У меня проблемы с пониманием того, как правильно использовать Elementtree. Я пытаюсь разобрать файл nessus. Извлеките данные для всех хостов с результатами, например, с серьезностью 4. Я могу идентифицировать sev, но я не уверен, как получить данные только для этих элементов. Я проверил документы и множество примеров в Интернете, но ни один из них не объясняет, как собирать данные со второго уровня. Я использую ElementTree 1.2.6.
Пример XML
<ReportItem port="445" svc_name="cifs" protocol="tcp" severity="4" pluginID="12215" pluginName="Sophos Anti-Virus Detection" pluginFamily="Windows">
<cpe>cpe:/a:sophos:sophos_anti-virus</cpe>
<cvss_base_score>10.0</cvss_base_score>
<cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C</cvss_vector>
<description>Sophos Anti-Virus, a commercial antivirus software package for Windows, is installed on the remote host. However, there is a problem with the install, either its services are not running or its engine and/or virus definition are out-of-date.</description>
<fname>sophos_installed.nasl</fname>
<plugin_modification_date>2013/04/02</plugin_modification_date>
<plugin_name>Sophos Anti-Virus Detection</plugin_name>
<plugin_publication_date>2002/04/26</plugin_publication_date>
<plugin_type>local</plugin_type>
<risk_factor>Critical</risk_factor>
<script_version>$Revision: 1.1411 $</script_version>
<see_also>http://www.sophos.com</see_also>
<solution>Make sure updates are working and the associated services are running.</solution>
<synopsis>An antivirus package is installed on the remote host, but it is not working properly.</synopsis>
<plugin_output>
Sophos Anti-Virus is installed on the remote host :
Installation path : c:\Program Files\Sophos\Sophos Anti-Virus
Product version : 10.0.10
Engine version : 3.45.0.2100
Virus signatures last updated : 2011/03/11
Nessus does not currently have information about Sophos 10.0. It may no
longer be supported.
The virus signatures on the remote host are out-of-date by at least 3 days.
The last update from the vendor was on 2015/04/10.
As a result, the remote host might be infected by viruses.
</plugin_output>
</ReportItem>
Текущий код
import elementtree.ElementTree as ET
def getDetails(nessus_file):
try:
tree = ET.parse(nessus_file)
doc = tree.getroot()
listitem = doc.getiterator()
for item in listitem:
if item.tag == 'ReportItem':
if item.get('severity') == '4':
walk = doc.getiterator('cve')
for cve in walk:
print cve.text #This prints all the CVEs that are in the nessus file, rather than just the cves associated with the sev 4 item.
except Exception as e:
print e
exit()
getDetails('file.nessus')
Обновленный код
import elementtree.ElementTree as ET
def getDetails(nessus_file):
try:
tree = ET.parse(nessus_file)
doc = tree.getroot()
listitem = doc.getiterator()
for document in doc:
if document.tag == 'Report':
for host in document:
if host.tag == 'ReportHost':
print 'Host: ' + host.get('name')
for item in listitem:
if item.tag == 'ReportItem':
if item.get('severity') == '4':
print item.get('pluginName')
for cve in item.findall('.//cve'):
print cve.text