Skip to content

Commit 52b4116

Browse files
AlperenY-csMaffooch
AlperenY-cs
and
Maffooch
authored
Add new parser - Rapplex (#10202)
* Added Rapplex parser files * Ruff checks were made. Warnings fixed. * Ruff checks were made on unittest parser. Warnings fixed. * Changed file loading process to use json.load instead of json.loads * Dedupe_algo changed to hash_code. Performance improvements and fixes in parser. * Corrections were made in accordance with DRY principles. * html2text import fix * Added settings hash * Checksum changed * Correct ruff errors --------- Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
1 parent c06a180 commit 52b4116

File tree

9 files changed

+1158
-1
lines changed

9 files changed

+1158
-1
lines changed

‎docs/content/en/integrations/parsers/file/rapplex.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: "Rapplex Scan"
3+
toc_hide: true
4+
---
5+
Import JSON report of [Rapplex - Web Application Security Scanner](https://rapplex.com)
6+
7+
8+
### Sample Scan Data
9+
Sample Rapplex scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/rapplex).

‎dojo/settings/.settings.dist.py.sha256sum

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2938ce5637b436fb25afc49dbc5eb68e3b640b87e311d052810ca82ad9c641a1
1+
5a6a0d26f8c1d8d164289a366ab3421ac60db7ceb8d903250cac2f912d9850db

‎dojo/settings/settings.dist.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1271,6 +1271,7 @@ def saml2_attrib_map_format(dict):
12711271
"Wiz Scan": ["title", "description", "severity"],
12721272
"Kubescape JSON Importer": ["title", "component_name"],
12731273
"Kiuwan SCA Scan": ["description", "severity", "component_name", "component_version", "cwe"],
1274+
"Rapplex Scan": ["title", "endpoints", "severity"],
12741275
}
12751276

12761277
# Override the hardcoded settings here via the env var
@@ -1491,6 +1492,7 @@ def saml2_attrib_map_format(dict):
14911492
"Deepfence Threatmapper Report": DEDUPE_ALGO_HASH_CODE,
14921493
"Kubescape JSON Importer": DEDUPE_ALGO_HASH_CODE,
14931494
"Kiuwan SCA Scan": DEDUPE_ALGO_HASH_CODE,
1495+
"Rapplex Scan": DEDUPE_ALGO_HASH_CODE,
14941496
}
14951497

14961498
# Override the hardcoded settings here via the env var

‎dojo/tools/rapplex/__init__.py

Whitespace-only changes.

‎dojo/tools/rapplex/parser.py

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
import json
2+
from datetime import datetime
3+
4+
from html2text import html2text
5+
6+
from dojo.models import Endpoint, Finding
7+
8+
9+
class RapplexParser:
10+
"""
11+
Rapplex - Web Application Security Scanner
12+
"""
13+
def get_scan_types(self):
14+
return ["Rapplex Scan"]
15+
16+
def get_label_for_scan_types(self, scan_type):
17+
return "Rapplex Scan"
18+
19+
def get_description_for_scan_types(self, scan_type):
20+
return "Import Rapplex JSON report."
21+
22+
def get_findings(self, filename, test):
23+
data = json.load(filename)
24+
findings = []
25+
severities = ["Information", "Low", "Medium", "High", "Critical"]
26+
27+
for severity in severities:
28+
current_severity = data.get("Severities", {}).get(severity)
29+
if not current_severity:
30+
continue
31+
32+
main_issue_groups = current_severity.get("IssueGroups", [])
33+
for main_issue_group in main_issue_groups:
34+
issues = main_issue_group.get("Issues", [])
35+
36+
for issue in issues:
37+
formatted_date = datetime.strptime(data.get("StartedDate", ""), "%d/%m/%Y %H:%M:%S").strftime("%Y-%m-%d")
38+
severity_level = current_severity.get("Name", "")
39+
title = issue.get("Title", "")
40+
url = issue.get("Url", "")
41+
req = issue.get("HttpRequest", "")
42+
res = issue.get("HttpResponse", "")
43+
issue_definition = main_issue_group.get("Definition", {})
44+
45+
cwe_val = None
46+
for classification in issue_definition.get("Classifications", []):
47+
if classification.get("Foundation") == "CWE":
48+
cwe_val = classification.get("Value")
49+
break
50+
51+
issue_sections = issue_definition.get("Sections", {})
52+
ref = html2text(issue_sections.get("References", ""))
53+
rem = issue_sections.get("Remediation", "")
54+
sum = issue_sections.get("Summary", "")
55+
56+
finding = Finding(
57+
title=title,
58+
test=test,
59+
severity=severity_level,
60+
date=formatted_date,
61+
description=sum,
62+
mitigation=rem,
63+
cwe=cwe_val,
64+
references=ref,
65+
active=True,
66+
)
67+
68+
finding.unsaved_request = req
69+
finding.unsaved_response = res
70+
71+
endpoint = Endpoint.from_uri(url)
72+
finding.unsaved_endpoints.append(endpoint)
73+
74+
findings.append(finding)
75+
return findings

‎unittests/scans/rapplex/rapplex_many_vul.json

Lines changed: 685 additions & 0 deletions
Large diffs are not rendered by default.

