pwn 0.4.333

data/lib/pwn/sast/window_location_hash.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: false
+
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to identify the potential
+    # for DOM-based XSS in the application.
+    module WindowLocationHash
+      @@logger = PWN::Plugins::PWNLogger.create
+
+      # Supported Method Parameters::
+      # PWN::SAST::WindowLocationHash.scan(
+      #   dir_path: 'optional path to dir defaults to .'
+      #   git_repo_root_uri: 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+        result_arr = []
+        logger_results = ''
+
+        PWN::Plugins::FileFu.recurse_dir(dir_path: dir_path) do |entry|
+          if File.file?(entry) && File.basename(entry) !~ /^pwn.+(html|json|db)$/ && File.basename(entry) !~ /\.JS-BEAUTIFIED$/
+            line_no_and_contents_arr = []
+            filename_arr = []
+            entry_beautified = false
+
+            if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              entry = "#{entry}.JS-BEAUTIFIED"
+              entry_beautified = true
+            end
+
+            test_case_filter = "
+              grep -n 'window.location.hash' #{entry}
+            "
+
+            str = `#{test_case_filter}`.to_s.scrub
+
+            if str.to_s.empty?
+              # If str length is >= 64 KB do not include results. (Due to Mongo Document Size Restrictions)
+              logger_results = "#{logger_results}~" # Catching bugs is good :)
+            else
+              str = "1:Result larger than 64KB -> Size: #{str.to_s.length}.  Please click the \"Path\" link for more details." if str.to_s.length >= 64_000
+
+              hash_line = {
+                timestamp: Time.now.strftime('%Y-%m-%d %H:%M:%S.%9N %z').to_s,
+                test_case: nist_800_53_requirements,
+                filename: filename_arr.push(git_repo_root_uri: git_repo_root_uri, entry: entry),
+                line_no_and_contents: '',
+                raw_content: str,
+                test_case_filter: test_case_filter
+              }
+
+              # COMMMENT: Must be a better way to implement this (regex is kinda funky)
+              line_contents_split = str.split(/^(\d{1,}):|\n(\d{1,}):/)[1..-1]
+              line_no_count = line_contents_split.length # This should always be an even number
+              current_count = 0
+              while line_no_count > current_count
+                line_no = line_contents_split[current_count]
+                contents = line_contents_split[current_count + 1]
+                if Dir.exist?("#{dir_path}/.git") ||
+                   Dir.exist?('.git')
+
+                  repo_root = dir_path
+                  repo_root = '.' if Dir.exist?('.git')
+
+                  author = PWN::Plugins::Git.get_author(
+                    repo_root: repo_root,
+                    from_line: line_no,
+                    to_line: line_no,
+                    target_file: entry,
+                    entry_beautified: entry_beautified
+                  )
+                else
+                  author = 'N/A'
+                end
+                hash_line[:line_no_and_contents] = line_no_and_contents_arr.push(line_no: line_no,
+                                                                                 contents: contents,
+                                                                                 author: author)
+
+                current_count += 2
+              end
+              result_arr.push(hash_line)
+              logger_results = "#{logger_results}x" # Seeing progress is good :)
+            end
+          end
+        end
+        logger_banner = "http://#{Socket.gethostname}:8808/doc_root/pwn-#{PWN::VERSION.to_s.scrub}/#{to_s.scrub.gsub('::', '/')}.html"
+        if logger_results.empty?
+          @@logger.info("#{logger_banner}: No files applicable to this test case.\n")
+        else
+          @@logger.info("#{logger_banner} => #{logger_results}complete.\n")
+        end
+        result_arr
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.nist_800_53_requirements
+        {
+          sast_module: self,
+          section: 'MALICIOUS CODE PROTECTION',
+          nist_800_53_uri: 'https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/control/?version=5.1&number=SI-3'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: Jacob Hoopes <jake.hoopes@gmail.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          Jacob Hoopes <jake.hoopes@gmail.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            dir_path: 'optional path to dir defaults to .',
+            git_repo_root_uri: 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module PWN
+  # This file, using the autoload directive loads SP static code analysis
+  # modules into memory only when they're needed. For more information, see:
+  # http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html
+  module SAST
+    # Zero False Negative SAST Modules
+    autoload :ApacheFileSystemUtilAPI, 'pwn/sast/apache_file_system_util_api'
+    autoload :AMQPConnectAsGuest, 'pwn/sast/amqp_connect_as_guest'
+    autoload :AWS, 'pwn/sast/aws'
+    autoload :BannedFunctionCallsC, 'pwn/sast/banned_function_calls_c'
+    autoload :Base64, 'pwn/sast/base64'
+    autoload :BeefHook, 'pwn/sast/beef_hook'
+    autoload :CmdExecutionJava, 'pwn/sast/cmd_execution_java'
+    autoload :CmdExecutionPython, 'pwn/sast/cmd_execution_python'
+    autoload :CmdExecutionRuby, 'pwn/sast/cmd_execution_ruby'
+    autoload :CmdExecutionScala, 'pwn/sast/cmd_execution_scala'
+    autoload :CSRF, 'pwn/sast/csrf'
+    autoload :DeserialJava, 'pwn/sast/deserial_java'
+    autoload :Emoticon, 'pwn/sast/emoticon'
+    autoload :Eval, 'pwn/sast/eval'
+    autoload :Factory, 'pwn/sast/factory'
+    autoload :FilePermission, 'pwn/sast/file_permission'
+    autoload :InnerHTML, 'pwn/sast/inner_html'
+    autoload :Keystore, 'pwn/sast/keystore'
+    autoload :LocationHash, 'pwn/sast/location_hash'
+    autoload :Log4J, 'pwn/sast/log4j'
+    autoload :Logger, 'pwn/sast/logger'
+    autoload :OuterHTML, 'pwn/sast/outer_html'
+    autoload :Password, 'pwn/sast/password'
+    autoload :PomVersion, 'pwn/sast/pom_version'
+    autoload :Port, 'pwn/sast/port'
+    autoload :PrivateKey, 'pwn/sast/private_key'
+    autoload :Redirect, 'pwn/sast/redirect'
+    autoload :ReDOS, 'pwn/sast/redos'
+    autoload :Shell, 'pwn/sast/shell'
+    autoload :SQL, 'pwn/sast/sql'
+    autoload :SSL, 'pwn/sast/ssl'
+    autoload :Sudo, 'pwn/sast/sudo'
+    autoload :TaskTag, 'pwn/sast/task_tag'
+    autoload :ThrowErrors, 'pwn/sast/throw_errors'
+    autoload :Token, 'pwn/sast/token'
+    autoload :Version, 'pwn/sast/version'
+    autoload :WindowLocationHash, 'pwn/sast/window_location_hash'
+
+    # Display a List of Each Static Code Anti-Pattern Matching Module
+
+    public_class_method def self.help
+      constants.sort
+    end
+  end
+end

data/lib/pwn/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module PWN
+  VERSION = '0.4.333'
+end

data/lib/pwn/www/app_cobalt_io.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+require 'yaml'
+
+module PWN
+  module WWW
+    # This plugin supports app.cobalt.io actions.
+    module AppCobaltIO
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::AppCobaltIO.open(
+      #   browser_type: 'optional - :firefox|:chrome|:ie|:headless (Defaults to :firefox)',
+      #   proxy: 'optional - scheme://proxy_host:port',
+      #   with_tor: 'optional - boolean (defaults to false)'
+      # )
+
+      public_class_method def self.open(opts = {})
+        browser_type = if opts[:browser_type].nil?
+                         :firefox
+                       else
+                         opts[:browser_type]
+                       end
+
+        proxy = opts[:proxy].to_s unless opts[:proxy].nil?
+
+        with_tor = if opts[:with_tor]
+                     true
+                   else
+                     false
+                   end
+
+        if proxy
+          if with_tor
+            browser_obj = PWN::Plugins::TransparentBrowser.open(
+              browser_type: browser_type,
+              proxy: proxy,
+              with_tor: with_tor
+            )
+          else
+            browser_obj = PWN::Plugins::TransparentBrowser.open(
+              browser_type: browser_type,
+              proxy: proxy
+            )
+          end
+        else
+          browser_obj = PWN::Plugins::TransparentBrowser.open(
+            browser_type: browser_type
+          )
+        end
+
+        browser_obj.goto('https://app.cobalt.io')
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::AppCobaltIO.login(
+      #   browser_obj: 'required - browser_obj returned from #open method',
+      #   username: 'required - username',
+      #   password: 'optional - passwd (will prompt if blank)',
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      # )
+
+      public_class_method def self.login(opts = {})
+        browser_obj = opts[:browser_obj]
+        username = opts[:username].to_s.scrub.strip.chomp
+        password = opts[:password]
+
+        if password.nil?
