Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Defective IVIL import into database #645

Open
alirezakv opened this issue Mar 21, 2018 · 1 comment
Open

Defective IVIL import into database #645

alirezakv opened this issue Mar 21, 2018 · 1 comment

Comments

@alirezakv
Copy link

some plugins in test tools will produce several outputs on the same port like "services" in OpenVAS.
for example:
services,127.0.0.1,3128, "a web server is running"
services,127.0.0.1,3128, "a web proxy is running"

when IVIL is imported into database, based on Findings.pm line 1140, if a match of "SearchTerm" (workspace_id, scan_id, host, port, plugin) exists, it will be updated in database which in this case will cause the results of the scan being overwritten. So you will have less results on seccubus than main openvas report.
This problem also exist in a much more severe way in ZAP (because zap produces lot's of results with the same combination of "SearchTerm"). For example if ZAP finds 5 different XSS points in a page, when importing to database, the first one will be imported, the second one will overwrite the first one, ... and only the last one will exist in database.

@lukaspj
Copy link

lukaspj commented Sep 11, 2018

Running a Nikto scan against multiple hostnames, only shows a single issue per finding even if it makes the same finding for each hostname. Is this related, or would the SearchTerm not match in this case?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants