public BindingSource getBindingSource(string targetCol = null, string keyword = null)
{
string query = "SELECT * FROM Amendment";
//if (targetCol != null && keyword != null)
// query += " WHERE " + targetCol + " LIKE '%" + keyword + "%'";
// Create
sqlite_conn = new SQLiteConnection("Data source=" + path + ";Version=3;New=True;Compress=True;");
// Open
sqlite_conn.Open();
// Create command
sqlite_cmd = sqlite_conn.CreateCommand();
Record.Record tempRecord = new Record.Record();
sqlite_cmd.CommandText = query;
SQLiteDataReader sqlite_datareader = sqlite_cmd.ExecuteReader();
DataTable dataTable = new DataTable();
dataTable.Load(sqlite_datareader);
foreach (DataColumn col in dataTable.Columns)
{
col.AllowDBNull = true;
}
BindingSource bSource = new BindingSource();
bSource.DataSource = dataTable;
sqlite_conn.Close();
return(bSource);
}
private void CheckNotPresent(Record.Record rec)
{
if (rec != null)
{
throw new RecordFormatException("Duplicate PageSettingsBlock record (sid=0x"
+ StringUtil.ToHexString(rec.Sid) + ")");
}
}
/*
* This is the output method.
* It is used to output the file from given path and also given Record.
*/
public override void output(string path, ref Record.Record record)
{
this.record = record;
using (WordprocessingDocument wordDoc = WordprocessingDocument.Create(path, WordprocessingDocumentType.Document)) {
new DocxTemplateBuilder().build(wordDoc, this);
}
}
/// <summary>
/// This is the output method.
/// It is used to output the file from given path and also given Record.
/// </summary>
/// <param name="path">the file path for output</param>
/// <param name="record">the Record for output</param>
public override void output(string fileName, ref Record.Record record)
{
StreamWriter sw = new StreamWriter(fileName);
sw.Write(getOutput(ref record));
sw.Flush();
sw.Close();
}
public void output(String path, ref Record.Record record)
{
OutputDefault outputFormater = getOutputFormater(path);
if (outputFormater != null)
{
outputFormater.output(path, ref record);
}
}
public void output(String path, String template, ref Record.Record record, ref Dictionary <String, String> dict)
{
OutputFromTemplateFormater outputFormater = getOutputFormater(path, template);
if (outputFormater != null)
{
outputFormater.output(path, template, ref record, ref dict);
}
}
/// <summary>
/// This is the getData method.
/// It is used to get data from the given XML file path and store
/// those data in given Record.
/// </summary>
/// <param name="filePath">the file path includes the needed information</param>
/// <param name="record">the record storing the output</param>
public override void getData(string filePath, ref Record.Record record)
{
this.tempRecord = record;
XmlTextReader reader = new XmlTextReader(filePath);
Dictionary <String, String> attributes = null;
String name = null;
// read the xml file
while (reader.Read())
{
switch (reader.NodeType)
{
case XmlNodeType.Element:
if (reader.Name != null)
{
// isEndTag here checks for self-ended tag
bool isEndTag = reader.IsEmptyElement;
name = reader.Name;
attributes = new Dictionary <string, string>();
while (reader.MoveToNextAttribute()) // Read the attributes
{
attributes[reader.Name] = reader.Value;
}
// action for startTag
startTag(name, attributes);
// is self-ended tag, take action on endTag
if (isEndTag)
{
endTag(name);
}
}
break;
case XmlNodeType.Text:
pushContent(reader.Value);
break;
case XmlNodeType.CDATA:
pushContent(reader.Value);
break;
case XmlNodeType.EndElement:
endTag(reader.Name);
break;
}
}
}
public override void output(string path, ref Record.Record record)
{
this.record = record;
// Create a Wordprocessing document.
using (SpreadsheetDocument package = SpreadsheetDocument.Create(path, SpreadsheetDocumentType.Workbook)) {
// Add a new workbook part
WorkbookPart wbPart = package.AddWorkbookPart();
wbPart.Workbook = new Workbook();
// Add a new worksheet part
WorksheetPart wsPart = package.WorkbookPart.AddNewPart <WorksheetPart>();
//Create the Spreadsheet DOM
Worksheet worksheet = new Worksheet();
SheetData sheetData = new SheetData();
String[] stringArray = { "Plugin Name",
"Hosts Affected",
"Description",
"Impact",
"Risk Level",
"Recommendations",
"Reference (CVE)",
"Reference (BID)",
"Reference (OSVDB)" };
sheetData.Append(buildRow(stringArray));
worksheet.Append(sheetData);
printHighRisk(sheetData);
printMediumRisk(sheetData);
printLowRisk(sheetData);
printNoneRisk(sheetData);
printOpenPort(sheetData);
wsPart.Worksheet = worksheet;
// Save changes to the spreadsheet part
wsPart.Worksheet.Save();
// create the worksheet to workbook relation
wbPart.Workbook.AppendChild(new Sheets());
wbPart.Workbook.GetFirstChild <Sheets>().AppendChild(new Sheet()
{
Id = wbPart.GetIdOfPart(wsPart),
SheetId = 1,