+          password = PWN::Plugins::AuthenticationHelper.mask_password
+        else
+          password = opts[:password].to_s.scrub.strip.chomp
+        end
+        mfa = opts[:mfa]
+
+        browser_obj.goto('https://app.cobalt.io/users/sign_in')
+
+        # id: 'user_email' doesn't work
+        browser_obj.text_field(index: 9).wait_until(&:present?).set(username)
+        # id: 'user_password' doesn't work
+        browser_obj.text_field(index: 10).wait_until(&:present?).set(password)
+        # name: 'commit' doesn't work
+        browser_obj.button(index: 6).wait_until(&:present?).click # no name or id in button element
+
+        if mfa
+          until browser_obj.url == 'https://app.cobalt.io/dashboard'
+            browser_obj.text_field(id: 'code').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser_obj.button(name: 'commit').wait_until(&:present?).click
+            sleep 3
+          end
+          print "\n"
+        end
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::AppCobaltIO.logout(
+      #   browser_obj: 'required - browser_obj returned from #open method'
+      # )
+
+      public_class_method def self.logout(opts = {})
+        browser_obj = opts[:browser_obj]
+        browser_obj.li(class: 'user-dropdown').wait_until(&:present?).click
+        browser_obj.link(index: 10).wait_until(&:present?).click
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::AppCobaltIO.close(
+      #   browser_obj: 'required - browser_obj returned from #open method'
+      # )
+
+      public_class_method def self.close(opts = {})
+        browser_obj = opts[:browser_obj]
+        PWN::Plugins::TransparentBrowser.close(
+          browser_obj: browser_obj
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: Jacob Hoopes <jake.hoopes@gmail.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          Jacob Hoopes <jake.hoopes@gmail.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          browser_obj = #{self}.open(
+            browser_type: 'optional - :firefox|:chrome|:ie|:headless (Defaults to :firefox)',
+            proxy: 'optional - scheme://proxy_host:port',
+            with_tor: 'optional - boolean (defaults to false)'
+          )
+          puts browser_obj.public_methods
+
+          browser_obj = #{self}.login(
+            browser_obj: 'required - browser_obj returned from #open method',
+            username: 'required - username',
+            password: 'optional - passwd (will prompt if blank),
+            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+          )
+
+          browser_obj = #{self}.logout(
+            browser_obj: 'required - browser_obj returned from #open method'
+          )
+
+          #{self}.close(
+            browser_obj: 'required - browser_obj returned from #open method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/www/bing.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module PWN
+  module WWW
+    # This plugin supports Bing actions.
+    module Bing
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::Bing.open(
+      #   browser_type: 'optional - :firefox|:chrome|:ie|:headless (Defaults to :firefox)',
+      #   proxy: 'optional scheme://proxy_host:port',
+      #   with_tor: 'optional boolean (defaults to false)'
+      # )
+
+      public_class_method def self.open(opts = {})
+        browser_type = if opts[:browser_type].nil?
+                         :firefox
+                       else
+                         opts[:browser_type]
+                       end
+
+        proxy = opts[:proxy].to_s unless opts[:proxy].nil?
+
+        with_tor = if opts[:with_tor]
+                     true
+                   else
+                     false
+                   end
+
+        if proxy
+          if with_tor
+            browser_obj = PWN::Plugins::TransparentBrowser.open(
+              browser_type: browser_type,
+              proxy: proxy,
+              with_tor: with_tor
+            )
+          else
+            browser_obj = PWN::Plugins::TransparentBrowser.open(
+              browser_type: browser_type,
+              proxy: proxy
+            )
+          end
+        else
+          browser_obj = PWN::Plugins::TransparentBrowser.open(
+            browser_type: browser_type
+          )
+        end
+        browser_obj.goto('https://www.bing.com')
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::Bing.search(
+      #   browser_obj: 'required - browser_obj returned from #open method',
+      #   q: 'required - search string'
+      # )
+
+      public_class_method def self.search(opts = {})
+        browser_obj = opts[:browser_obj]
+        q = opts[:q].to_s
+
+        browser_obj.text_field(name: 'q').wait_until(&:present?).set(q)
+        browser_obj.button(id: 'sb_form_go').wait_until(&:present?).click
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::Bing.close(
+      #   browser_obj: 'required - browser_obj returned from #open method',
+      # )
+
+      public_class_method def self.close(opts = {})
+        browser_obj = opts[:browser_obj]
+        PWN::Plugins::TransparentBrowser.close(
+          browser_obj: browser_obj
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: Jacob Hoopes <jake.hoopes@gmail.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          Jacob Hoopes <jake.hoopes@gmail.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          browser_obj = #{self}.open(
+            browser_type: 'optional :firefox|:chrome|:ie|:headless (Defaults to :firefox)',
+            proxy: 'optional scheme://proxy_host:port',
+            with_tor: 'optional boolean (defaults to false)'
+          )
+          puts browser_obj.public_methods
+
+          browser_obj = #{self}.search(
+            browser_obj: 'required - browser_obj returned from #open method',
+            q: 'required - search string'
+          )
+
+          browser_obj = #{self}.close(
+            browser_obj: 'required - browser_obj returned from #open method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/www/bug_crowd.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require 'yaml'
+
+module PWN
+  module WWW
+    # This plugin supports bugcrowd.com actions.
