Changeset 7 for trunk/scanner/db/scavenger.sql

Timestamp:

06/22/07 14:18:59 (2 years ago)

Author:

wisniewski

Message:

Added some Documentation and changed the db/scavenger.sql file to add the views

Files:

• trunk/scanner/db/scavenger.sql (modified) (6 diffs)

trunk/scanner/db/scavenger.sql

@@ -1 +1 @@
-SET NAMES latin1;
-SET FOREIGN_KEY_CHECKS = 0;
+
+CREATE TABLE `divisions` (
+  `id` int(3) NOT NULL auto_increment,
+  `division` varchar(4) NOT NULL default '',
+  `description` varchar(50) NOT NULL default '',
+  PRIMARY KEY  (`id`)
+) ENGINE=MyISAM AUTO_INCREMENT=4 DEFAULT CHARSET=latin1;
+
+insert into `divisions` values('1','ABC','Test 1'),
+ ('2','DEF','Test 2'),
+ ('3','GHI','Test 3');
-
-CREATE TABLE `network` (
@@ -14 +25 @@
- ('2','192.168.15.0','25','2','DEF'),
- ('3','192.168.33.0','24','1','GHI'),
-1
+0
-
-CREATE TABLE `plugins` (
@@ -111 +122 @@
-) ENGINE=InnoDB DEFAULT CHARSET=latin1;
-
+insert into `scanScavengerQuick` values('1','127.0.0.1','001C42C67A48','0','2007-06-21 12:22:42','0','0');
-
-CREATE TABLE `scanScavengerVPN` (
@@ -212 +224 @@
-) ENGINE=InnoDB DEFAULT CHARSET=latin1 COMMENT='InnoDB free: 5120 kB';
-
+insert into `scavenger_nessus` values('5','127.0.0.1','mysql (3306/tcp)','10719','1','\nSynopsis :\n\nA Database server is listening on the remote port.\n\nDescription :\n\nThe remote host is running MySQL, an open-source Database server. It\nis possible to extract the version number of the remote installation\nby receiving the server greeting.\n\nSolution :\n\nRestrict access to the database to allowed IPs only.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe remote MySQL version is 5.0.38-Ubuntu_0ubuntu1-log\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('6','127.0.0.1','general/tcp','12634','1','Nessus can run commands on localhost to check if patches are applied\nThe output of \"uname -a\" is :\nLinux ubuntu 2.6.20-16-generic #2 SMP Thu Jun 7 20:19:32 UTC 2007 i686 GNU/Linux\n\nThe remote Debian system is :\n4.0\n\nLocal security checks have been enabled for this host.\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('7','127.0.0.1','general/tcp','25010','3','\nSeveral remote vulnerabilities have been discovered in the MIT reference\nimplementation of the Kerberos network authentication protocol suite,\nwhich may lead to the execution of arbitrary code. The Common \nVulnerabilities and Exposures project identifies the following problems:\n    It was discovered that the krb5 telnet daemon performs insufficient\n    validation of usernames, which might allow unauthorized logins or\n    privilege escalation.\n    iDefense discovered that a buffer overflow in the logging code of the\n    KDC and the administration daemon might lead to arbitrary code\n    execution.\n    It was discovered that a double free in the RPCSEC_GSS part of the \n    GSS library code might lead to arbitrary code execution.\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.6-2sarge4.\nFor the upcoming stable distribution (etch) these problems have been fixed\nin version 1.4.4-7etch1.\nFor the unstable distribution (sid) these problems will be fixed soon.\nWe recommend that you upgrade your Kerberos packages.\n\n\nSolution : http://www.debian.org/security/2007/dsa-1276\nRisk factor : High\nThe package libkrb53 is vulnerable in Debian 4.0.\nUpgrade to libkrb53_1.4.4-7etch1\n\nCVE : CVE-2007-0956, CVE-2007-0957, CVE-2007-1216\nOther references : DSA:1276\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('8','127.0.0.1','general/tcp','24819','3','\nGerardo Richarte discovered that GnuPG, a free PGP replacement, provides\ninsufficient user feedback if an OpenPGP message contains both unsigned\nand signed portions. Inserting text segments into an otherwise signed\nmessage could be exploited to forge the content of signed messages.\nThis update prevents such attacks\n the old behaviour can still be\nactivated by passing the --allow-multiple-messages option.