Question

我试图解析nessus xml报告，并试图获取具体的描述和plugin_output，但由于某种原因似乎无法获取

我有以下xml数据：

<ReportHost name="WebServerA.internal">
<HostProperties>
<tag name="cpe-1">cpe:/a:microsoft:iis:8.5</tag>
<tag name="cpe">cpe:/o:microsoft:windows</tag>
<tag name="patch-summary-total-cves">14</tag>
<tag name="cpe-0">cpe:/o:microsoft:windows_server_2012:r2</tag>
<tag name="system-type">general-purpose</tag>
<tag name="operating-system">Microsoft Windows Server 2012 R2 Standard</tag>
<tag name="LastUnauthenticatedResults">1545398521</tag>
<tag name="Credentialed_Scan">false</tag>
<tag name="policy-used">Basic Network Scan</tag>
<tag name="os">windows</tag>
<tag name="mac-address">00:10:36:A5:3B:AA</tag>
<tag name="host-fqdn">WebServerA.internal</tag>
<tag name="host-rdns">WebServerA.internal</tag>
<tag name="HOST_END">Fri Dec 21 08:22:01 2018</tag>
<tag name="netbios-name">WEBSERVERA</tag>
<tag name="host-ip">10.1.5.33</tag>
<tag name="HOST_START">Fri Dec 21 08:16:28 2018</tag>
</HostProperties>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="117886" pluginName="Local Checks Not Enabled (info)" pluginFamily="Settings">
<description>Nessus did not enable local checks on the remote host. This does not necessarily indicate a problem with the scan. </description>
<plugin_output>
The following issues were reported :

  - Plugin      : no_local_checks_credentials.nasl
    Plugin ID   : 110723
    Plugin Name : No Credentials Provided
    Message     :
Credentials were not provided for detected SSH service.
</plugin_output>
</ReportItem>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="19506" pluginName="Nessus Scan Information" pluginFamily="Settings">
<description>This plugin displays, for each tested host, information about the scan itself :

  - The version of the plugin set.
  - The type of scanner (Nessus or Nessus Home).
  - The version of the Nessus Engine.
  - The port scanner(s) used.
  - The port range scanned.
  - Whether credentialed or third-party patch management     checks are possible.
  - The date of the scan.
  - The duration of the scan.
  - The number of hosts scanned in parallel.
  - The number of checks done in parallel.
</description>
<plugin_output>Information about this scan :

Nessus version : 7.1.1
Plugin feed version : 201810052251
Scanner edition used : Nessus
</plugin_output>
</ReportHost>

下面的代码是我试图用来遍历并获取数据的代码，但是当我运行child循环并打印child.attrib时，它只是返回一个空白{}而没有似乎能够获取报告项目以及它们之间的内容。

for host in root.iter('HostProperties'):
    for child in host:
        print child.attrib

Answer 1

我认为您的xml不正确，因为标记：

<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="19506" pluginName="Nessus Scan Information" pluginFamily="Settings">

用</ReportItem>不能正确关闭。当我按照以下示例关闭它时，我得到了正确的答案：

<ReportHost name="WebServerA.internal">
<HostProperties>
<tag name="cpe-1">cpe:/a:microsoft:iis:8.5</tag>
<tag name="cpe">cpe:/o:microsoft:windows</tag>
<tag name="patch-summary-total-cves">14</tag>
<tag name="cpe-0">cpe:/o:microsoft:windows_server_2012:r2</tag>
<tag name="system-type">general-purpose</tag>
<tag name="operating-system">Microsoft Windows Server 2012 R2 Standard</tag>
<tag name="LastUnauthenticatedResults">1545398521</tag>
<tag name="Credentialed_Scan">false</tag>
<tag name="policy-used">Basic Network Scan</tag>
<tag name="os">windows</tag>
<tag name="mac-address">00:10:36:A5:3B:AA</tag>
<tag name="host-fqdn">WebServerA.internal</tag>
<tag name="host-rdns">WebServerA.internal</tag>
<tag name="HOST_END">Fri Dec 21 08:22:01 2018</tag>
<tag name="netbios-name">WEBSERVERA</tag>
<tag name="host-ip">10.1.5.33</tag>
<tag name="HOST_START">Fri Dec 21 08:16:28 2018</tag>
</HostProperties>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="117886" pluginName="Local Checks Not Enabled (info)" pluginFamily="Settings">
<description>Nessus did not enable local checks on the remote host. This does not necessarily indicate a problem with the scan. </description>
<plugin_output>
The following issues were reported :

  - Plugin      : no_local_checks_credentials.nasl
    Plugin ID   : 110723
    Plugin Name : No Credentials Provided
    Message     :
Credentials were not provided for detected SSH service.
</plugin_output>
</ReportItem>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="19506" pluginName="Nessus Scan Information" pluginFamily="Settings">
<description>This plugin displays, for each tested host, information about the scan itself :

  - The version of the plugin set.
  - The type of scanner (Nessus or Nessus Home).
  - The version of the Nessus Engine.
  - The port scanner(s) used.
  - The port range scanned.
  - Whether credentialed or third-party patch management     checks are possible.
  - The date of the scan.
  - The duration of the scan.
  - The number of hosts scanned in parallel.
  - The number of checks done in parallel.
</description>
<plugin_output>Information about this scan :

Nessus version : 7.1.1
Plugin feed version : 201810052251
Scanner edition used : Nessus
</plugin_output>
</ReportItem>
</ReportHost>

下面是我的结果，使用的代码与您使用的代码相同：

{'name': 'cpe-1'}
{'name': 'cpe'}
{'name': 'patch-summary-total-cves'}
{'name': 'cpe-0'}
{'name': 'system-type'}
{'name': 'operating-system'}
{'name': 'LastUnauthenticatedResults'}
{'name': 'Credentialed_Scan'}
{'name': 'policy-used'}
{'name': 'os'}
{'name': 'mac-address'}
{'name': 'host-fqdn'}
{'name': 'host-rdns'}
{'name': 'HOST_END'}
{'name': 'netbios-name'}
{'name': 'host-ip'}
{'name': 'HOST_START'}

希望这对您有所帮助。

从xml获取特定元素数据

1 个答案: