1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from datetime import datetime
import pygeoip
from elasticsearch import Elasticsearch
from libnmap.parser import NmapParser
def store_report(nmap_report, database, index):
rval = True
for nmap_host in nmap_report.hosts:
rv = store_reportitem(nmap_host, database, index)
if rv is False:
print(
"Failed to store host {0} in "
"elasticsearch".format(nmap_host.address)
)
rval = False
return rval
def get_os(nmap_host):
rval = {"vendor": "unknown", "product": "unknown"}
if nmap_host.is_up() and nmap_host.os_fingerprinted:
cpelist = nmap_host.os.os_cpelist()
if len(cpelist):
mcpe = cpelist.pop()
rval.update(
{"vendor": mcpe.get_vendor(), "product": mcpe.get_product()}
)
return rval
def get_geoip_code(address):
gi = pygeoip.GeoIP("/usr/share/GeoIP/GeoIP.dat")
return gi.country_code_by_addr(address)
def store_reportitem(nmap_host, database, index):
host_keys = [
"starttime",
"endtime",
"address",
"hostnames",
"ipv4",
"ipv6",
"mac",
"status",
]
jhost = {}
for hkey in host_keys:
if hkey == "starttime" or hkey == "endtime":
val = getattr(nmap_host, hkey)
jhost[hkey] = datetime.fromtimestamp(int(val) if len(val) else 0)
else:
jhost[hkey] = getattr(nmap_host, hkey)
jhost.update({"country": get_geoip_code(nmap_host.address)})
jhost.update(get_os(nmap_host))
for nmap_service in nmap_host.services:
reportitems = get_item(nmap_service)
for ritem in reportitems:
ritem.update(jhost)
database.index(index=index, doc_type="NmapItem", body=ritem)
return jhost
def get_item(nmap_service):
service_keys = ["port", "protocol", "state"]
ritems = []
# create report item for basic port scan
jservice = {}
for skey in service_keys:
jservice[skey] = getattr(nmap_service, skey)
jservice["type"] = "port-scan"
jservice["service"] = nmap_service.service
jservice["service-data"] = nmap_service.banner
ritems.append(jservice)
# create report items from nse script output
for nse_item in nmap_service.scripts_results:
jnse = {}
for skey in service_keys:
jnse[skey] = getattr(nmap_service, skey)
jnse["type"] = "nse-script"
jnse["service"] = nse_item["id"]
jnse["service-data"] = nse_item["output"]
ritems.append(jnse)
return ritems
xmlscans = [
"../libnmap/test/files/1_hosts.xml",
"../libnmap/test/files/full_sudo6.xml",
"/vagrant/nmap_switches.xml",
"/vagrant/nmap-5hosts.xml",
]
for xmlscan in xmlscans:
nmap_report = NmapParser.parse_fromfile(xmlscan)
if nmap_report:
rep_date = datetime.fromtimestamp(int(nmap_report.started))
index = "nmap-{0}".format(rep_date.strftime("%Y-%m-%d"))
db = Elasticsearch()
j = store_report(nmap_report, db, index)
|
