nessus-csv-parse.pl

Making your vulnerabilities pretty!

Welcome to the home page of nessus-csv-parse.pl. I wrote this program to help convert the stock CSV output of Nessus into something a little more readable. Even though Nessus is perfectly capable of generating HTML output, I found it to be rather cumbersome (especially when it crashes my browser!). nessus-csv-parse is primarily designed to generate simpler, more readable HTML, but it can also generate a stripped-down CSV that you can use more easily in your own scripts.

I don't claim to be a great (or even mediocre) programmer. Although I've done a good deal of testing, there are bound to be a few bugs, missing features, or places where I could do it better. If you have any suggestions or improvements, please e-mail me at bcotton@purdue.edu (please be sure to include "Nessus" in the subject line). As usual, there is no guarantee, explicit or implied, of any suitability for any purpose, and use is at your own risk. As of now, this is not under a formal license, but a "please give me credit if you use the code" arrangement. I would like to thank David Crooke for the code used to handle line breaks inside the comma-separated elements.

If there is interest, I'll start an e-mail list for discussion of this program. Send me an e-mail if you're interested in such.

Links!

Download the latest version (1.0 - 9/15/2008) . It has a .txt extension to make the web server happy. MD5: b4999204d7b22d2053e0bc84d2ef3448

Documentation, such that it is

Sample HTML output (Coming soon. I don't want to put my actual vulnerabilities on display!)

Current features

Removes entries for port 0, since those are generally informational and not necessary for a first-look
Optionally uses ARP to get the MAC for an IP. Nessus can do this, but if your scanner is on a different subnet, you're out of luck.
Optionally produces HTML output with defined classes (see the documentation) so that you can apply your own styles
Optionally produces an XML file so you can munge the data however you wish.
Optionally allows the inclusion of a custom <head> section to define your styles in the document itself
The HTML output displays each IP once, in order to better delineate the vulnerabilities of each host
Automatic hyperlink generation when a CVE or URL is mentioned.

Features to add

Quicker pings. Since different OSes have different ping implementations, the ping used is simple. (Maybe I should just use Net::ping?) Future updates will check the OS to give ping a shorter timeout. That way, we're not waiting 20 seconds for an IP which isn't responding.
Better documentation. What currently exists was written in a hurry. Some of it will need to be expanded.
An option to remove entries where the risk is "none".
Non-specific improvements to the HTML output. It's still big -- it could be smaller.
Add the option to do host lookups. I personally don't care, but some users might find it handy.
Valid HTML(?). This one is questionable. It would be nice if the HTML could pass validation, but would it be necessary? There are certainly other things I could be working on.
Make this page prettier.