Re: nasl output format / nbe parsing

Bill Petersen <[email protected]> Fri, 09 Dec 2005 06:49:39 -0600
Newsgroups	gmane.comp.security.nessus.devel
Message-ID	<[email protected]>
This is a cryptographically signed message in MIME format.

--===============0656770295==
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=sha1; boundary="------------ms090307080909030800070502"

This is a cryptographically signed message in MIME format.

--------------ms090307080909030800070502
Content-Type: multipart/alternative;
	boundary="------------070409090303010308000009"

This is a multi-part message in MIME format.
--------------070409090303010308000009
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

I totally agree.  Anything that will help make the parsing easier would 
be appreciated.

Bill Petersen, CISSP
Senior Information Security Analyst
Alcatel North America Information Security
[email protected]
Voice: 972-519-4249
Fax:   972-477-5300



Matt Van Mater wrote:

>I was updating a nbe file parser I wrote in perl and noticed a few
>plugins do not output the various fields in the 'normal' order.  For
>example, there are some plugins where the "Risk factor" is printed
>before the "Solution" (nasl #10399), when in most other plugin output
>the solution is printed before the risk factor.  I can give specific
>examples of other plugins that exhibit similar behavior, and can work
>with Renaud/whoever to do that as a 'short term' fix
>
>However, as a long term fix, I'd love to see a truly well formed way
>of parsing all possible fields from a NBE file.  It could be as simple
>as extending the pipe | delimiter to the nasl output fields as well,
>or something more complicated.
>
>I realize that this might result in output lines with empty fields
>that look like:
>results|W.X.Y|W.X.Y.Z|rdp (3389/tcp)||||||||||
>or something more verbose like
>results|W.X.Y|W.X.Y.Z|rdp (3389/tcp)|Synopsis: |Description: |foo: |bar: |baz:
>
>But I personally am very willing to eat a little extra disk space in
>my report files as a tradeoff for having a strictly ordered, well
>formed nasl output.  While my parser can handle a few of the
>inconsistent output formats, it won't be able to handle all of them
>without getting ugly,  and might not work properly if/when new nasls
>are released.
>
>I admit that i'm not the worlds best expert on parsing/regexps but I
>do think I'm fairly good and I find parsing NBE cumbersome due to
>these inconsistencies.  Am I totally off base here?
>
>Matt
>_______________________________________________
>Nessus-devel mailing list
>[email protected]
>http://mail.nessus.org/mailman/listinfo/nessus-devel
>  
>

--------------070409090303010308000009
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="Helvetica, Arial, sans-serif">I totally agree.&nbsp; Anything
that will help make the parsing easier would be appreciated.<br>
<br>
</font>
<pre class="moz-signature" cols="72">Bill Petersen, CISSP
Senior Information Security Analyst
Alcatel North America Information Security
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
Voice: 972-519-4249
Fax:   972-477-5300</pre>
<br>
<br>
Matt Van Mater wrote:
<blockquote
 cite="[email protected]"
 type="cite">
  <pre wrap="">I was updating a nbe file parser I wrote in perl and noticed a few
plugins do not output the various fields in the 'normal' order.  For
example, there are some plugins where the "Risk factor" is printed
before the "Solution" (nasl #10399), when in most other plugin output
the solution is printed before the risk factor.  I can give specific
examples of other plugins that exhibit similar behavior, and can work
with Renaud/whoever to do that as a 'short term' fix

However, as a long term fix, I'd love to see a truly well formed way
of parsing all possible fields from a NBE file.  It could be as simple
as extending the pipe | delimiter to the nasl output fields as well,
or something more complicated.

I realize that this might result in output lines with empty fields
that look like:
results|W.X.Y|W.X.Y.Z|rdp (3389/tcp)||||||||||
or something more verbose like
results|W.X.Y|W.X.Y.Z|rdp (3389/tcp)|Synopsis: |Description: |foo: |bar: |baz:

But I personally am very willing to eat a little extra disk space in
my report files as a tradeoff for having a strictly ordered, well
formed nasl output.  While my parser can handle a few of the
inconsistent output formats, it won't be able to handle all of them
without getting ugly,  and might not work properly if/when new nasls
are released.

I admit that i'm not the worlds best expert on parsing/regexps but I
do think I'm fairly good and I find parsing NBE cumbersome due to
these inconsistencies.  Am I totally off base here?

Matt
_______________________________________________
Nessus-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a class="moz-txt-link-freetext" href="http://mail.nessus.org/mailman/listinfo/nessus-devel">http://mail.nessus.org/mailman/listinfo/nessus-devel</a>
  </pre>
</blockquote>
</body>
</html>

--------------070409090303010308000009--

--------------ms090307080909030800070502
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMvzCC
BCAwggMIoAMCAQICAgE5MA0GCSqGSIb3DQEBBAUAMFUxCzAJBgNVBAYTAkZSMRAwDgYDVQQK
EwdBbGNhdGVsMRYwFAYDVQQLEw1QS0kgQXV0aG9yaXR5MRwwGgYDVQQDExNBbGNhdGVsIElu
dGVybmFsIENBMB4XDTA0MDYxNjE5NTMzMloXDTA2MDYxNjE5NTMzMloweDEZMBcGA1UEChMQ
QWxjYXRlbCBJbnRlcm5hbDEZMBcGCgmSJomT8ixkAQETCUpGMDAxNTMwOTEWMBQGA1UEAxMN
QmlsbCBQRVRFUlNFTjEoMCYGCSqGSIb3DQEJARYZQmlsbC5QZXRlcnNlbkBhbGNhdGVsLmNv
bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzgxWy36UbHYxT5FzciUGNBjvvYbW5no6
LeDMcnm3TFxPE+wrUNNq3VDoHidvRSwqcuIHtHXLb936JvaYfg9Qmh1CtEbPknszo9arifSe
wNvLUlzEjI2sJKSazT6ioL2fDNQNLue03u5e6NK3uZm3Ur4p/sAU+gmDN0PAhZFg3m8CAwEA
AaOCAVkwggFVMA4GA1UdDwEB/wQEAwIFIDARBglghkgBhvhCAQEEBAMCBaAwbgYDVR0gBGcw
ZTBjBgkrDAKHbjsIAwEwVjAcBggrBgEFBQcCAjAQMA4WB0FsY2F0ZWwwAwIBATA2BggrBgEF
BQcCARYqaHR0cDovL3d3dy5hbGNhdGVsLmNvbS9QS0kvaW50ZXJuYWwvY3AucGRmMHkGA1Ud
HwRyMHAwNqA0oDKGMGh0dHA6Ly93d3cuYWxjYXRlbC5jb20vUEtJL2ludGVybmFsL2ludGVy
bmFsLmNybDA2oDSgMoYwaHR0cDovL2F3dy5hbGNhdGVsLmNvbS9QS0kvaW50ZXJuYWwvaW50
ZXJuYWwuY3JsMCQGA1UdEQQdMBuBGUJpbGwuUGV0ZXJzZW5AYWxjYXRlbC5jb20wHwYDVR0j
BBgwFoAUVtds4oYp1x2WRx0RRIboTqxQJjcwDQYJKoZIhvcNAQEEBQADggEBAEiGwNe7TC/t
Jvm6Th8vv4Ab94REsJ3KyUpY7NWM8t+U5BolzClPWlXs8zHyANMDxR2A1eQwmV31b6ilw379
W98qlpPLdRsJP2VwRRiOet7QhF9gDEu0TaYfB9kv3xB2PoXZWlnB9BfGLkcz8mhwDQG3th4v
ClIxC6s2jW6CmiCrBA8/4rFPKoa8f5COmfWNkzyInn6o8jNvwmGSFipWujdpIZVS8oCy4M55
DEiSiBlsAuTFdwtbmoDmjk2cRi76zkcIsq230pQBAGXoXDA4g0woIWbPUojvtYG5D2MGgdkw
5IJtVOsVnASs5SVY3Wjeo6ZORG3b0ZN0T7ArOBFMJrgwggQhMIIDCaADAgECAgIBOjANBgkq
hkiG9w0BAQQFADBVMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHQWxjYXRlbDEWMBQGA1UECxMN
UEtJIEF1dGhvcml0eTEcMBoGA1UEAxMTQWxjYXRlbCBJbnRlcm5hbCBDQTAeFw0wNDA2MTYx
OTUzMzJaFw0wNjA2MTYxOTUzMzJaMHgxGTAXBgNVBAoTEEFsY2F0ZWwgSW50ZXJuYWwxGTAX
BgoJkiaJk/IsZAEBEwlKRjAwMTUzMDkxFjAUBgNVBAMTDUJpbGwgUEVURVJTRU4xKDAmBgkq
hkiG9w0BCQEWGUJpbGwuUGV0ZXJzZW5AYWxjYXRlbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBANLVCU5D0+X1WZzRmmIeyuxkYCGRniox1yO4+G5aeMRgV1mkhof516mrFX6f
143pL0ScK1+Eb8DxTf723t54H/a3jRrmGOZ+wjslAYfTbcSDsFPxJQ3LLN21zO4WA89Oq4YN
RU/2620xlrxLnmoaTewZuc8uWXSdauzZgHleluUvAgMBAAGjggFaMIIBVjAPBgNVHQ8BAf8E
BQMDB4AAMBEGCWCGSAGG+EIBAQQEAwIFoDBuBgNVHSAEZzBlMGMGCSsMAoduOwgDATBWMBwG
CCsGAQUFBwICMBAwDhYHQWxjYXRlbDADAgEBMDYGCCsGAQUFBwIBFipodHRwOi8vd3d3LmFs
Y2F0ZWwuY29tL1BLSS9pbnRlcm5hbC9jcC5wZGYweQYDVR0fBHIwcDA2oDSgMoYwaHR0cDov
L3d3dy5hbGNhdGVsLmNvbS9QS0kvaW50ZXJuYWwvaW50ZXJuYWwuY3JsMDagNKAyhjBodHRw
Oi8vYXd3LmFsY2F0ZWwuY29tL1BLSS9pbnRlcm5hbC9pbnRlcm5hbC5jcmwwJAYDVR0RBB0w
G4EZQmlsbC5QZXRlcnNlbkBhbGNhdGVsLmNvbTAfBgNVHSMEGDAWgBRW12zihinXHZZHHRFE
huhOrFAmNzANBgkqhkiG9w0BAQQFAAOCAQEAOi5s85K9n2Yhqy+QGp/R5luUbny52sI+cfHP
Uz4gur1vLD4rpb8YwZghkTvt6ZYopnH6jzbc6pvGPiCegyCZgB6AJFHDeof6VGhHBwWLLm2S
EKGfjAS4Vl799c36k7SRDQRylEttsAEf7NI9BxtVVhk1nbD40ib0nYrDHPOwK4QgkQQPg223
MsW2xzcxN/l0gvt3iPJXuIknZwUk1CU2Afm2i6R9YvKBjtJk1W374a82Ti91p3E6NMdjMAQy
B+gXnI4nzwe1DbaNJ/mJAZuQn0h73i/WC2NfAMwYjTRX67hRmaLq1tMIEyOBkDwB3eNdR68q
7ySb66/IdffDfXOrtjCCBHIwggNaoAMCAQICAQgwDQYJKoZIhvcNAQEEBQAwUTELMAkGA1UE
BhMCRlIxEDAOBgNVBAoTB0FsY2F0ZWwxFjAUBgNVBAsTDVBLSSBBdXRob3JpdHkxGDAWBgNV
BAMTD0FsY2F0ZWwgUm9vdCBDQTAeFw0wMTA5MDYxMTUxMThaFw0xMTA5MDQxMTUxMThaMFUx
CzAJBgNVBAYTAkZSMRAwDgYDVQQKEwdBbGNhdGVsMRYwFAYDVQQLEw1QS0kgQXV0aG9yaXR5
MRwwGgYDVQQDExNBbGNhdGVsIEludGVybmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAtonheA9cfZ6gIVjljzoJgMPk11u49KMVGNkmdrvHDl3lV8uSoEvLREzgH1M+
awBNRsFuYzYJVYPRk6r1XxctKwJRKwaLE01VqnYmaCi/Cf6Drk8KpB6loRl0p+NxgDEbypR/
3nJrvI3RdBPs84MIROLXIE6iYDgloKTSu2tEfPKT22zsBfQtyvP0LFS2kfZ19emmRv14QYLz
kBUxZkQxgDIuyc5eisVzGremj8TjhOrXY90Ad/CHrXDftCFrnFyvMPTAeOqsqe4/AyVWwEeZ