‎unittests/scans/rapplex/rapplex_one_vul.json

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
{
2+
"ScanId": "a2azd6fe",
3+
"Target": "http://testphp.vulnweb.com/",
4+
"Description": null,
5+
"CreatedDate": "05/03/2024 10:14:05",
6+
"StartedDate": "05/03/2024 10:14:05",
7+
"ScanTime": 30,
8+
"ScanTimeAsStr": "30s",
9+
"ScanPolicy": {
10+
"Title": "Default",
11+
"Scope": {
12+
"CrawlDepth": 5,
13+
"OnlySameOrigin": true,
14+
"EnableParentPath": false,
15+
"AllowSubDomain": false,
16+
"BaseDomain": null,
17+
"InScopeDomains": [],
18+
"PreferMobileVersion": false,
19+
"MobileDevice": null,
20+
"MaximumLinks": 500,
21+
"MaximumFilesPerFolder": 30,
22+
"MaximumAttackToRecurringParam": 5
23+
},
24+
"SecurityChecks": "<div class=\"legend\">Q = Query String\r\nP = Post\r\nH = Header\r\nC = Cookie\r\nU = Url\r\nR = Url Rewrite\r\nE = Extra Parameter\r\n</div>Engine Q P H C U R E\r\n====================================================\r\nBackup Files [ ] [ ] [ ] [ ] [X] [ ] [ ]\r\nCORS Tests [ ] [ ] [X] [ ] [ ] [ ] [ ]\r\nDOM based XSS [ ] [ ] [ ] [ ] [X] [ ] [ ]\r\nFile Upload [ ] [X] [ ] [ ] [ ] [ ] [ ]\r\nOpen Redirect [X] [X] [ ] [ ] [ ] [X] [ ]\r\nShort (8.3) Files [ ] [ ] [ ] [ ] [X] [ ] [ ]\r\nCommand Injection [X] [X] [ ] [ ] [ ] [X] [ ]\r\nHeader Injection [X] [X] [ ] [ ] [ ] [X] [ ]\r\nFile Inclusion [X] [X] [ ] [ ] [ ] [X] [ ]\r\nCode Injection [X] [X] [ ] [ ] [ ] [X] [ ]\r\nSQL Injection [X] [X] [ ] [ ] [ ] [X] [ ]\r\nHTML Injection [X] [X] [ ] [ ] [ ] [X] [X]\r\n",
25+
"EnabledAuthentication": false,
26+
"Connection": {
27+
"IsRateLimited": false,
28+
"Rate": 100,
29+
"Failure": "AutoRetry",
30+
"MaxRetryCount": 3
31+
}
32+
},
33+
"Fingerprinting": {
34+
"IsEnabled": true,
35+
"Groups": [
36+
{
37+
"Title": "Web Server",
38+
"Items": [
39+
{
40+
"Title": "nginx",
41+
"Value": 100
42+
}
43+
]
44+
},
45+
{
46+
"Title": "Programming Language",
47+
"Items": [
48+
{
49+
"Title": "PHP",
50+
"Value": 100
51+
}
52+
]
53+
},
54+
{
55+
"Title": "Operating System",
56+
"Items": [
57+
{
58+
"Title": "Linux",
59+
"Value": 100
60+
}
61+
]
62+
},
63+
{
64+
"Title": "Database",
65+
"Items": [
66+
{
67+
"Title": "MySQL",
68+
"Value": 100
69+
}
70+
]
71+
}
72+
]
73+
},
74+
"Severities": {
75+
"Information": {
76+
"Name": "Information",
77+
"IssueGroups": [],
78+
"Total": 0
79+
},
80+
"Low": {
81+
"Name": "Low",
82+
"IssueGroups": [],
83+
"Total": 0
84+
},
85+
"Medium": {
86+
"Name": "Medium",
87+
"IssueGroups": [],
88+
"Total": 0
89+
},
90+
"High": {
91+
"Name": "High",
92+
"IssueGroups": [],
93+
"Total": 0
94+
},
95+
"Critical": {
96+
"Name": "Critical",
97+
"IssueGroups": [
98+
{
99+
"gIndex": 0,
100+
"Group": "SQL Injection",
101+
"Severity": "Critical",
102+
"Definition": {
103+
"MarkdownContent": null,
104+
"Title": "SQL Injection",
105+
"Severity": "Critical",
106+
"Sections": {
107+
"Classification": "<p>PCI 3.2-6.5.1, OWASP 2013-A1, CWE 89, WASC 19</p>",
108+
