pwn 0.4.333

data/etc/userland/virtualbox/jenkins/jobs/selfupdate-rvm.xml

@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project>
+  <actions/>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>9</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>/bin/bash --login -c &quot;cd $PWN_ROOT &amp;&amp; ./vagrant/provisioners/rvm.sh&quot;</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <hudson.plugins.logparser.LogParserPublisher plugin="log-parser@2.0">
+      <unstableOnWarning>true</unstableOnWarning>
+      <failBuildOnError>true</failBuildOnError>
+      <showGraphs>true</showGraphs>
+      <parsingRulesPath>$PWN_ROOT/userland/$PWN_PROVIDER/jenkins/log_parser_rules/self_update.rules</parsingRulesPath>
+      <useProjectRule>false</useProjectRule>
+    </hudson.plugins.logparser.LogParserPublisher>
+  </publishers>
+  <buildWrappers>
+    <hudson.plugins.ansicolor.AnsiColorBuildWrapper plugin="ansicolor@0.5.0">
+      <colorMapName>xterm</colorMapName>
+    </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+  </buildWrappers>
+</project>

data/etc/userland/virtualbox/jenkins/jobs/selfupdate-ssllabs-scan.xml

@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project>
+  <actions/>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>9</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>/bin/bash --login -c &quot;cd $PWN_ROOT &amp;&amp; ./vagrant/provisioners/ssllabs-scan.sh&quot;</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <hudson.plugins.logparser.LogParserPublisher plugin="log-parser@2.0">
+      <unstableOnWarning>true</unstableOnWarning>
+      <failBuildOnError>true</failBuildOnError>
+      <showGraphs>true</showGraphs>
+      <parsingRulesPath>$PWN_ROOT/userland/$PWN_PROVIDER/jenkins/log_parser_rules/self_update.rules</parsingRulesPath>
+      <useProjectRule>false</useProjectRule>
+    </hudson.plugins.logparser.LogParserPublisher>
+  </publishers>
+  <buildWrappers>
+    <hudson.plugins.ansicolor.AnsiColorBuildWrapper plugin="ansicolor@0.5.0">
+      <colorMapName>xterm</colorMapName>
+    </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+  </buildWrappers>
+</project>

data/etc/userland/virtualbox/jenkins/jobs/selfupdate-wpscan.xml

@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project>
+  <actions/>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    <jenkins.model.BuildDiscarderProperty>
+      <strategy class="hudson.tasks.LogRotator">
+        <daysToKeep>-1</daysToKeep>
+        <numToKeep>9</numToKeep>
+        <artifactDaysToKeep>-1</artifactDaysToKeep>
+        <artifactNumToKeep>-1</artifactNumToKeep>
+      </strategy>
+    </jenkins.model.BuildDiscarderProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>/bin/bash --login -c &quot;cd $PWN_ROOT &amp;&amp; ./vagrant/provisioners/wpscan.rb&quot;</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <hudson.plugins.logparser.LogParserPublisher plugin="log-parser@2.0">
+      <unstableOnWarning>true</unstableOnWarning>
+      <failBuildOnError>true</failBuildOnError>
+      <showGraphs>true</showGraphs>
+      <parsingRulesPath>$PWN_ROOT/userland/$PWN_PROVIDER/jenkins/log_parser_rules/self_update.rules</parsingRulesPath>
+      <useProjectRule>false</useProjectRule>
+    </hudson.plugins.logparser.LogParserPublisher>
+  </publishers>
+  <buildWrappers>
+    <hudson.plugins.ansicolor.AnsiColorBuildWrapper plugin="ansicolor@0.5.0">
+      <colorMapName>xterm</colorMapName>
+    </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+  </buildWrappers>
+</project>

data/etc/userland/virtualbox/jenkins/log_parser_rules/arachni.rules

@@ -0,0 +1,5 @@
+# Arachni found something if the console output contains [+]
+warning /^\[\+\] [1-9][0-9]{1,} issues were detected\./
+
+# Success if 0 issues were detected
+info /^\[\+\] 0 issues were detected\.$/

data/etc/userland/virtualbox/jenkins/log_parser_rules/sast.rules

@@ -0,0 +1,2 @@
+# Warn when an x has been identified in console output for any test case (implies security pattern matched)
+warning /\=\>(.+x.*)(?=complete.)/

