pwn 0.4.333

data/bin/pwn_owasp_zap_active_scan

@@ -0,0 +1,134 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'optparse'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-aAPIKEY', '--api_key=APIKEY', '<Required - OWASP Zap API Key (Tools>Options>API)>') do |a|
+    opts[:api_key] = a
+  end
+
+  options.on('-tTARGET', '--target_url=TARGET', '<Required - Target URI to Scan>') do |t|
+    opts[:target_url] = t
+  end
+
+  options.on('-oDIR', '--report_output_dir=DIR', '<Required - Output Directory for Active Scan Report>') do |o|
+    opts[:output_dir] = o
+  end
+
+  options.on('-bTYPE', '--browser_type=TYPE', '<Optional - Browser Type <firefox|chrome|headless|rest> (Defaults to chrome)>') do |b|
+    opts[:browser_type] = b
+  end
+
+  options.on('-IINST', '--navigation_instruct=INST', '<Optional - Path to Navigation Instructions (e.g. Auth w/ Target - see /pwn/etc/owasp_zap/navigation.instruct.EXAMPLE)>') do |i|
+    opts[:navigation_instruct] = i
+  end
+
+  options.on('-zZPATH', '--zap_bin_path=ZPATH', '<Optional - Path to zap.sh>') do |z|
+    opts[:zap_bin_path] = z
+  end
+
+  options.on('-h', '--[no-]headless', '<Optional - Run OWASP Zap Headless>') do |h|
+    opts[:headless] = h
+  end
+
+  options.on('-pPROXY', '--proxy=PROXY', '<Optional - Change Local Zap Proxy Listener (Default http://127.0.0.1:8080)>') do |p|
+    opts[:proxy] = p
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  logger = PWN::Plugins::PWNLogger.create
+
+  api_key = opts[:api_key].to_s.strip.chomp.scrub
+
+  if opts[:browser_type].nil?
+    browser_type = :chrome
+  else
+    browser_type = opts[:browser_type].to_s.strip.chomp.scrub.to_sym
+  end
+
+  target_url = opts[:target_url].to_s.strip.chomp.scrub
+  output_dir = opts[:output_dir].to_s.strip.chomp.scrub
+  navigation_instruct = opts[:navigation_instruct].to_s.strip.chomp.scrub if File.exist?(opts[:navigation_instruct].to_s.strip.chomp.scrub)
+  zap_bin_path = opts[:zap_bin_path].to_s.strip.chomp.scrub if File.exist?(opts[:zap_bin_path].to_s.strip.chomp.scrub)
+  headless = opts[:headless]
+  proxy = opts[:proxy].to_s.strip.chomp.scrub
+  proxy = 'http://127.0.0.1:8080' if proxy == ''
+
+  # ------
+  # Dynamically build arguments hash based on flags passed and Open Zap
+  start_args = {}
+  start_args[:api_key] = api_key
+  start_args[:zap_bin_path] = zap_bin_path if zap_bin_path != ''
+  start_args[:headless] = true if headless
+  start_args[:proxy] = proxy
+  zap_obj = PWN::Plugins::OwaspZap.start(start_args)
+
+  logger.info(zap_obj)
+
+  browser = PWN::Plugins::TransparentBrowser.open(
+    browser_type: browser_type,
+    proxy: proxy
+  )
+
+  if browser_type == :rest
+    browser.get(target_url)
+  else
+    browser.goto(target_url)
+  end
+
+  if navigation_instruct
+    File.read(navigation_instruct).each_line do |instruction|
+      browser.instance_eval(instruction.to_s.scrub.strip.chomp)
+    end
+  end
+
+  PWN::Plugins::OwaspZap.spider(
+    zap_obj: zap_obj,
+    target: target_url
+  )
+
+  PWN::Plugins::OwaspZap.active_scan(
+    zap_obj: zap_obj,
+    target: target_url
+  )
+
+  # Generate all Report Types
+  (1..3).each do |report_iteration|
+    case report_iteration
+    when 1
+      report_type = 'html'
+    when 2
+      report_type = 'markdown'
+    when 3
+      report_type = 'xml'
+    end
+
+    report_path = PWN::Plugins::OwaspZap.generate_report(
+      zap_obj: zap_obj,
+      output_dir: output_dir,
+      report_type: report_type
+    )
+
+    logger.info("Report can be found here: #{report_path}")
+  end
+
+  PWN::Plugins::OwaspZap.stop(zap_obj: zap_obj)
+rescue StandardError => e
+  raise e
+ensure
+  PWN::Plugins::OwaspZap.stop(zap_obj: zap_obj) unless zap_obj.nil?