Name = "Findings"
});
wbPart.Workbook.Save();
}
}
public Record.Record getData(List <String> paths)
{
record = new Record.Record();
foreach (String path in paths)
{
Parser inputParser = getInputParser(path);
if (inputParser != null)
{
inputParser.getData(path, ref record);
}
}
return(record);
}
// TextFileParser functions
public override void getData(string filePath, ref Record.Record record)
{
this.tempRecord = record;
try {
using (StreamReader sr = new StreamReader(filePath)) {
string line;
while ((line = sr.ReadLine()) != null)
{
processData(line);
}
}
}
catch (System.IO.IOException) {
}
}
public Databaser(String path, ref Record.Record record)
{
this.path = path;
this.record = record;
// Create
sqlite_conn = new SQLiteConnection("Data source=" + path + ";Version=3;New=True;Compress=True;");
// Open
sqlite_conn.Open();
// Create command
sqlite_cmd = sqlite_conn.CreateCommand();
// Command
sqlite_cmd.CommandText = "CREATE TABLE IF NOT EXISTS Record(" +
"id INTEGER PRIMARY KEY," +
"originalId INTEGER," +
"pluginName VARCHAR(500) NOT NULL," +
"ipList VARCHAR(1000) NOT NULL," +
"description VARCHAR(1000) NOT NULL," +
"impact VARCHAR(2000) NOT NULL," +
"riskfactor VARCHAR(10) NOT NULL," +
"recommendation VARCHAR(2000) NOT NULL," +
"bidlist VARCHAR(2000) NOT NULL," +
"cvelist VARCHAR(2000) NOT NULL," +
"osvdblist VARCHAR(2000) NOT NULL," +
"referenceLink VARCHAR(200)," +
"revisionNo INTEGER" +
");";
// Execute non query command
sqlite_cmd.ExecuteNonQuery();
insertRecordToDatabase(record.getHighRisk());
insertRecordToDatabase(record.getMediumRisk());
insertRecordToDatabase(record.getLowRisk());
insertRecordToDatabase(record.getNoneRisk());
insertRecordToDatabase(record.getOpenPort());
sqlite_conn.Close();
}
/// <summary>
/// This is the getData method.
/// It is used to get data from the given text file path and store
/// those data in given Record.
/// </summary>
/// <param name="filePath">the file path includes the useful information</param>
/// <param name="record">the variable stores the output</param>
public override void getData(string filePath, ref Record.Record record)
{
this.tempRecord = record;
try {
string line;
// read through the text file
using (StreamReader sr = new StreamReader(filePath)) {
while ((line = sr.ReadLine()) != null)
{
// process each line
if (line == "65389/tcp unknown unknown")
{
continue;
}
processData(line);
}
}
}
catch (System.IO.IOException) {
}
}
override public void getData(String filePath, ref Record.Record record)
{
this.tempRecord = record;
XmlTextReader reader = new XmlTextReader(filePath);
Dictionary <String, String> attributes = null;
String name = null;
while (reader.Read())
{
switch (reader.NodeType)
{
case XmlNodeType.Element:
if (reader.Name != null)
{
name = reader.Name;
attributes = new Dictionary <string, string>();
while (reader.MoveToNextAttribute()) // Read the attributes
{
attributes[reader.Name] = reader.Value;
}
startTag(name, attributes);
}
break;
case XmlNodeType.Text:
pushContent(reader.Value);
break;
case XmlNodeType.EndElement:
endTag(reader.Name);
break;
}
}
}
abstract public void output(String path, ref Record.Record record);
/// <summary>
/// This is the output method.
/// It is used to output the file from given path and also given Record.
/// </summary>
/// <param name="path">the file path for output</param>
/// <param name="record">the Record for output</param>
public override void output(string path, ref Record.Record record)
{
#region // get Useful Data
List <DataEntry> highRisk = record.getHighRiskEntriesWithoutHotfix();
List <DataEntry> mediumRisk = record.getMediumRiskEntriesWithoutHotfix();
List <DataEntry> lowRisk = record.getLowRiskEntriesWithoutHotfix();
List <DataEntry> noneRisk = record.getNoneRiskEntriesWithoutHotfix();
Dictionary <int, DataEntry> openPort = new Dictionary <int, DataEntry>();
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
openPort = record.getOpenPort();
}
List <DataEntry> tempEntries = record.getWholeEntriesWithoutOpenPortAndHotfix();
Record.Record tempRecord = new Record.Record();
foreach (DataEntry entry in tempEntries)
{
tempRecord.guiAddEntry(entry);
}
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
foreach (DataEntry entry in openPort.Values)
{
tempRecord.guiAddEntry(entry);
}
}
RiskStats riskStats = tempRecord.getRiskStats();
#endregion
using (WordprocessingDocument wordDoc = WordprocessingDocument.Create(path, WordprocessingDocumentType.Document)) {
MainDocumentPart mainDocumentPart = wordDoc.AddMainDocumentPart();
styleDefinitionsPart = wordDoc.MainDocumentPart.StyleDefinitionsPart;
// If the Styles part does not exist, add it and then add the style.
if (styleDefinitionsPart == null)
{
styleDefinitionsPart = AddStylesPartToPackage(wordDoc);
// Code removed here...