data/etc/userland/virtualbox/jenkins/log_parser_rules/self_update.rules

@@ -0,0 +1,14 @@
+#ok /not really/
+
+# match line containing 'error', case-insensitive
+error /(?i)(^|\s)error(:|\s)/
+
+# match line containing 'warning', case-insensitive
+warning /(?i)(^|\s)warning(:|\s)/
+
+# create a quick access link to lines in the report containing 'INFO'
+info /INFO/
+
+# each line containing 'BUILD' represents the start of a section for grouping errors and warnings found after the line.
+# also creates a quick access link.
+start /BUILD/

data/etc/userland/virtualbox/jenkins/log_parser_rules/ssllabs-scan.rules

@@ -0,0 +1,8 @@
+# Fail
+error /("grade"(:\s+|:)("D\+"|"D"|"D-"|"F")|Certificate not valid for domain name|Unable to connect to the server)/
+
+# Warn as TLS Certs Begin to Degrade
+warning /"grade"(:\s+|:)("B\+"|"B"|"B-"|"C\+"|"C"|"C-")/
+
+# Build Success
+info /"grade"(:\s+|:)("A\+"|"A"|"A-")/

data/etc/userland/virtualbox/jenkins/log_parser_rules/system_maintenance.rules

@@ -0,0 +1,9 @@
+# FYI: Prone to false positives
+# Mark Build as Failed if the Following Generic Strings are Discovered
+error /(?i)(error|stacktrace|exception):/
+
+# Mark Build as Unstable if the Following Generic Strings are Discovered
+warning /(?i)warning:/
+
+# Build Success
+info /.*/

data/etc/userland/virtualbox/jenkins/log_parser_rules/wpscan.rules

@@ -0,0 +1,2 @@
+# wpscan found something if the console output contains [+]
+warning /\[\!\].+$/

data/etc/userland/virtualbox/jenkins/vagrant.yaml.EXAMPLE

@@ -0,0 +1,8 @@
+user: 'pwnadmin'
+pass: 'changeme'
+fullname: 'changeme'
+email: 'changeme@pwn.local'
+ssh_keygen_pass: 'changeme'
+#jenkins_job_credentials:
+#  - { ssh_username: 'changeme', description: 'changeme', credential_id: '000000001' }
+#  - { ssh_username: 'changeme', description: 'changeme', credential_id: '000000002' }

data/etc/userland/virtualbox/letsencrypt/vagrant.yaml.EXAMPLE

@@ -0,0 +1,5 @@
+domains: 
+  - jenkins.DOMAIN
+  - openvas.DOMAIN
+  - sast.DOMAIN
+email: youremail@DOMAIN

data/etc/userland/virtualbox/metasploit/vagrant.yaml.EXAMPLE

@@ -0,0 +1,4 @@
+msfrpcd_host: '127.0.0.1'
+port: 55553
+username: 'pwnadmin'
+password: 'changeme'

data/etc/userland/virtualbox/nessus/vagrant.yaml.EXAMPLE

@@ -0,0 +1,2 @@
+access_key: 'ACCESS_KEY'
+secret_key: 'SECRET_KEY'

data/etc/userland/virtualbox/openvas/vagrant.yaml.EXAMPLE

@@ -0,0 +1,2 @@
+user: 'pwnadmin'
+pass: 'changeme'

data/etc/userland/virtualbox/owasp_zap/navigation.instruct.EXAMPLE

@@ -0,0 +1,3 @@
+text_field(id: 'username').wait_until(&:present?).set('<target username>')
+text_field(id: 'password').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mask_password))
+button(name: 'login').wait_until(&:present?).click!

data/etc/userland/virtualbox/postgres/vagrant.yaml.EXAMPLE

@@ -0,0 +1,2 @@
+user: 'pwnadmin'
+pass: 'changeme'