\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.4.1-1.sarge7.\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 1.4.6-2.\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.6-2.\nWe recommend that you upgrade your gnupg packages.\n\n\nSolution : http://www.debian.org/security/2007/dsa-1266\nRisk factor : High\nThe package gnupg is vulnerable in Debian 4.0.\nUpgrade to gnupg_1.4.6-2\n\nThe package gnupg is vulnerable in Debian etch.\nUpgrade to gnupg_1.4.6-2\n\nCVE : CVE-2007-1263\nOther references : DSA:1266\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('9','127.0.0.1','nessus (1241/tcp)','21643','1','\nSynopsis :\n\nThe remote service encrypts communications using SSL.\n\nDescription :\n\nThis script detects which SSL ciphers are supported by the remote\nservice for encrypting communications. \n\nSee also :\n\nhttp://www.openssl.org/docs/apps/ciphers.html\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nHere is a list of the SSL ciphers supported by the remote server :\n\n  Medium Strength Ciphers (128-bit key)\n    TLSv1\n      DES-CBC-SHA                Kx=RSA        Au=RSA     Enc=DES(56)      Mac=SHA1   \n\n  High Strength Ciphers (> 128-bit key)\n    TLSv1\n      DES-CBC3-SHA               Kx=RSA        Au=RSA     Enc=3DES(168)    Mac=SHA1   \n      AES128-SHA                 Kx=RSA        Au=RSA     Enc=AES(128)     Mac=SHA1   \n      AES256-SHA                 Kx=RSA        Au=RSA     Enc=AES(256)     Mac=SHA1   \n      RC4-MD5                    Kx=RSA        Au=RSA     Enc=RC4(128)     Mac=MD5    \n      RC4-SHA                    Kx=RSA        Au=RSA     Enc=RC4(128)     Mac=SHA1   \n\nThe fields above are :\n\n  {OpenSSL ciphername}\n  Kx={key exchange}\n  Au={authentication}\n  Enc={symmetric encryption method}\n  Mac={message authentication code}\n  {export flag}\n\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('10','127.0.0.1','nessus (1241/tcp)','10147','1','\nSynopsis :\n\nA Nessus daemon is listening on the remote port.\n\nDescription :\n\nA Nessus daemon is listening on the remote port.  It is not\nrecommended to let anyone connect to this port.\n\nAlso, make sure that the remote Nessus installation has\nbeen authorized.\n\nSolution :\n\nFilter incoming traffic to this port.\n\nRisk factor : \n\nNone\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('11','127.0.0.1','http (80/tcp)','11032','1','The following directories were discovered:\n/doc, /icons\n\nWhile this is not, in and of itself, a bug, you should manually inspect \nthese directories to ensure that they are in compliance with company\nsecurity standards\n\nOther references : OWASP:OWASP-CM-006\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('12','127.0.0.1','ssh (22/tcp)','10881','1','The remote SSH daemon supports the following versions of the\nSSH protocol :\n\n  . 1.99\n  . 2.0\n\n\nSSHv2 host key fingerprint : ac:8d:2a:4a:e6:72:0b:2c:5e:7d:10:8f:93:d3:4b:1b\n\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('13','127.0.0.1','ssh (22/tcp)','11574','1','\nThe remote host seem to be  running an SSH server which can allow\nan attacker to determine the existence of a given login by comparing\nthe time the remote sshd daemon takes to refuse a bad password for a \nnon-existent login compared to the time it takes to refuse a bad password\nfor a valid login.\n\nAn attacker may use this flaw to set up  a brute force attack against\nthe remote host.\n\nSolution : Disable PAM support if you do not use it, upgrade to the newest \nversion of OpenSSH\n\nRisk factor : Low\nCVE : CVE-2003-0190\nBID : 7342, 7467, 7482, 11781\nOther references : OSVDB:2109, OSVDB:2140\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('14','127.0.0.1','http (80/tcp)','10662','1','The following CGI have been discovered :\n\nSyntax : cginame (arguments [default value])\n\n. (C=M\nO [A] C=N\nO [D] C=S\nO [A] C=D\nO [A] )\n\n\nDirectory index found at /\n\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC'),
