Объркване с анализирането на XML с elementtree

Имам проблеми с разбирането как да използвам Elementtree правилно. Опитвам се да анализирам nessus файл. Извлечете данните за всички хостове с констатации например със степен на тежест 4. Мога да идентифицирам sev, но не съм сигурен как да изтегля данните само за тези елементи. Проверих документите и много примери онлайн, но никой не обяснява как да събера данни от второто ниво. Използвам ElementTree 1.2.6

Примерен XML

<ReportItem port="445" svc_name="cifs" protocol="tcp" severity="4" pluginID="12215" pluginName="Sophos Anti-Virus Detection" pluginFamily="Windows">
<cpe>cpe:/a:sophos:sophos_anti-virus</cpe>
<cvss_base_score>10.0</cvss_base_score>
<cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C</cvss_vector>
<description>Sophos Anti-Virus, a commercial antivirus software package for Windows, is installed on the remote host. However, there is a problem with the install, either its services are not running or its engine and/or virus definition are out-of-date.</description>
<fname>sophos_installed.nasl</fname>
<plugin_modification_date>2013/04/02</plugin_modification_date>
<plugin_name>Sophos Anti-Virus Detection</plugin_name>
<plugin_publication_date>2002/04/26</plugin_publication_date>
<plugin_type>local</plugin_type>
<risk_factor>Critical</risk_factor>
<script_version>$Revision: 1.1411 $</script_version>
<see_also>http://www.sophos.com</see_also>
<solution>Make sure updates are working and the associated services are running.</solution>
<synopsis>An antivirus package is installed on the remote host, but it is not working properly.</synopsis>
<plugin_output>
Sophos Anti-Virus is installed on the remote host :

  Installation path : c:\Program Files\Sophos\Sophos Anti-Virus
  Product version   : 10.0.10
  Engine version    : 3.45.0.2100
  Virus signatures last updated   : 2011/03/11

Nessus does not currently have information about Sophos 10.0. It may no
longer be supported.

The virus signatures on the remote host are out-of-date by at least 3 days.
The last update from the vendor was on 2015/04/10.

As a result, the remote host might be infected by viruses.
</plugin_output>
</ReportItem>

Текущ код

import elementtree.ElementTree as ET

def getDetails(nessus_file):
    try:
        tree = ET.parse(nessus_file)
        doc = tree.getroot()
        listitem = doc.getiterator()

        for item in listitem:
            if item.tag == 'ReportItem':
                if item.get('severity') == '4':
                    walk = doc.getiterator('cve')
                    for cve in walk:
                        print cve.text #This prints all the CVEs that are in the nessus file, rather than just the cves associated with the  sev 4 item.

    except Exception as e:
        print e
        exit()

getDetails('file.nessus')

Актуализиран код

import elementtree.ElementTree as ET

    def getDetails(nessus_file):
        try:
            tree = ET.parse(nessus_file)
            doc = tree.getroot()
            listitem = doc.getiterator()

            for document in doc:
                if document.tag == 'Report':
                    for host in document:
                        if host.tag == 'ReportHost':
                            print 'Host: ' + host.get('name')
                            for item in listitem:
                                if item.tag == 'ReportItem':
                                    if item.get('severity') == '4':
                                        print item.get('pluginName')
                                        for cve in item.findall('.//cve'):
                                            print cve.text

python elementtree
person iNoob    schedule 26.04.2015    source източник

Отговори (1)


arrow_upward
1
arrow_downward

Вероятно търсите findall:

for cve in item.findall('.//cve'):
    print cve.text

Ето актуализираната функция:

def get_details(nessus_file):
    tree = ET.parse(nessus_file)
    for reporthost in tree.findall('/Report/ReportHost'):
        print 'Host: ' + host.get('name')
        for item in reporthost.findall('ReportItem'):
            if item.get('severity') == '4':
                print item.get('pluginName')
                for cve in item.findall('cve'):
                    print cve.text
person Daniel    schedule 26.04.2015
comment
Актуализирах кода си в публикацията с въпроси (за илюстрация) и все още изглежда, че хваща всички CVE, а не само елемента със sev 4. - person iNoob; 26.04.2015
comment
arr добре, бихте ли обяснили структурата '/item/item2', която използвате - person iNoob; 26.04.2015