data/etc/userland/virtualbox/recon-ng/vagrant.yaml.EXAMPLE

@@ -0,0 +1,52 @@
+ipinfodb_api_key: ""
+bing_api_key: ""
+shodan_api_key: ""
+shodan_api_key: ""
+google_api_key: ""
+google_cse_key: ""
+builtwith_api_key: ""
+bing_api_key: ""
+github_api_key: ""
+hashes_api_key: ""
+github_api_key: ""
+linkedin_api_key: ""
+linkedin_secret_key: ""
+bing_api_key: ""
+jigsaw_username_key: ""
+jigsaw_password_key: ""
+jigsaw_api_key: ""
+jigsaw_username_key: ""
+jigsaw_password_key: ""
+jigsaw_api_key: ""
+jigsaw_api_key: ""
+shodan_api_key: ""
+flickr_api_key: ""
+twitter_api_key: ""
+twitter_secret_key: ""
+google_api_key: ""
+instagram_api_key: ""
+instagram_secret_key: ""
+shodan_api_key: ""
+github_api_key: ""
+fullcontact_api_key: ""
+github_api_key: ""
+censysio_id_key: ""
+censysio_secret_key: ""
+pwnedlist_api_key: ""
+pwnedlist_secret_key: ""
+pwnedlist_iv_key: ""
+pwnedlist_api_key: ""
+pwnedlist_secret_key: ""
+pwnedlist_iv_key: ""
+pwnedlist_api_key: ""
+pwnedlist_secret_key: ""
+pwnedlist_api_key: ""
+pwnedlist_secret_key: ""
+pwnedlist_api_key: ""
+pwnedlist_secret_key: ""
+twitter_api_key: ""
+twitter_secret_key: ""
+twitter_api_key: ""
+twitter_secret_key: ""
+github_api_key: ""
+

data/etc/userland/virtualbox/vagrant.yaml.EXAMPLE

@@ -0,0 +1,4 @@
+cpus: 1
+memory: 4096
+hostname: pwndeployed.pwn.local
+diskMB: 36864

data/etc/userland/vmware/apache2/jenkins_443.conf

@@ -0,0 +1,90 @@
+<IfModule mod_ssl.c>
+  <VirtualHost *:443>
+    ServerAdmin root@localhost.internal
+    ServerName jenkins.DOMAIN
+
+    ErrorLog ${APACHE_LOG_DIR}/error.log
+    CustomLog ${APACHE_LOG_DIR}/access.log combined
+    ErrorDocument 503 "Sleeping for maintenance..."
+ 
+    SSLEngine On
+    SSLProxyEngine On
+    SSLCertificateFile /etc/letsencrypt/live/jenkins.DOMAIN/fullchain.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/jenkins.DOMAIN/privkey.pem
+    Include /etc/letsencrypt/options-ssl-apache.conf
+ 
+    ProxyRequests     Off
+    ProxyPreserveHost On
+    ProxyPass         / http://127.0.0.1:8888/ nocanon
+    ProxyPassReverse  / http://127.0.0.1:8888/
+    ProxyPassReverse  / http://jenkins.DOMAIN/
+    AllowEncodedSlashes NoDecode
+    ProxyPreserveHost on
+    RequestHeader set X-Forwarded-Proto "https"
+    RequestHeader set X-Forwarded-Port "443"
+    <Proxy http://127.0.0.1:8888/*>
+      Order allow,deny
+      Allow from all
+    </Proxy>
+    #RewriteEngine On
+    #RewriteCond %{HTTP_COOKIE} (JSESSIONID.[a-z0-9]+)
+    #RewriteRule ^/?logout$ https://SSO.onelogin.com/trust/saml2/http-redirect/slo/519926 [R,CO=%1:LOGGED_OUT:;]
+  </VirtualHost>
+  # TLS Hardening
+  #
+  # Pseudo Random Number Generator (PRNG):
+  # Configure one or more sources to seed the PRNG of the SSL library.
+  # The seed data should be of good random quality.
+  # WARNING! On some platforms /dev/random blocks if not enough entropy
+  # is available. This means you then cannot use the /dev/random device
+  # because it would lead to very long connection times (as long as
+  # it requires to make more entropy available). But usually those
+  # platforms additionally provide a /dev/urandom device which doesn't
+  # block. So, if available, use this one instead. Read the mod_ssl User
+  # Manual for more details.
+  #
+  SSLRandomSeed startup builtin
+  SSLRandomSeed startup file:/dev/urandom 512
+  SSLRandomSeed connect builtin
+  SSLRandomSeed connect file:/dev/urandom 512
+
+  ##
+  ##  SSL Global Context
+  ##
+  ##  All SSL configuration in this context applies both to
+  ##  the main server and all SSL-enabled virtual hosts.
+  ##
+  #
+  #   Some MIME-types for downloading Certificates and CRLs
+  #
+  AddType application/x-x509-ca-cert .crt
+  AddType application/x-pkcs7-crl    .crl
+
+  #   Pass Phrase Dialog:
+  #   Configure the pass phrase gathering process.
+  #   The filtering dialog program (`builtin' is a internal
+  #   terminal dialog) has to provide the pass phrase on stdout.
+  SSLPassPhraseDialog  builtin
+
+  #   Inter-Process Session Cache:
+  #   Configure the SSL Session Cache: First the mechanism 
+  #   to use and second the expiring timeout (in seconds).
+  #SSLSessionCache         dbm:/var/run/apache2/ssl_scache
+  SSLSessionCache        shmcb:/var/cache/mod_ssl/scache(512000)
+  SSLSessionCacheTimeout  300
+
+  #   SSL Cipher Suite:
+  #   List the ciphers that the client is permitted to negotiate.
+  #   See the mod_ssl documentation for a complete list.
+  #   enable only secure ciphers:
+  SSLCipherSuite  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA
+  SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+
+  SSLHonorCipherOrder On
+  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
+  Header always set X-Frame-Options SAMEORIGIN
+  Header set Cache-Control "no-cache, no-store, must-revalidate"
+  Header set Pragma "no-cache"
+  Header set Expires 0
+</IfModule>

