FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Add scorecard support for Seczone's VulHunter IAST tool. Upgrade · ghdevnull/BenchmarkJava@69ced49 · GitHub

/ BenchmarkJava Public
forked from OWASP-Benchmark/BenchmarkJava

Commit 69ced49

Browse files
davewichers
committed
Add scorecard support for Seczone's VulHunter IAST tool. Upgrade
a few dependencies in the pom.xml.
1 parent b38d197 commit 69ced49

4 files changed

Lines changed: 250 additions & 31 deletions

File tree

‎pom.xml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -925,7 +925,7 @@ But it might be needed for Java 10, because I get this error, that I don't get w
925925
<dependency>
926926
<groupId>org.owasp.esapi</groupId>
927927
<artifactId>esapi</artifactId>
928-
<version>2.2.2.0</version>
928+
<version>2.2.3.0</version>
929929
</dependency>
930930

931931
<dependency>
@@ -1130,7 +1130,9 @@ But it might be needed for Java 10, because I get this error, that I don't get w
11301130
<plugin>
11311131
<groupId>org.codehaus.cargo</groupId>
11321132
<artifactId>cargo-maven2-plugin</artifactId>
1133-
<version>1.8.2</version>
1133+
<version>1.8.5</version>
1134+
<!-- 1.9+ requires a change in cargo configuration. So not using yet.
1135+
<version>1.9.0</version> -->
11341136
</plugin>
11351137

11361138
<!-- SpotBugs Static Analysis - the successor to FindBugs -->
@@ -1222,12 +1224,12 @@ But it might be needed for Java 10, because I get this error, that I don't get w
12221224
<version.jackson>2.9.8</version.jackson>
12231225
<version.jersey>1.19.4</version.jersey>
12241226
<version.slf4j>1.7.30</version.slf4j>
1225-
<version.spotbugs.maven>4.1.4</version.spotbugs.maven>
1227+
<version.spotbugs.maven>4.2.2</version.spotbugs.maven>
12261228
<version.spotbugs>4.2.0</version.spotbugs>
1227-
<version.springframework>4.3.29.RELEASE</version.springframework>
1229+
<version.springframework>4.3.30.RELEASE</version.springframework>
12281230
<!-- tomcat 8.5 is last version to support Java 7. Tomcat 9+ requires Java 8. -->
12291231
<tomcat.major.version>8</tomcat.major.version>
1230-
<version.tomcat>8.5.56</version.tomcat>
1232+
<version.tomcat>8.5.64</version.tomcat>
12311233
<tomcat.url>http://archive.apache.org/dist/tomcat/tomcat-${tomcat.major.version}/v${version.tomcat}/bin/apache-tomcat-${version.tomcat}.zip</tomcat.url>
12321234
</properties>
12331235
</project>

‎src/main/java/org/owasp/benchmark/score/BenchmarkScore.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@
8888
import org.owasp.benchmark.score.parsers.QualysWASReader;
8989
import org.owasp.benchmark.score.parsers.Rapid7Reader;
9090
import org.owasp.benchmark.score.parsers.Reader;
91+
import org.owasp.benchmark.score.parsers.SeczoneReader;
9192
import org.owasp.benchmark.score.parsers.SeekerReader;
9293
import org.owasp.benchmark.score.parsers.SemgrepReader;
9394
import org.owasp.benchmark.score.parsers.ShiftLeftReader;
@@ -959,7 +960,13 @@ else if ( filename.endsWith( ".fpr" ) ) {
959960
}
960961

961962
else if ( filename.endsWith( ".log" ) ) {
962-
tr = new ContrastReader().parse( fileToParse );
963+
964+
String line1 = getLine( fileToParse, 0 ); // line1 contains: Starting Contrast!
965+
if ( line1 != null && line1.contains( "Starting Contrast" )) {
966+
tr = new ContrastReader().parse( fileToParse );
967+
} else if ( line1 != null && line1.contains( "seczone.iast" )) {
968+
tr = new SeczoneReader().parse( fileToParse );
969+
} else System.out.println("Error: No matching parser found for .log file: " + filename);
963970
}
964971

965972
else if ( filename.endsWith( ".hcl" ) ) {

‎src/main/java/org/owasp/benchmark/score/parsers/ContrastReader.java‎

Lines changed: 40 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,13 @@ public TestResults parse(File f) throws Exception {
7171

7272
private void parseContrastFinding(TestResults tr, String json) throws Exception {
7373
TestCaseResult tcr = new TestCaseResult();
74-
74+
7575
try {
7676
JSONObject obj = new JSONObject(json);
7777
String ruleId = obj.getString( "ruleId" );
7878
tcr.setCWE(cweLookup(ruleId));
7979
tcr.setCategory(ruleId);
80-
80+
8181
JSONObject request = obj.getJSONObject("request");
8282
String uri = request.getString("uri" );
8383

