gauntlt 0.0.0 → 0.0.5

data/.gitignore

@@ -22,4 +22,7 @@ pkg
 tmp
 .bundle
 doc
+Gemfile.lock
 .rvmrc
+.rbenv*
+*.gem

data/.gitmodules

@@ -0,0 +1,6 @@
+[submodule "vendor/sslyze"]
+	path = vendor/sslyze
+	url = git://github.com/iSECPartners/sslyze.git
+[submodule "vendor/sqlmap"]
+	path = vendor/sqlmap
+	url = https://github.com/sqlmapproject/sqlmap.git

data/.travis.yml

@@ -0,0 +1,9 @@
+language: ruby
+rvm:
+  - 1.9.3
+before_install:
+  - git submodule update --init --recursive
+before_script:
+  - sudo apt-get install nmap
+  - export SSLYZE_PATH="/home/vagrant/builds/thegauntlet/gauntlt/vendor/sslyze/sslyze.py"
+  - export SQLMAP_PATH="/home/vagrant/builds/thegauntlet/gauntlt/vendor/sqlmap/sqlmap.py"

data/Gemfile

@@ -1,4 +1,5 @@
-source "http://rubygems.org"
+source :rubygems
 
-# Specify your gem's dependencies in gauntlt.gemspec
 gemspec
+
+gem 'debugger'

data/LICENSE

@@ -0,0 +1,10 @@
+The MIT License (MIT)
+
+Copyright (c) 2012 James Wickett, Mani Tadayon, gauntlt.org
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

data/README.md

@@ -0,0 +1,95 @@
+# gauntlt [![Build Status](https://secure.travis-ci.org/thegauntlet/gauntlt.png?branch=master)](http://travis-ci.org/thegauntlet/gauntlt)
+
+gauntlt is a ruggedization framework
+
+## PROJECT STATUS
+
+The gauntlt project is under active development and is not ready for production use but we are looking for community feedback and involvement on the project.  Please file issues via github and follow the project on twitter: [@gauntlt](https://twitter.com/gauntlt).
+
+Have questions?  Ask us anything on the [gauntlt google group](http://bit.ly/gauntlt_group).
+
+## GET STARTED
+
+Before you start, please note that gauntlt is tested regularly against ruby 1.9.3. We don't test againt older versions of ruby. Keep in mind that you run gauntlt separately from the application it targets, so it does not matter whether the targeted application uses ruby.
+
+1. Clone the git repo
+
+        $ git clone --recursive git@github.com:thegauntlet/gauntlt.git
+        $ cd gauntlt
+
+
+2. Install bundler
+
+        $ gem install bundler
+
+
+3. Install dependencies
+
+Note, you may see errors in bundle related to the curb gem.  It is looking for curl dependencies. In ubuntu you can do a sudo apt-get install libcurl4-openssl-dev
+
+        $ bundle
+
+4. Create an attack file
+
+        # general format
+        $ bin/gauntlt attack --name <attack_name> --attack-file my_attack.attack
+
+        # for example, launch an nmap attack
+        # nmap.attack
+        Feature: nmap attacks
+          Background:
+            Given "nmap" is installed
+            And the target hostname is "google.com"
+
+          Scenario: Verify server is available on standard web ports
+            When I launch an "nmap" attack with:
+              """
+              nmap -p 80,443 <hostname>
+              """
+            Then the output should contain:
+              """
+              80/tcp  open  http
+              443/tcp open  https
+              """
+
+        $ bin/gauntlt attack -n nmap -a nmap.attack
+
+      For more attack examples, refer to features/attacks.
+
+5. Other commands
+
+        # list defined attacks
+        $ bin/gauntlt attack --list
+
+        # get help
+        $ bin/gauntlt help
+
+
+## ROADMAP
+
+We are adding different features into gauntlt rignt now.  Please submit issues via github and tag them as enhancements.  The core team meets weekly and will divide out the enhancement requests into our monthly releases.
+
+Below are some tools we are targeting but don't let that stop you from adding your favorite hacking tool.
+
+  * [curl] [curl]
+  * [nmap] [nmap]
+  * [sslyze] [sslyze]
+  * [sqlmap] [sqlmap]
+  * [w3af] [w3af]
+  * [arachni] [arachni]
+
+Have questions?  Ask us anything on the [gauntlt google group](http://bit.ly/gauntlt_group).
+
+## ADD A MODULE
+See the wiki on how to add a module into gauntlt. We would love your contributions.
+
+## LICENSE
+
+gauntlt is licensed under The MIT License. See the LICENSE file in the repo or visit [gauntlt.mit-license.org](http://gauntlt.mit-license.org/) for details.
+
+[curl]: http://curl.haxx.se
+[nmap]: http://nmap.org
+[sslyze]: https://github.com/iSECPartners/sslyze
+[w3af]: http://w3af.sourceforge.net
+[sqlmap]: http://sqlmap.org
+[arachni]: http://arachni-scanner.com