data/etc/userland/vmware/apache2/jenkins_80.conf

@@ -0,0 +1,7 @@
+<VirtualHost *:80>
+  ServerName jenkins.DOMAIN
+ 
+  RewriteEngine on
+  ReWriteCond %{SERVER_PORT} !^443$
+  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
+</VirtualHost>

data/etc/userland/vmware/apache2/openvas_443.conf

@@ -0,0 +1,87 @@
+<IfModule mod_ssl.c>
+  <VirtualHost *:443>
+    ServerAdmin root@localhost.internal
+    ServerName openvas.DOMAIN
+
+    ErrorLog ${APACHE_LOG_DIR}/error.log
+    CustomLog ${APACHE_LOG_DIR}/access.log combined
+    ErrorDocument 503 "Sleeping for maintenance..."
+ 
+    SSLEngine On
+    SSLProxyEngine On
+    SSLCertificateFile /etc/letsencrypt/live/jenkins.DOMAIN/fullchain.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/jenkins.DOMAIN/privkey.pem
+    Include /etc/letsencrypt/options-ssl-apache.conf
+ 
+    ProxyRequests     Off
+    ProxyPreserveHost On
+    ProxyPass         / http://127.0.0.1:9392/ nocanon
+    ProxyPassReverse  / http://127.0.0.1:9392/
+    ProxyPassReverse  / http://openvas.DOMAIN/
+    AllowEncodedSlashes NoDecode
+    ProxyPreserveHost on
+    RequestHeader set X-Forwarded-Proto "https"
+    RequestHeader set X-Forwarded-Port "443"
+    <Proxy http://127.0.0.1:9392/*>
+      Order allow,deny
+      Allow from all
+    </Proxy>
+  </VirtualHost>
+  # TLS Hardening
+  #
+  # Pseudo Random Number Generator (PRNG):
+  # Configure one or more sources to seed the PRNG of the SSL library.
+  # The seed data should be of good random quality.
+  # WARNING! On some platforms /dev/random blocks if not enough entropy
+  # is available. This means you then cannot use the /dev/random device
+  # because it would lead to very long connection times (as long as
+  # it requires to make more entropy available). But usually those
+  # platforms additionally provide a /dev/urandom device which doesn't
+  # block. So, if available, use this one instead. Read the mod_ssl User
+  # Manual for more details.
+  #
+  SSLRandomSeed startup builtin
+  SSLRandomSeed startup file:/dev/urandom 512
+  SSLRandomSeed connect builtin
+  SSLRandomSeed connect file:/dev/urandom 512
+
+  ##
+  ##  SSL Global Context
+  ##
+  ##  All SSL configuration in this context applies both to
+  ##  the main server and all SSL-enabled virtual hosts.
+  ##
+  #
+  #   Some MIME-types for downloading Certificates and CRLs
+  #
+  AddType application/x-x509-ca-cert .crt
+  AddType application/x-pkcs7-crl    .crl
+
+  #   Pass Phrase Dialog:
+  #   Configure the pass phrase gathering process.
+  #   The filtering dialog program (`builtin' is a internal
+  #   terminal dialog) has to provide the pass phrase on stdout.
+  SSLPassPhraseDialog  builtin
+
+  #   Inter-Process Session Cache:
+  #   Configure the SSL Session Cache: First the mechanism 
+  #   to use and second the expiring timeout (in seconds).
+  #SSLSessionCache         dbm:/var/run/apache2/ssl_scache
+  SSLSessionCache        shmcb:/var/cache/mod_ssl/scache(512000)
+  SSLSessionCacheTimeout  300
+
+  #   SSL Cipher Suite:
+  #   List the ciphers that the client is permitted to negotiate.
+  #   See the mod_ssl documentation for a complete list.
+  #   enable only secure ciphers:
+  SSLCipherSuite  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA
+  SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+
+  SSLHonorCipherOrder On
+  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
+  Header always set X-Frame-Options SAMEORIGIN
+  Header set Cache-Control "no-cache, no-store, must-revalidate"
+  Header set Pragma "no-cache"
+  Header set Expires 0
+</IfModule>