+    module BugCrowd
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::BugCrowd.open(
+      #   browser_type: 'optional - :firefox|:chrome|:ie|:headless (Defaults to :firefox)',
+      #   proxy: 'optional - scheme://proxy_host:port',
+      #   with_tor: 'optional - boolean (defaults to false)'
+      # )
+
+      public_class_method def self.open(opts = {})
+        browser_type = if opts[:browser_type].nil?
+                         :firefox
+                       else
+                         opts[:browser_type]
+                       end
+
+        proxy = opts[:proxy].to_s unless opts[:proxy].nil?
+
+        with_tor = if opts[:with_tor]
+                     true
+                   else
+                     false
+                   end
+
+        if proxy
+          if with_tor
+            browser_obj = PWN::Plugins::TransparentBrowser.open(
+              browser_type: browser_type,
+              proxy: proxy,
+              with_tor: with_tor
+            )
+          else
+            browser_obj = PWN::Plugins::TransparentBrowser.open(
+              browser_type: browser_type,
+              proxy: proxy
+            )
+          end
+        else
+          browser_obj = PWN::Plugins::TransparentBrowser.open(
+            browser_type: browser_type
+          )
+        end
+
+        browser_obj.goto('https://bugcrowd.com')
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::BugCrowd.login(
+      #   browser_obj: 'required - browser_obj returned from #open method',
+      #   username: 'required - username',
+      #   password: 'optional - passwd (will prompt if blank)',
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      # )
+
+      public_class_method def self.login(opts = {})
+        browser_obj = opts[:browser_obj]
+        username = opts[:username].to_s.scrub.strip.chomp
+        password = opts[:password]
+
+        if password.nil?
+          password = PWN::Plugins::AuthenticationHelper.mask_password
+        else
+          password = opts[:password].to_s.scrub.strip.chomp
+        end
+        mfa = opts[:mfa]
+
+        browser_obj.goto('https://bugcrowd.com/user/sign_in')
+
+        browser_obj.text_field(id: 'user_email').wait_until(&:present?).set(username)
+        browser_obj.text_field(id: 'user_password').wait_until(&:present?).set(password)
+        browser_obj.button(name: 'button').wait_until(&:present?).click
+
+        if mfa
+          until browser_obj.url == 'https://bugcrowd.com/programs'
+            browser_obj.text_field(name: 'otp_attempt').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser_obj.button(name: 'commit').wait_until(&:present?).click
+            sleep 3
+          end
+          print "\n"
+        end
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::BugCrowd.logout(
+      #   browser_obj: 'required - browser_obj returned from #open method'
+      # )
+
+      public_class_method def self.logout(opts = {})
+        browser_obj = opts[:browser_obj]
+        browser_obj.li(class: 'dropdown-hover').wait_until(&:present?).hover
+        browser_obj.link(class: 'signout_link').wait_until(&:present?).click
+
+        browser_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # browser_obj = PWN::WWW::BugCrowd.close(
+      #   browser_obj: 'required - browser_obj returned from #open method'
+      # )
+
+      public_class_method def self.close(opts = {})
+        browser_obj = opts[:browser_obj]
+        PWN::Plugins::TransparentBrowser.close(
+          browser_obj: browser_obj
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: Jacob Hoopes <jake.hoopes@gmail.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          Jacob Hoopes <jake.hoopes@gmail.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          browser_obj = #{self}.open(
+            browser_type: 'optional - :firefox|:chrome|:ie|:headless (Defaults to :firefox)',
+            proxy: 'optional - scheme://proxy_host:port',
+            with_tor: 'optional - boolean (defaults to false)'
+          )
+          puts browser_obj.public_methods
+
+          browser_obj = #{self}.login(
+            browser_obj: 'required - browser_obj returned from #open method',
+            username: 'required - username',
+            password: 'optional - passwd (will prompt if blank),
+            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+          )
+
+          browser_obj = #{self}.logout(
+            browser_obj: 'required - browser_obj returned from #open method'
+          )
+
+          #{self}.close(
+            browser_obj: 'required - browser_obj returned from #open method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end