#!/bin/bash
domainname="http://www.cvedetails.com/cve/"
querylist="http://www.cvedetails.com/vulnerability-search.php?f=1&cveid="
echo "before while"
while read x ;do
wget -O result.html $domainname${x}
found=`cat result.html|grep -ic 'Unknown CVE ID'`
echo 'before if'
if ((${found}>0))
then
echo "not found"
else
# 取漏洞名称
cvename=`cat result.html|grep -i '<title>'|sed 's/</>/g'|cut -d '>' -f3`
echo 'cvename '${cvename}
flag=`echo ${cvename}|cut -d'-' -f1`
if [ "${flag}" != "CVE" ]; then
continue
echo 'now come true'
fi
# 取漏洞cvss分数
cvss=`cat result.html|tr -d '\n'|tr -d "'"|sed 's/<th>Cvss Score<\/th>/@<th>Cvss Score<\/th>/g'|tr '@' '\n'|sed 's/</>/g'|grep -i '>th>Cvss Score>\/th>'|cut -d '>' -f9`
echo 'cvss '${cvss}
# 取漏洞描述信息
desc=`cat result.html|grep -i '<meta name="description" content="CVE'|cut -d '"' -f4`
echo 'desc '${desc}
# 取漏洞参考条目数
# refcount=`cat result.html|grep -ic '<td class="r_average">'`
# 提取漏洞参考条目
refcontent=`cat result.html|tr -d '\n'|tr -d "'"|sed 's/<br\\>//g'|sed 's/<td class="r_average">/@<td class="r_average">/g'|tr '@' '\n'|sed 's/</>/g'|grep -i '>td class="r_average">'|cut -d '>' -f5`
echo 'refcontent '${refcontent}
# 取查询信息
wget -O query.html $querylist${x}
cat query.html|tr -d '\n'|sed 's/<tr class="srrowns">/@<tr class="srrowns">/g'|tr '@' '\n'|sed 's/<\/table>/@<\/table>/g'|tr '@' '\n'|sed 's/</>/g'>querylast.html
qfound=`cat query.html|grep -ic 'title="View cwe definition "'`
if ((${qfound}>0))
then
# 是否有exploit
exploit=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f31`
echo 'exploit '${exploit}
# 漏洞类型
vulner_type=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f37`
echo 'vulner_type '${vulner_type}
# 命名时间
publish_date=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f41`
echo 'publish_date '${publish_date}
# 更新时间
update_date=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f45`
echo 'update_date '${update_date}
# cvss分数
cvss_score=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f51`
echo 'cvss_score '${cvss_score}
# gained_access_level
gained_access_level=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f57`
echo 'gained_access_level '${gained_access_level}
# access
access=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f61`
echo 'access '${access}
# Complexity
complexity=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f65`
echo 'complexity '${complexity}
# Authentication
authentication=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f69`
echo 'authentication '${authentication}
# Confidentiality
confidentiality=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f73`
echo 'confidentiality '${confidentiality}
# Integrity
integrity=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f77`
echo 'integrity '${integrity}
# Availability
availability=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f81`
echo 'availability '${availability}
else
# 是否有exploit
exploit=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f27`
echo 'exploit '${exploit}
# 漏洞类型
vulner_type=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f33`
echo 'vulner_type '${vulner_type}
# 命名时间
publish_date=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f37`
echo 'publish_date '${publish_date}
# 更新时间
update_date=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f41`
echo 'update_date '${update_date}
# cvss分数
cvss_score=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f47`
echo 'cvss_score '${cvss_score}
# gained_access_level
gained_access_level=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f53`
echo 'gained_access_level '${gained_access_level}
# access
access=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f57`
echo 'access '${access}
# Complexity
complexity=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f61`
echo 'complexity '${complexity}
# Authentication
authentication=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f65`
echo 'authentication '${authentication}
# Confidentiality
confidentiality=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f69`
echo 'confidentiality '${confidentiality}
# Integrity
integrity=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f73`
echo 'integrity '${integrity}
# Availability
availability=`cat querylast.html|grep -i '>tr class="srrowns">'|cut -d '>' -f77`
echo 'availability '${availability}
fi
# 插入数据库
resultrow="INSERT INTO t_control(id)
