bpmcdevitt/brendan.mcdevitt.tech
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

big update

Browse source
This commit is contained in:
Brendan McDevitt 2022-02-25 01:56:24 -05:00
parent af1af681e9
commit e6c312a1ec
12 changed files with 15353 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Gemfile.lock
View file

@ -29,6 +29,8 @@ GEM
safe_yaml (~> 1.0)
jekyll-feed (0.11.0)
jekyll (~> 3.3)
jekyll-jupyter-notebook (0.0.4)
jekyll
jekyll-sass-converter (1.5.2)
sass (~> 3.4)
jekyll-seo-tag (2.5.0)
@ -67,6 +69,7 @@ PLATFORMS
DEPENDENCIES
jekyll (= 3.8.5)
jekyll-feed (~> 0.6)
jekyll-jupyter-notebook
minima (~> 2.5.0)
tzinfo-data

14563
_includes/apple_advisories_cve_risk_scores.html Normal file
View file

File diff suppressed because one or more lines are too long

17
_includes/collapse.html Normal file
View file

@ -0,0 +1,17 @@
<!-- Start Collapse.html -->
<script>
var coll = document.getElementsByClassName("collapsible");
var i;
for (i = 0; i < coll.length; i++) {
coll[i].addEventListener("click", function() {
this.classList.toggle("active");
var content = document.getElementById(this.id+"data");
if (content.style.display === "block") {
content.style.display = "none";
} else {
content.style.display = "block";
}
});
}
</script>
<!-- End Collapse.html -->

7
_layouts/default.html
View file

@ -20,7 +20,7 @@
<div class="site">
<div class="title">
<a href="/">Brendan McDevitt</a>
<a href="https://git.mcdevitt.tech/bpmcdevitt">Brendan McDevitt</a>
<a class="extra" href="/">home</a>
<a class="extra" href="/about">about</a>
<a class="extra"href="/photos">photos</a>
@ -28,9 +28,10 @@
{{ content }}
<a href="https://git.mcdevitt.tech/bpmcdevitt"><img style="position: absolute; top: 0;
<!-- <a href="https://git.mcdevitt.tech/bpmcdevitt"><img style="position: absolute; top: 0;
right: 0; border: 0; width: 149px; height: 149px;"
src="/assets/github-fork-me.png" alt="Fork me on GitLab"></a>
src="/assets/github-fork-me.png" alt="Fork me on GitLab", class="forkme"></a>
-->
</body>
</html>

521
_programming/2021-01-06-command-line-redhat-pkg-auditor.markdown Normal file
View file