}
AddNewStyle(styleDefinitionsPart, "entry_heading", "Entry_heading");
Document document = new Document();
Body body = new Body();
document.Append(body);
mainDocumentPart.Document = document;
#region // print Risk Statistics
// start output
addParagraph(body, "Risk Statistics", true, 5, false, false);
addParagraph(body, "High Risk: " + highRisk.Count, false, 2, false, false);
addParagraph(body, "Medium Risk: " + mediumRisk.Count, false, 2, false, false);
addParagraph(body, "Low Risk: " + lowRisk.Count, false, 2, false, false);
addParagraph(body, "None Risk: " + noneRisk.Count, false, 2, false, false);
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
addParagraph(body, "Open Port: " + openPort.Count, false, 2, false, false);
}
#endregion
#region // print Host Statistics
// Per host statistics
addParagraph(body, "Risk Statistics", true, 5, true, false);
foreach (KeyValuePair <String, Dictionary <RiskFactor, int> > entry in riskStats.getRiskStats())
{
String tempString = entry.Key;
Dictionary <RiskFactor, int> hostRisks = entry.Value;
foreach (KeyValuePair <RiskFactor, int> hostRisk in hostRisks)
{
if (hostRisk.Key != RiskFactor.NULL)
{
if (hostRisk.Key != RiskFactor.OPEN ||
(hostRisk.Key == RiskFactor.OPEN && Program.state.panelOutputSelect_isOutputOpenPort))
{
tempString += " " + RiskFactorFunction.getEnumString(hostRisk.Key) + ": ";
if (hostRisk.Key != RiskFactor.OPEN)
{
tempString += hostRisk.Value.ToString();
}
else if (Program.state.panelOutputSelect_isOutputOpenPort)
{
bool isOutput = false;
foreach (DataEntry tempEntry in openPort.Values)
{
if (tempEntry.getIp() == entry.Key)
{
tempString += tempEntry.getDescription().Split(',').Length.ToString();
isOutput = true;
break;
}
}
if (!isOutput)
{
tempString += "0";
}
}
}
}
}
addParagraph(body, tempString, false, 0, false, false);
}
#endregion
#region // print HIGH/MEDIUM/LOW/NONE Findings
// High Risks
addParagraph(body, "High Risk Findings\n", true, 2, true, false);
foreach (DataEntry entry in highRisk)
{
addParagraph(body, entry.getPluginName(), true, 0, true, false, true);
addTable(body, buildTable(entry, RiskFactor.HIGH));
}
// Medium Risks
addParagraph(body, "Medium Risk Findings\n", true, 2, true, false);
foreach (DataEntry entry in mediumRisk)
{
addParagraph(body, entry.getPluginName(), true, 0, true, false, true);
addTable(body, buildTable(entry, RiskFactor.MEDIUM));
}
// Low Risks
addParagraph(body, "Low Risk Findings\n", true, 2, true, false);
foreach (DataEntry entry in lowRisk)
{
addParagraph(body, entry.getPluginName(), true, 0, true, false, true);
addTable(body, buildTable(entry, RiskFactor.LOW));
}
// None Risks
addParagraph(body, "None Risk Findings\n", true, 2, true, false);
foreach (DataEntry entry in noneRisk)
{
addParagraph(body, entry.getPluginName(), true, 0, true, false, true);
addTable(body, buildTable(entry, RiskFactor.NONE));
}
#endregion
#region // print Missing Hotfix findings
if (Program.state.panelOutputSelect_isOutputHotfix)
{
addParagraph(body, "Missing Hotfix Findings\n", true, 2, true, false);
addTable(body, buildTableHotfix(new Hotfix(record)));
}
#endregion
#region // print Open Port Findings
// Open Ports
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
addParagraph(body, "Open Ports Findings\n", true, 2, true, false);
addTable(body, buildTableOpenPort(openPort));
}
#endregion
#region // print IP Host Table
// Open Ports
if (Program.state.panelOutputSelect_isOutputIpHost)
{
addParagraph(body, "IP Host Table\n", true, 2, true, false);
addTable(body, buildTableIpHost());
}
#endregion
}
}
private String getOutput(ref Record.Record record)
{
Dictionary <int, DataEntry> highRisk = record.getHighRisk();
Dictionary <int, DataEntry> mediumRisk = record.getMediumRisk();
Dictionary <int, DataEntry> lowRisk = record.getLowRisk();
Dictionary <int, DataEntry> noneRisk = record.getNoneRisk();
Dictionary <int, DataEntry> openPort = record.getOpenPort();
RiskStats riskStats = record.getRiskStats();
StringBuilder sb = new StringBuilder();
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Risk Statistics</H4>" + "\n");
sb.Append("<br>High Risk: " + highRisk.Count + "\n");
sb.Append("<br>Medium Risk: " + mediumRisk.Count + "\n");
sb.Append("<br>Low Risk: " + lowRisk.Count + "\n");
sb.Append("<br>None Risk: " + noneRisk.Count + "\n");
sb.Append("<br>Open Port: " + openPort.Count + "\n");
sb.Append("</DIV>" + "\n");
// Per host statistics
