Appscan的python扩展工具: PyScan

  Appscan的python扩展工具: PyScan 收藏
      IBM Rational AppScan 是一个面向 Web 应用安全检测的自动化工具，使用它可以自动化检测 Web 应用的安全漏洞，比如跨站点脚本攻击（Cross Site Scripting Flaws）、注入式攻击（Injection Flaws）、失效的访问控制（Broken Access Control）、缓存溢出问题（Buffer Overflows）等等。这些安全漏洞大多包括在 OWASP（Open Web Application Security Project，开放式 Web 应用程序安全项目）所公布的 Web 应用安全漏洞中.
从 7.5 版本以后，Rational Appscan 提供了扩展机制 —— AppScan eXtension Framework。
       利用 Appscan 提供的 eXtension framework，用户可以非常简单的为 AppScan 提供扩展。扩展的内容几乎没有任何限制，可以从一个简单的通知程序到一个非常复杂的安全分析工具，使得用户可以根据自己的需要来客户化 AppScan。AppScan eXtension Framework 支持多种语言，如 Python、C#、C++、J#、Jscript 等等 . 本文主要介绍如何利用python进行扩展--PyScan.

       进入Pyscan的方法：在appscan中点击"工具", "扩展“， "PyScan“。如果没有，可下载安装PyScan。
appScan：AppScan SDK 的主接口 IAppScan 的实例对象。IAppScan 接口包含了 AppScan 扫描测试引擎的主要功能对象，通过使用这个接口的实例，就可以调用 AppScan 的主要功能，它一般作为客户端访问 AppScan 的入口。如该接口中的 Scan 属性，它实际上是 IScanManager 的实例对象。上面的类图列举了 IScanManager 中的部分方法，比如 Scan() 方法用来开始对目标网站的同步扫描，ScanAsync() 和 Scan() 方法功能相同，只不过是异步方法，ResetExploereAndTestData() 用来清空网站扫描和安全测试结果等等。

IAppscan接口
属性：
IConfiguration Config; # 配置信息接口
IScanManager Scan;  # 扫描管理对象

IConfiguration
包含了Appscan进行扫描的配置信息，如配置扫描的代理, 它有成员变量：
IAppScanProxySettings ProxySettings
如果想获取到Appscan的所有漏洞信息，它有成员变量：
IRules Rules; 它能指向每一条漏洞的接口： IIssueTypeData.

IIssueTypeData的公有属性
Advisory: 漏洞的咨询信息
AdvisoryID：漏洞的咨询ID
AdvisoryName：咨询名
CveId： CVE ID
Description： 漏洞描述
Name：漏洞名
RemediationID： 建议ID
RemediationTitle： 建议标题
Severity：安全分数
ThreatClass：威胁分类
UserDefined：该漏洞是否为用户自定义
VariantTypes：有关漏洞检测的过程信息，如检测所用的URL等

IScanManager
这是一个扫描管理对象，包括
公有属性：
CurrentUrl: 当前扫描的URL
ScanData：保存的扫描数据
ScanExpert：扫描专家对象
Status: 扫描状态，如Test扫描状态, Pretest预扫描状态
公有方法：
ResetScanData()：清空扫描数据
ReTest()：重新测试一个漏洞
ReTestAsync()：异步测试
Scan()： 开启一个扫描任务
ScanAsync()：开启一个扫描任务，异步扫描
SendManualTest()：开始一个手动测试。
Stop()：结束当前任务
IScanData
IScanManager.scanData成员是一个IScanData对象，它保存了一个任务的扫描信息。
公有属性：
AppTreeRoot：URL目录树的根结点
Config：扫描的配置信息
TotalScanDuration： 扫描时间
VisitedUrls：扫描的URL

IScanConfiguration
IScanData.Config成员是一个IScanConfiguration对象，它包含了一个任务的扫描配置信息。
公有属性：
ClientSideCertificate：客户认证设置
CommunicationTimeout：会话超时时间（从发送请求，到接收到响应）
CustomErrorPages：定制错误信息页集合。
CustomParameters：定制参数
DefaultLimit：扫描深度设置
ScanPolicy： 深度优先，还是广度优先
SessionManagement：会话管理器
StartingUrl：起启URL
TestPolicy：扫描策略，它包括了漏洞的集合

例程：

# -*- coding: cp936 -*-
import re
import sys
import string
from urlparse import urlparse, urlunparse
import win32com.client
import __main__
appScan = __main__.appScan

startingUrl = ""
vuls_conn = None

def getStartingUrl():
    '''
    get the starting url
    '''
    startingUri = System.Uri(appScan.Scan.ScanData.Config.StartingUrl)
    url = startingUri.ToString()
    print "Starting url is : ", url
    return url

def GetAllIssueTypesCount():
    '''
    Get the count of all the test rules currently installed with Appscan
    '''
    rules = appScan.Config.Rules.IssueTypes
    print len(rules)

def DisplayAllIssueTypes():
    '''
    Display all the test rules installed with Appscan
    '''
    rules = appScan.Config.Rules.IssueTypes
    for rule in rules:
        # rule is a IIssueTypeData class object
        print rule.Description
        print rule.AdvisoryID

def GetCurrentIssueTypesCount():
    '''
    Get the count of current using issue types
    '''
    issueTypesCount = appScan.Scan.ScanData.Config.TestPolicy.IssueTypes.Dictionary.get_Count()
    print "issueTypesCount = ", issueTypesCount
    return issueTypesCount

def GetIssueDescription(issueType):
    '''
    Get the issueType Description of a issueType
    '''
    rules = appScan.Config.Rules.IssueTypes
    for rule in rules:
        if rule.AdvisoryID == issueType.AdvisoryID:
            return rule.Description

def GetIssueType(issueTypeName):
    '''
    Gets an IssueType element according to the giving issueTypeName string
    The IssueType element can be used with the appScan.Scan.SendManualTest method
    '''
    # Get all issue types that partially match the name
    issueTypes = appScan.Scan.ScanData.Config.TestPolicy.IssueTypes
    values = list (issueTypes.Dictionary.Values)