@ -0,0 +1,521 @@
---
layout: programming
title: "command line: redhat package auditor"
date: 2021-01-06
categories: programming
---
# Command Line Programming - [RedHat Package Auditor](https://git.mcdevitt.tech/bpmcdevitt/misc_rbtools/-/tree/master/security_tools/redhat_tools)
I am working on a project where I am looking into vulnerabilities for Redhat
and CentOS systems. Throughout my time as a sysadmin I have always been a huge fan of command-line
programs. This is one of the programs that I hacked together to make my job
easier.
# Making my life easier
For a project I am working on, I am having to compare operating system vendor data against NVD data and have
been working in a spreadsheet initially to record the results. I am looking to see if NVD has captured correct
CPE data from the operating system vendors source. To start I was manually
looking at CVE/Advisory postings from Redhat and comparing with what was on
NVDs page for the given CVE. This grew tediuous rather quickly after I got
through a handful of CVEs. I needed to write a tool that would query Redhat's
API and give me all the needed info on that CVE. My first step was to see
if there was anything available that could do this quickly. After
looking online and finding old, outdated programs, I thought it would be quicker if I hacked together something.
I am a big linux nerd and have always loved using different command-line
programs. I have been using it for over 5 years now and I am always stumbling
upon new command-line driven programs. Writing command-line programs is fun and
this was an opportunity to write a new one.
This program will query Redhats Security API and spit back CVE data. I
have taken some of the examples from the README document that is linked here
with the source code.
<hr>
{%highlight bash %}
./rpm_pkg_audit.rb --help
Usage: rpm_pkg_audit.rb [options]
-p, --pkg PKGNAME Takes a base pkg name and returns cves from redhats security API.
-l, --list List packages in the XML datafile.
-x, --xmlpkg PKGNAME The pkg name you want to audit from xml file rpm-to-cve.xml
-r, --refresh Refresh rpm-to-cve.xml file with latest pkgs and cves
-c, --cve CVE-2020-1234 Takes a cve id and returns cve json from redhats security API.
-f, --cves-from-file cves.txt Takes a file one cve id per line and sends a batch request to redhat security API
-a, --advisory RHSA-2019:0997 Takes a RHSA advisory and sends an API request to redhat RHSA-2015:2155
{%endhighlight%}
<hr>
# CVES
We can query for CVE's using two options:
{% highlight bash %}
--cve
--cves-from-file
{%endhighlight%}
Here are some examples:
### Single CVE
{% highlight bash %}
./rpm_pkg_audit.rb --cve CVE-2016-3627
{% endhighlight %}
<button type="button" class="collapsible" id="json1">Click here for the JSON.</button>
<div class="content" id="json1data" markdown="1">
{% highlight json %}
{
"threat_severity": "Moderate",
"public_date": "2016-03-21T00:00:00Z",
"bugzilla": {
"description": "CVE-2016-3627 libxml2: stack exhaustion while parsing xml files in recovery mode",
"id": "1319829",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1319829"
},
"cvss": {
"cvss_base_score": "4.3",
"cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"status": "verified"
},
"cwe": "CWE-674",
"details": [
"The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.",