"Summary": "<p>SQL Injection is an attack technique used to exploit applications that construct SQL statements from user-supplied input. When successful, the attacker is able to change the logic of SQL statements executed against the database.</p>\n<p>With a successful attack, an attacker can gain:</p>\n<ul>\n<li><strong>Unauthorized access to an application</strong>: An attacker can successfully bypass an application's authentication mechanism to have illegitimate access to it.</li>\n<li><strong>Information disclosure</strong>: A SQL injection attack could lead to a complete data leakage from the database server.</li>\n<li><strong>Loss of data availability</strong>: An attacker can delete records from the database server.</li>\n<li><strong>Compromised data integrity</strong>: As SQL statements are also used to modify or add the record, an attacker can use SQL injection to modify or add data stored in a database. This would lead to compromised data integrity.</li>\n</ul>",
109+
"Remediation": "<ul>\n<li>Whitelisting is the best practice to validate input against blacklisting whenever it is practicable.</li>\n<li>Do not create SQL queries with string concatenation. Instead use prepared statements or stored procedures.</li>\n</ul>",
110+
"References": "<ul>\n<li><a href=\"http://projects.webappsec.org/SQL-Injection\">SQL Injection</a></li>\n<li><a href=\"https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet\">SQL Injection Prevention Cheat Sheet</a></li>\n<li><a href=\"http://cwe.mitre.org/data/definitions/89.html\">Improper Neutralization of Special Elements used in an SQL Command</a></li>\n<li><a href=\"https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></li>\n</ul>"
111+
},
112+
"References": [
113+
{
114+
"Title": "SQL Injection",
115+
"Link": "http://projects.webappsec.org/SQL-Injection"
116+
},
117+
{
118+
"Title": "SQL Injection Prevention Cheat Sheet",
119+
"Link": "https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet"
120+
},
121+
{
122+
"Title": "Improper Neutralization of Special Elements used in an SQL Command",
123+
"Link": "http://cwe.mitre.org/data/definitions/89.html"
124+
},
125+
{
126+
"Title": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
127+
"Link": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
128+
}
129+
],
130+
"Classifications": [
131+
{
132+
"Foundation": "PCI",
133+
"Version": "3.2",
134+
"Value": "6.5.1",
135+
"Formatted": "PCI 3.2-6.5.1"
136+
},
137+
{
138+
"Foundation": "OWASP",
139+
"Version": "2013",
140+
"Value": "A1",
141+
"Formatted": "OWASP 2013-A1"
142+
},
143+
{
144+
"Foundation": "CWE",
145+
"Version": "",
146+
"Value": "89",
147+
"Formatted": "CWE 89"
148+
},
149+
{
150+
"Foundation": "WASC",
151+
"Version": "",
152+
"Value": "19",
153+
"Formatted": "WASC 19"
154+
}
155+
]
156+
},
157+
"Issues": [
158+
{
159+
"vIndex": 61,
160+
"Title": "SQL Injection",
161+
"Severity": "Critical",
162+
"Url": "http://testphp.vulnweb.com/listproducts.php?cat=1",
163+
"Path": "/listproducts.php?cat=1",
164+
"Html": null,
165+
"IsR2Visible": true,
166+
"HttpRequest": "GET /listproducts.php?cat=1%20AND%20GTID_SUBSET(CONCAT(0x3a%2c0x35714C314E6A33633731306E)%2c6148) HTTP/1.1\nCache-Control: no-cache\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nAccept-Language: en-us,en;q=0.5\nAccept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5\nReferer: http://testphp.vulnweb.com/categories.php\nHost: testphp.vulnweb.com\n\n",
167+