@@ -90,46 +90,61 @@ private void parseContrastFinding(TestResults tr, String json) throws Exception
9090
}
9191
}
9292
} catch (Exception e) {
93-
// System.err.println("> Parse error: " + json);
94-
// e.printStackTrace();
93+
// There are a few crypto-bad-mac findings not associated with a request, so ignore errors associated with those.
94+
if (!json.contains("\"ruleId\":\"crypto-bad-mac\"")) {
95+
System.err.println("Contrast Results Parse error for: " + json);
96+
e.printStackTrace();
97+
}
9598
}
9699
}
97-
100+
98101
private static int cweLookup(String rule) {
99102
switch (rule) {
100-
case "cookie-flags-missing":
101-
return 614; // insecure cookie use
102-
case "sql-injection":
103-
return 89; // sql injection
104103
case "cmd-injection":
105104
return 78; // command injection
106-
case "ldap-injection":
107-
return 90; // ldap injection
105+
case "cookie-flags-missing":
106+
return 614; // insecure cookie use
107+
case "crypto-bad-ciphers":
108+
return 327; // weak encryption
109+
case "crypto-bad-mac":
110+
return 328; // weak hash
111+
case "crypto-weak-randomness":
112+
return 330; // weak random
113+
case "csp-header-insecure":
114+
return 0000; // Don't care
115+
case "csp-header-missing":
116+
return 0000; // Don't care
108117
case "header-injection":
109118
return 113; // header injection
110119
case "hql-injection":
111120
return 564; // hql injection
112-
case "unsafe-readline":
113-
return 0000; // unsafe readline
114-
case "reflection-injection":
115-
return 0000; // reflection injection
116-
case "reflected-xss":
117-
return 79; // xss
118-
case "xpath-injection":
119-
return 643; // xpath injection
121+
case "hsts-header-missing":
122+
return 319; // CWE-319: Cleartext Transmission of Sensitive Information
123+
case "ldap-injection":
124+
return 90; // ldap injection
120125
case "path-traversal":
121126
return 22; // path traversal
122-
case "crypto-bad-mac":
123-
return 328; // weak hash
124-
case "crypto-weak-randomness":
125-
return 330; // weak random
126-
case "crypto-bad-ciphers":
127-
return 327; // weak encryption
127+
case "reflected-xss":
128+
return 79; // xss
129+
case "reflection-injection":
130+
return 0000; // reflection injection
131+
case "redos":
132+
return 400; // regex denial of service - CWE-400: Uncontrolled Resource Consumption
133+
case "sql-injection":
134+
return 89; // sql injection
128135
case "trust-boundary-violation":
129136
return 501; // trust boundary
137+
case "unsafe-readline":
138+
return 0000; // unsafe readline
139+
case "xcontenttype-header-missing":
140+
return 0000; // Don't care
141+
case "xpath-injection":
142+
return 643; // xpath injection
130143
case "xxe":
131144
return 611; // xml entity
145+
default: System.out.println("WARNING: Contrast-Unrecognized finding type: " + rule);
132146
}
147+
133148
return 0;
134149
}
135150

