Get specific element data from xml

Question

I am trying to parse a nessus xml report and am trying to get the specific description and plugin_output but can't seem to get it for some reason

I have the following xml data:

<ReportHost name="WebServerA.internal">
<HostProperties>
<tag name="cpe-1">cpe:/a:microsoft:iis:8.5</tag>
<tag name="cpe">cpe:/o:microsoft:windows</tag>
<tag name="patch-summary-total-cves">14</tag>
<tag name="cpe-0">cpe:/o:microsoft:windows_server_2012:r2</tag>
<tag name="system-type">general-purpose</tag>
<tag name="operating-system">Microsoft Windows Server 2012 R2 Standard</tag>
<tag name="LastUnauthenticatedResults">1545398521</tag>
<tag name="Credentialed_Scan">false</tag>
<tag name="policy-used">Basic Network Scan</tag>
<tag name="os">windows</tag>
<tag name="mac-address">00:10:36:A5:3B:AA</tag>
<tag name="host-fqdn">WebServerA.internal</tag>
<tag name="host-rdns">WebServerA.internal</tag>
<tag name="HOST_END">Fri Dec 21 08:22:01 2018</tag>
<tag name="netbios-name">WEBSERVERA</tag>
<tag name="host-ip">10.1.5.33</tag>
<tag name="HOST_START">Fri Dec 21 08:16:28 2018</tag>
</HostProperties>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="117886" pluginName="Local Checks Not Enabled (info)" pluginFamily="Settings">
<description>Nessus did not enable local checks on the remote host. This does not necessarily indicate a problem with the scan. </description>
<plugin_output>
The following issues were reported :

  - Plugin      : no_local_checks_credentials.nasl
    Plugin ID   : 110723
    Plugin Name : No Credentials Provided
    Message     :
Credentials were not provided for detected SSH service.
</plugin_output>
</ReportItem>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="19506" pluginName="Nessus Scan Information" pluginFamily="Settings">
<description>This plugin displays, for each tested host, information about the scan itself :

  - The version of the plugin set.
  - The type of scanner (Nessus or Nessus Home).
  - The version of the Nessus Engine.
  - The port scanner(s) used.
  - The port range scanned.
  - Whether credentialed or third-party patch management     checks are possible.
  - The date of the scan.
  - The duration of the scan.
  - The number of hosts scanned in parallel.
  - The number of checks done in parallel.
</description>
<plugin_output>Information about this scan :

Nessus version : 7.1.1
Plugin feed version : 201810052251
Scanner edition used : Nessus
</plugin_output>
</ReportHost>

And the following code is what i am trying to use in order to loop through and get the data, but when i run the child loop and print child.attrib, it just comes back with a blank {} and doesn't seem to be able to grab the report items and whats in between them.

for host in root.iter('HostProperties'):
    for child in host:
        print child.attrib

Answer 1

I think your xml is not proper, because the tag :

<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="19506" pluginName="Nessus Scan Information" pluginFamily="Settings">

is not closed properly with </ReportItem>. I got correct answer, when i closed it for example as per below :

<ReportHost name="WebServerA.internal">
<HostProperties>
<tag name="cpe-1">cpe:/a:microsoft:iis:8.5</tag>
<tag name="cpe">cpe:/o:microsoft:windows</tag>
<tag name="patch-summary-total-cves">14</tag>
<tag name="cpe-0">cpe:/o:microsoft:windows_server_2012:r2</tag>
<tag name="system-type">general-purpose</tag>
<tag name="operating-system">Microsoft Windows Server 2012 R2 Standard</tag>
<tag name="LastUnauthenticatedResults">1545398521</tag>
<tag name="Credentialed_Scan">false</tag>
<tag name="policy-used">Basic Network Scan</tag>
<tag name="os">windows</tag>
<tag name="mac-address">00:10:36:A5:3B:AA</tag>
<tag name="host-fqdn">WebServerA.internal</tag>
<tag name="host-rdns">WebServerA.internal</tag>
<tag name="HOST_END">Fri Dec 21 08:22:01 2018</tag>
<tag name="netbios-name">WEBSERVERA</tag>
<tag name="host-ip">10.1.5.33</tag>
<tag name="HOST_START">Fri Dec 21 08:16:28 2018</tag>
</HostProperties>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="117886" pluginName="Local Checks Not Enabled (info)" pluginFamily="Settings">
<description>Nessus did not enable local checks on the remote host. This does not necessarily indicate a problem with the scan. </description>
<plugin_output>
The following issues were reported :

  - Plugin      : no_local_checks_credentials.nasl
    Plugin ID   : 110723
    Plugin Name : No Credentials Provided
    Message     :
Credentials were not provided for detected SSH service.
</plugin_output>
</ReportItem>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="0" pluginID="19506" pluginName="Nessus Scan Information" pluginFamily="Settings">
<description>This plugin displays, for each tested host, information about the scan itself :

  - The version of the plugin set.
  - The type of scanner (Nessus or Nessus Home).
  - The version of the Nessus Engine.
  - The port scanner(s) used.
  - The port range scanned.
  - Whether credentialed or third-party patch management     checks are possible.
  - The date of the scan.
  - The duration of the scan.
  - The number of hosts scanned in parallel.
  - The number of checks done in parallel.
</description>
<plugin_output>Information about this scan :

Nessus version : 7.1.1
Plugin feed version : 201810052251
Scanner edition used : Nessus
</plugin_output>
</ReportItem>
</ReportHost>

Below is my result with the same code that you are using :

{'name': 'cpe-1'}
{'name': 'cpe'}
{'name': 'patch-summary-total-cves'}
{'name': 'cpe-0'}
{'name': 'system-type'}
{'name': 'operating-system'}
{'name': 'LastUnauthenticatedResults'}
{'name': 'Credentialed_Scan'}
{'name': 'policy-used'}
{'name': 'os'}
{'name': 'mac-address'}
{'name': 'host-fqdn'}
{'name': 'host-rdns'}
{'name': 'HOST_END'}
{'name': 'netbios-name'}
{'name': 'host-ip'}
{'name': 'HOST_START'}

Hope this helps you.