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Risk Statistics</H4>" + "\n");
foreach (KeyValuePair <String, Dictionary <RiskFactor, int> > entry in riskStats.getRiskStats())
{
sb.Append("<br/>");
sb.Append(HTMLOutputFormater.forHTML(entry.Key));
sb.Append(":\t");
Dictionary <RiskFactor, int> hostRisks = entry.Value;
foreach (KeyValuePair <RiskFactor, int> hostRisk in hostRisks)
{
if (hostRisk.Key != RiskFactor.NULL)
{
sb.Append(HTMLOutputFormater.forHTML(RiskFactorFunction.getEnumString(hostRisk.Key) + " : "));
sb.Append(HTMLOutputFormater.forHTML(hostRisk.Value.ToString()) + '\t');
}
}
}
sb.Append("</DIV>" + "\n");
// High Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>High Risk Findings</H4>" + "\n");
foreach (KeyValuePair <int, DataEntry> entry in highRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry.Value, RiskFactor.HIGH));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// Medium Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Medium Risk Findings</H4>" + "\n");
foreach (KeyValuePair <int, DataEntry> entry in mediumRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry.Value, RiskFactor.MEDIUM));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// Low Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Low Risk Findings</H4>" + "\n");
foreach (KeyValuePair <int, DataEntry> entry in lowRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry.Value, RiskFactor.LOW));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// None Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>None Risk Findings</H4>" + "\n");
foreach (KeyValuePair <int, DataEntry> entry in noneRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry.Value, RiskFactor.NONE));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// Open Ports
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Open Ports Findings</H4>" + "\n");
foreach (KeyValuePair <int, DataEntry> entry in openPort)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry.Value, RiskFactor.OPEN));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
return(sb.ToString());
}
public InternalChart(RecordStream rs)
{
_plsRecords = new List <PLSAggregate>();
records = new List <RecordBase>(128);
if (rs.PeekNextSid() != BOFRecord.sid)
{
throw new Exception("BOF record expected");
}
BOFRecord bof = (BOFRecord)rs.GetNext();
if (bof.Type != BOFRecordType.Chart)
{
throw new RuntimeException("Bad BOF record type");
}
records.Add(bof);
while (rs.HasNext())
{
int recSid = rs.PeekNextSid();
Record.Record rec = rs.GetNext();
if (recSid == EOFRecord.sid)
{
records.Add(rec);
break;
}
if (recSid == ChartRecord.sid)
{
continue;
}
if (recSid == ChartFRTInfoRecord.sid)
{
_chartFrtInfo = (ChartFRTInfoRecord)rec;
}
else if (recSid == HeaderRecord.sid)
{
header = (HeaderRecord)rec;
}
else if (recSid == FooterRecord.sid)
{
footer = (FooterRecord)rec;
}
else if (recSid == HCenterRecord.sid)
{
_hCenter = (HCenterRecord)rec;
}
else if (recSid == VCenterRecord.sid)
{
_vCenter = (VCenterRecord)rec;
}
else if (recSid == LeftMarginRecord.sid)
{
_leftMargin = (LeftMarginRecord)rec;
}
else if (recSid == RightMarginRecord.sid)
{
_rightMargin = (RightMarginRecord)rec;
}
else if (recSid == TopMarginRecord.sid)
{
_topMargin = (TopMarginRecord)rec;
}
else if (recSid == BottomMarginRecord.sid)
{
_bottomMargin = (BottomMarginRecord)rec;
}
else if (recSid == UnknownRecord.PLS_004D) // PLS
{
PLSAggregate pls = new PLSAggregate(rs);
PLSAggregateVisitor rv = new PLSAggregateVisitor(records);
pls.VisitContainedRecords(rv);
_plsRecords.Add(pls);
continue;
}
else if (recSid == PrintSetupRecord.sid)
{
printSetup = (PrintSetupRecord)rec;
}
else if (recSid == PrintSizeRecord.sid)
{
_printSize = (PrintSizeRecord)rec;
}
else if (recSid == HeaderFooterRecord.sid)
{
HeaderFooterRecord hf = (HeaderFooterRecord)rec;
if (hf.IsCurrentSheet)
{
_headerFooter = hf;
}
else
{
_sviewHeaderFooters.Add(hf);
}
}
else if (recSid == ProtectRecord.sid)
{
_protect = (ProtectRecord)rec;
}
records.Add(rec);
}
}
/// <summary>
/// This is the output method.
/// It is used to output the file from given path and also given Record.
/// </summary>
/// <param name="path">the file path for output</param>
/// <param name="record">the Record for output</param>
public override void output(string path, ref Record.Record record)
{
this.record = record;
bool isRawRecordOuput = record.getIsOutputRecord();
Record.DataEntry.EntryType outputEntryType = record.getOutputEntryType();
// Create a Wordprocessing document.
using (SpreadsheetDocument package = SpreadsheetDocument.Create(path, SpreadsheetDocumentType.Workbook)) {
#region // print HIGH/MEDIUM/LOW/NONE Findings
// Add a new workbook part
WorkbookPart wbPart = package.AddWorkbookPart();
wbPart.Workbook = new Workbook();
// Add a new worksheet part
WorksheetPart wsPart = package.WorkbookPart.AddNewPart <WorksheetPart>();
//Create the Spreadsheet DOM
Worksheet worksheet = new Worksheet();
SheetData sheetData = new SheetData();
if (!isRawRecordOuput)
{
String[] stringArray = { "Plugin Name",
"Hosts Affected",
"Description",
"Impact",
"Risk Level",
"Recommendations",
"Reference (CVE)",
"Reference (BID)",
"Reference (OSVDB)",
"Reference Link" };
sheetData.Append(buildRow(stringArray));
}
else
{
if (outputEntryType == DataEntry.EntryType.Acunetix)
{
String[] stringArray = { "Plugin Name",
"Hosts Affected",
"Description",
"Impact",
"Risk Level",
"Recommendations",
"File Name",
"SubDomain",
"SubDirectory",
"Department",
"Affected Item ",
"Affected Item Link",
"Affected Item Detail",
"Affected Item Request",
"Affected Item Response",
"ModuleName",
"IsFalsePositive",
"AOP_SourceFile",
"AOP_SourceLine",
"AOP_Additional",
"DetailedInformation",
"AcunetixType",
"Reference" };
sheetData.Append(buildRow(stringArray));
}
else if (outputEntryType == DataEntry.EntryType.NMAP)
{
String[] stringArray = { "Plugin Name",
"Hosts Affected",
"Description",
"Risk Level",
"File Name",
"entryType",
"OS",
"OSDetail",
"openPortList",
"closedPortList",
"filteredPortList",
"unknownPortList" };
sheetData.Append(buildRow(stringArray));
}
else if (outputEntryType == DataEntry.EntryType.MBSA)
{
String[] stringArray = { "Plugin Name",
"Hosts Affected",
"Description",
"Impact",
"Risk Level",
"Recommendations",
"bidlist",
"cvelist",
"osvdblist",
"referenceLink",
"fileName",
"entryType",
"checkID",
"checkGrade",
"checkType",
"checkCat",
"checkRank",
"checkName",
"checkURL1",
"checkURL2",
"checkGroupID",
"checkGroupName",
"detailText",
"updateDataIsInstalled",
"updateDataRestartRequired",
"updateDataID",
"updateDataGUID",
"updateDataBulletinID",
"updateDataKBID",
"updateDataType",
"UpdateDataInformationURL",
"UpdateDataDownloadURL",
"severity",
"tableHeader",
"tableRowData" };
sheetData.Append(buildRow(stringArray));
}
else if (outputEntryType == DataEntry.EntryType.NESSUS)
{
String[] stringArray = { "Plugin Name",
"Hosts Affected",
"Description",
"Impact",
"Risk Level",
"Recommendations",
"bidlist",
"cvelist",
"osvdblist",
"referenceLink",
"fileName",
"entryType",
"port",
"protocol",
"svc_name",
"pluginFamily",
"plugin_publication_date",
"plugin_modification_date",
"cvss_vector",
"cvss_base_score ",
"plugin_output",
"plugin_version ",
"see_alsoList",
"pluginID",
"microSoftID",
"severity" };
sheetData.Append(buildRow(stringArray));
}
}
worksheet.Append(sheetData);
if (!isRawRecordOuput)
{
printHighRisk(sheetData);
printMediumRisk(sheetData);
printLowRisk(sheetData);
printNoneRisk(sheetData);
#endregion
#region // print Missing Hotfix Findings
if (Program.state.panelOutputSelect_isOutputHotfix)
{
printHotfix(sheetData);
}
#endregion
#region // print Open Port Findings
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
printOpenPort(sheetData);
}
#endregion
}
else
{
if (outputEntryType == DataEntry.EntryType.Acunetix)
{
printAcunetixExcel(sheetData);
}
else if (outputEntryType == DataEntry.EntryType.NMAP)
{
printNmapExcel(sheetData);
}
else if (outputEntryType == DataEntry.EntryType.NESSUS)
{
printNessusExcel(sheetData);
}
else if (outputEntryType == DataEntry.EntryType.MBSA)
{
printMbsaExcel(sheetData);
}
}
wsPart.Worksheet = worksheet;
// Save changes to the spreadsheet part
wsPart.Worksheet.Save();
// create the worksheet to workbook relation
wbPart.Workbook.AppendChild(new Sheets());
wbPart.Workbook.GetFirstChild <Sheets>().AppendChild(new Sheet()
{
Id = wbPart.GetIdOfPart(wsPart),
SheetId = 1,
Name = "Findings"
});
wbPart.Workbook.Save();
}
}
/// <summary> /// This is the abstract output method. /// It is used to output the file from given path and also given Record, /// with reference to the given template path and also a dictionary includes /// the string to be replaced. /// </summary> /// <param name="path">the file path for output</param> /// <param name="template">the template path for output</param> /// <param name="record">the Record for output</param> /// <param name="dict">the dict for string replacement</param> abstract public void output(String path, String template, ref Record.Record record, ref Dictionary <String, String> dict);
public override void output(string path, string template, ref Record.Record record, ref Dictionary <String, String> dict)
{
if (!File.Exists(template))
{
Console.Error.WriteLine("The Template doesn't exist.");
