05
Mar
2012

Introducing Uirusu

I am pleased to announce that I have release Uirusu v0.0.1 as an replacement to my previous virustotal gem. This new gem is supports the v2 Virustotal API. The gem includes an example binary called uirusu as an example of how to use the API. Below I have included a few simplified examples of usage.

#First you need to include the correct require files
require 'rubygems'
require 'uirusu'

APT_KEY = "YOUR API KEY HERE"

hash = "FD287794107630FA3116800E617466A9" #Hash for a version of Poison Ivy
url = "http://www.google.com"
comment = "Hey this is Poison Ivy, anyone have a copy of this binary?"

#To query a hash(sha1/sha256/md5)
results = Uirusu::VTFile.query_report(APT_KEY, hash)
result = Uirusu::VTResult.new(hash, results)
print result.to_stdout if result != nil

#To scan for a url
results = Uirusu::VTUrl.query_report(APT_KEY, url)
result = Uirusu::VTResult.new(url, results)
print result.to_stdout if result != nil

#To post a comment to a resource(url/hash/scan_id)
results = Uirusu::VTComment.post_comment(APT_KEY, hash, comment)
print results if results != nil

For a more complex example take a look at the Uirusu::CLI::Application class, it covers uploading files/urls and waiting for them to be processed.

Installation

You can install uirusu with Rubygems, by typing gem install uirusu in your command prompt. Please see the project page for more information.

Issues

Please report any issues that are discovered and I will do my best to fix them in a timely manner.


20
Feb
2012

Risu v1.5.0 Released

Risu v1.5.0 has been released. This adds compatibility with Nessus v5 along with other bug fixes.


#1.5.0 (February 20, 2012)
- Updated the Item model to be compatible with Nessus 5.0
    - Added critical_risks()
    - Added critical_risks_unique()
    - Added critical to the Risks by Severity Graph
    - Everything that used High as its data now uses Critical
    - The new methods also have associated tests.
- Updated the Plugin model to be compatible with Nessus 5.0
    - Added critical_risks()
- Added New tags
    - Plugin Model
        - fname
    - Item Model
        - plugin_name (Not all plugins seem to support this XML struct yet)
- Added new Methods to the Reference class for accessing references easier
    - cve
    - cpe
    - cwe
    - iava
    - msft
    - osvdb
    - owasp
    - cert
    - edb_id
    - rhsa
    - secunia
    - suse
- Added new methods to the Item class
    - stigs_severity_graph()
    - stig_findings()
    - all_risks_unique_sorted() from [aeriff] on github
- New Templates
    - stig_findings_summary - Quick summary of all the stig related findings by severity
- Template Updates
    - technical_findings - Added critical risks
    - exec_summary - added critical risks and a stig graph
    - findings_host - added critical and lowered the font sizes a bunch
    - notable_detailed - added critical and changed header to Notable
    - exec_summary_detailed - added critical risks
    - host_summary - added critical risks
    - graphs - added stig graph
    - host_summary - added critical risks and page numbers
    - Misc changes in other templates
- Added test::unit tests for most of the specs

You can install risu with Rubygems, by typing gem install risu in your command prompt. Please see the project page for more information.

Please report any issues that are discovered and I will do my best to fix them in a timely manner.


23
Jan
2012

Risu v1.4.9 Released

Risu v1.4.9 has been released. This is a minor release adding new XML tags.


    #1.4.9 (January 23, 2012)
    - Added a simple notable vulnerability template table report
    - Added a detailed notable vulnerability template like the technical_findings report just limited to the top vulnerabilities up to 10
    - API for the top 10 vulnerabilities can be found on the Item model
        - top_10_sorted_raw(), returns the top 10 vulnerabilities in an Array sorted in the form of [plugin_id, count]
        - top_10_sorted(), returns the top 10 vulnerabilities in an Array sorted in the form of [name, count]
        - top_10_table(output), inserts a table into the output parameter object with the top 10 data using the top_10_sorted() method
    - All report template classification headers are forced upper case
    - Added 6 PCI related fields
        - pcidss:directory_browsing
        - pcidss:known_credentials
        - pcidss:compromised_host:worm
        - pcidss:unprotected_mssql_db
        - pcidss:obsolete_software
        - pcidss:www:sql_injection
    - Added New XML fields
        - exploit_framework_exploithub
        - exploithub_sku
        - stig_severity
    - Item.risks_by_host now only returns High findings. New accessors for each level will be added for 1.5 with support for the next version of Nessus
    - Fixed a bug on the exec_summary_detailed detailed report
    - A quick reference for Microsoft findings can now be found in the Patch model,
    You are able to get host_id, name(patch name, ie MS01-001), value (plugin_id)
    - Please report any missing tags that risu outputs to jacob[dot]hammackj[@]hammackj[.]com, I expect a ton of Microsoft Patch tags missing

You can install risu with Rubygems, by typing gem install risu in your command prompt. Please see the project page for more information.

Please report any issues that are discovered and I will do my best to fix them in a timely manner.


12
Jul
2011

Risu v1.4.6 Released

Risu v1.4.6 has been released. This is a minor release adding several PCI tags and a user template directory(~/.risu/templates/).


#1.4.6 (July 12, 2011)
- Added pcidss:dns_zone_transfer to the Nessus parser
- Added pcidss:obsolete_operating_system to the Nessus parser
- Removed warnings about several Microsoft patch tags, not sure what to do with them at the moment.
- Added a user template directory. Risu will scan ~/.risu/templates for user templates.

You can install risu with Rubygems, by typing gem install risu in your command prompt. Please see the project page for more information.

Please report any issues that are discovered and I will do my best to fix them in a timely manner.


04
Jul
2011

Risu v1.4.5 Released

Risu v1.4.5 has been released. Major changes to the way templates are handled. They are now treated like plugins and dynamically loaded when risu starts. This means several things, including you no longer have to specify the full path to the template to use it. This also makes it easier for me to add more renderers. This version also includes all of the missing xml fields that have been reported.


#1.4.5 (July 4, 2011)
- Implemented an modular template system, **breaks all existing templates**.
    - All templates are now implemented as Ruby classes this allows them to be dynamically loaded and removes the need to type the entire path to the template
    - This allows me to implement rendering systems that will be able to write pdf/html/rtf/csv in the future without having to have templates for each type
- Updated the Severity Graph and added some auto generated text based on the graph percentages
- Added a method to generate text for the other_os_graph
- Added a method to generate text for the windows_os_graph
- Added some auto generated text for unsupported operating systems to put into a report.
- Added AIX named_scopes on the Host model (os_aix and not_os_aix)
- Unified the colors to be the same for all the graphs
- Added validation of the XML files for Nessus Documents
- Added 'system_type' field to the Nessus parser

You can install risu with Rubygems, by typing gem install risu in your command prompt.

Please report any issues that are discovered and I will do my best to fix them in a timely manner.