data/Rakefile

@@ -1 +1,5 @@
 require "bundler/gem_tasks"
+
+Dir['gem_tasks/**/*.rake'].each { |rake| load rake }
+
+task :default => [:spec, :features]

data/bin/gauntlt

@@ -1,4 +1,53 @@
 #!/usr/bin/env ruby
-
+$:.unshift(File.join(File.dirname(__FILE__), "/../lib"))
 require 'gauntlt'
-puts Hola.hi(ARGV[0])
+
+require 'acclaim'
+
+class Gauntlt::Command < Acclaim::Command
+  option :help,     '-h', '--help',    'Help outputs available command options'
+  option :version,  '-v', '--version', 'Version of app'
+
+  when_called do |options, args|
+    if options.help? || options.empty?
+      help options: false
+      Gauntlt::Command.run 'help'
+    elsif options.version?
+      puts Gauntlt::VERSION
+    end
+  end
+end
+
+# gauntlt attack ...
+class Gauntlt::Command::Attack < Gauntlt::Command
+  option :help, '-h', '--help', 'Help outputs available command options'
+  option :list, '-l', '--list', 'List of available attacks'
+
+  option :name, '-n', '--name', 'Name of attack to launch', arity: [1, 0]
+  option :attack_file, '-a', '--attack-file', 'Name of file with attack definition', arity: [1, 0]
+
+  action do |options, args|
+    if options.list? || options.empty?
+      puts "Available attacks:"
+      puts ""
+      puts Gauntlt.attacks.map{|a| "  #{a}"}.join("\n")
+      puts ""
+      puts "  try: gauntlt attack -n nmap"
+    elsif options.help?
+      help options: false
+      Gauntlt::Command.run 'help'
+      puts "  try: gauntlt attack -n nmap -a your.attack"
+    else
+      if options.attack_file? && options.name?
+        puts Gauntlt.attack(options.name, :attack_file => options.attack_file)
+      else
+        puts "  Must specify name and attack-file"
+        puts ""
+        puts "  try: gauntlt attack -n nmap -a your.attack"
+        raise
+      end
+    end
+  end
+end
+
+Gauntlt::Command.run *ARGV

data/features/attack.feature

@@ -0,0 +1,62 @@
+Feature: Verify the attack behaviour is correct
+
+  In order to ensure attack behaviour is correct,
+  As a software developer or security expert,
+  I want to run automated attacks that will pass or fail.
+
+  Scenario: List available attack steps
+    Given an attack "nmap" exists
+    When I run `gauntlt attack --list`
+    Then it should pass with:
+      """
+      nmap
+      """
+
+  Scenario: Run attack for existing tests
+    Given an attack "nmap" exists
+    And a file named "nmap.attack" with:
+    """
+    Feature: my nmap attacks
+      Scenario: nmap attack works
+        Given "nmap" is installed
+        And the target hostname is "google.com"
+        When I launch an "nmap" attack with:
+          \"\"\"
+          nmap -p 80,443 <hostname>
+          \"\"\"
+        Then the output should contain:
+          \"\"\"
+          80/tcp  open  http
+          443/tcp open  https
+          \"\"\"
+    """
+    When I run `gauntlt attack --name nmap --attack-file nmap.attack`
+    Then it should pass
+
+  Scenario: Bad attack name specified
+    When I run `gauntlt attack --name thisattackwouldneverexist`
+    Then it should fail with:
+    """
+    Must specify name and attack-file
+    """
+
+  Scenario: No attack name specified
+    When I run `gauntlt attack --attack-file thisattackwouldneverexist`
+    Then it should fail with:
+    """
+    Must specify name and attack-file
+    """
+
+  Scenario: Bad attack file specified
+    When I run `gauntlt attack --name nmap --attack-file thisattackwouldneverexist`
+    Then it should fail with:
+    """
+    No 'thisattackwouldneverexist' attack found
+    """
+
+  Scenario: No attack file specified
+    When I run `gauntlt attack --name nmap`
+    Then it should fail with:
+    """
+    Must specify name and attack-file
+    """

data/features/attacks/cookies.feature

@@ -0,0 +1,25 @@
+Feature: Cookies attack
+
+  Scenario: Launch cookies attack
+    Given an attack "cookies" exists
+    And a file named "cookies.attack" with:
+      """
+      Feature: Evaluate received cookies against expected.
+
+      Background:
+        Given "curl" is installed
+        And the target hostname is "google.com"
+
+      Scenario: Verify server is returning the cookies expected
+        When I launch a "cookies" attack
+        Then the following cookies should be received:
+          | name | secure | _rest              |
+          | PREF | false  | {}                 |
+          | NID  | false  | {'HttpOnly': None} |
+      """
+    When I run `gauntlt attack --name cookies --attack-file cookies.attack`
+    Then it should pass
+    And the output should contain:
+      """
+      4 steps (4 passed)
+      """

