pwn 0.4.414 → 0.4.415
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile +3 -3
- data/README.md +2 -2
- data/bin/pwn_sast +1 -0
- data/git_commit_test_reinit_gem.sh +7 -2
- data/lib/pwn/sast/signature.rb +140 -0
- data/lib/pwn/sast.rb +1 -0
- data/lib/pwn/version.rb +1 -1
- data/spec/lib/pwn/sast/signature_spec.rb +25 -0
- data/update_pwn.sh +0 -2
- metadata +11 -8
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 61670e1dd6c986c619918f5f97abefcde8593af1cb34c1cbe8089c9102a57346
|
|
4
|
+
data.tar.gz: 0a4daaa0f3b6a3790886adc5863f59084359b7efdd9e642f13739b5674783a54
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a47ee10adfd7d9f236f4c51c58ba4bd5505aa0df21a37966427731d6a743e4fa3e31122290acad1d9c5adb25034c2876c6fc1c6ff26317d4617ad22ca78dfbc5
|
|
7
|
+
data.tar.gz: 5cd9ebf6af0386fbfae0a776481c990e1ec28b9253ac8f6683b070452e7abd9de38fbc4bbb902241310b349c9181b6dd142e1f1e0b1b49b3f88a92834967f75e
|
data/Gemfile
CHANGED
|
@@ -32,7 +32,7 @@ gem 'ipaddress', '0.8.3'
|
|
|
32
32
|
# gem 'jenkins_api_client', '1.5.3' # Temporarily disabled until arangamani/jenkins_api_client/issues/304 is Closed out
|
|
33
33
|
gem 'js-beautify', '0.1.8'
|
|
34
34
|
gem 'json', '2.6.1'
|
|
35
|
-
gem 'jsonpath', '1.1.
|
|
35
|
+
gem 'jsonpath', '1.1.2'
|
|
36
36
|
gem 'jwt', '2.3.0'
|
|
37
37
|
gem 'luhn', '1.0.2'
|
|
38
38
|
gem 'mail', '2.7.1'
|
|
@@ -59,7 +59,7 @@ gem 'rex', '2.0.13'
|
|
|
59
59
|
gem 'rmagick', '4.2.5'
|
|
60
60
|
gem 'rspec', '3.11.0'
|
|
61
61
|
gem 'rtesseract', '3.1.2'
|
|
62
|
-
gem 'rubocop', '1.28.
|
|
62
|
+
gem 'rubocop', '1.28.2'
|
|
63
63
|
gem 'rubocop-rake', '0.6.0'
|
|
64
64
|
gem 'rubocop-rspec', '2.10.0'
|
|
65
65
|
gem 'ruby-audio', '1.6.1'
|
|
@@ -79,5 +79,5 @@ gem 'tty-prompt', '0.23.1'
|
|
|
79
79
|
gem 'watir', '7.1.0'
|
|
80
80
|
gem 'waveform', '0.1.2'
|
|
81
81
|
gem 'webrick', '1.7.0'
|
|
82
|
-
gem 'wicked_pdf', '2.
|
|
82
|
+
gem 'wicked_pdf', '2.6.0'
|
|
83
83
|
gem 'yard', '0.9.27'
|
data/README.md
CHANGED
|
@@ -37,7 +37,7 @@ $ rvm use ruby-3.1.2@pwn
|
|
|
37
37
|
$ rvm list gemsets
|
|
38
38
|
$ gem install --verbose pwn
|
|
39
39
|
$ pwn
|
|
40
|
-
pwn[v0.4.
|
|
40
|
+
pwn[v0.4.415]:001 >>> PWN.help
|
|
41
41
|
```
|
|
42
42
|
|
|
43
43
|
[](https://youtu.be/G7iLUY4FzsI)
|
|
@@ -52,7 +52,7 @@ $ rvm use ruby-3.1.2@pwn
|
|
|
52
52
|
$ gem uninstall --all --executables pwn
|
|
53
53
|
$ gem install --verbose pwn
|
|
54
54
|
$ pwn
|
|
55
|
-
pwn[v0.4.
