testssl.sh-masscan
testssl.sh-masscan copied to clipboard
Import script does import the vulnerabilities
Hello,
I noticed when trying to use your script to import the csv files into elastic search nothing gets imported for the vulnerabilities as it appears with - and also when trying to do a search in kibana nothing is found for vulnerabilities.
I was having similar issues. Observations:
- As of testssl 2.9dev that NOT OK no longer appears to be consistently included within findings
- within docTestest.py not all testssl vulnerabilities test cases are included in the potential vulnerabilities test
I am not sure if this is the best long term strategy, but tactically this is the approach I took.
within docTestssl.py #reVulnerable = re.compile("\(NOT ok\)", re.IGNORECASE) reVulnerable = re.compile("(LOW|MEDIUM|HIGH|CRITICAL)", re.IGNORECASE)
#elif line['id'] in ("heartbleed", "ccs", "secure_renego", "sec_client_renego", "crime", "breach", "poodle_ssl", "fallback_scsv", "freak", "DROWN", "logjam", "beast", "rc4") and reVulnerable.search(line['finding']): elif line['id'] in ("heartbleed", "ccs", "secure_renego", "sec_client_renego", "crime", "breach", "poodle_ssl", "fallback_scsv", "sweet32", "freak", "drown", "DROWN", "logjam", "LOGJAM_common primes", "cbc_tls1", "lucky13", "ticketbleed", "beast", "rc4") and reVulnerable.search(line['severity']):
Hope this helps