"Missing recursive loop detection checks were found in the xmlParserEntityCheck() and xmlStringGetNodeList() functions of libxml2, causing application using the library to crash by stack exhaustion while building the associated data. An attacker able to send XML data to be parsed in recovery mode could launch a Denial of Service on the application."
],
"affected_release": [
{
"product_name": "Red Hat Enterprise Linux 6",
"release_date": "2016-06-23T00:00:00Z",
"advisory": "RHSA-2016:1292",
"cpe": "cpe:/o:redhat:enterprise_linux:6",
"package": "libxml2-0:2.7.6-21.el6_8.1"
},
{
"product_name": "Red Hat Enterprise Linux 7",
"release_date": "2016-06-23T00:00:00Z",
"advisory": "RHSA-2016:1292",
"cpe": "cpe:/o:redhat:enterprise_linux:7",
"package": "libxml2-0:2.9.1-6.el7_2.3"
},
{
"product_name": "Red Hat JBoss Core Services 1",
"release_date": "2016-12-15T00:00:00Z",
"advisory": "RHSA-2016:2957",
"cpe": "cpe:/a:redhat:jboss_core_services:1"
}
],
"package_state": [
{
"product_name": "Red Hat Enterprise Linux 5",
"fix_state": "Will not fix",
"package_name": "libxml2",
"cpe": "cpe:/o:redhat:enterprise_linux:5"
},
{
"product_name": "Red Hat JBoss Enterprise Web Server 3",
"fix_state": "Will not fix",
"package_name": "libxml2",
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3"
}
],
"name": "CVE-2016-3627"
}
{%endhighlight%}
</div>
### Multiple CVES
{% highlight bash %}
# create a file one cve per line
touch cves.txt
echo "CVE-2016-3627" >> cves.txt
echo "CVE-2016-1839" >> cves.txt
./rpm_pkg_audit.rb --cves-from-file cves.txt
{% endhighlight %}
<button type="button" class="collapsible" id="json2">Click here for the JSON.</button>
<div class="content" id="json2data" markdown="1">
{% highlight json %}
[
{
"CVE": "CVE-2016-1839",
"severity": "moderate",
"public_date": "2016-05-23T00:00:00Z",
"advisories": [
"RHSA-2016:1292",
"RHSA-2016:2957"
],
"bugzilla": "1338703",
"bugzilla_description": "CVE-2016-1839 libxml2: Heap-based buffer overread in xmlDictAddString",
"cvss_score": 4.3,
"cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"CWE": "CWE-122",
"affected_packages": [
"libxml2-0:2.9.1-6.el7_2.3",
"libxml2-0:2.7.6-21.el6_8.1"
],
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-1839.json"
},
{
"CVE": "CVE-2016-3627",
"severity": "moderate",
"public_date": "2016-03-21T00:00:00Z",
"advisories": [
"RHSA-2016:1292",
"RHSA-2016:2957"
],
"bugzilla": "1319829",
"bugzilla_description": "CVE-2016-3627 libxml2: stack exhaustion while parsing xml files in recovery mode",
"cvss_score": 4.3,
"cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"CWE": "CWE-674",
"affected_packages": [
"libxml2-0:2.9.1-6.el7_2.3",
"libxml2-0:2.7.6-21.el6_8.1"
],
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-3627.json"
}
]
{%endhighlight%}
</div>
This will give us json data back for multiple cves, in the order that we
created them in our file.
When we query with multiple cves in a file, we will split up the requests to
groups of 500 cve ids.
<hr>
### Advisories
Redhat will post a security advisory when a vulnerability comes out. These are
in the schema RHSA-YEAR:ADVISORY_NUM. As an example: RHSA-2019:0997
{% highlight bash %}
./rpm_pkg_audit.rb --advisory RHSA-2019:0997
{%endhighlight %}
<button type="button" class="collapsible" id="json3">Click here for the JSON.</button>
<div class="content" id="json3data" markdown="1">
{% highlight json %}
[
{
"CVE": "CVE-2019-9636",
"severity": "important",
"public_date": "2019-03-06T00:00:00Z",
"advisories": [
"RHBA-2019:0763",
"RHSA-2019:2980",
