新版nessus 6.10.7 API 接口，可实现自动扫描，自定义入库操作

新版nessus  6.10.7 API 接口，可实现自动化扫描，自定义入库操作

新版nessus API 接口 替换了之前的nessus命令行模式，这是nessus出于安全因素考虑。

安装完nessus后，打开 https://localhost:8834/api#/authorization 即可看到API接口用法。

一、获取token

下面是获取token的POST 的API调用示例

POST /session HTTP/1.1
Host: 127.0.0.1:8834
Content-Type: application/json

{"username":"username","password":"password"}

二、获取keys

POST成功后，获得token值，通过token值可获得两个KEY

获取keys------------------------------------------------------------------
PUT /session/keys HTTP/1.1
Host: localhost:8834
Content-Type: application/json
X-Cookie: token=654dce4789dca2552643364dc69f2f55bd421f660a761cff;

{"username":"username","password":"password"}

-----服务器返回
{"secretKey":"a2d60653d1870b19c9dd3c62cbb67fb000375e5ae6c740be83d115a30baa2eff","accessKey":"e51bfb5d718094e982346eb6e98e0aeade6132517257944d9edd2404d1d8d1ff"}

三、获取uuid

获得模板信息（获得uuid）---------------------------------------------------------------
GET /editor/scan/templates HTTP/1.1
Host: localhost:8834
Content-Type: application/json
X-Cookie: token=654dce4789dca2552643364dc69f2f55bd421f660a761cff;
X-ApiKeys: secretKey=a2d60653d1870b19c9dd3c62cbb67fb000375e5ae6c740be83d115a30baa2eff;accessKey=e51bfb5d718094e982346eb6e98e0aeade6132517257944d9edd2404d1d8d1ff;
----服务器返回信息

.....Advanced Scan "uuid":"ad629e16-03b6-8c1d-cef6-ef8c9dd3c658d24bd260ef5f9e66",这个UUID后面创建新的扫描用得上。

四、获取folder_id

GET /scans HTTP/1.1
Host: localhost:8834
Content-Type: application/json
X-Cookie: token=654dce4789dca2552643364dc69f2f55bd421f660a761cff;
X-ApiKeys: secretKey=a2d60653d1870b19c9dd3c62cbb67fb000375e5ae6c740be83d115a30baa2eff;accessKey=e51bfb5d718094e982346eb6e98e0aeade6132517257944d9edd2404d1d8d1ff;
---------服务器返回

......My Scans","id":106......

这个106后面创建新的扫描用得上

五、创建新的扫描
POST /scans HTTP/1.1
Host: localhost:8834
Content-Type: application/json
X-Cookie: token=654dce4789dca2552643364dc69f2f55bd421f660a761cff;
X-ApiKeys: secretKey=a2d60653d1870b19c9dd3c62cbb67fb000375e5ae6c740be83d115a30baa2eff;accessKey=e51bfb5d718094e982346eb6e98e0aeade6132517257944d9edd2404d1d8d1ff;

{"uuid":"ad629e16-03b6-8c1d-cef6-ef8c9dd3c658d24bd260ef5f9e66","settings":{"name":"8.8.8.8","description":"8.8.8.8","enabled": "false","launch_now":"true","folder_id":"106","text_targets":"8.8.8.8"}}

以上的UUID和folder_id直接填入，8.8.8.8是需要扫描的IP。扫描完成后，可获得结果，结果可自定义写入MYSQL、sql server、hive、es 等等