Environment.Exit(0);
}
this.record = record;
File.Copy(template, path, true);
calculateRiskStats();
using (WordprocessingDocument doc = WordprocessingDocument.Open(path, true)) {
// Obtain all paragraphs
Paragraph[] paragraphs = doc.MainDocumentPart.Document.Descendants <Paragraph>().ToArray <Paragraph>();
foreach (Paragraph paragraph in paragraphs)
{
// Obtain the whole text from each paragraph
OpenXmlLeafTextElement[] textElements = paragraph.Descendants <OpenXmlLeafTextElement>().ToArray <OpenXmlLeafTextElement>();
String wholeText = "";
foreach (OpenXmlLeafTextElement textElement in textElements)
{
wholeText += textElement.Text;
}
// if the whole text contains '[' and contains ']', it's a string need to replace
if (wholeText.Contains('[') && wholeText.Contains(']'))
{
String beforeReplaceText;
String afterReplaceText;
String text;
if (wholeText.IndexOf('[') == 0)
{
beforeReplaceText = "";
}
else
{
beforeReplaceText = wholeText.Substring(0, wholeText.IndexOf('['));
}
text = wholeText.Substring(wholeText.IndexOf('['), wholeText.LastIndexOf(']') - wholeText.IndexOf('[') + 1);
if (wholeText.LastIndexOf(']') == wholeText.Length - 1)
{
afterReplaceText = "";
}
else
{
afterReplaceText = wholeText.Substring(wholeText.LastIndexOf(']') + 1);
}
bool textChanged = false;
if (dict.ContainsKey(text))
{
text = dict[text];
textChanged = true;
}
else
{
switch (text)
{
case "[Title]":
text = "eWalker";
textChanged = true;
break;
case "[(RESTRICTED)]":
text = "(RESTRICTED)";
textChanged = true;
break;
case "[date]":
text = String.Format("{0:dd/MM/yyyy}", DateTime.Now);
textChanged = true;
break;
case "[version]":
text = "1.0";
textChanged = true;
break;
case "[Responsible person]":
text = "Ricci IEONG, Principal Consultant";
textChanged = true;
break;
case "[phone]":
text = "+852 3520 4004";
textChanged = true;
break;
case "[ver 0.1 date]":
text = String.Format("{0:dd/MM/yyyy}", DateTime.Now);
textChanged = true;
break;
case "[ver 0.1 revisor]":
text = "eWalker Project Team";
textChanged = true;
break;
case "[ver 0.1 description]":
text = "First release";
textChanged = true;
break;
case "[ver 1.0 date]":
text = String.Format("{0:dd/MM/yyyy}", DateTime.Now);
textChanged = true;
break;
case "[ver 1.0 revisor]":
text = "eWalker Project Team";
textChanged = true;
break;
case "[ver 1.0 description]":
text = "Second release";
textChanged = true;
break;
case "[Executive Summary]":
text = "// TODO: Executive Summary";
textChanged = true;
break;
case "[Risk Severity Table]":
break;
case "[number of high risk items]":
text = noOfHighRiskItems.ToString() + " (" + String.Format("{0:0.00}", percentageOfHigh * 100) + "%)";
textChanged = true;
break;
case "[number of medium risk items]":
text = noOfMediumRiskItems.ToString() + " (" + String.Format("{0:0.00}", percentageOfMedium * 100) + "%)";
textChanged = true;
break;
case "[number of low risk items]":
text = noOfLowRiskItems.ToString() + " (" + String.Format("{0:0.00}", percentageOfLow * 100) + "%)";
textChanged = true;
break;
case "[number of AOI risk items]":
text = noOfNoneRiskItems.ToString() + " (" + String.Format("{0:0.00}", percentageOfNone * 100) + "%)";
textChanged = true;
break;
case "[number of total risk items]":
text = totalItems.ToString();
textChanged = true;
break;
case "[High Risk Issues]":
printHighRisk(paragraph);
break;
case "[Medium Risk Issues]":
printMediumRisk(paragraph);
break;
case "[Low Risk Issues]":
printLowRisk(paragraph);
break;
case "[Area of Improvement]":
printNoneRisk(paragraph);
break;
case "[Conclusions]":
break;
case "[tool name 001]":
break;
case "[tool description 001]":
break;
case "[tool name 002]":
break;
case "[tool description 002]":
break;
default:
break;
}
}
if (textChanged)
{
foreach (OpenXmlLeafTextElement textElement in textElements)
{
if (textElement == textElements.First())
{
textElements.First().Text = beforeReplaceText + text + afterReplaceText;
}
else
{
textElement.Remove();
}
}
}
}
}
doc.MainDocumentPart.Document.Save();
}
}
public override void output(string path, ref Record.Record record)
{
Dictionary <int, DataEntry> highRisk = record.getHighRisk();
Dictionary <int, DataEntry> mediumRisk = record.getMediumRisk();
Dictionary <int, DataEntry> lowRisk = record.getLowRisk();
Dictionary <int, DataEntry> noneRisk = record.getNoneRisk();
Dictionary <int, DataEntry> openPort = record.getOpenPort();
RiskStats riskStats = record.getRiskStats();
using (WordprocessingDocument wordDoc = WordprocessingDocument.Create(path, WordprocessingDocumentType.Document)) {
MainDocumentPart mainDocumentPart = wordDoc.AddMainDocumentPart();
Document document = new Document();
Body body = new Body();
document.Append(body);
mainDocumentPart.Document = document;
// start output
addParagraph(body, "Risk Statistics", true, 5, false, false);
addParagraph(body, "High Risk: " + highRisk.Count, false, 2, false, false);
addParagraph(body, "Medium Risk: " + mediumRisk.Count, false, 2, false, false);
addParagraph(body, "Low Risk: " + lowRisk.Count, false, 2, false, false);
addParagraph(body, "None Risk: " + noneRisk.Count, false, 2, false, false);
addParagraph(body, "Open Port: " + openPort.Count, false, 2, false, false);
// Per host statistics
addParagraph(body, "Risk Statistics", true, 5, true, false);
foreach (KeyValuePair <String, Dictionary <RiskFactor, int> > entry in riskStats.getRiskStats())
{
String tempString = entry.Key;
Dictionary <RiskFactor, int> hostRisks = entry.Value;
foreach (KeyValuePair <RiskFactor, int> hostRisk in hostRisks)
{
if (hostRisk.Key != RiskFactor.NULL)
{
tempString += " " + RiskFactorFunction.getEnumString(hostRisk.Key) + ": " +
hostRisk.Value.ToString();
}
}
addParagraph(body, tempString, false, 0, false, false);
}
// High Risks
addParagraph(body, "High Risk Findings\n", true, 2, true, false);
foreach (KeyValuePair <int, DataEntry> entry in highRisk)
{
addParagraph(body, entry.Value.getPluginName(), true, 0, true, false);
addTable(body, buildTable(entry.Value, RiskFactor.HIGH));
}
// Medium Risks
addParagraph(body, "Medium Risk Findings\n", true, 2, true, false);
foreach (KeyValuePair <int, DataEntry> entry in mediumRisk)
{
addParagraph(body, entry.Value.getPluginName(), true, 0, true, false);
addTable(body, buildTable(entry.Value, RiskFactor.MEDIUM));
}
// Low Risks
addParagraph(body, "Low Risk Findings\n", true, 2, true, false);
foreach (KeyValuePair <int, DataEntry> entry in lowRisk)
{
addParagraph(body, entry.Value.getPluginName(), true, 0, true, false);
addTable(body, buildTable(entry.Value, RiskFactor.LOW));
}
// None Risks
addParagraph(body, "None Risk Findings\n", true, 2, true, false);
foreach (KeyValuePair <int, DataEntry> entry in noneRisk)
{
addParagraph(body, entry.Value.getPluginName(), true, 0, true, false);
addTable(body, buildTable(entry.Value, RiskFactor.NONE));
}
// Open Ports
addParagraph(body, "Open Ports Findings\n", true, 2, true, false);
foreach (KeyValuePair <int, DataEntry> entry in openPort)
{
addParagraph(body, entry.Value.getPluginName(), true, 0, true, false);
addTable(body, buildTable(entry.Value, RiskFactor.OPEN));
}
}
}
/// <summary> /// This is the abstract getData method. /// It is used to get data and store to the given record. /// </summary> /// <param name="filePath">the file path needs get information</param> /// <param name="record">the record storing the output</param> public abstract void getData(string filePath, ref Record.Record record);
public Record.Record getRecord()
{
// Create
sqlite_conn = new SQLiteConnection("Data source=" + path + ";Version=3;New=True;Compress=True;");
// Open
sqlite_conn.Open();
// Create command
sqlite_cmd = sqlite_conn.CreateCommand();
Record.Record tempRecord = new Record.Record();
sqlite_cmd.CommandText = "SELECT * " +
"FROM Record AS R " +
"WHERE (R.revisionNo = (SELECT MAX(R2.revisionNo) " +
"FROM Record AS R2 " +
"WHERE R.originalId = R2.originalId)" +
") OR " +
"R.revisionNo = 1;";
SQLiteDataReader sqlite_datareader = sqlite_cmd.ExecuteReader();
while (sqlite_datareader.Read())
{
// get the content of the text field
List <String> cveList = sqlite_datareader["cvelist"].ToString().Split(',').ToList <String>();
List <String> bidList = sqlite_datareader["bidlist"].ToString().Split(',').ToList <String>();
List <String> osvdbList = sqlite_datareader["osvdblist"].ToString().Split(',').ToList <String>();
for (int i = 0; i < cveList.Count; i++)
{
String tempString = "";
foreach (char c in cveList[i])
{
if (c != ' ')
{
tempString += c;
}
}
cveList[i] = tempString;
}
for (int i = 0; i < bidList.Count; i++)
{
String tempString = "";
foreach (char c in bidList[i])
{
if (c != ' ')
{
tempString += c;
}
}
bidList[i] = tempString;
}
for (int i = 0; i < osvdbList.Count; i++)
{
String tempString = "";
foreach (char c in osvdbList[i])
{
if (c != ' ')
{
tempString += c;
}
}
osvdbList[i] = tempString;
}
tempRecord.guiAddEntry(new NessusDataEntry(sqlite_datareader["pluginName"].ToString(),
sqlite_datareader["ipList"].ToString(),
sqlite_datareader["description"].ToString(),
sqlite_datareader["impact"].ToString(),
(int)RiskFactorFunction.getEnum(sqlite_datareader["riskfactor"].ToString()),
RiskFactorFunction.getEnum(sqlite_datareader["riskfactor"].ToString()),
sqlite_datareader["recommendation"].ToString(),
cveList,
bidList,
osvdbList,
sqlite_datareader["referenceLink"].ToString()));
}
sqlite_conn.Close();
return(tempRecord);
}
/// <summary>
/// This is the getOutput method.
/// It is used to create a series of string with HTML elements for the HTML
/// output.