+  browser = PWN::Plugins::TransparentBrowser.close(browser_obj: browser) unless browser.nil?
+end

data/bin/pwn_pastebin_sample_filter

@@ -0,0 +1,61 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'optparse'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-rPATTERN', '--regex=PATTERN', "<Required - Regex Pattern for Interesting Pastes ('.*' for All)>") do |r|
+    opts[:regex] = r
+  end
+
+  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy>') do |p|
+    opts[:proxy] = p
+  end
+
+  options.on('-T', '--[no-]with-tor', '<Optional - Proxy w/ TOR (Defaults to false)>') do |w|
+    opts[:with_tor] = w
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+proxy = opts[:proxy]
+with_tor = opts[:with_tor]
+regex = opts[:regex]
+
+browser_obj = PWN::WWW::Pastebin.open(
+  browser_type: :headless,
+  proxy: proxy,
+  with_tor: with_tor
+)
+
+begin
+  loop do
+    browser_obj.div(id: 'menu_2').links[0].click
+    code_frame = browser_obj.div(id: 'code_frame').text
+    if code_frame.match?(/#{regex}/mi)
+      puts "\nCurrent Link: #{browser_obj.url}"
+      puts "#{code_frame}\n\n\n"
+    else
+      print '.'
+    end
+    sleep 9
+  end
+rescue StandardError => e
+  raise e
+ensure
+  if browser_obj
+    browser_obj = PWN::Plugins::TransparentBrowser.close(
+      browser_obj: browser_obj
+    )
+  end
+end

data/bin/pwn_perimeter_recon

@@ -0,0 +1,318 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'optparse'
+require 'uri'
+require 'json'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-tDOMAINS', '--targets=DOMAINS', '<Required - Comma-Delimited List of Target Domains>') do |t|
+    opts[:targets] = t
+  end
+
+  options.on('-dDIR', '--output-dir=DIR', '<Required - Directory to Save Results>') do |d|
+    opts[:output_dir] = d
+  end
+
+  options.on('-eEXCLUDE', '--exclude-domains=EXCLUDE', '<Optional - Comma-Delimited List of Domains to Exclude>') do |e|
+    opts[:exclude_domains] = e
+  end
+
+  options.on('-sSUBLIST3R', '--sublist3r-path=SUBLIST3R', '<Optional - Path to Sublist3r>') do |s|
+    opts[:sublist3r_path] = s
+  end
+
+  options.on('-i', '--[no-]ipinfo', '<Optional - Leverage ipinfo.com on Domains (Defaults to false)>') do |i|
+    opts[:ipinfo] = i
+  end
+
+  options.on('-nNMAP', '--nmap-path=NMAP', '<Optional - Path to Nmap>') do |n|
+    opts[:nmap_path] = n
+  end
+
+  options.on('-EWITNESS', '--eyewitness-path=WITNESS', '<Optional - Path to eyewitness/Requires Nmap Flag>') do |w|
+    opts[:eyewitness_path] = w
+  end
+
+  options.on('-bBURP', '--burp-path=BURP', '<Optional - Path to Burp>') do |b|
+    opts[:burp_path] = b
+  end
+
+  options.on('-r', '--[no-]resume-last-scan', '<Optional - Resume Last Scan (Defaults to false)>') do |r|
+    opts[:resume_last_scan] = r
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+# Colors!
