After a successful authentication, session_id is nil since gem version 0.1.3

[thesp0nge]

Hi there, I have a small ruby utility I daily use in my job to fetch data from my Nexpose server (https://github.com/thesp0nge/nexty).

When moving form nexpose gem from version 0.1.4 (included) and later, after being successfully authenticated, all further requests fails. Session ID is not nil as stated before, however my code searching for an IP is not working, instead using gem version 0.1.3 works like a sharm.

Paolo

[mdaines-r7]

I cannot reproduce the behavior you describe using 0.6.1 of the gem. After successful login, I get a value value for nsc.session_id

Do you have some minimal reproducing code to demonstrate the problem?

[thesp0nge]

@mdaines-r7 I edited the issue... the problem is not that session_id is nil but all other API calls failed.

You can try with this app: https://github.com/thesp0nge/nexty

[gschneider-r7]

Do you have a usage example showing the failure?

[thesp0nge]

Install the nexty gem or clone the repo, change config.yaml accordingly and then issue the command: bundle exec ruby -I lib bin/nexty --host ip
This should retrieve risk factor and site number for ip in nexpose.

With latest gem the ip is not found, with version older then 0.1.3 the code works.

[gschneider-r7]

Given that your Nexty gem seems to duplicate some of the Nexpose gem's functionality from 0.1.3, it might be easier to create a new script (or gem) that just uses the Nexpose gem features instead.

To achieve the functionality you're having trouble with currently, you could do this for example with the Nexpose gem:

require "nexpose"
nsc = Nexpose::Connection.new("127.0.0.1", "username", "password")
nsc.login
host = nsc.find_device_by_address("10.0.0.1")
puts "#{host.address} #{host.site_id} #{host.risk_score} #{host.risk_factor}"

[thesp0nge]

Well bur why on older gem my code works and with newer not?
Il 23/gen/2014 20:23 "gschneider" notifications@github.com ha scritto:

Given that your Nexty gem seems to duplicate some of the Nexpose gem's
functionality from 0.1.3, it might be easier to create a new script (or
gem) that just uses the Nexpose gem features instead.

To achieve the functionality you're having trouble with currently, you
could do this for example with the Nexpose gem:

require "nexpose"nsc = Nexpose::Connection.new("127.0.0.1", "username", "password")host = nsc.find_device_by_address("10.0.0.1")puts "#{host.address} #{host.site_id} #{host.risk_score} #{host.risk_factor}"

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/45#issuecomment-33158556
.

[mdaines-r7]

There were breaking changes to some of the calls between 0.1.3 and 0.1.4, thus leading the problem described.

This is part of the reason I've started trying to put in the release notes and be more vigilant that a patch release does not introduce breaking API changes.

[thesp0nge]

It sounds like "ooops, your code doesn't work but we don't know why and we don't care that much". Thank you after all.

[mdaines-r7]

Sorry you took it that way.

If you look at the methods being called, there was a swap in method names between the versions you are concerned about. I don't have the changes in front of me, but it's commits to the repo between 6 Feb and 14 Feb 2013. @gschneider-r7 showed them to me, but I don't have that good a memory. It was something like changing device_list to list_devices or site_listing to list_sites.

[thesp0nge]

That's fine to me. Nexty is just an internal tool for my daily usage since
we use Nexpose a lot at work. I'll hack over it when I have some spare time
to invest

On 31 January 2014 15:58, Michael Daines notifications@github.com wrote:

Sorry you took it that way.

If you look at the methods being called, there was a swap in method names
between the versions you are concerned about. I don't have the changes in
front of me, but it's commits to the repo between 6 Feb and 14 Feb 2013.
@gschneider-r7 https://github.com/gschneider-r7 showed them to me, but
I don't have that good a memory. It was something like changing device_list
to list_devices or site_listing to list_sites.

Reply to this email directly or view it on GitHubhttps://github.com//issues/45#issuecomment-33800339
.

$ cd /pub
$ more beer

The Application Security blog you really want to read:
http://armoredcode.com