/// </summary>
/// <param name="record">the Record for output</param>
/// <returns>a series of string with HTML tags for HTML output</returns>
private String getOutput(ref Record.Record record)
{
#region // get Useful Data
List <DataEntry> highRisk = record.getHighRiskEntriesWithoutHotfix();
List <DataEntry> mediumRisk = record.getMediumRiskEntriesWithoutHotfix();
List <DataEntry> lowRisk = record.getLowRiskEntriesWithoutHotfix();
List <DataEntry> noneRisk = record.getNoneRiskEntriesWithoutHotfix();
Dictionary <int, DataEntry> openPort = new Dictionary <int, DataEntry>();
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
openPort = record.getOpenPort();
}
List <DataEntry> tempEntries = record.getWholeEntriesWithoutOpenPortAndHotfix();
Record.Record tempRecord = new Record.Record();
foreach (DataEntry entry in tempEntries)
{
tempRecord.guiAddEntry(entry);
}
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
foreach (DataEntry entry in openPort.Values)
{
tempRecord.guiAddEntry(entry);
}
}
RiskStats riskStats = tempRecord.getRiskStats();
#endregion
StringBuilder sb = new StringBuilder();
#region // print Risk Statistics
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Risk Statistics</H4>" + "\n");
sb.Append("<br>High Risk: " + highRisk.Count + "\n");
sb.Append("<br>Medium Risk: " + mediumRisk.Count + "\n");
sb.Append("<br>Low Risk: " + lowRisk.Count + "\n");
sb.Append("<br>None Risk: " + noneRisk.Count + "\n");
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
sb.Append("<br>Open Port: " + openPort.Count + "\n");
}
sb.Append("</DIV>" + "\n");
#endregion
#region // print Host Statistics
// Per host statistics
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Risk Statistics</H4>" + "\n");
foreach (KeyValuePair <String, Dictionary <RiskFactor, int> > entry in riskStats.getRiskStats())
{
sb.Append("<br/>");
sb.Append(HTMLOutputFormater.forHTML(entry.Key));
sb.Append(":\t");
Dictionary <RiskFactor, int> hostRisks = entry.Value;
foreach (KeyValuePair <RiskFactor, int> hostRisk in hostRisks)
{
if (hostRisk.Key != RiskFactor.NULL)
{
if (hostRisk.Key != RiskFactor.OPEN ||
(hostRisk.Key == RiskFactor.OPEN && Program.state.panelOutputSelect_isOutputOpenPort))
{
sb.Append(HTMLOutputFormater.forHTML(RiskFactorFunction.getEnumString(hostRisk.Key) + " : "));
if (hostRisk.Key != RiskFactor.OPEN)
{
sb.Append(HTMLOutputFormater.forHTML(hostRisk.Value.ToString()) + '\t');
}
else if (Program.state.panelOutputSelect_isOutputOpenPort)
{
bool isOutput = false;
foreach (DataEntry tempEntry in openPort.Values)
{
if (tempEntry.getIp() == entry.Key)
{
sb.Append(tempEntry.getDescription().Split(',').Length.ToString() + '\t');
isOutput = true;
break;
}
}
if (!isOutput)
{
sb.Append("0\t");
}
}
}
}
}
}
sb.Append("</DIV>" + "\n");
#endregion
#region // print HIGH/MEDIUM/LOW/NONE Findings
// High Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>High Risk Findings</H4>" + "\n");
foreach (DataEntry entry in highRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry, RiskFactor.HIGH));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// Medium Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Medium Risk Findings</H4>" + "\n");
foreach (DataEntry entry in mediumRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry, RiskFactor.MEDIUM));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// Low Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Low Risk Findings</H4>" + "\n");
foreach (DataEntry entry in lowRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry, RiskFactor.LOW));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
// None Risks
sb.Append("<DIV>" + "\n");
sb.Append("<H4>None Risk Findings</H4>" + "\n");
foreach (DataEntry entry in noneRisk)
{
sb.Append("<p>" + "\n");
sb.Append(getDataEntryHTML(entry, RiskFactor.NONE));
sb.Append("</p>" + "\n");
}
sb.Append("</DIV>" + "\n");
#endregion
#region // print Missing Hotfix Findings
if (Program.state.panelOutputSelect_isOutputHotfix)
{
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Missing Hotfix Findings</H4>" + "\n");
sb.Append("<p>" + "\n");
sb.Append(HTML_TABLE_START);
sb.Append("\n");
sb.Append("<TR>\n");
sb.Append("<TD>Host</TD>\n");
sb.Append("<TD>Missing Hotfix(s)</TD>\n");
sb.Append("</TR>\n");
Dictionary <String, String> hotfixList = new Hotfix(record).getHotfixListGroupByHost();
foreach (KeyValuePair <String, String> finding in hotfixList)
{
sb.Append("<TR>\n");
// ip address for the open port findings
sb.Append("<TD>");
//MessageBox.Show(finding.Key);
sb.Append(finding.Key);
sb.Append("</TD>\n");
// open ports
sb.Append("<TD>");
sb.Append(HTMLOutputFormater.forHTML(finding.Value).Replace("\n", "<br/>"));
sb.Append("</TD>\n");
sb.Append("</TR>\n");
}
sb.Append(HTML_TABLE_END);
sb.Append("</p>" + "\n");
sb.Append("</DIV>" + "\n");
}
#endregion
#region // print Open Port Findings
// Open Ports
if (Program.state.panelOutputSelect_isOutputOpenPort)
{
sb.Append("<DIV>" + "\n");
sb.Append("<H4>Open Ports Findings</H4>" + "\n");
sb.Append("<p>" + "\n");
sb.Append(HTML_TABLE_START);
sb.Append("\n");
sb.Append("<TR>\n");
sb.Append("<TD>Host</TD>\n");
sb.Append("<TD>Open Port(s)</TD>\n");
sb.Append("</TR>\n");
foreach (KeyValuePair <int, DataEntry> keyValuePair in openPort)
{
DataEntry entry = keyValuePair.Value;
sb.Append("<TR>\n");
// ip address for the open port findings
sb.Append("<TD>");
sb.Append(entry.getIp());
sb.Append("</TD>\n");
// open ports
sb.Append("<TD>");
sb.Append(HTMLOutputFormater.forHTML(entry.getDescription()).Replace("\n", "<br/>"));
sb.Append("</TD>\n");
sb.Append("</TR>\n");
}
sb.Append(HTML_TABLE_END);
sb.Append("</p>" + "\n");
sb.Append("</DIV>" + "\n");
}
#endregion
return(sb.ToString());
}
// InputParser functions abstract public void getData(String filePath, ref Record.Record record);