SELECT 1 FROM DUAL WHERE EXISTS(SELECT 1 FROM t_vulner_code WHERE vulner_code='${x}' AND vulner_code_type='CVE');
INSERT INTO t_vulnerability(
vulner_name_en,
description_en,
security_level,
exploit,
vulner_type,
publish_date,
update_date,
cvss,
gained_access_level,
access,
authentication,
confidentiality,
integrity,
availability,
reference)
SELECT trim('${cvename}'),trim('${desc}'),trim('${complexity}'),
trim('${exploit}'),trim('${vulner_type}'),trim('${publish_date}'),trim('${update_date}'),trim('${cvss}'),trim('${gained_access_level}'),
trim('${access}'),trim('${authentication}'),trim('${confidentiality}'),trim('${integrity}'),trim('${availability}'),trim('${refcontent}') FROM DUAL
WHERE NOT EXISTS(SELECT 1 FROM t_vulner_code WHERE vulner_code='${x}' AND vulner_code_type='CVE');
INSERT INTO t_vulner_code(vulner_id,vulner_code_type,vulner_code)
SELECT LAST_INSERT_ID(),'CVE',trim('${x}') from dual
WHERE NOT EXISTS(SELECT 1 FROM t_vulner_code WHERE vulner_code='${x}' AND vulner_code_type='CVE') and LAST_INSERT_ID()<>0 ;"
echo $resultrow
mysql -h 192.168.3.93 -phuawei virus -e"${resultrow}"
echo $resultrow
# 取漏洞bid信息
cat result.html|tr -d '\n'|sed 's/title="External url">http:\/\/www.securityfocus.com\/bid\//@@title="External url">http:\/\/www.securityfocus.com\/bid\//g'|tr '@@' '\n'|grep -i 'title="External url">http://www.securityfocus.com/bid/'>bid.html
bidcnt=`wc -l bid.html|cut -d ' ' -f1`
echo "BIDCNT=${bidcnt}"
while ((${bidcnt}>0))
do
bid=`tail -${bidcnt} bid.html|tr -d '\n'|cut -d '/' -f5|cut -d '<' -f1`
echo "BID=${bid}"
bidinfo="INSERT INTO t_vulner_code(vulner_id,vulner_code_type,vulner_code)
SELECT vulner_id,'BID',trim('${bid}') from t_vulner_code
WHERE vulner_code_type='CVE' and vulner_code='${x}'; "
mysql -h 192.168.3.93 -phuawei virus -e"${bidinfo}"
echo ${bidinfo}
let "bidcnt=${bidcnt}-1"
done
#取厂商等信息
cat result.html|tr -d '\n'|sed 's/<table class="listtable" id="vulnprodstable">/@@<table class="listtable" id="vulnprodstable">/g'|tr '@@' '\n'|tail -1|sed 's/<a name="vulnprodcount">/@@<a name="vulnprodcount">/g'|tr '@@' '\n'|grep '<table class="listtable" id="vulnprodstable">' |sed 's/<td class="num">/@@<td class="num">/g'| tr '@@' '\n'|grep "<a href=">bb.html
row=`wc -l bb.html|cut -d ' ' -f1`
resultrow="insert into t_vulner_count(vulner_id,cnt) select vulner_id,${row} from t_vulner_code where vulner_code_type='CVE' and vulner_code='${x}';"
echo ${resultrow}
mysql -h 192.168.3.93 -phuawei virus -e"${resultrow}"
while ((${row}>0))
do
vendor=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f6|cut -d '/' -f5`
vendorname=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f7|cut -d '<' -f1`
product=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f10|cut -d '/' -f5`
productname=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f11|cut -d '<' -f1`
producttype=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f4|cut -d '<' -f1`
version=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f14|cut -d '<' -f1`
update=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f16|cut -d '<' -f1`
edtion=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f18|cut -d '<' -f1`
language=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f20|cut -d '<' -f1`
versionid=`tail -${row} bb.html|tr -d '\n'|cut -d '>' -f22|cut -d '/' -f3`
resultrow="insert into t_software_vendor select ${vendor},'${vendorname}' from dual where not exists(select 1 from t_software_vendor where ware_vendor_id=${vendor});
insert into t_software_product select ${vendor},${product},'${productname}','${producttype}' from dual where not exists(select 1 from t_software_product where ware_product_id=${product});
insert into t_software_version select ${vendor},${product},${versionid},'${version}','${update}','${edtion}','${language}' from dual where not exists(select 1 from t_software_version where ware_version_id=${versionid});
insert into t_object_software select t.vulner_id,1,${versionid} from t_vulner_code t where t.vulner_code_type='CVE' and t.vulner_code='${x}' ;"
mysql -h 192.168.3.93 -phuawei virus -e"${resultrow}"
echo $resultrow
let "row=${row}-1"
done
fi
#删除本行
sed -i "/${x}/d" cvelist.txt
done<cvelist.txt
echo done
# 15 cve_id
# 31 exploit
# 37 vulner_type
# 41 Publish_Date
# 45 Update_Date
# 51 cvss_score
# 57 Gained_Access_Level
# 61 access
# 65 Complexity
# 69 Authentication
# 73 Confidentiality
# 77 Integrity
# 81 Availability