"RHSA-2019:0806",
"RHSA-2019:1467",
"RHSA-2019:0981",
"RHSA-2019:0710",
"RHSA-2019:0765",
"RHSA-2019:0997",
"RHSA-2019:3170",
"RHBA-2019:0764",
"RHSA-2019:0902"
],
"bugzilla": "1688543",
"bugzilla_description": "CVE-2019-9636 python: Information Disclosure due to urlsplit improper NFKC normalization",
"cvss_score": null,
"cvss_scoring_vector": null,
"CWE": "CWE-172",
"affected_packages": [
"python3-0:3.6.8-2.el8_0",
"python27-python-0:2.7.13-4.el6",
"rhvm-appliance-0:4.2-20190411.1.el7",
"python27-python-0:2.7.13-6.el7",
"python-0:2.7.5-59.el7_4",
"python-0:2.7.5-70.el7_5",
"rh-python36-python-0:3.6.3-4.el6",
"redhat-virtualization-host-0:4.2-20190411.1.el7_6",
"python27:2.7-8000020190410132513.c0efe978",
"rh-python35-python-0:3.5.1-12.el7",
"rh-python35-python-0:3.5.1-12.el6",
"python-0:2.7.5-77.el7_6",
"python-0:2.6.6-68.el6_10",
"rh-python36-python-0:3.6.3-7.el7"
],
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9636.json",
"cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvss3_score": "9.8"
}
]
{%endhighlight%}
</div>
<hr>
### rpm-to-cve.xml
Redhats Security API also posts a mapping of RPM packages to CVEs in a
parseable XML file. This file can be downloaded [here](https://www.redhat.com/security/data/metrics/rpm-to-cve.xml). This commandline program can also
download a fresh XML file locally using the --refresh option.
{% highlight bash %}
./rpm_pkg_audit.rb --refresh
{% endhighlight %}
I run this as a sanity check to make sure the cmd finished downloading the file succesfully
{% highlight bash %}
echo $?
0
{% endhighlight %}
We can search for packages listed in this xml file by passing the --list option
and piping to a standard unix search tool like grep
{% highlight bash %}
./rpm_pkg_audit.rb --list | grep ^kernel
{%endhighlight%}
We can query packages in this xml file by querying the exact package name
{% highlight bash %}
./rpm_pkg_audit.rb --xmlpkg kernel-0:2.6.9-55.EL
{%endhighlight%}
<button type="button" class="collapsible" id="json4">Click here for the JSON.</button>
<div class="content" id="json4data" markdown="1">
{% highlight json %}
{
"rhel_package_name": "kernel-0:2.6.9-55.EL",
"cves": [
"CVE-2005-2873",
"CVE-2005-3257",
"CVE-2006-0557",
"CVE-2006-1863",
"CVE-2007-1592",
"CVE-2007-3379"
],
"cve_count": 6
}
{% endhighlight %}
</div>
<hr>
### Query Redhat API For a package name
We can query the Redhat security API for a specific pkg by querying the BASE
pkg name. In this example we query the API and send bash as a param.
{% highlight bash %}
./rpm_pkg_audit.rb --pkg bash
{%endhighlight%}
<button type="button" class="collapsible" id="json5">Click here for the JSON.</button>
<div class="content" id="json5data" markdown="1">
{%highlight json %}
[
{
"cve_id": "CVE-2019-18276",
"advisories": [
],
"affected_packages": [
]
},
{
"cve_id": "CVE-2012-6711",
"advisories": [
],
"affected_packages": [
]
},
{
"cve_id": "CVE-2019-9924",
"advisories": [
"RHSA-2020:1113",
"RHSA-2020:3474",
"RHSA-2020:3592",
"RHSA-2020:3803",
"RHBA-2020:1540"
],
"affected_packages": [
"ansible-tower-36/ansible-tower:3.6.4-1",
"bash-0:4.2.46-34.el7",
"bash-0:4.2.46-32.el7_6",
"bash-0:4.2.46-34.el7_7",
"bash-0:4.2.46-30.el7_4"
]
},
{
"cve_id": "CVE-2017-5932",
"advisories": [
],
"affected_packages": [
]
},
{
"cve_id": "CVE-2016-9401",
"advisories": [
"RHSA-2017:1931",
"RHSA-2017:0725"
],
"affected_packages": [
"bash-0:4.2.46-28.el7",
"bash-0:4.1.2-48.el6"
]
},
{
"cve_id": "CVE-2016-7543",
"advisories": [
"RHSA-2017:1931",
"RHSA-2017:0725"
],
"affected_packages": [
"bash-0:4.2.46-28.el7",
"bash-0:4.1.2-48.el6"
]
},
{
"cve_id": "CVE-2016-0634",
"advisories": [
"RHSA-2017:1931",
"RHSA-2017:0725"
],
"affected_packages": [
"bash-0:4.2.46-28.el7",
"bash-0:4.1.2-48.el6"
]
},
{
"cve_id": "CVE-2014-6278",
"advisories": [
],
"affected_packages": [
]
},
{
"cve_id": "CVE-2014-6277",
"advisories": [
],
"affected_packages": [
]
},
{
"cve_id": "CVE-2014-7187",
"advisories": [
"RHSA-2014:1312",
"RHSA-2014:1311",
"RHSA-2014:1354",
"RHSA-2014:1306",
"RHSA-2014:1865"
],
"affected_packages": [
"bash-0:3.2-32.el5_9.3",
"bash-0:3.2-33.el5_11.1.sjis.2",
"bash-0:4.2.45-5.el7_0.4",
"rhev-hypervisor6-0:6.5-20140930.1.el6ev",
"bash-0:4.1.2-15.el6_5.2",
"bash-0:3.2-32.el5_9.3.sjis.1",
"bash-0:3.2-33.el5_11.4",
"bash-0:4.1.2-15.el6_5.1.sjis.2"
]
},
{
"cve_id": "CVE-2014-7186",
"advisories": [
"RHSA-2014:1312",
"RHSA-2014:1311",
"RHSA-2014:1354",
"RHSA-2014:1306",
"RHSA-2014:1865"
],
"affected_packages": [
"bash-0:3.2-32.el5_9.3",
"bash-0:3.2-33.el5_11.1.sjis.2",
"bash-0:4.2.45-5.el7_0.4",
"rhev-hypervisor6-0:6.5-20140930.1.el6ev",
"bash-0:4.1.2-15.el6_5.2",
"bash-0:3.2-32.el5_9.3.sjis.1",
"bash-0:3.2-33.el5_11.4",
"bash-0:4.1.2-15.el6_5.1.sjis.2"
]
},
{
"cve_id": "CVE-2014-6271",
"advisories": [
"RHSA-2014:1354",
"RHSA-2014:1294",
"RHSA-2014:1293",
"RHSA-2014:1295"
],
"affected_packages": [
"bash-0:3.0-27.el4.2",
"bash-0:3.2-33.el5_11.1.sjis.1",
"bash-0:3.2-33.el5.1",
"bash-0:4.2.45-5.el7_0.2",
"rhev-hypervisor6-0:6.5-20140930.1.el6ev",
"bash-0:4.1.2-15.el6_5.1",
"bash-0:4.1.2-15.el6_5.1.sjis.1"
]
},
{
"cve_id": "CVE-2014-7169",
"advisories": [
"RHSA-2014:1312",
"RHSA-2014:1311",
"RHSA-2014:1354",
"RHSA-2014:1306",
"RHSA-2014:1865"
],
"affected_packages": [
"bash-0:3.2-32.el5_9.3",
"bash-0:3.2-33.el5_11.1.sjis.2",
"bash-0:4.2.45-5.el7_0.4",
"rhev-hypervisor6-0:6.5-20140930.1.el6ev",
"bash-0:4.1.2-15.el6_5.2",
"bash-0:3.2-32.el5_9.3.sjis.1",
"bash-0:3.2-33.el5_11.4",
"bash-0:4.1.2-15.el6_5.1.sjis.2"
]
},
{
"cve_id": "CVE-2012-3410",
"advisories": [
],
"affected_packages": [
]
},
{
"cve_id": "CVE-2008-5374",
"advisories": [
"RHSA-2011:1073",
"RHSA-2011:0261"
],
"affected_packages": [
"bash-0:3.0-27.el4",
"bash-0:3.2-32.el5"
]
}
]
{% endhighlight %}
</div>
<hr>
### Get the program!
I hope somebody can make use of this program for easier system administration
and security auditing purposes. I encourage all rhel/centos security admins to
make use of it if you would like better insight into CVE data from the vendor
source. You should be able to make use of the program
by cloning my misc_rbtools directory from my Gitlab. I will be expanding this
into its own Ruby gem in the coming days so please check back on this post. I
will update the link to the Ruby Gem page once it has been ported to a Gem!
{%highlight bash %}
git clone https://git.mcdevitt.tech/bpmcdevitt/misc_rbtools.git
Cloning into 'misc_rbtools'...
remote: Enumerating objects: 56, done.
remote: Counting objects: 100% (56/56), done.
remote: Compressing objects: 100% (55/55), done.
remote: Total 815 (delta 28), reused 0 (delta 0), pack-reused 759
Receiving objects: 100% (815/815), 118.60 MiB | 11.06 MiB/s, done.
Resolving deltas: 100% (362/362), done.
cd misc_rbtools/security_tools/redhat_tools/
{%endhighlight%}
You should now have access to the ./rpm_pkg_audit.rb script, have fun auditing!
{% include collapse.html %}