|
|
55
|
+
pwn[v0.4.415]:001 >>> PWN.help
|
|
56
56
|
```
|
|
57
57
|
|
|
58
58
|
|
data/bin/pwn_sast
CHANGED
|
@@ -1,5 +1,10 @@
|
|
|
1
1
|
#!/bin/bash --login
|
|
2
|
-
|
|
2
|
+
usage() {
|
|
3
|
+
echo "USAGE: ${0} '<full name>' <email address> '<git commit comments>'"
|
|
4
|
+
exit 1
|
|
5
|
+
}
|
|
6
|
+
|
|
7
|
+
if (( $# == 3 )); then
|
|
3
8
|
# Default Strategy is to merge codebase
|
|
4
9
|
git config pull.rebase false
|
|
5
10
|
git config commit.gpgsign true
|
|
@@ -18,5 +23,5 @@ if [[ $1 != "" && $2 != "" && $3 != "" ]]; then
|
|
|
18
23
|
git tag $this_version
|
|
19
24
|
fi
|
|
20
25
|
else
|
|
21
|
-
|
|
26
|
+
usage
|
|
22
27
|
fi
|
|
@@ -0,0 +1,140 @@
|
|
|
1
|
+
# frozen_string_literal: false
|
|
2
|
+
|
|
3
|
+
require 'socket'
|
|
4
|
+
|
|
5
|
+
module PWN
|
|
6
|
+
module SAST
|
|
7
|
+
# SAST Module used to identify private keys used for authenticating
|
|
8
|
+
# with remote hosts.
|
|
9
|
+
module Signature
|
|
10
|
+
@@logger = PWN::Plugins::PWNLogger.create
|
|
11
|
+
|
|
12
|
+
# Supported Method Parameters::
|
|
13
|
+
# PWN::SAST::Signature(
|
|
14
|
+
# dir_path: 'optional path to dir defaults to .'
|
|
15
|
+
# git_repo_root_uri: 'optional http uri of git repo scanned'
|
|
16
|
+
# )
|
|
17
|
+
|
|
18
|
+
public_class_method def self.scan(opts = {})
|
|
19
|
+
dir_path = opts[:dir_path]
|
|
20
|
+
git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
|
|
21
|
+
result_arr = []
|
|
22
|
+
logger_results = ''
|
|
23
|
+
|
|
24
|
+
PWN::Plugins::FileFu.recurse_dir(dir_path: dir_path) do |entry|
|
|
25
|
+
if File.file?(entry) && File.basename(entry) !~ /^pwn.+(html|json|db)$/ && File.basename(entry) !~ /\.JS-BEAUTIFIED$/
|
|
26
|
+
line_no_and_contents_arr = []
|
|
27
|
+
filename_arr = []
|
|
28
|
+
entry_beautified = false
|
|
29
|
+
|
|
30
|
+
if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
|
|
31
|
+
js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
|
|
32
|
+
entry = "#{entry}.JS-BEAUTIFIED"
|
|
33
|
+
entry_beautified = true
|
|
34
|
+
end
|
|
35
|
+
|
|
36
|
+
test_case_filter = "
|
|
37
|
+
grep -n \
|
|
38
|
+
-e 'Signature' #{entry}
|
|
39
|
+
"
|
|
40
|
+
|
|
41
|
+
str = `#{test_case_filter}`.to_s.scrub
|
|
42
|
+
|
|
43
|
+
if str.to_s.empty?
