+			"RemedialActions": "",
+			"ExploitationSkills": "",
+			"RemedialProcedure": "<div>\n<p>Please upgrade your installation of Bootstrap to the latest stable version.</p>\n</div>",
+			"RemedyReferences": "<div><ul><li><a href='https://getbootstrap.com/'>Downloading Bootstrap</a></li></ul></div>",
+			"ExternalReferences": "",
+			"ProofOfConcept": ""
+		},
+		{
+			"Url": "https://www.sampleweb.org/",
+			"Type": "CookieNotMarkedAsHttpOnly",
+			"Name": "Cookie Not Marked as HttpOnly",
+			"Severity": "Low",
+			"Certainty": 100,
+			"Confirmed": true,
+			"Classification": {
+				"Owasp": "A5",
+				"Owasp2017": "A6",
+				"Wasc": "15",
+				"Cwe": "16",
+				"Capec": "107",
+				"Pci31": null,
+				"Pci32": null,
+				"Hipaa": null
+			},
+			"HttpRequest": {
+				"Method": "GET",
+				"Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n",
+				"Parameters": [ ]
+			},
+			"HttpResponse": {
+				"StatusCode": 200,
+				"Duration": 644.6389,
+				"Content": null
+			},
+			"ExtraInformation": [
+				{
+					"Name": "Identified Cookie(s)",
+					"Value": "cookieconsent_status"
+				},
+				{
+					"Name": "Cookie Source",
+					"Value": "JavaScript"
+				}
+			],
+			"KnownVulnerabilities": [ ],
+			"Description": "<p>Netsparker identified a cookie not marked as HTTPOnly.</p><p>HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.</p>",
+			"Impact": "<div>During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.</div>",
+			"RemedialActions": "<div><ol><li>See the remedy for solution.</li><li>Consider marking all of the cookies used by the application as HTTPOnly. (<em>After these changes javascript code will not be able to read cookies.</em>)</li></ol></div>",
+			"ExploitationSkills": "",
+			"RemedialProcedure": "<div>Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as <a href=\"https://labs.portcullis.co.uk/tools/xss-tunnel/\" data-mce-href=\"https://labs.portcullis.co.uk/tools/xss-tunnel/\">XSS Tunnel</a> to bypass HTTPOnly protection.</div>",
+			"RemedyReferences": "",
+			"ExternalReferences": "<div><ul><li><a href='https://www.owasp.org/index.php/HTTPOnly'>OWASP HTTPOnly Cookies</a></li><li><a href='https://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly%28VS.80%29.aspx'>MSDN - ASP.NET HTTPOnly Cookies</a></li></ul></div>",
+			"ProofOfConcept": ""
+		}
+	]
+}
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		5adedc433a342d675492b86dc18786f72e167115f9718a397dc9b91c5fdc9c94
		1a74292fc58b2bd05c763c8c126b0b35888e2a6f8ef9ab2588bb6c8589987c9c