data/etc/userland/vmware/apache2/openvas_80.conf

@@ -0,0 +1,7 @@
+<VirtualHost *:80>
+  ServerName openvas.DOMAIN
+ 
+  RewriteEngine on
+  ReWriteCond %{SERVER_PORT} !^443$
+  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
+</VirtualHost>

data/etc/userland/vmware/apache2/sast_443.conf

@@ -0,0 +1,87 @@
+<IfModule mod_ssl.c>
+  <VirtualHost *:443>
+    ServerAdmin root@localhost.internal
+    ServerName sast.DOMAIN
+
+    ErrorLog ${APACHE_LOG_DIR}/error.log
+    CustomLog ${APACHE_LOG_DIR}/access.log combined
+    ErrorDocument 503 "Under construction..."
+ 
+    SSLEngine On
+    SSLProxyEngine On
+    SSLCertificateFile /etc/letsencrypt/live/jenkins.DOMAIN/fullchain.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/jenkins.DOMAIN/privkey.pem
+    Include /etc/letsencrypt/options-ssl-apache.conf
+ 
+    ProxyRequests     Off
+    ProxyPreserveHost On
+    ProxyPass         / http://127.0.0.1:4567/ nocanon
+    ProxyPassReverse  / http://127.0.0.1:4567/
+    ProxyPassReverse  / http://sast.DOMAIN/
+    AllowEncodedSlashes NoDecode
+    ProxyPreserveHost on
+    RequestHeader set X-Forwarded-Proto "https"
+    RequestHeader set X-Forwarded-Port "443"
+    <Proxy http://127.0.0.1:4567/*>
+      Order allow,deny
+      Allow from all
+    </Proxy>
+  </VirtualHost>
+  # TLS Hardening
+  #
+  # Pseudo Random Number Generator (PRNG):
+  # Configure one or more sources to seed the PRNG of the SSL library.
+  # The seed data should be of good random quality.
+  # WARNING! On some platforms /dev/random blocks if not enough entropy
+  # is available. This means you then cannot use the /dev/random device
+  # because it would lead to very long connection times (as long as
+  # it requires to make more entropy available). But usually those
+  # platforms additionally provide a /dev/urandom device which doesn't
+  # block. So, if available, use this one instead. Read the mod_ssl User
+  # Manual for more details.
+  #
+  SSLRandomSeed startup builtin
+  SSLRandomSeed startup file:/dev/urandom 512
+  SSLRandomSeed connect builtin
+  SSLRandomSeed connect file:/dev/urandom 512
+
+  ##
+  ##  SSL Global Context
+  ##
+  ##  All SSL configuration in this context applies both to
+  ##  the main server and all SSL-enabled virtual hosts.
+  ##
+  #
+  #   Some MIME-types for downloading Certificates and CRLs
+  #
+  AddType application/x-x509-ca-cert .crt
+  AddType application/x-pkcs7-crl    .crl
+
+  #   Pass Phrase Dialog:
+  #   Configure the pass phrase gathering process.
+  #   The filtering dialog program (`builtin' is a internal
+  #   terminal dialog) has to provide the pass phrase on stdout.
+  SSLPassPhraseDialog  builtin
+
+  #   Inter-Process Session Cache:
+  #   Configure the SSL Session Cache: First the mechanism 
+  #   to use and second the expiring timeout (in seconds).
+  #SSLSessionCache         dbm:/var/run/apache2/ssl_scache
+  SSLSessionCache        shmcb:/var/cache/mod_ssl/scache(512000)
+  SSLSessionCacheTimeout  300
+
+  #   SSL Cipher Suite:
+  #   List the ciphers that the client is permitted to negotiate.
+  #   See the mod_ssl documentation for a complete list.
+  #   enable only secure ciphers:
+  SSLCipherSuite  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA
+  SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+
+  SSLHonorCipherOrder On
+  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
+  Header always set X-Frame-Options SAMEORIGIN
+  Header set Cache-Control "no-cache, no-store, must-revalidate"
+  Header set Pragma "no-cache"
+  Header set Expires 0
+</IfModule>

