Documentation - List of security checks

[thesp0nge]

Documentation - List of security checks

[lwoodson]

k, wrote this then actually looked at the code. Seems like everything is listed in https://github.com/codesake/codesake_dawn/blob/master/lib/codesake/dawn/knowledge_base.rb and references the common securities and vulnerabilities at http://cve.mitre.org/. Let me know if you would like help putting some documentation together in the readme.

[thesp0nge]

Hi Lance, you can see the list of security checks also https://github.com/codesake/codesake_dawn/blob/master/Competitive_matrix.md or by calling dawn with the -k flag.

What do you think about 'dawn -k' output?

[lwoodson]

Thanks for the response and direction. Kind of hard to read through the list with the formatting as is, I think primarily due to the description/remediation headers. What about the following?

Name: CVE-2013-1933 CVSS: 9.3   Released: 2013-04-25
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit 
(karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute 
arbitrary commands via shell metacharacters in a PDF filename.   To remediate, 
please upgrade karteek-docsplit version to the latest version available.

[thesp0nge]

Last commit introduced a new behaviour when listing knowledge base content. By default only security check name is echoed, you will have more information asking for --verbose.