+ ('15','127.0.0.1','http (80/tcp)','10056','2','The /doc directory is browsable.\n/doc shows the content of the /usr/doc directory and therefore it shows which programs and - important! - the version of the installed programs.\n\nSolution : Use access restrictions for the /doc directory.\nIf you use Apache you might use this in your access.conf:\n\n <Directory /usr/doc>\n AllowOverride None\n order deny,allow\n deny from all\n allow from localhost\n </Directory>\n\nRisk factor : High\nCVE : CVE-1999-0678\nBID : 318\n\n','001C42C67A48','1','1','2007-06-21 12:22:42',null,'0','localhost',null,'1','ABC');
-
-CREATE TABLE `scavenger_nessus_archived` (
@@ -263 +286 @@
-) ENGINE=InnoDB DEFAULT CHARSET=latin1;
-
+insert into `scavenger_nessus_timestamps` values('1','','','scan_start','Thu Jun 21 12:11:22 2007'),
+ ('2','','127.0.0.1','host_start','Thu Jun 21 12:11:23 2007'),
+ ('3','','127.0.0.1','host_end','Thu Jun 21 12:11:25 2007'),
+ ('4','','','scan_end','Thu Jun 21 12:11:25 2007'),
+ ('5','','','scan_start','Thu Jun 21 12:17:44 2007'),
+ ('6','','127.0.0.1','host_start','Thu Jun 21 12:17:44 2007'),
+ ('7','','127.0.0.1','host_end','Thu Jun 21 12:17:45 2007'),
+ ('8','','','scan_end','Thu Jun 21 12:17:45 2007'),
+ ('9','','','scan_start','Thu Jun 21 12:19:55 2007'),
+ ('10','','127.0.0.1','host_start','Thu Jun 21 12:19:55 2007'),
+ ('11','','127.0.0.1','host_end','Thu Jun 21 12:19:56 2007'),
+ ('12','','','scan_end','Thu Jun 21 12:19:56 2007'),
+ ('13','','','scan_start','Thu Jun 21 12:22:54 2007'),
+ ('14','','127.0.0.1','host_start','Thu Jun 21 12:22:54 2007'),
+ ('15','','127.0.0.1','host_end','Thu Jun 21 12:27:42 2007'),
+ ('16','','','scan_end','Thu Jun 21 12:27:43 2007');
-
-CREATE TABLE `scavenger_people` (
@@ -286 +325 @@
-
-SET FOREIGN_KEY_CHECKS = 1;
+
+DROP VIEW IF EXISTS `scavenger_nessus_filter`;
+CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`%` SQL SECURITY DEFINER VIEW `scavenger_nessus_filter` AS select `n`.`riskval` AS `riskval`,`n`.`scanType` AS `scanType`,`n`.`host` AS `host`,`n`.`dnsName` AS `dnsName`,`n`.`smbName` AS `smbName`,`n`.`instance` AS `instance`,`n`.`date` AS `date`,`n`.`id` AS `id`,`n`.`color` AS `color`,`n`.`scriptid` AS `scriptid`,`n`.`fk_division` AS `fk_division` from `scavenger_nessus` `n` where ((`n`.`instance` >= 0) and not(`n`.`id` in (select `r`.`fk_nessus_id` AS `fk_nessus_id` from `scan_responses` `r`)));
+
+DROP VIEW IF EXISTS `scavenger_nessus_filter_all`;
+CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`%` SQL SECURITY DEFINER VIEW `scavenger_nessus_filter_all` AS select `n`.`id` AS `id`,`n`.`host` AS `host`,`n`.`service` AS `service`,`n`.`scriptid` AS `scriptid`,`n`.`riskval` AS `riskval`,`n`.`msg` AS `msg`,`n`.`mac` AS `mac`,`n`.`scanID` AS `scanID`,`n`.`scanType` AS `scanType`,`n`.`date` AS `date`,`n`.`originalID` AS `originalID`,`n`.`instance` AS `instance`,`n`.`dnsName` AS `dnsName`,`n`.`smbName` AS `smbName`,`n`.`color` AS `color`,`n`.`fk_division` AS `fk_division` from `scavenger_nessus` `n` where ((`n`.`instance` >= 0) and not(`n`.`id` in (select `r`.`fk_nessus_id` AS `fk_nessus_id` from `scan_responses` `r`)));
+
+DROP VIEW IF EXISTS `scavenger_nessus_filter_w_plugin`;
+CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`%` SQL SECURITY DEFINER VIEW `scavenger_nessus_filter_w_plugin` AS select `f`.`riskval` AS `riskval`,`f`.`scanType` AS `scanType`,`f`.`host` AS `host`,`f`.`dnsName` AS `dnsName`,`f`.`smbName` AS `smbName`,`f`.`instance` AS `instance`,`f`.`date` AS `date`,`f`.`id` AS `id`,`f`.`color` AS `color`,`f`.`scriptid` AS `scriptid`,`f`.`fk_division` AS `fk_division`,`p`.`name` AS `name`,`p`.`category` AS `category` from (`scavenger_nessus_filter` `f` left join `plugins` `p` on((`f`.`scriptid` = `p`.`id`)));