"HttpResponse": "HTTP/1.1 200 OK\nConnection: keep-alive\nDate: Fri, 03 May 2024 07:18:31 GMT\nTransfer-Encoding: chunked\nServer: nginx/1.19.0\nX-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1\nContent-Encoding: gzip\nContent-Type: text/html; charset=UTF-8\n\r\n\r\n<ellipsis>...</ellipsis>\r\neBeginEditable name=&quot;content_rgn&quot; --&gt;\n&lt;div id=&quot;content&quot;&gt;\n\tError: Malformed GTID set specification &#39;:<mark>5qL1Nj3c710n</mark>&#39;.\nWarning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /hj/var/www/lis\r\n<ellipsis>...</ellipsis>\r\n",
168+
"ResponseTime": null,
169+
"Active": true,
170+
"Exploitable": true,
171+
"Payload": "1 AND GTID_SUBSET(CONCAT(0x3a,0x35714C314E6A33633731306E),6148)",
172+
"InjectionPoint": {
173+
"Name": "cat",
174+
"Type": "QueryString"
175+
},
176+
"CommentGroups": [
177+
{
178+
"Name": "Proof",
179+
"Items": [
180+
{
181+
"Title": "Database Type",
182+
"Text": "MySQL",
183+
"Note": null
184+
},
185+
{
186+
"Title": "Database Version",
187+
"Text": "8.0.22-0ubuntu0.20.04.2",
188+
"Note": null
189+
},
190+
{
191+
"Title": "Tables",
192+
"Text": "artists (adesc,aname,artist_id)\r\ncarts (cart_id,item,price)\r\ncateg (cat_id,cdesc,cname)\r\nfeatured (feature_text,pic_id)\r\nguestbook (mesaj,sender,senttime)\r\npictures (a_id,cat_id,img,pic_id,plong,price,pshort,title)\r\nproducts (description,id,name,price,rewritename)\r\nusers (address,cart,cc,email,name,pass,phone,uname)\r\n",
193+
"Note": null
194+
}
195+
]
196+
},
197+
{
198+
"Name": "WAF",
199+
"Items": [
200+
{
201+
"Title": "Cloudflare",
202+
"Text": "Rule name: SQL Injection - Rapplex\r\n\r\nRule: http.request.query eq 1 AND GTID_SUBSET(CONCAT(0x3a,0x35714C314E6A33633731306E),6148)\r\n\r\nAction: Block",
203+
"Note": "This rule can be imported via Cloudflare dashboard."
204+
},
205+
{
206+
"Title": "TR7",
207+
"Text": "Etkinlik durumu: Devrede\r\nAçıklama: 89277915 - Rapplex Ruleset\r\nRegex: 1\\ AND\\ GTID_SUBSET\\(CONCAT\\(0x3a,0x35714C314E6A33633731306E\\),6148\\)\r\nRisk ölçeği: Kritik\r\n\r\nSaldırı alanı;\r\n- Path\r\n- Query\r\n- Header\r\n- From\r\n- JSON\r\n- XML\r\n- RAW",
208+
"Note": "This rule can be imported with TR7 dashboard."
209+
},
210+
{
211+
"Title": "F5 BIG-IP",
212+
"Text": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<vulnerabilities>\r\n <vulnerability>\r\n <attack_type>SQL-Injection</attack_type>\r\n <name>SQL Injection</name>\r\n <url><![CDATA[http://testphp.vulnweb.com/listproducts.php?cat=1]]></url>\r\n <parameter><![CDATA[cat]]></parameter>\r\n <threat>Critical</threat>\r\n <severity>Critical</severity>\r\n </vulnerability>\r\n</vulnerabilities>",
213+
"Note": ""
214+
},
215+
{
216+
"Title": "FortiWeb",
217+
"Text": "config waf custom-protection-rule\r\n edit Rapplex - SQL Injection\r\n set type Request\r\n set action alert_deny\r\n set severity High\r\n config meet-condition\r\n edit <Fill with unique value>\r\n set request-target REQUEST_URI\r\n set pattern 1 AND GTID_SUBSET(CONCAT(0x3a,0x35714C314E6A33633731306E),6148)\r\n next\r\n end\r\n next\r\nend",
218+
"Note": "This rule is compatible with FortiWeb 7.4.0+"
219+
},
220+
{
221+
"Title": "ModSecurity",
222+
"Text": "SecRule REQUEST_URI '1 AND GTID_SUBSET(CONCAT(0x3a,0x35714C314E6A33633731306E),6148)' 'id: <Fill with unique id value>', t:none, deny, log, msg:'SQL Injection - Rapplex'",
223+
"Note": ""
224+
}
225+
]
226+
}
227+
],
228+
"Comment": null
229+
}
230+
]
231+
}
232+
],
233+
"Total": 1
234+
}
235+
}
236+
}
237+

0 commit comments

Comments
 (0)