How to extract Nessus XML Data in python

Question

So, I have some Nessus files and I would like to extract the XML data out of it. I know you can just convert to a csv within Nessus but that is not an option for me in my scenario, so I am creating a parser and converter in Python.

It mostly works, the only issue is that I can only grab certain data. Right now, I am using Python's ElementTree library. Below is an example of my problem.

ReportHost {'name': 'IP GO HERE'}

HostProperties {}

tag {'name': 'LastAuthenticatedResults'}
tag {'name': 'host-fqdn'}
tag {'name': 'host-ip'}
tag {'name': 'operating-system'}
tag {'name': 'system-type'}
tag {'name': 'host-uuid'}
tag {'name': 'HOST_START'}
tag {'name': 'HOST_END'}
tag {'name': 'os'}
tag {'name': 'policy-used'}
tag {'name': 'Credentialed_Scan'}

In the XML file there is actual data that goes along with all of these. Using ElementTree , I can grab data out of ReportHost but nothing out of the tags. There is supposed to be data in each of the tags. For example, there is an ip address after host-ip in the xml, but when I parse it using elementTree, nothing shows up.

Example in XML File: <tag name="host-ip">1.1.1.1</tag>

How do I grab this data? Is there just something I am missing?

Here is some code to help explain what I am doing ( etree is ElementTree ). This code gets the ip address out of ReportHost:

 mainTree = etree.parse(fileName)
 root = mainTree.getroot()
 for reportHost in root.iter('ReportHost'):
     hostIP.append(reportHost.get('name'))

Answer 1

You can create a list of values from tag elements with findall() . Element.text give you the tag text content and element.attrib catch the whole dictionary with element.get('key_name') catch the key_value of the key_name:

import xml.etree.ElementTree as ET

fileName = 'nessus.xml'

mainTree = ET.parse(fileName)
root = mainTree.getroot()

for reportHost in root.iter('ReportHost'):
    print(reportHost.get('name'))

for HostProperties_tag in root.findall('.//HostProperties/tag'):
    print(f"{HostProperties_tag.attrib}{HostProperties_tag.text}")

Output for example:

192.168.1.0
...
{'name': 'operating-system'}Microsoft Windows XP Professional Microsoft Windows Server 2008 R2
{'name': 'mac-address'}00:0c:22:a0:bd:00
{'name': 'traceroute-hop-0'}192.168.1.0
{'name': 'host-ip'}192.168.1.0
{'name': 'HOST_START'}Sat Feb 24 17:46:12 2018