DHnYbGOJDAOR4wdVZNkoKfjDiBYKSehOvdeCYickkhf2R80SHOJRp6nVYcTIw0nI9wIDAQAB
o4IBTzCCAUswDgYDVR0PAQH/BAQDAgGGMBEGCWCGSAGG+EIBAQQEAwIAhzAdBgNVHQ4EFgQU
Vtds4oYp1x2WRx0RRIboTqxQJjcwHwYDVR0jBBgwFoAU5Gw5z7mdVgsxf9MVNKE6Fj42m4cw
DwYDVR0TAQH/BAUwAwEB/zBqBgNVHSAEYzBhMF8GCSsMAoduOwgBATBSMBwGCCsGAQUFBwIC
MBAwDhYHQWxjYXRlbDADAgEBMDIGCCsGAQUFBwIBFiZodHRwOi8vd3d3LmFsY2F0ZWwuY29t
L1BLSS9yb290L2NwLnBkZjBpBgNVHR8EYjBgMC6gLKAqhihodHRwOi8vd3d3LmFsY2F0ZWwu
Y29tL1BLSS9yb290L3Jvb3QuY3JsMC6gLKAqhihodHRwOi8vYXd3LmFsY2F0ZWwuY29tL1BL
SS9yb290L3Jvb3QuY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCq47YnuqEKOMbrvDcIGskbAv4o
wjFNE8XeJMKPv6UgzVj96SXZMpdJRT1bqWq8q5TiO+WhTJOQcw9WB/GupZuC1EZFKpafF2mn
mnzROZVrr612XKS8CpeDiKEobLA0QV9qBmFZCHH5XuR+ZnOjLKIpeiilSb5NLKKu859ZZPR+
93okoYGoyA7FYxWOaO1ntjGRPtAD1Y7yG0brtV47T31qYTmC8Di4VcjrIbGfsmolSTH1DRXR
iEhUxB18UxEywcXsls6IubVFq6qlLrvO+hfHfD3UZHhMLByemMNaf9iPAu53mvn7tv7TC4Ga
rXp0vzsU2MjhKMXudAi2buZQrh0kMYICkDCCAowCAQEwWzBVMQswCQYDVQQGEwJGUjEQMA4G
A1UEChMHQWxjYXRlbDEWMBQGA1UECxMNUEtJIEF1dGhvcml0eTEcMBoGA1UEAxMTQWxjYXRl
bCBJbnRlcm5hbCBDQQICATowCQYFKw4DAhoFAKCCAYswGAYJKoZIhvcNAQkDMQsGCSqGSIb3
DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUxMjA5MTI0OTM5WjAjBgkqhkiG9w0BCQQxFgQUpKuL
9QsiHco1Dh3pA8KmiFt8HdgwUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAOBggqhkiG
9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwagYJKwYB
BAGCNxAEMV0wWzBVMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHQWxjYXRlbDEWMBQGA1UECxMN
UEtJIEF1dGhvcml0eTEcMBoGA1UEAxMTQWxjYXRlbCBJbnRlcm5hbCBDQQICATkwbAYLKoZI
hvcNAQkQAgsxXaBbMFUxCzAJBgNVBAYTAkZSMRAwDgYDVQQKEwdBbGNhdGVsMRYwFAYDVQQL
Ew1QS0kgQXV0aG9yaXR5MRwwGgYDVQQDExNBbGNhdGVsIEludGVybmFsIENBAgIBOTANBgkq
hkiG9w0BAQEFAASBgES304byNZHvNibsKXkTsq95zrozp8Ag15w9nUcYh+S9BlYLB43wSPrj
OGGe3XcQU6F9KFiB17j+kckCQZC9EprtJ77yVSuanxQTOD58MzXafL3jhQSpjJb+J3DpUJvm
Bkhn4n9aeNohnqSm6Z2tf6rKuYTCp2xBWQ2XcYyebqBEAAAAAAAA
--------------ms090307080909030800070502--

--===============0656770295==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel
--===============0656770295==--