+@red = "\e[31m"
+@green = "\e[32m"
+@yellow = "\e[33m"
+@end_of_color = "\e[0m"
+
+# Required Flag Variables
+targets = opts[:targets].to_s.scrub.strip.chomp.delete("\s").split(',')
+output_dir = opts[:output_dir].to_s.scrub.strip.chomp if Dir.exist?(opts[:output_dir].to_s.scrub.strip.chomp)
+
+if opts[:resume_last_scan]
+  @resume_last_scan = opts[:resume_last_scan]
+  @runtime_timestamp = File.basename(Dir.glob("#{output_dir}/target_domains*")[-1]).split('-')[-6..-1].join('-').split('.txt')[0]
+  target_domains = "#{output_dir}/target_domains-#{@runtime_timestamp}.txt"
+else
+  @resume_last_scan = nil
+  @runtime_timestamp = Time.now.strftime('%Y-%m-%d-%H-%M-%S')
+  target_domains = "#{output_dir}/target_domains-#{@runtime_timestamp}.txt"
+  File.open(target_domains, 'w') do |f|
+    targets.each do |target|
+      f.puts target
+    end
+  end
+end
+
+exclude_domains = opts[:exclude_domains].to_s.scrub.strip.chomp.delete("\s").split(',')
+ipinfo = opts[:ipinfo]
+sublist3r_path = opts[:sublist3r_path].to_s.scrub.strip.chomp
+burp_path = opts[:burp_path].to_s.scrub.strip.chomp
+nmap_path = opts[:nmap_path].to_s.scrub.strip.chomp
+eyewitness_path = opts[:eyewitness_path].to_s.scrub.strip.chomp
+
+def invoke_burp(opts = {})
+  burp_path = opts[:burp_path]
+  burp_target = opts[:burp_target]
+  port_number = opts[:port_number]
+  port_protocol = opts[:port_protocol]
+  output_dir = opts[:output_dir]
+  use_https = opts[:use_https]
+  target_domain = URI.parse(burp_target).host
+
+  json_results = "#{output_dir}/#{target_domain}-#{port_protocol}-#{port_number}-#{@runtime_timestamp}-burpsuite_activescan.json"
+  html_results = "#{output_dir}/#{target_domain}-#{port_protocol}-#{port_number}-#{@runtime_timestamp}-burpsuite_activescan.html"
+
+  if File.exist?(json_results)
+    puts "#{@yellow}Already Exists: #{json_results}#{@end_of_color}"
+  else
+    burp_obj = PWN::Plugins::BurpSuite.start(
+      burp_jar_path: burp_path,
+      headless: true,
+      browser_type: :headless
+    )
+
+    PWN::Plugins::BurpSuite.disable_proxy(
+      burp_obj: burp_obj
+    )
+
+    browser_obj = burp_obj[:burp_browser]
+
+    puts "#{@green}Navigating to: #{burp_target}#{@end_of_color}"
+    browser_obj.goto(burp_target)
+
+    puts "#{@green}Invoking Active Scan...#{@end_of_color}"
+    json_scan_queue = PWN::Plugins::BurpSuite.invoke_active_scan(
+      burp_obj: burp_obj,
+      target_url: burp_target,
+      use_https: use_https
+    )
+    puts "#{@green}complete.#{@end_of_color}"
+
+    print "#{@green}Generating Burp Suite Active Scan JSON Results...#{@end_of_color}"
+    scan_issues_hash = PWN::Plugins::BurpSuite.get_scan_issues(
+      burp_obj: burp_obj
+    )
+
+    File.open(json_results, 'w') do |f|
+      f.puts scan_issues_hash.to_json
+    end
+    puts "#{@green}complete.#{@end_of_color}\n\n\n"
+
+    print "#{@green}Generating Burp Suite Active Scan HTML Results...#{@end_of_color}"
+    PWN::Plugins::BurpSuite.generate_scan_report(
+      burp_obj: burp_obj,
+      report_type: :html,
+      output_path: html_results
+    )
+
+    burp_obj = PWN::Plugins::BurpSuite.stop(burp_obj: burp_obj)
+    puts "#{@green}complete.#{@end_of_color}\n\n\n"
+  end
+rescue StandardError => e
+  puts "#{@red}#{e}#{@end_of_color}"
+ensure
+  burp_obj = PWN::Plugins::BurpSuite.stop(burp_obj: burp_obj) unless burp_obj.nil?
