PWN::Plugins::DefectDojo module && pwn_defectdojo_importscan Driver -…

Gemfile

@@ -26,7 +26,7 @@ gem 'colorize', '1.1.0'
 gem 'credit_card_validations', '6.1.0'
 gem 'eventmachine', '1.2.7'
 gem 'executable-hooks', '1.7.1'
-gem 'faker', '3.3.0'
+gem 'faker', '3.3.1'
 gem 'faye-websocket', '0.11.3'
 gem 'ffi', '1.16.3'
 gem 'fftw3', '0.3'
@@ -63,7 +63,7 @@ gem 'pdf-reader', '2.12.0'
 gem 'pg', '1.5.6'
 gem 'pry', '0.14.2'
 gem 'pry-doc', '1.5.0'
-gem 'rake', '13.1.0'
+gem 'rake', '13.2.0'
 gem 'rb-readline', '0.5.5'
 gem 'rbvmomi', '3.0.0'
 gem 'rdoc', '6.6.3.1'
@@ -75,7 +75,7 @@ gem 'rspec', '3.13.0'
 gem 'rtesseract', '3.1.3'
 gem 'rubocop', '1.62.1'
 gem 'rubocop-rake', '0.6.0'
-gem 'rubocop-rspec', '2.27.1'
+gem 'rubocop-rspec', '2.28.0'
 gem 'ruby-audio', '1.6.1'
 gem 'ruby-nmap', '1.0.3'
 gem 'ruby-saml', '1.16.0'

README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.76]:001 >>> PWN.help
+pwn[v0.5.77]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.3.0@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.76]:001 >>> PWN.help
+pwn[v0.5.77]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.3.0@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.76]:001 >>> PWN.help
+pwn[v0.5.77]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

bin/pwn_defectdojo_importscan

@@ -38,6 +38,10 @@ OptionParser.new do |options|
     opts[:file] = f
   end
 
+  options.on('-TNAME', '--test-title=NAME', '<Optional - name of test to associate w/ scan type (Defaults to --scan-type value>') do |t|
+    opts[:test_title] = t
+  end
+
   options.on('-lUSER', '--lead-username=USER', '<Optional - username of lead to tie to engagement (Defaults to username)>') do |l|
     opts[:lead_username] = l
   end
@@ -58,6 +62,10 @@ OptionParser.new do |options|
     opts[:verified] = v
   end
 
+  options.on('-G', '--group-by', '<Optional - group findings by "component_name" || "component_name+component_version" || "file_path" || "finding_title" (defaults to nil)') do |g|
+    opts[:group_by] = g
+  end
+
   options.on('-g', '--create-finding-groups', '<Optional - group similar findings into one finding (defaults to false)') do |g|
     opts[:create_finding_groups] = g
   end
@@ -91,10 +99,12 @@ engagement_name = opts[:engagement_name]
 scan_type = opts[:scan_type]
 file = opts[:file]
 opts[:lead_username] ? (lead_username = opts[:lead_username]) : (lead_username = username)
+test_title = opts[:test_title]
 tags = opts[:tags]
 minimum_severity = opts[:minimum_severity]
 scan_date = opts[:scan_date]
 verified = opts[:verified]
+group_by = opts[:group_by]
 create_findings_groups = opts[:create_finding_groups]
 close_old_findings_product_scope = opts[:close_old_findings_product_scope]
 close_old_findings = opts[:close_old_findings]
@@ -113,11 +123,13 @@ begin
     engagement_name: engagement_name,
     scan_type: scan_type,
     file: file,
+    test_title: test_title,
     lead_username: lead_username,
     tags: tags,
     minimum_severity: minimum_severity,
     scan_date: scan_date,
     verified: verified,
+    group_by: group_by,
     create_findings_groups: create_findings_groups,
     close_old_findings_product_scope: close_old_findings_product_scope,
     close_old_findings: close_old_findings,

lib/pwn/plugins/defect_dojo.rb

@@ -432,6 +432,8 @@ module DefectDojo
         http_body[:multipart] = true
         http_body[:file] = File.new(opts[:file].to_s.strip.chomp.scrub, 'rb') if File.exist?(opts[:file].to_s.strip.chomp.scrub)
 
+        http_body[:test_title] = opts[:test_title]
+
         # Ok lets determine the resource_uri for the lead username
         lead_username = opts[:lead_username].to_s.strip.chomp.scrub
         user_list = self.user_list(dd_obj: dd_obj)
@@ -469,6 +471,19 @@ module DefectDojo
         # Defaults to false
         opts[:verified] ? (http_body[:verified] = true) : (http_body[:verified] = false)
 
+        valid_group_by = %w[
+          component_name
+          component_name+compoent_version
+          file_path
+          finding_title
+        ]
+
+        group_by = opts[:group_by]
+        # If group_by is set, ensure we have a valid group_by value
+        raise "ERROR: Invalid group_by value: #{group_by}.  Options are 'product' or 'engagement'" unless valid_group_by.include?(group_by) || group_by.nil?
+
+        http_body[:group_by] = group_by if group_by
+
         opts[:create_finding_groups] ? (http_body[:create_finding_groups_for_all_findings] = true) : (http_body[:create_finding_groups_for_all_findings] = false)
 
         opts[:close_old_findings_product_scope] ? (http_body[:close_old_findings_product_scope] = true) : (http_body[:close_old_findings_product_scope] = false)

lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.76'
+  VERSION = '0.5.77'
 end