|
|
44
|
+
# If str length is >= 64 KB do not include results. (Due to Mongo Document Size Restrictions)
|
|
45
|
+
logger_results = "#{logger_results}~" # Catching bugs is good :)
|
|
46
|
+
else
|
|
47
|
+
str = "1:Result larger than 64KB -> Size: #{str.to_s.length}. Please click the \"Path\" link for more details." if str.to_s.length >= 64_000
|
|
48
|
+
|
|
49
|
+
hash_line = {
|
|
50
|
+
timestamp: Time.now.strftime('%Y-%m-%d %H:%M:%S.%9N %z').to_s,
|
|
51
|
+
test_case: nist_800_53_requirements,
|
|
52
|
+
filename: filename_arr.push(git_repo_root_uri: git_repo_root_uri, entry: entry),
|
|
53
|
+
line_no_and_contents: '',
|
|
54
|
+
raw_content: str,
|
|
55
|
+
test_case_filter: test_case_filter
|
|
56
|
+
}
|
|
57
|
+
|
|
58
|
+
# COMMMENT: Must be a better way to implement this (regex is kinda funky)
|
|
59
|
+
line_contents_split = str.split(/^(\d{1,}):|\n(\d{1,}):/)[1..-1]
|
|
60
|
+
line_no_count = line_contents_split.length # This should always be an even number
|
|
61
|
+
current_count = 0
|
|
62
|
+
while line_no_count > current_count
|
|
63
|
+
line_no = line_contents_split[current_count]
|
|
64
|
+
contents = line_contents_split[current_count + 1]
|
|
65
|
+
if Dir.exist?("#{dir_path}/.git") ||
|
|
66
|
+
Dir.exist?('.git')
|
|
67
|
+
|
|
68
|
+
repo_root = dir_path
|
|
69
|
+
repo_root = '.' if Dir.exist?('.git')
|
|
70
|
+
|
|
71
|
+
author = PWN::Plugins::Git.get_author(
|
|
72
|
+
repo_root: repo_root,
|
|
73
|
+
from_line: line_no,
|
|
74
|
+
to_line: line_no,
|
|
75
|
+
target_file: entry,
|
|
76
|
+
entry_beautified: entry_beautified
|
|
77
|
+
)
|
|
78
|
+
else
|
|
79
|
+
author = 'N/A'
|
|
80
|
+
end
|
|
81
|
+
hash_line[:line_no_and_contents] = line_no_and_contents_arr.push(line_no: line_no,
|
|
82
|
+
contents: contents,
|
|
83
|
+
author: author)
|
|
84
|
+
|
|
85
|
+
current_count += 2
|
|
86
|
+
end
|
|
87
|
+
result_arr.push(hash_line)
|
|
88
|
+
logger_results = "#{logger_results}x" # Seeing progress is good :)
|
|
89
|
+
end
|
|
90
|
+
end
|
|
91
|
+
end
|
|
92
|
+
logger_banner = "http://#{Socket.gethostname}:8808/doc_root/pwn-#{PWN::VERSION.to_s.scrub}/#{to_s.scrub.gsub('::', '/')}.html"
|
|
93
|
+
if logger_results.empty?
|
|
94
|
+
@@logger.info("#{logger_banner}: No files applicable to this test case.\n")
|
|
95
|
+
else
|
|
96
|
+
@@logger.info("#{logger_banner} => #{logger_results}complete.\n")