data/features/attacks/curl.feature

@@ -0,0 +1,23 @@
+Feature: curl attack
+  Background:
+    Given an attack "curl" exists
+
+  Scenario: curl attack
+    Given a file named "curl.attack" with:
+      """
+      Feature: Launch curl attack
+
+      Background:
+        Given "curl" is installed
+        And the target hostname is "google.com"
+
+      Scenario: Verify a 301 is received from a curl
+        When I launch a "curl" attack
+        Then the response code should be "301"
+      """
+    When I run `gauntlt attack --name curl --attack-file curl.attack`
+    Then it should pass
+    And the output should contain:
+      """
+      4 steps (4 passed)
+      """

data/features/attacks/http_methods.feature

@@ -0,0 +1,33 @@
+Feature: http_methods attack
+  Background:
+    Given an attack "http_methods" exists
+
+  Scenario: http methods
+    Given a file named "http_methods.attack" with:
+      """
+      Feature: Evaluate responses to various HTTP methods.
+
+      Background:
+        Given "curl" is installed
+        And the target hostname is "google.com"
+
+      Scenario Outline: Verify server responds correctly to various HTTP methods
+        When I launch a "curl" attack with:
+          \"\"\"
+            curl -i -X <method> <hostname>
+          \"\"\"
+        Then the output should contain "<response>"
+        Examples:
+          | method | response                       |
+          | delete | Error 405 (Method Not Allowed) |
+          | patch  | Error 405 (Method Not Allowed) |
+          | trace  | Error 405 (Method Not Allowed) |
+          | track  | Error 405 (Method Not Allowed) |
+          | bogus  | Error 405 (Method Not Allowed) |
+      """
+    When I run `gauntlt attack --name http_methods --attack-file http_methods.attack`
+    Then it should pass
+    And the output should contain:
+      """
+      5 scenarios (5 passed)
+      """

data/features/attacks/nmap.feature

@@ -0,0 +1,40 @@
+Feature: nmap attack
+  @slow
+  Scenario: Launch nmap attack
+    Given an attack "nmap" exists
+    And a file named "nmap.attack" with:
+    """
+    Feature: nmap attacks
+
+      Background:
+        Given "nmap" is installed
+        And the target hostname is "google.com"
+
+      Scenario: Verify server is available on standard web ports
+        When I launch an "nmap" attack with:
+          \"\"\"
+          nmap -p 80,443 <hostname>
+          \"\"\"
+        Then the output should contain:
+          \"\"\"
+          80/tcp  open  http
+          443/tcp open  https
+          \"\"\"
+
+      @slow
+      Scenario: Detect OS
+        When I launch an "nmap" attack with:
+          \"\"\"
+          nmap -sV -p80 -PN <hostname>
+          \"\"\"
+        Then the output should contain:
+          \"\"\"
+          Service Info: OS: Linux
+          \"\"\"
+    """
+    When I run `gauntlt attack --name nmap --attack-file nmap.attack`
+    Then it should pass
+    And the output should contain:
+      """
+      8 steps (8 passed)
+      """

data/features/attacks/sqlmap.feature

@@ -0,0 +1,17 @@
+Feature: sqlmap attack
+
+  Scenario:
+    Given an attack "sqlmap" exists
+    And a file named "sqlmap.attack" with:
+      """
+        Feature: Run sqlmap against a target
+
+        Background:
+          Given "sqlmap" is installed
+      """
+    When I run `gauntlt attack --name sqlmap --attack-file sqlmap.attack`
+    Then it should pass
+    And the output should contain:
+      """
+      1 step (1 passed)
+      """

data/features/attacks/sslyze.feature

@@ -0,0 +1,36 @@
+Feature: sslyze attack
+
+  Scenario:
+    Given an attack "sslyze" exists
+    And a file named "sslyze.attack" with:
+      """
+        Feature: Run sslyze against a target
+
+        Background:
+          Given "sslyze" is installed
+          And the target hostname is "google.com"
+
+        Scenario: Ensure no anonymous certificates
+          When I launch an "sslyze" attack with:
+            \"\"\"
+              python <sslyze_path> <hostname>:443
+            \"\"\"
+          Then the output should not contain:
+            \"\"\"
+            Anon
+            \"\"\"
+
+        # Scenario: Make sure that the certificate key size is at least 2048
+        #   Given the target hostname is "google.com"
+        #   When I launch an "sslyze" attack with:
+        #     \"\"\"
+        #       python <sslyze_path> <hostname>:443
+        #     \"\"\"
+        #   Then the key size should be at least 2048
+      """
+    When I run `gauntlt attack --name sslyze --attack-file sslyze.attack`
+    Then it should pass
+    And the output should contain:
+      """
+      4 steps (4 passed)
+      """