26
_programming/2021-01-30-python-pandas-transform-csv.markdown Normal file
View file

@ -0,0 +1,26 @@
---
layout: programming
title: "python pandas: transform csv - add a new column"
date: 2021-01-30
categories: programming
---
# Problem:
I needed to group severity of CVEs for a project I am working on into low,
medium, and high ranges. We have a risk score value between 0-100 that we can use to
categorize each CVE into a range.
<br>
# Solution:
We use the pandas library because it has some methods already written that allow
us to read a csv file and apply our severity function to the data on each row
in our csv file.
We can use the apply() function to do this with a lambda. We can define a new
column this way and it will write out the newly computed data to its own column
at the end of our file.
<br>
{% include apple_advisories_cve_risk_scores.html %}

58
_security/2022-02-24-docker-wordpress-vulnscanner.markdown Normal file
View file

@ -0,0 +1,58 @@
---
layout: security
title: "A Docker container to find Wordpress vulnerabilities"
date: 2022-02-24
categories: security
---
# WPScan Wordpress Vulnerability Database
## The data:
The WPScan team is a CNA. A [CVE Numbering
Authority](https://www.cve.org/ProgramOrganization/CNAs). A CNA basically gives the
authority to submit vulnerabilities in a piece of software (or hardware) to a particular vendor. The WPScan team finds many vulnerabilities in wordpress installs
all across the internet. Any researcher can submit a vulnerability at the
following [url](https://wpscan.com/submit).
For easier insight into the vulnerability data that they house, they have an [API](https://wpscan.com/docs/api/v3/) that can be
queried. I wrote a docker container that has shellscript wrapper that will query for
vulnerable plugins, themes, and wordpress core versions. I hope it can be
useful for somebody else that wants quick insight into the data this database
houses.
You will need to create an API token on the [wpscan](https://wpscan.com) website. They will allow you
25 free API calls per day on the free plan. That is more than enough for my
hobbyist usage with this program. You can find the source code at my gitlab
[here](https://git.mcdevitt.tech/bpmcdevitt/docker_wordpress_scanner).
Here is an example of the usage and querying for the navz-photo-gallery plugin:
```
docker run --env-file .env wp_checker --plugin 'navz-photo-gallery'
{
"navz-photo-gallery": {
"friendly_name": "ACF Photo Gallery Field",
"latest_version": "1.7.8",
"last_updated": "2021-12-22T19:24:00.000Z",
"popular": true,
"vulnerabilities": [
{
"id": "5855f1fe-28f6-4cd6-a83c-95c23d809b79",
"title": "ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting",
"created_at": "2021-12-20T09:35:11.000Z",
"updated_at": "2021-12-20T09:35:12.000Z",
"published_date": "2021-12-20T00:00:00.000Z",
"description": null,
"poc": null,
"vuln_type": "XSS",
"references": {
"cve": [
"2021-24909"
]
},
"cvss": null,
"fixed_in": "1.7.5",
"introduced_in": null
}
]
}
}
```

96
_security/2022-02-25-cve-cna-security-advisories.markdown Normal file
View file