    # Iterate over all of them, trying to get a match
    foundIssueType = None
    for v in values:
        # Check if a partial match was found
        print v.RulesIssueType.Description
        if v.RulesIssueType.Description.__contains__(issueTypeName):
            foundIssueType = v.RulesIssueType.ResultsIssueType

            # If an exact match was found - use that
            if v.RulesIssueType.Description == issueTypeName:
                return foundIssueType

    return foundIssueType

def DisplayConfigInfo():
    '''
    Display some configure information
    '''
    startingUri = System.Uri(appScan.Scan.ScanData.Config.StartingUrl)
    if startingUri != None:
        print "startingUri:", startingUri
       
    scanLimit = appScan.Scan.ScanData.Config.DepthLimit.Value
    print "DepthLimit = ", scanLimit
   
    scanLimit = appScan.Scan.ScanData.Config.NumberOfThreads.__str__;
    print "NumberOfThreads = ", scanLimit

    timeLimit = appScan.Scan.ScanData.Config.TimeLimit.Value
    print "timeLimit = ", timeLimit

def StartScan():
    '''
    Display current scan info
    '''   
    appScan.Scan.ScanData.Config.StartingUrl = "http://stroke.tw/"

    # Set a proxy server
    #appScan.Scan.ScanData.Config.ProxyServerConfiguration.IPAddress = "119.70.40.101"
    #appScan.Scan.ScanData.Config.ProxyServerConfiguration.Port = 8080
    #appScan.Scan.ScanData.Config.ProxyServerConfiguration.Enabled = True

    appScan.Scan.Scan(True, True)
    totalScanDuration = appScan.Scan.ScanData.TotalScanDuration
    print "totalScanDuration = ", totalScanDuration

def GetVisitedUrls():
    '''
    Get the urls visited
    '''
    appData = appScan.Scan.ScanData.AppTreeRoot.GetApplicationData()
    urls = list(appData.VisitedUrls)
    for url in urls:
        print url.Request.Uri.ToString()

def showTestUrlsbyId(advisoryid):
    '''
    show the urls test using
    '''
    issues = appScan.Scan.ScanData.AppTreeRoot.GetIssues()
    issueslist = list(issues)
    for issue in issueslist:
        if issue.IssueType.AdvisoryID != advisoryid:
            continue
        print GetIssueDescription(issue.IssueType)
        tests = list(issue.Variants)
        print len(tests)
        for test in tests:
            request = test.Request.RawRequest
            print request
            print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"

def showAllVuls():
    issues = appScan.Scan.ScanData.AppTreeRoot.GetIssues()
    issueslist = list(issues)
    for issue in issueslist:
        print GetIssueDescription(issue.IssueType)
        tests = list(issue.Variants)
        for test in tests:
            request = test.Request.RawRequest
            print request
            print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
            break

def insertResult(vultype, request, param):

    print "type: ", vultype

    print "request: ", request

    print "param: ", param

def saveScanResults():
    '''
    Display the results of current scan
    '''
    global vuls_conn
   
    issues = appScan.Scan.ScanData.AppTreeRoot.GetIssues()
    issueslist = list(issues)
    print "ISSUES COUNT = ", len(issueslist)

    vuls_conn = win32com.client.Dispatch("ADODB.Connection")
    vuls_DSN = r"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=U:\work\vulns.accdb;Persist Security Info=False;"
    vuls_conn.Open(vuls_DSN)
   
    for issue in issueslist:
        descript = GetIssueDescription(issue.IssueType)
        print "Descript = ", descript

        # XSS
        if issue.IssueType.AdvisoryID == '57':
            tests = list(issue.Variants)
            print len(tests)
           
            for test in tests:
                if test.Vulnerable == True:
                    request = test.Request.RawRequest
                    print request
                    print "~~~~~~~~~~~~~~~~~~~", test.Entity.Name
                    insertResult('XSS', request, test.Entity.Name)
                    break

        # SQL盲注和SQL注入
        if (issue.IssueType.AdvisoryID == '142') or (issue.IssueType.AdvisoryID == '132'):
            tests = list(issue.Variants)
            for test in tests:
                if test.Vulnerable == True:
                    request = test.Request.RawRequest
                    insertResult('SQLInject', request, test.Entity.Name)
                    break

if __name__ == '__main__':
    #getStartingUrl()
    #GetCurrentIssueTypesCount()
    #DisplayAllIssueTypes()
    #DisplayConfigInfo()
    #GetVisitedUrls()
    showAllVuls()
    #showTestUrlsbyId('57')