+end
+
+# Run Sublist3r to find as many domains as possible for a given FQDN
+unless sublist3r_path == ''
+  if @resume_last_scan.nil?
+    sublist3r_target_domains_arr = []
+    File.readlines(target_domains).uniq.each do |s_line|
+      sublist3r_target = s_line.to_s.scrub.strip.chomp
+      sublist3r_results = "#{output_dir}/#{sublist3r_target}-#{@runtime_timestamp}-sublist3r.txt"
+      print "#{@green}Sublist3r Domain Discovery #{sublist3r_target}...#{@end_of_color}"
+      puts `python #{sublist3r_path} -v -d #{sublist3r_target} -o #{sublist3r_results}`
+      File.readlines(sublist3r_results).uniq.each do |sr_line|
+        discovered_domain = sr_line.to_s.scrub.strip.chomp
+        sublist3r_target_domains_arr.push(discovered_domain)
+      end
+      puts "#{@green}complete.#{@end_of_color}"
+    end
+    File.open(target_domains, 'a') do |f|
+      sublist3r_target_domains_arr.uniq do |discovered_domain|
+        if URI.parse(discovered_domain).host.nil?
+          f.puts discovered_domain unless exclude_domains.include?(discovered_domain)
+        else
+          parsed_domain = URI.parse(discovered_domain).host
+          f.puts parsed_domain unless exclude_domains.include?(parsed_domain)
+        end
+      end
+    end
+  else
+    puts "#{@yellow}Resuming scan from #{target_domains}...#{@end_of_color}"
+  end
+end
+
+# Obtain additional information about the targeted hosts...
+unless ipinfo.nil?
+  File.readlines(target_domains).uniq.each do |h_line|
+    ipinfo_target = h_line.to_s.scrub.strip.chomp
+    ipinfo_json_results = "#{output_dir}/#{ipinfo_target}-#{@runtime_timestamp}-ipinfo.json"
+    puts "#{@yellow}Already Exists: #{ipinfo_json_results}#{@end_of_color}" if File.exist?(ipinfo_json_results)
+    next if exclude_domains.include?(ipinfo_target) || File.exist?(ipinfo_json_results)
+
+    ipinfo_struc = PWN::Plugins::IPInfo.get(ip_or_host: ipinfo_target)
+    File.open(ipinfo_json_results, 'w') do |f|
+      f.puts ipinfo_struc.to_json
+    end
+  end
+end
+
+unless nmap_path == ''
+  print "#{@green}Nmap all the things...#{@end_of_color}"
+  File.readlines(target_domains).uniq.each do |n_line|
+    nmap_target = n_line.to_s.scrub.strip.chomp
+    nmap_xml_results = "#{output_dir}/#{nmap_target}-#{@runtime_timestamp}-nmap_default.xml"
+    puts "#{@yellow}Already Exists: #{nmap_xml_results}#{@end_of_color}" if File.exist?(nmap_xml_results)
+    next if exclude_domains.include?(nmap_target)
+
+    begin
+      unless File.exist?(nmap_xml_results)
+        PWN::Plugins::NmapIt.port_scan do |nmap|
+          nmap.connect_scan = true
+          nmap.service_scan = true
+          nmap.os_fingerprint = true
+          nmap.verbose = true
+          nmap.targets = nmap_target
+          nmap.xml = nmap_xml_results
+        end
+      end
+
+      # Eyewitness Nmap XML Results
+      unless eyewitness_path == ''
+        print "#{@green}Eyewitness Nmap XML Results...#{@end_of_color}"
+        system("#{eyewitness_path} -x '#{nmap_xml_results}' -d '#{output_dir}/#{nmap_target}-#{@runtime_timestamp}' --no-prompt --all-protocols")
+      end
+
+      PWN::Plugins::NmapIt.parse_xml_results(xml_file: nmap_xml_results) do |xml|
+        xml.each_host do |host|
+          puts "#{@green}#{host.hostname}#{@end_of_color}"
+
+          host.scripts.each do |name, output|
+            puts name
+            output.each_line { |h_line| puts h_line }
+          end
+
+          host.each_port do |port|
+            puts "#{@yellow}#{port.number}|#{port.protocol}|#{port.state}|#{port.reason}|#{port.service}#{@end_of_color}"
+
+            case port.number.to_i
+            when 80
+              burp_target = "http://#{nmap_target}"
+              unless burp_path == ''
+                invoke_burp(
+                  burp_path: burp_path,
+                  burp_target: burp_target,
+                  port_number: port.number,
+                  port_protocol: port.protocol,
+                  output_dir: output_dir,
+                  use_https: false
+                )
