Shell Programming and Scripting

Raw Results:

results|192.168.2|192.168.2.1|general/udp|10287|Security Note|For your information, here is the traceroute from 192.168.2.24 to 192.168.2.1 : \n192.168.2.24\n192.168.2.1\n\n
results|192.168.2|192.168.2.1|ssh (22/tcp)|22964|Security Note|An SSH server is running on this port.\n
results|192.168.2|192.168.2.1|ssh (22/tcp)|10267|Security Note|\nSynopsis :\n\nAn SSH server is listening on this port.\n\nDescription :\n\nIt is possible to obtain information about the remote SSH\nserver by sending an empty authentication request.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nSSH version : SSH-1.99-Cisco-1.25\n\n
results|192.168.2|192.168.2.1|general/tcp|11936|Security Note|\nRemote operating system : KYOCERA Printer\nConfidence Level : 48\nMethod : SinFP\n\n \nThe remote host is running KYOCERA Printer\n
results|192.168.2|192.168.2.1|general/tcp|19506|Security Note|Information about this scan : \n\nNessus version : 3.2.1\nPlugin feed version : 200806200134\nType of plugin feed : Direct\nScanner IP : 192.168.2.24\nPort scanner(s) : nessus_tcp_scanner \nPort range : default\nThorough tests : no\nExperimental tests : no\nParanoia level : 1\nReport Verbosity : 1\nSafe checks : yes\nOptimize the test : yes\nMax hosts : 20\nMax checks : 5\nRecv timeout : 5\nScan Start Date : 2008/6/25 11:26\nScan duration : 90 sec\n\n
results|192.168.2|192.168.2.1|general/tcp|21745|Security Note|\nSynopsis :\n\nIt was not possible to log into the remote host\n\nDescription :\n\nThe credentials provided for the scan did not allow us to log into the\nremote host.\n\n\nRisk factor : \n\nNone\n\nPlugin output : \n\n- It was not possible to log into the remote host via ssh\n\n


1. I am attempting to grab all lines beginning with results
2. Put the results in a tab format to export to excel
3. Break up into major columns: IP address, Service, VulID number, (Security Note, hole, or Warning),

(column 1)192.168.2.1 (column 2)general/tcp (column 3)21745 (column 4) Synopsis : It was not possible to log into the remote host. Description : The credentials provided for the scan did not allow us to log into the remote host. Risk factor : None Plugin output : It was not possible to log into the remote host via ssh


I have started on a very basic script:

> awk -F "|" '{print $3} | sort | uniq

The fields are not all the same which is posing a problem. Please help

Why are you using sort and uniq? But you didn't mention anything about it?
As you want the fields to be tab delimited then the below comman will be useful :
awk -F "|" '{printf("%s\t%s\t%s\t%s\n", $3, $4,$5,$7}' results_file

Code:

gawk -F"|" '$1 == "results" { gsub(/\\n/,"", $7); printf "%s\t%s\t%s\t%s\n", $3,$4,$5,$7}' file

gives the following output ($7 truncated for ease of viewing)

Code:

192.168.2.1     general/udp     10287   For your information, here is the tra
192.168.2.1     ssh (22/tcp)    22964   An SSH server is running on this port
192.168.2.1     ssh (22/tcp)    10267   Synopsis :An SSH server is listening 
192.168.2.1     general/tcp     11936   Remote operating system : KYOCERA
192.168.2.1     general/tcp     19506   Information about this scan : Nessus