Repository navigation
Nikto parser unable to handle error cases #604
Description
🐞 Bug report
Describe the bug
The Nikto parser is unable to properly parse findings when Nikto could not find a webserver (returns error as raw finding).
Steps To Reproduce
With Nikto installed, run a scan on a domain without a running webserver.
apiVersion: execution.securecodebox.io/v1
kind: Scan
metadata:
name: nuclei-scan
namespace: securecodebox-scanners
spec:
parameters:
- -host
- google.com
- -port
- "8080"
- -Tuning
- 1,2,3,5,7,b
scanType: nikto
Nikto logs
- Nikto v2.1.6
---------------------------------------------------------------------------
+ No web server found on google.com:8080
---------------------------------------------------------------------------
+ 0 host(s) tested
Nikto raw findings
{"id": "000029","OSVDB": "0","url":"/","msg":"No web server found on google.com:8080"}}Parser logs
Starting Parser
Fetching result file
Fetched result file
Parser failed with error:
TypeError: Cannot read property 'filter' of undefined
at parse (/home/app/parser-wrapper/parser/parser.js:47:26)
at main (/home/app/parser-wrapper/parser-wrapper.js:126:22)
at processTicksAndRejections (internal/process/task_queues.js:95:5)
Furthermore, running Nikto on an unresolvable domain name, results in an empty raw findings file. Parser crashes with the same error.
Expected behavior
If there are no findings, or if Nikto encounters an error, the parser should not crash. The parser should create a finding of Nikto's error.
System (please complete the following information):
secureCodeBox v3.0.1
Activity
rfelber commentedon Aug 20, 2021
Good catch 👍🏻 Thx for reporting this issue.
SebieF commentedon Aug 24, 2021
Unfortunately we could not reproduce the nikto raw findings, instead we got an empty json file (with 0 Bytes). How did you get the raw (invalid) json file
(i.e. {"id": "000029","OSVDB": "0","url":"/","msg":"No web server found on xxxx:80"}})?
But you are right that the parser should not crash.
JohannesZahn commentedon Aug 24, 2021
I added a unit test for this case and will fix the problem as soon as I can .
EndPositive commentedon Aug 24, 2021
I've updated the OP with a concrete example scan for "No webserver found" crash. I had originally redacted the domain name because it was internal.
JohannesZahn commentedon Aug 25, 2021
@EndPositive Thanks for the example. I assume the closing bracket at the end of the output is a typo right?
EndPositive commentedon Aug 25, 2021
It is actually not. I'm not sure why Nikto adds it.
J12934 commentedon Aug 25, 2021
Nikto has produced invalid XML before, thought I had fix it with sullo/nikto#637 but it seems like there is still an edge case left when there is no host found as the first bracket is never opened.
I think we'd should rather try to fix this in Nikto first before we try to fix / parse the invalid json.
JohannesZahn commentedon Aug 25, 2021
I'll have a look what messes up the nikto result
JohannesZahn commentedon Aug 25, 2021
I opened an issue on nikto side sullo/nikto#740. I think if the expected output is produced by nikto our parser should work fine. Also in nikto v2.5 (not yet released) the problem does not occure anymore it seems to me.
{ "host":"www.example.com", "ip":"93.184.216.34", "port":"8080", "banner":"", "vulnerabilities":[ { "id":"0", "method":"GET", "url":"", "msg":"Unable to connect to www.example.com:8080." } ] }