+              end
+
+            when 443
+              burp_target = "https://#{nmap_target}"
+              unless burp_path == ''
+                invoke_burp(
+                  burp_path: burp_path,
+                  burp_target: burp_target,
+                  port_number: port.number,
+                  port_protocol: port.protocol,
+                  output_dir: output_dir,
+                  use_https: true
+                )
+              end
+
+            when 8080
+              burp_target = "http://#{nmap_target}:#{port.number}"
+              unless burp_path == ''
+                invoke_burp(
+                  burp_path: burp_path,
+                  burp_target: burp_target,
+                  port_number: port.number,
+                  port_protocol: port.protocol,
+                  output_dir: output_dir,
+                  use_https: false
+                )
+              end
+
+            when 8443
+              burp_target = "https://#{nmap_target}:#{port.number}"
+              unless burp_path == ''
+                invoke_burp(
+                  burp_path: burp_path,
+                  burp_target: burp_target,
+                  port_number: port.number,
+                  port_protocol: port.protocol,
+                  output_dir: output_dir,
+                  use_https: true
+                )
+              end
+
+            when 8888
+              burp_target = "http://#{nmap_target}:#{port.number}"
+              unless burp_path == ''
+                invoke_burp(
+                  burp_path: burp_path,
+                  burp_target: burp_target,
+                  port_number: port.number,
+                  port_protocol: port.protocol,
+                  output_dir: output_dir
+                )
+              end
+
+            else
+              puts "Nothing special implemented for #{port.protocol} #{port.number}"
+            end
+
+            port.scripts.each do |name, output|
+              puts name
+              output.each_line { |p_line| puts p_line }
+            end
+          end
+        end
+      end
+    rescue StandardError => e
+      puts "#{@red}#{e}#{@end_of_color}"
+      next
+    end
+  end
+  puts "#{@green}complete.#{@end_of_color}"
+end

data/bin/pwn_sast

@@ -0,0 +1,161 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: false
+
+require 'pwn'
+require 'optparse'
+require 'htmlentities'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-dDIR', '--dir-path=DIR', '<Required - Report Output Directory>') { |d| opts[:dir_path] = d }
+
+  options.on('-uGITURI', '--uri-source-root=GITURI', '<Required - HTTP URI of Git Repo Scanned e.g. https://github.com/0dayInc/pwn/tree/master>') do |u|
+    opts[:uri_source_root] = u
+  end
+
+  options.on('-tTHREADS', '--max-threads=THREADS', '<Optional # Test Cases to Run Simultaneously (Default 25)>') do |t|
+    opts[:max_threads] = t
+  end
+
+  options.on('-TCASE', '--test-cases=CASE', '<Optional Comma-Delimited Test Cases to Invoke (-l for List)>') do |c|
+    opts[:chosen_test_cases] = c
+  end
+
+  options.on('-l', '--[no-]list-test-cases', '<Optional List Available Test Cases to Invoke and Exit>') do |l|
+    opts[:list_test_cases] = l
+  end
+
+  options.on('-nREPORTNAME', '--report-name=REPORTNAME', '<Optional Report Name (Defaults to, "File.basename(Dir.pwd)")>') do |n|
+    opts[:report_name] = n
+  end
+
+  options.on('-s', '--[no-]start-reporting-server', '<Optional - Start Simple HTTP Server for Reporting>') do |s|
+    opts[:start_reporting_server] = s
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  pwn_provider = ENV['PWN_PROVIDER'] if ENV['PWN_PROVIDER']
+
+  green = "\e[32m"
+  end_of_color = "\e[0m"
+
+  dir_path = opts[:dir_path].to_s.scrub
+  uri_source_root = opts[:uri_source_root].to_s.scrub
+  max_threads = opts[:max_threads]
+  chosen_test_cases = opts[:chosen_test_cases]
+  list_test_cases = opts[:list_test_cases]
+
+  report_name = File.basename(Dir.pwd)
+  report_name = opts[:report_name] unless opts[:report_name].nil?