|
|
97
|
+
end
|
|
98
|
+
result_arr
|
|
99
|
+
rescue StandardError => e
|
|
100
|
+
raise e
|
|
101
|
+
end
|
|
102
|
+
|
|
103
|
+
# Used primarily to map NIST 800-53 Revision 4 Security Controls
|
|
104
|
+
# https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
|
|
105
|
+
# to PWN Exploit & Static Code Anti-Pattern Matching Modules to
|
|
106
|
+
# Determine the level of Testing Coverage w/ PWN.
|
|
107
|
+
|
|
108
|
+
public_class_method def self.nist_800_53_requirements
|
|
109
|
+
{
|
|
110
|
+
sast_module: self,
|
|
111
|
+
section: 'CRYPTOGRAPHIC MODULE AUTHENTICATION',
|
|
112
|
+
nist_800_53_uri: 'https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control/?version=5.1&number=IA-7'
|
|
113
|
+
}
|
|
114
|
+
rescue StandardError => e
|
|
115
|
+
raise e
|
|
116
|
+
end
|
|
117
|
+
|
|
118
|
+
# Author(s):: 0day Inc. <request.pentest@0dayinc.com>
|
|
119
|
+
|
|
120
|
+
public_class_method def self.authors
|
|
121
|
+
"AUTHOR(S):
|
|
122
|
+
0day Inc. <request.pentest@0dayinc.com>
|
|
123
|
+
"
|
|
124
|
+
end
|
|
125
|
+
|
|
126
|
+
# Display Usage for this Module
|
|
127
|
+
|
|
128
|
+
public_class_method def self.help
|
|
129
|
+
puts "USAGE:
|
|
130
|
+
sast_arr = #{self}.scan(
|
|
131
|
+
dir_path: 'optional path to dir defaults to .',
|
|
132
|
+
git_repo_root_uri: 'optional http uri of git repo scanned'
|
|
133
|
+
)
|
|
134
|
+
|
|
135
|
+
#{self}.authors
|
|
136
|
+
"
|
|
137
|
+
end
|
|
138
|
+
end
|
|
139
|
+
end
|
|
140
|
+
end
|
data/lib/pwn/sast.rb
CHANGED
|
@@ -36,6 +36,7 @@ module PWN
|
|
|
36
36
|
autoload :Redirect, 'pwn/sast/redirect'
|
|
37
37
|
autoload :ReDOS, 'pwn/sast/redos'
|
|
38
38
|
autoload :Shell, 'pwn/sast/shell'
|
|
39
|
+
autoload :Signature, 'pwn/sast/signature'
|
|
39
40
|
autoload :SQL, 'pwn/sast/sql'
|
|
40
41
|
autoload :SSL, 'pwn/sast/ssl'
|
|
41
42
|
autoload :Sudo, 'pwn/sast/sudo'
|
data/lib/pwn/version.rb
CHANGED
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
require 'spec_helper'
|
|
4
|
+
|
|
5
|
+
describe PWN::SAST::Signature do
|
|
6
|
+
it 'scan method should exist' do
|
|
7
|
+
scan_response = PWN::SAST::Signature
|
|
8
|
+
expect(scan_response).to respond_to :scan
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
it 'should display information for nist_800_53_requirements' do
|
|
12
|
+
nist_800_53_requirements_response = PWN::SAST::Signature
|
|
13
|
+
expect(nist_800_53_requirements_response).to respond_to :nist_800_53_requirements
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
it 'should display information for authors' do
|
|
17
|
+
authors_response = PWN::SAST::Signature
|
|
18
|
+
expect(authors_response).to respond_to :authors
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
it 'should display information for existing help method' do
|
|
22
|
+
help_response = PWN::SAST::Signature
|
|
23
|
+
expect(help_response).to respond_to :help
|
|
24
|
+
end
|
|
25
|
+
end
|
data/update_pwn.sh
CHANGED
|
@@ -5,7 +5,5 @@ else
|
|
|
5
5
|
pwn_root="${PWN_ROOT}"
|
|
6
6
|
fi
|
|
7
7
|
|
|
8
|
-
#sudo /bin/bash --login -c "cd ${pwn_root} && ./reinstall_pwn_gemset.sh"
|
|
9
|
-
#sudo /bin/bash --login -c "cd ${pwn_root} && ./build_pwn_gem.sh"
|
|
10
8
|
export rvmsudo_secure_path=1
|
|
11
9
|
rvmsudo /bin/bash --login -c "cd ${pwn_root} && ./build_pwn_gem.sh"
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: pwn
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.4.
|
|
4
|
+
version: 0.4.415
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- 0day Inc.