@ -0,0 +1,96 @@
---
layout: security
title: "cve.org CNA Security Advisories"
date: 2022-02-25
categories: security
---
# cve.org CNA Security Advisories
## The data:
The website hosted at cve.org has recently been revamped. They host the source
code for the site at the following
[url](https://github.com/CVEProject/cve-website).
I wanted to know the organization names of each CNA and if possible, where they post their
vendor security advisories. I was looking for a URL to each advisory for each
vendor. This is so I can look into what
the actual vendor is saying when they are being notified of security
vulnerabilities. To obtain this infromation, we can look through the source
code used in the CVE Project website.
On the website itself if you search the 'List of
Partners' found [here](https://www.cve.org/PartnerInformation/ListofPartners)
you will find a hyperlink to a sub page for each organization name. As of writing this post,
there are 211 partners.
An example of one of the organization names page looks looks like this.
[apache](https://www.cve.org/PartnerInformation/ListofPartners/partner/apache).
Notice the 'View Advisories' link here under the Security Advisories section.
![This](/assets/apache_cna_view_advisories.png){:class="img-responsive"} This is what I was looking for.
It really is nice that they host the source code to their website in the open.
Because of this, I can quickly pull this information that I want by writing a
little bit of code. It's just your standard GET request and parse a JSON file.
I like Ruby and both Python but I have been using Ruby longer, so I use that
more for pulling data quickly like the JSON data we are working with today. You
can find a [JSON
file](https://github.com/CVEProject/cve-website/blob/dev/src/assets/data/CNAsList.json) that the website uses to load the CNA information. We can write code that downloads this json file and parses it...like this!
```
#!/usr/bin/env ruby
# outputs the list of CNA organizationNames and the securityAdvisory urls from the json file here:
# https://raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json
require 'json'
require 'rest-client'
class CnaSecurityAdvisories
attr_accessor :url
def initialize
@url = 'https://raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json'
end
def send_request_rest
RestClient::Request.execute(
method: :get,
url: url
)
end
def parse_res(response)
JSON.parse(response.body)
end
def get_json
res = send_request_rest
if res.code == 200
parse_res(res)
else
"HTTP Status: #{res.code}"
end
end
def perform
json = get_json
json.map do |d|
org_name = d.dig('organizationName')
security_advisories = d.dig('securityAdvisories')
security_advisory_urls = security_advisories.dig('advisories').map { |adv| adv.dig('url') }
{ orgName: org_name, security_advisories_urls: security_advisory_urls }
end
end
end
```
I usually will pull out pry and load the class in the console and run it like this to export the data to a new json file.
```
[3] pry(main)> data = CnaSecurityAdvisories.new.perform
[4] pry(main)> File.write('/home/booboy/cna_security_advisory_urls.json', data.to_json)
=> 25298
```
I have hosted this code at my gitlab.
[source code](https://git.mcdevitt.tech/bpmcdevitt/security_research/-/blob/master/tools/cve_cna_security_advisories/cna_security_advisories.rb) and
[json data](https://git.mcdevitt.tech/bpmcdevitt/security_research/-/blob/master/tools/cve_cna_security_advisories/cna_security_advisory_urls.json)

2
_security/index.html
View file

@ -4,7 +4,7 @@ title: security index
---
<div id="home">
<h1>Security Thoughts</h1>
<h1>Security</h1>
<ul class="security">
{% for post in site.security %}
{%unless post.title == 'security index' %}

BIN
assets/apache_cna_view_advisories.png Executable file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 44 KiB

63
css/screen.css
View file

@ -22,6 +22,7 @@ body {
text-align: center;
}
h1, h2, h3, h4, h5, h6 {
font-size: 100%;
}
@ -233,6 +234,8 @@ ul.security {
}
#post img {
width: auto ;
height: auto ;
max-width: 42em;
padding: 1em 0;
}
@ -372,4 +375,64 @@ ul.security {
#related h2 {
margin-bottom: 1em;
}
/
/* Style the button that is used to open and close the collapsible content */
.collapsible {
background-color: #eee;
color #444;
cursor: pointer;
padding: 18px;
width: 100%;
border: none;
text-align: left;
outline: none;
font-size: 15px;
}
/* Add a background color to the button if it is clicked on (add the .active class with JS), and when you move the mouse over it (hover) */
.active, .collapsible:hover {
background-color: #ccc;
}
/* Style the collapsible content. Note: hidden by default */
.content {
padding: 0 18px;
display: none;
overflow: hidden;
background-color: #f1f1f1;
} /* Style the button that is used to open and close the collapsible content */
.collapsible {
background-color: #eee;
color #444;
cursor: pointer;
padding: 18px;
width: 100%;
border: none;
text-align: left;
outline: none;
font-size: 15px;
}
/* Add a background color to the button if it is clicked on (add the .active class with JS), and when you move the mouse over it (hover) */
.active, .collapsible:hover {
background-color: #ccc;
}
/* Style the collapsible content. Note: hidden by default */
.content {
padding: 0 18px;
display: none;
overflow: hidden;
background-color: #f1f1f1;
}
@media only screen and (min-width: 481px) {
body {
padding-top: 24px;
padding-right: 24px;
padding-left: 24px;
padding-bottom: 24px;
}
/

2
index.html
View file

@ -31,7 +31,7 @@ title: brendan mcdevitt
{% endfor %}
</ul>
<h1>Security Thoughts</h1>
<h1>Security</h1>
<ul class="security">
{% for post in site.security %}
{% unless post.title == 'security index' %}