+
+  start_reporting_server = opts[:start_reporting_server]
+
+  # Define Test Cases to Run & Start Thread Pool
+  if chosen_test_cases && !list_test_cases
+    test_cases = chosen_test_cases.to_s.scrub.chomp.strip.delete("\s").split(',').map(&:to_sym)
+  else
+    test_cases = %i[
+      ApacheFileSystemUtilAPI
+      AMQPConnectAsGuest
+      AWS
+      BannedFunctionCallsC
+      Base64
+      BeefHook
+      CmdExecutionJava
+      CmdExecutionPython
+      CmdExecutionRuby
+      CmdExecutionScala
+      CSRF
+      Emoticon
+      DeserialJava
+      Eval
+      InnerHTML
+      FilePermission
+      Factory
+      LocationHash
+      Log4J
+      Logger
+      Keystore
+      OuterHTML
+      Password
+      PomVersion
+      Port
+      PrivateKey
+      Redirect
+      ReDOS
+      Shell
+      SQL
+      SSL
+      Sudo
+      TaskTag
+      ThrowErrors
+      Token
+      Version
+    ]
+  end
+
+  if list_test_cases
+    test_cases.each { |tc| puts "#{green}#{tc}#{end_of_color}" }
+    exit
+  end
+
+  raise "ERROR: Invalid Directory #{dir_path}" unless File.directory?(dir_path)
+
+  results_hash = {
+    report_name: HTMLEntities.new.encode(
+      report_name.to_s.scrub.strip.chomp
+    ),
+    data: []
+  }
+
+  mutex = Mutex.new
+
+  PWN::Plugins::ThreadPool.fill(enumerable_array: test_cases, max_threads: max_threads) do |test_case|
+    sca_arr = PWN::SAST.const_get(
+      test_case.to_s.scrub
+    ).scan(
+      dir_path: dir_path,
+      git_repo_root_uri: uri_source_root
+    )
+
+    sca_arr.each do |hash_line|
+      mutex.synchronize do
+        results_hash[:data].push(hash_line)
+      end
+    end
+  end
+
+  # Generate HTML Report
+  print "#{$PROGRAM_NAME} Generating Report..."
+  PWN::Reports::SAST.generate(
+    dir_path: dir_path,
+    results_hash: results_hash
+  )
+  puts 'complete.'
+
+  # Start Simple HTTP Server (If Requested)
+  if start_reporting_server
+    listen_port = Random.rand(1_025..65_535)
+
+    if pwn_provider == 'docker'
+      listen_ip = '0.0.0.0'
+    else
+      listen_ip = '127.0.0.1'
+    end
+
+    puts "For Scan Results Navigate to: http://127.0.0.1:#{listen_port}/pwn_scan_git_source.html"
+    system("cd #{dir_path} && pwn_simple_http_server -i #{listen_ip} -p #{listen_port}")
+  end
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+end