Scan profile and CVSS examples

Author: hcastilho

probely_api_examples/finding_cvss.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+"""
+Output CVSS score and vector for all findings in a target
+
+
+This example is for python 3.5
+"""
+import argparse
+
+import requests
+from urllib.parse import urljoin
+
+
+api_base_url = "https://api.probely.com"
+finding_list_endpoint = urljoin(api_base_url, "targets/{target}/findings/")
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument("target", help="Target id")
+    args = parser.parse_args()
+
+    token = input("API Token:")
+    headers = {'Authorization': "JWT {}".format(token)}
+
+    # Findings
+    response = requests.get(
+        finding_list_endpoint.format(target=args.target),
+        headers=headers,
+        params={'length': 100}
+    )
+    response.raise_for_status()
+    findings = response.json()['results']
+
+    print('Id, CVSS Score, CVSS vector')
+    for finding in findings:
+        if finding['cvss_score']:
+            print("%s, %s, %s" % (finding['id'],
+                                  finding['cvss_score'],
+                                  finding['cvss_vector']))

probely_api_examples/start_scan.py

@@ -12,7 +12,7 @@
 from urllib.parse import urljoin
 
 token = input("API Token:")
-headers = {'Authorization': "JWT {}".formar(token)}
+headers = {'Authorization': "JWT {}".format(token)}
 
 target_id = input("Target ID:")
 

probely_api_examples/start_scan_profile.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+"""
+Start a scan using the API selecting a scan profile
+
+Currently there are 3 different scan profiles:
+* normal -- default profile
+* full -- does everything the default profile does and adds boolean based SQL
+          injection tests
+* safe -- doesn't use any content changing methods (no POST, DELETE, etc) and
+          tries fewer payloads for SQL injection tests
+
+"""
+import requests
+from urllib.parse import urljoin
+
+token = input("API Token:")
+headers = {'Authorization': "JWT {}".format(token)}
+
+target_id = input("Target ID:")
+
+api_base_url = "https://api.probely.com"
+scan_now_endpoint = urljoin(api_base_url, "targets/{target_id}/scan_now/")
+
+response = requests.post(scan_now_endpoint.format(target_id=target_id),
+                         data={'scan_profile': 'safe'},
+                         headers=headers)