data/etc/userland/vmware/apache2/sast_80.conf

@@ -0,0 +1,9 @@
+<VirtualHost *:80>
+  ServerName sast.DOMAIN
+ 
+  RewriteEngine on
+  ReWriteCond %{SERVER_PORT} !^443$
+  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
+  RewriteCond %{SERVER_NAME} =sast.DOMAIN
+  RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
+</VirtualHost>

data/etc/userland/vmware/apache2/vagrant.yaml.EXAMPLE

@@ -0,0 +1,9 @@
+# self_signed || letsencrypt# 
+tls_deployment_type: 'self_signed'
+country_name: 'US'
+state_or_prov: 'NY'
+city_name: 'New York'
+org_company_name: 'Company'
+org_unit_name: 'Unit'
+common_name_fqdn: 'pwndeployed.local'
+email_addr: ''

data/etc/userland/vmware/arachni/navigation-REST.instruct.EXAMPLE

@@ -0,0 +1,29 @@
+base_url = '<base_target_api_url>'
+
+rest_response = rest_client.execute(
+  method: :post,
+  url: "#{base_url}/<login_path>",
+  verify_ssl: false,
+  headers: { content_type: 'application/json' },
+  payload: '{ "username":"<target_username>", "password":"<target_password>" }'
+) { |response, request, result| response } # Don't raise exceptions and simply return the response
+
+token_hash = JSON.parse(rest_response.body, symbolize_names: true)
+
+rest_response = rest_client.execute(
+  method: :get,
+  url: "#{base_url}/<misc_api_path>",
+  verify_ssl: false,
+  headers: {
+    content_type: 'application/json',
+    authorization: token_hash[:bearer_token],
+    params: {
+      sort: 'desc',
+      max_records: 36
+    }
+  }
+) {|response, request, result| response } # Don't raise exceptions and simply return the response
+
+# If you want to force a Custom HTTP Header to Be Passed to pwn_arachni_rest
+# the following example is reserved for such cases:
+pwn_arachni_rest_custom_http_header = "Authorization: #{token_hash[:bearer_token]}"

data/etc/userland/vmware/arachni/navigation.instruct.EXAMPLE

@@ -0,0 +1,3 @@
+text_field(id: 'username').wait_until(&:present?).set('<target username>')
+text_field(id: 'password').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mask_password)
+button(name: 'login').wait_until(&:present?).click!

data/etc/userland/vmware/burpsuite/navigation.instruct.EXAMPLE

@@ -0,0 +1,3 @@
+text_field(id: 'username').wait_until(&:present?).set('<target username>')
+text_field(id: 'password').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mask_password)
+button(name: 'login').wait_until(&:present?).click!

data/etc/userland/vmware/burpsuite/vagrant.yaml.EXAMPLE

@@ -0,0 +1,2 @@
+burpsuite_pro_jar_sha256_sum: <SHA256 SUM to BURPSUITE PRO JAR>
+license_key: <VALUE OF BURP LICENSE>

data/etc/userland/vmware/defectdojo/vagrant.yaml.EXAMPLE

@@ -0,0 +1,3 @@
+url: '<changeme>'
+user: 'pwnadmin'
+api_key: '<changeme>'

data/etc/userland/vmware/jenkins/inject_build_envs.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+export GIT_COMMIT_MESSAGE=$(git show -s --format=%B $GIT_COMMIT)
+echo GIT_COMMIT_MESSAGE=$(echo $GIT_COMMIT_MESSAGE) > $WORKSPACE/env.properties
+
+export JIRA_ISSUE_UPDATER_DEBUG=TRUE
+echo JIRA_ISSUE_UPDATER_DEBUG=$(echo $JIRA_ISSUE_UPDATER_DEBUG) >> $WORKSPACE/env.properties
+
+export JIRA_ISSUE_ID=$(echo $GIT_COMMIT_MESSAGE | grep -oE "issue-[0-9]+" | head -n 1)
+echo JIRA_ISSUE_ID=$(echo $JIRA_ISSUE_ID) >> $WORKSPACE/env.properties
+
+export JIRA_PROJECT=$(echo $JIRA_ISSUE_ID | sed -E 's/-[0-9]+$//g')
+echo JIRA_PROJECT=$(echo $JIRA_PROJECT) >> $WORKSPACE/env.properties
+
+export TIMESTAMP=$(date +%Y-%m-%d-%H:%M:%S-UTC)
+echo TIMESTAMP=$(echo $TIMESTAMP) >> $WORKSPACE/env.properties