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2022-04-
|
|
11
|
+
date: 2022-04-26 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: activesupport
|
|
@@ -296,14 +296,14 @@ dependencies:
|
|
|
296
296
|
requirements:
|
|
297
297
|
- - '='
|
|
298
298
|
- !ruby/object:Gem::Version
|
|
299
|
-
version: 1.1.
|
|
299
|
+
version: 1.1.2
|
|
300
300
|
type: :runtime
|
|
301
301
|
prerelease: false
|
|
302
302
|
version_requirements: !ruby/object:Gem::Requirement
|
|
303
303
|
requirements:
|
|
304
304
|
- - '='
|
|
305
305
|
- !ruby/object:Gem::Version
|
|
306
|
-
version: 1.1.
|
|
306
|
+
version: 1.1.2
|
|
307
307
|
- !ruby/object:Gem::Dependency
|
|
308
308
|
name: jwt
|
|
309
309
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -674,14 +674,14 @@ dependencies:
|
|
|
674
674
|
requirements:
|
|
675
675
|
- - '='
|
|
676
676
|
- !ruby/object:Gem::Version
|
|
677
|
-
version: 1.28.
|
|
677
|
+
version: 1.28.2
|
|
678
678
|
type: :runtime
|
|
679
679
|
prerelease: false
|
|
680
680
|
version_requirements: !ruby/object:Gem::Requirement
|
|
681
681
|
requirements:
|
|
682
682
|
- - '='
|
|
683
683
|
- !ruby/object:Gem::Version
|
|
684
|
-
version: 1.28.
|
|
684
|
+
version: 1.28.2
|
|
685
685
|
- !ruby/object:Gem::Dependency
|
|
686
686
|
name: rubocop-rake
|
|
687
687
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -954,14 +954,14 @@ dependencies:
|
|
|
954
954
|
requirements:
|
|
955
955
|
- - '='
|
|
956
956
|
- !ruby/object:Gem::Version
|
|
957
|
-
version: 2.
|
|
957
|
+
version: 2.6.0
|
|
958
958
|
type: :runtime
|
|
959
959
|
prerelease: false
|
|
960
960
|
version_requirements: !ruby/object:Gem::Requirement
|
|
961
961
|
requirements:
|
|
962
962
|
- - '='
|
|
963
963
|
- !ruby/object:Gem::Version
|
|
964
|
-
version: 2.
|
|
964
|
+
version: 2.6.0
|
|
965
965
|
- !ruby/object:Gem::Dependency
|
|
966
966
|
name: yard
|
|
967
967
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -1588,6 +1588,7 @@ files:
|
|
|
1588
1588
|
- lib/pwn/sast/redirect.rb
|
|
1589
1589
|
- lib/pwn/sast/redos.rb
|
|
1590
1590
|
- lib/pwn/sast/shell.rb
|
|
1591
|
+
- lib/pwn/sast/signature.rb
|
|
1591
1592
|
- lib/pwn/sast/sql.rb
|
|
1592
1593
|
- lib/pwn/sast/ssl.rb
|
|
1593
1594
|
- lib/pwn/sast/sudo.rb
|
|
@@ -1881,6 +1882,7 @@ files:
|
|
|
1881
1882
|
- spec/lib/pwn/sast/redirect_spec.rb
|
|
1882
1883
|
- spec/lib/pwn/sast/redos_spec.rb
|
|
1883
1884
|
- spec/lib/pwn/sast/shell_spec.rb
|
|
1885
|
+
- spec/lib/pwn/sast/signature_spec.rb
|
|
1884
1886
|
- spec/lib/pwn/sast/sql_spec.rb
|
|
1885
1887
|
- spec/lib/pwn/sast/ssl_spec.rb
|
|
1886
1888
|
- spec/lib/pwn/sast/sudo_spec.rb
|
|
@@ -2149,6 +2151,7 @@ test_files:
|
|
|
2149
2151
|
- spec/lib/pwn/sast/redirect_spec.rb
|
|
2150
2152
|
- spec/lib/pwn/sast/redos_spec.rb
|
|
2151
2153
|
- spec/lib/pwn/sast/shell_spec.rb
|
|
2154
|
+
- spec/lib/pwn/sast/signature_spec.rb
|
|
2152
2155
|
- spec/lib/pwn/sast/sql_spec.rb
|
|
2153
2156
|
- spec/lib/pwn/sast/ssl_spec.rb
|
|
2154
2157
|
- spec/lib/pwn/sast/sudo_spec.rb
|