‎src/main/java/org/owasp/benchmark/score/parsers/SeczoneReader.java‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Benchmark Project For details, please see
6+
* <a href="https://www.owasp.org/index.php/Benchmark">https://www.owasp.org/index.php/Benchmark</a>.
7+
*
8+
* The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
12+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details
14+
*
15+
* @author Dave Wichers <a href="https://www.aspectsecurity.com">Aspect Security</a>
16+
* @created 2015
17+
*/
18+
19+
package org.owasp.benchmark.score.parsers;
20+
21+
import java.io.BufferedReader;
22+
import java.io.File;
23+
import java.io.FileReader;
24+
import java.text.SimpleDateFormat;
25+
import java.util.ArrayList;
26+
import java.util.Date;
27+
import java.util.List;
28+
29+
import org.owasp.benchmark.score.BenchmarkScore;
30+
31+
public class SeczoneReader extends Reader {
32+
33+
public static void main(String[] args) throws Exception {
34+
File f = new File("seczone.log");
35+
SeczoneReader cr = new SeczoneReader();
36+
cr.parse(f);
37+
}
38+
39+
public TestResults parse(File f) throws Exception {
40+
TestResults tr = new TestResults("VulHunter", true, TestResults.ToolType.IAST);
41+
42+
BufferedReader reader = new BufferedReader(new FileReader(f));
43+
String firstLine = null;
44+
String lastLine = "";
45+
String line = "";
46+
ArrayList<String> chunk = new ArrayList<String>();
47+
String testNumber = "00001";
48+
while (line != null) {
49+
try {
50+
line = reader.readLine();
51+
if (line != null) {
52+
if ( firstLine == null ) firstLine = line;
53+
lastLine = line;
54+
if (line.contains("Accept Request URL====>>") && !line.endsWith(".html")) {
55+
// ok, we're starting a new URL, so process this one and start the next chunk
56+
parseVulHunterFinding(tr, testNumber, chunk);
57+
chunk.clear();
58+
testNumber = "00000";
59+
String fname = "/" + BenchmarkScore.TESTCASENAME;
60+
int idx = line.indexOf( fname );
61+
if ( idx != -1 ) {
62+
testNumber = line.substring(idx + fname.length(), idx + fname.length() + 5 );
63+
}
64+
} else if (line.contains("Report BUG===>>>")) {
65+
chunk.add(line);
66+
} else if (line.contains("get engine jar")) {
67+
String versionLine = line.substring(line.indexOf("\\engine-")
68+
+ "\\engine-".length());
69+
String version = versionLine.substring(0, versionLine.indexOf(".jar"));
70+
tr.setToolVersion(version);
71+
}
72+
}
73+
} catch (Exception ex) {
74+
ex.printStackTrace();
75+
}
76+
}
77+
//Last
78+
if(!chunk.isEmpty()){
79+
// ok, we're starting a new URL, so process this one and start the next chunk
80+
parseVulHunterFinding(tr, testNumber, chunk);
81+
chunk.clear();
82+
testNumber = "00000";
83+
String fname = "/" + BenchmarkScore.TESTCASENAME;
84+
int idx = lastLine.indexOf( fname );
85+
if ( idx != -1 ) {
86+
testNumber = lastLine.substring(idx + fname.length(), idx + fname.length() + 5 );
87+
}
88+
}
89+
reader.close();
90+
tr.setTime(calculateTime(firstLine, lastLine));
91+
return tr;
92+
}
93+
94+
private String calculateTime(String firstLine, String lastLine) {
95+
// Lines start with: PID_8772 | 2020-12-11 19:00:51.370 INFO ...
96+
try {
97+
String start = firstLine.split(" ")[3];
98+
String stop = lastLine.split(" ")[3];
99+
SimpleDateFormat sdf = new SimpleDateFormat("HH:mm:ss.SSS");
100+
Date startTime = sdf.parse(start);
101+
Date stopTime = sdf.parse(stop);
102+
long startMillis = startTime.getTime();
103+
long stopMillis = stopTime.getTime();
104+
return ((stopMillis - startMillis) / 1000) + " seconds";
105+
} catch (Exception e) {
106+
e.printStackTrace();
107+
}
108+
return null;
109+
}
110+
111+
private void parseVulHunterFinding(TestResults tr, String testNumber, List<String> chunk) throws Exception {
112+
for (String line : chunk) {
113+
TestCaseResult tcr = new TestCaseResult();
114+
115+
String ruleid = line.substring(line.indexOf("ruleId=\"") + 8, line.length() - 2);
116+
tcr.setCWE(cweLookup(ruleid));
117+
tcr.setCategory(ruleid);
118+
119+
try {
120+
tcr.setNumber(Integer.parseInt(testNumber));
121+
} catch (NumberFormatException e) {
122+
System.out.println("> Parse error: " + line);
123+
}
124+
125+
if (tcr.getCWE() != 0) {
126+
// System.out.println( tcr.getNumber() + "\t" + tcr.getCWE() + "\t" + tcr.getCategory() );
127+
tr.put(tcr);
128+
}
129+
}
130+
}
131+
132+
private static int cweLookup(String rule) {
133+
switch (rule) {
134+
case "cmd-injection"://12432
135+
return 78; // command injection
136+
case "cookie-injection":
137+
return 0000; // What is this exactly?
138+
case "content-type-missing":
139+
return 0000; // Don't care
140+
case "cookie-missing-httponly":
141+
return 1004; // insecure cookie use
142+
case "cookie-missing-secure":
143+
return 614; // insecure cookie use
144+
case "crypto-bad-ciphers":
145+
return 327; // weak encryption
146+
case "crypto-bad-mac":
147+
return 328; // weak hash
148+
case "crypto-weak-randomness":
149+
return 330; // weak random
150+
case "csrf":
151+
return 352; // csrf
152+
case "header-injection":
153+
return 113; // header injection
154+
case "hql-injection":
155+
return 564; // hql injection
156+
case "hsts":
157+
return 319; // CWE-319: Cleartext Transmission of Sensitive Information
158+
case "ldap-injection":
159+
return 90; // ldap injection
160+
case "path-traversal"://19703
161+
return 22; // path traversal
162+
case "reflected-xss"://21290
163+
return 79; // xss
164+
case "reflection-injection":
165+
return 0000; // reflection injection
166+
case "referrer-policy-missing":
167+
return 0000; // Don't care
168+
case "sensitive-data-flow-tracking":
169+
return 0000; // Don't care
170+
case "sensitive-data-response-tracking":
171+
return 0000; // Don't care
172+
case "sql-injection"://20501
173+
return 89; // sql injection
174+
case "trust-boundary-violation":
175+
return 501; // trust boundary
176+
case "unsafe-readline":
177+
return 0000; // unsafe readline
178+
case "unsafe-web-service-call":
179+
return 0000; // Not sure what this is.
180+
case "weak-password-db-connection":
181+
return 0000; // Don't care
182+
case "x-xss-protection-header-disabled":
183+
return 0000; // Don't care
184+
case "xcontenttype-header-missing":
185+
return 0000; // Don't care
186+
case "xpath-injection":
187+
return 643; // xpath injection
188+
case "xxe":
189+
return 611; // xml entity
190+
default: System.out.println("WARNING: VulHunter-Unrecognized finding type: " + rule);
191+
}
192+
return 0;
193+
}
194+
195+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL