pwn 0.4.594 → 0.4.595

data/bin/pwn_owasp_zap_active_scan

@@ -1,134 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-require 'optparse'
-
-opts = {}
-OptionParser.new do |options|
-  options.banner = "USAGE:
-    #{$PROGRAM_NAME} [opts]
-  "
-
-  options.on('-aAPIKEY', '--api_key=APIKEY', '<Required - OWASP Zap API Key (Tools>Options>API)>') do |a|
-    opts[:api_key] = a
-  end
-
-  options.on('-tTARGET', '--target_url=TARGET', '<Required - Target URI to Scan>') do |t|
-    opts[:target_url] = t
-  end
-
-  options.on('-oDIR', '--report_output_dir=DIR', '<Required - Output Directory for Active Scan Report>') do |o|
-    opts[:output_dir] = o
-  end
-
-  options.on('-bTYPE', '--browser_type=TYPE', '<Optional - Browser Type <firefox|chrome|headless|rest> (Defaults to chrome)>') do |b|
-    opts[:browser_type] = b
-  end
-
-  options.on('-IINST', '--navigation_instruct=INST', '<Optional - Path to Navigation Instructions (e.g. Auth w/ Target - see /pwn/etc/owasp_zap/navigation.instruct.EXAMPLE)>') do |i|
-    opts[:navigation_instruct] = i
-  end
-
-  options.on('-zZPATH', '--zap_bin_path=ZPATH', '<Optional - Path to zap.sh>') do |z|
-    opts[:zap_bin_path] = z
-  end
-
-  options.on('-h', '--[no-]headless', '<Optional - Run OWASP Zap Headless>') do |h|
-    opts[:headless] = h
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - Change Local Zap Proxy Listener (Default http://127.0.0.1:8080)>') do |p|
-    opts[:proxy] = p
-  end
-end.parse!
-
-if opts.empty?
-  puts `#{$PROGRAM_NAME} --help`
-  exit 1
-end
-
-begin
-  logger = PWN::Plugins::PWNLogger.create
-
-  api_key = opts[:api_key].to_s.strip.chomp.scrub
-
-  if opts[:browser_type].nil?
-    browser_type = :chrome
-  else
-    browser_type = opts[:browser_type].to_s.strip.chomp.scrub.to_sym
-  end
-
-  target_url = opts[:target_url].to_s.strip.chomp.scrub
-  output_dir = opts[:output_dir].to_s.strip.chomp.scrub
-  navigation_instruct = opts[:navigation_instruct].to_s.strip.chomp.scrub if File.exist?(opts[:navigation_instruct].to_s.strip.chomp.scrub)
-  zap_bin_path = opts[:zap_bin_path].to_s.strip.chomp.scrub if File.exist?(opts[:zap_bin_path].to_s.strip.chomp.scrub)
-  headless = opts[:headless]
-  proxy = opts[:proxy].to_s.strip.chomp.scrub
-  proxy = 'http://127.0.0.1:8080' if proxy == ''
-
-  # ------
-  # Dynamically build arguments hash based on flags passed and Open Zap
-  start_args = {}
-  start_args[:api_key] = api_key
-  start_args[:zap_bin_path] = zap_bin_path if zap_bin_path != ''
-  start_args[:headless] = true if headless
-  start_args[:proxy] = proxy
-  zap_obj = PWN::Plugins::OwaspZap.start(start_args)
-
-  logger.info(zap_obj)
-
-  browser = PWN::Plugins::TransparentBrowser.open(
-    browser_type: browser_type,
-    proxy: proxy
-  )
-
-  if browser_type == :rest
-    browser.get(target_url)
-  else
-    browser.goto(target_url)
-  end
-
-  if navigation_instruct
-    File.read(navigation_instruct).each_line do |instruction|
-      browser.instance_eval(instruction.to_s.scrub.strip.chomp)
-    end
-  end
-
-  PWN::Plugins::OwaspZap.spider(
-    zap_obj: zap_obj,
-    target: target_url
-  )
-
-  PWN::Plugins::OwaspZap.active_scan(
-    zap_obj: zap_obj,
-    target: target_url
-  )
-
-  # Generate all Report Types
-  (1..3).each do |report_iteration|
-    case report_iteration
-    when 1
-      report_type = 'html'
-    when 2
-      report_type = 'markdown'
-    when 3
-      report_type = 'xml'
-    end
-
-    report_path = PWN::Plugins::OwaspZap.generate_report(
-      zap_obj: zap_obj,
-      output_dir: output_dir,
-      report_type: report_type
-    )
-
-    logger.info("Report can be found here: #{report_path}")
-  end
-
-  PWN::Plugins::OwaspZap.stop(zap_obj: zap_obj)
-rescue StandardError => e
-  raise e
-ensure
-  PWN::Plugins::OwaspZap.stop(zap_obj: zap_obj) unless zap_obj.nil?
-  browser = PWN::Plugins::TransparentBrowser.close(browser_obj: browser) unless browser.nil?
-end

data/bin/pwn_pastebin_sample_filter

@@ -1,61 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-require 'optparse'
-
-opts = {}
-OptionParser.new do |options|
-  options.banner = "USAGE:
-    #{$PROGRAM_NAME} [opts]
-  "
-
-  options.on('-rPATTERN', '--regex=PATTERN', "<Required - Regex Pattern for Interesting Pastes ('.*' for All)>") do |r|
-    opts[:regex] = r
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy>') do |p|
-    opts[:proxy] = p
-  end
-
-  options.on('-T', '--[no-]with-tor', '<Optional - Proxy w/ TOR (Defaults to false)>') do |w|
-    opts[:with_tor] = w
-  end
-end.parse!
-
-if opts.empty?
-  puts `#{$PROGRAM_NAME} --help`
-  exit 1
-end
-
-proxy = opts[:proxy]
-with_tor = opts[:with_tor]
-regex = opts[:regex]
-
-browser_obj = PWN::WWW::Pastebin.open(
-  browser_type: :headless,
-  proxy: proxy,
-  with_tor: with_tor
-)
-
-begin
-  loop do
-    browser_obj.div(id: 'menu_2').links[0].click
-    code_frame = browser_obj.div(id: 'code_frame').text
-    if code_frame.match?(/#{regex}/mi)
-      puts "\nCurrent Link: #{browser_obj.url}"
-      puts "#{code_frame}\n\n\n"
-    else
-      print '.'
-    end
-    sleep 9
-  end
-rescue StandardError => e
-  raise e
-ensure
-  if browser_obj
-    browser_obj = PWN::Plugins::TransparentBrowser.close(
-      browser_obj: browser_obj
-    )
-  end
-end

data/bin/pwn_perimeter_recon

@@ -1,326 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-require 'optparse'
-require 'uri'
-require 'json'
-
-opts = {}
-OptionParser.new do |options|
-  options.banner = "USAGE:
-    #{$PROGRAM_NAME} [opts]
-  "
-
-  options.on('-tDOMAINS', '--targets=DOMAINS', '<Required - Comma-Delimited List of Target Domains>') do |t|
-    opts[:targets] = t
-  end
-
-  options.on('-dDIR', '--output-dir=DIR', '<Required - Directory to Save Results>') do |d|
-    opts[:output_dir] = d
-  end
-
-  options.on('-eEXCLUDE', '--exclude-domains=EXCLUDE', '<Optional - Comma-Delimited List of Domains to Exclude>') do |e|
-    opts[:exclude_domains] = e
-  end
-
-  options.on('-sSUBLIST3R', '--sublist3r-path=SUBLIST3R', '<Optional - Path to Sublist3r>') do |s|
-    opts[:sublist3r_path] = s
-  end
-
-  options.on('-i', '--[no-]ipinfo', '<Optional - Leverage ipinfo.com on Domains (Defaults to false)>') do |i|
-    opts[:ipinfo] = i
-  end
-
-  options.on('-nNMAP', '--nmap-path=NMAP', '<Optional - Path to Nmap>') do |n|
-    opts[:nmap_path] = n
-  end
-
-  options.on('-EWITNESS', '--eyewitness-path=WITNESS', '<Optional - Path to eyewitness/Requires Nmap Flag>') do |w|
-    opts[:eyewitness_path] = w
-  end
-
-  options.on('-bBURP', '--burp-path=BURP', '<Optional - Path to Burp>') do |b|
-    opts[:burp_path] = b
-  end
-
-  options.on('-r', '--[no-]resume-last-scan', '<Optional - Resume Last Scan (Defaults to false)>') do |r|
-    opts[:resume_last_scan] = r
-  end
-end.parse!
-
-if opts.empty?
-  puts `#{$PROGRAM_NAME} --help`
-  exit 1
-end
-
-# Colors!
-@red = "\e[31m"
-@green = "\e[32m"
-@yellow = "\e[33m"
-@end_of_color = "\e[0m"
-
-# Required Flag Variables
-targets = opts[:targets].to_s.scrub.strip.chomp.delete("\s").split(',')
-output_dir = opts[:output_dir].to_s.scrub.strip.chomp if Dir.exist?(opts[:output_dir].to_s.scrub.strip.chomp)
-
-if opts[:resume_last_scan]
-  @resume_last_scan = opts[:resume_last_scan]
-  @runtime_timestamp = File.basename(Dir.glob("#{output_dir}/target_domains*")[-1]).split('-')[-6..-1].join('-').split('.txt')[0]
-  target_domains = "#{output_dir}/target_domains-#{@runtime_timestamp}.txt"
-else
-  @resume_last_scan = nil
-  @runtime_timestamp = Time.now.strftime('%Y-%m-%d-%H-%M-%S')
-  target_domains = "#{output_dir}/target_domains-#{@runtime_timestamp}.txt"
-  File.open(target_domains, 'w') do |f|
-    targets.each do |target|
-      f.puts target
-    end
-  end
-end
-
-exclude_domains = opts[:exclude_domains].to_s.scrub.strip.chomp.delete("\s").split(',')
-ipinfo = opts[:ipinfo]
-sublist3r_path = opts[:sublist3r_path].to_s.scrub.strip.chomp
-burp_path = opts[:burp_path].to_s.scrub.strip.chomp
-nmap_path = opts[:nmap_path].to_s.scrub.strip.chomp
-eyewitness_path = opts[:eyewitness_path].to_s.scrub.strip.chomp
-
-def invoke_burp(opts = {})
-  burp_path = opts[:burp_path]
-  burp_target = opts[:burp_target]
-  port_number = opts[:port_number]
-  port_protocol = opts[:port_protocol]
-  output_dir = opts[:output_dir]
-  use_https = opts[:use_https]
-  target_domain = URI.parse(burp_target).host
-
-  json_results = "#{output_dir}/#{target_domain}-#{port_protocol}-#{port_number}-#{@runtime_timestamp}-burpsuite_activescan.json"
-  html_results = "#{output_dir}/#{target_domain}-#{port_protocol}-#{port_number}-#{@runtime_timestamp}-burpsuite_activescan.html"
-
-  if File.exist?(json_results)
-    puts "#{@yellow}Already Exists: #{json_results}#{@end_of_color}"
-  else
-    burp_obj = PWN::Plugins::BurpSuite.start(
-      burp_jar_path: burp_path,
-      headless: true,
-      browser_type: :headless
-    )
-
-    PWN::Plugins::BurpSuite.disable_proxy(
-      burp_obj: burp_obj
-    )
-
-    browser_obj = burp_obj[:burp_browser]
-
-    puts "#{@green}Navigating to: #{burp_target}#{@end_of_color}"
-    browser_obj.goto(burp_target)
-
-    puts "#{@green}Invoking Active Scan...#{@end_of_color}"
-    json_scan_queue = PWN::Plugins::BurpSuite.invoke_active_scan(
-      burp_obj: burp_obj,
-      target_url: burp_target,
-      use_https: use_https
-    )
-    puts "#{@green}complete.#{@end_of_color}"
-
-    print "#{@green}Generating Burp Suite Active Scan JSON Results...#{@end_of_color}"
-    scan_issues_hash = PWN::Plugins::BurpSuite.get_scan_issues(
-      burp_obj: burp_obj
-    )
-
-    File.open(json_results, 'w') do |f|
-      f.puts JSON.pretty_generate(scan_issues_hash)
-    end
-    puts "#{@green}complete.#{@end_of_color}\n\n\n"
-
-    print "#{@green}Generating Burp Suite Active Scan HTML Results...#{@end_of_color}"
-    PWN::Plugins::BurpSuite.generate_scan_report(
-      burp_obj: burp_obj,
-      report_type: :html,
-      output_path: html_results
-    )
-
-    burp_obj = PWN::Plugins::BurpSuite.stop(burp_obj: burp_obj)
-    puts "#{@green}complete.#{@end_of_color}\n\n\n"
-  end
-rescue StandardError => e
-  puts "#{@red}#{e}#{@end_of_color}"
-ensure
-  burp_obj = PWN::Plugins::BurpSuite.stop(burp_obj: burp_obj) unless burp_obj.nil?
-end
-
-# Run Sublist3r to find as many domains as possible for a given FQDN
-unless sublist3r_path == ''
-  if @resume_last_scan.nil?
-    sublist3r_target_domains_arr = []
-    File.readlines(target_domains).uniq.each do |s_line|
-      sublist3r_target = s_line.to_s.scrub.strip.chomp
-      sublist3r_results = "#{output_dir}/#{sublist3r_target}-#{@runtime_timestamp}-sublist3r.txt"
-      print "#{@green}Sublist3r Domain Discovery #{sublist3r_target}...#{@end_of_color}"
-      puts `python #{sublist3r_path} -v -d #{sublist3r_target} -o #{sublist3r_results}`
-      File.readlines(sublist3r_results).uniq.each do |sr_line|
-        discovered_domain = sr_line.to_s.scrub.strip.chomp
-        sublist3r_target_domains_arr.push(discovered_domain)
-      end
-      puts "#{@green}complete.#{@end_of_color}"
-    end
-    File.open(target_domains, 'a') do |f|
-      sublist3r_target_domains_arr.uniq do |discovered_domain|
-        if URI.parse(discovered_domain).host.nil?
-          f.puts discovered_domain unless exclude_domains.include?(discovered_domain)
-        else
-          parsed_domain = URI.parse(discovered_domain).host
-          f.puts parsed_domain unless exclude_domains.include?(parsed_domain)
-        end
-      end
-    end
-  else
-    puts "#{@yellow}Resuming scan from #{target_domains}...#{@end_of_color}"
-  end
-end
-
-# Obtain additional information about the targeted hosts...
-unless ipinfo.nil?
-  File.readlines(target_domains).uniq.each do |h_line|
-    ipinfo_target = h_line.to_s.scrub.strip.chomp
-    ipinfo_json_results = "#{output_dir}/#{ipinfo_target}-#{@runtime_timestamp}-ipinfo.json"
-    puts "#{@yellow}Already Exists: #{ipinfo_json_results}#{@end_of_color}" if File.exist?(ipinfo_json_results)
-    next if exclude_domains.include?(ipinfo_target) || File.exist?(ipinfo_json_results)
-
-    ipinfo_struc = PWN::Plugins::IPInfo.get(ip_or_host: ipinfo_target)
-    File.open(ipinfo_json_results, 'w') do |f|
-      f.puts JSON.pretty_generate(ipinfo_struc)
-    end
-  end
-end
-
-unless nmap_path == ''
-  print "#{@green}Nmap all the things...#{@end_of_color}"
-  File.readlines(target_domains).uniq.each do |n_line|
-    nmap_target = n_line.to_s.scrub.strip.chomp
-    nmap_xml_results = "#{output_dir}/#{nmap_target}-#{@runtime_timestamp}-nmap_default.xml"
-    puts "#{@yellow}Already Exists: #{nmap_xml_results}#{@end_of_color}" if File.exist?(nmap_xml_results)
-    next if exclude_domains.include?(nmap_target)
-
-    begin
-      unless File.exist?(nmap_xml_results)
-        PWN::Plugins::NmapIt.port_scan do |nmap|
-          nmap.connect_scan = true
-          nmap.service_scan = true
-          nmap.os_fingerprint = true
-          nmap.verbose = true
-          nmap.targets = nmap_target
-          nmap.xml = nmap_xml_results
-        end
-      end
-
-      # Eyewitness Nmap XML Results
-      unless eyewitness_path == ''
-        print "#{@green}Eyewitness Nmap XML Results...#{@end_of_color}"
-        system(
-          eyewitness_path,
-          '-x',
-          nmap_xml_results,
-          '-d',
-          "#{output_dir}/#{nmap_target}-#{@runtime_timestamp}",
-          '--no-prompt',
-          '--all-protocols'
-        )
-      end
-
-      PWN::Plugins::NmapIt.parse_xml_results(xml_file: nmap_xml_results) do |xml|
-        xml.each_host do |host|
-          puts "#{@green}#{host.hostname}#{@end_of_color}"
-
-          host.scripts.each do |name, output|
-            puts name
-            output.each_line { |h_line| puts h_line }
-          end
-
-          host.each_port do |port|
-            puts "#{@yellow}#{port.number}|#{port.protocol}|#{port.state}|#{port.reason}|#{port.service}#{@end_of_color}"
-
-            case port.number.to_i
-            when 80
-              burp_target = "http://#{nmap_target}"
-              unless burp_path == ''
-                invoke_burp(
-                  burp_path: burp_path,
-                  burp_target: burp_target,
-                  port_number: port.number,
-                  port_protocol: port.protocol,
-                  output_dir: output_dir,
-                  use_https: false
-                )
-              end
-
-            when 443
-              burp_target = "https://#{nmap_target}"
-              unless burp_path == ''
-                invoke_burp(
-                  burp_path: burp_path,
-                  burp_target: burp_target,
-                  port_number: port.number,
-                  port_protocol: port.protocol,
-                  output_dir: output_dir,
-                  use_https: true
-                )
-              end
-
-            when 8080
-              burp_target = "http://#{nmap_target}:#{port.number}"
-              unless burp_path == ''
-                invoke_burp(
-                  burp_path: burp_path,
-                  burp_target: burp_target,
-                  port_number: port.number,
-                  port_protocol: port.protocol,
-                  output_dir: output_dir,
-                  use_https: false
-                )
-              end
-
-            when 8443
-              burp_target = "https://#{nmap_target}:#{port.number}"
-              unless burp_path == ''
-                invoke_burp(
-                  burp_path: burp_path,
-                  burp_target: burp_target,
-                  port_number: port.number,
-                  port_protocol: port.protocol,
-                  output_dir: output_dir,
-                  use_https: true
-                )
-              end
-
-            when 8888
-              burp_target = "http://#{nmap_target}:#{port.number}"
-              unless burp_path == ''
-                invoke_burp(
-                  burp_path: burp_path,
-                  burp_target: burp_target,
-                  port_number: port.number,
-                  port_protocol: port.protocol,
-                  output_dir: output_dir
-                )
-              end
-
-            else
-              puts "Nothing special implemented for #{port.protocol} #{port.number}"
-            end
-
-            port.scripts.each do |name, output|
-              puts name
-              output.each_line { |p_line| puts p_line }
-            end
-          end
-        end
-      end
-    rescue StandardError => e
-      puts "#{@red}#{e}#{@end_of_color}"
-      next
-    end
-  end
-  puts "#{@green}complete.#{@end_of_color}"
-end

data/bin/pwn_phone

@@ -1,131 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-require 'optparse'
-require 'fileutils'
-require 'ruby-audio'
-require 'fftw3'
-require 'waveform'
-
-opts = {}
-OptionParser.new do |options|
-  options.banner = "USAGE:
-    #{$PROGRAM_NAME} [opts]
-  "
-
-  options.on('-tPATH', '--target-file=PATH', '<Required - File Containing List of Targets to Dial>') do |t|
-    opts[:target_file] = t
-  end
-
-  options.on('-sSEC', '--seconds-to-record=SEC', '<Optional - Seconds to Record (Defaults to 60)>') do |s|
-    opts[:seconds_to_record] = s
-  end
-
-  options.on('-TTHREADS', '--max-threads=THREADS', '<Optional # Calls to Run Simultaneously (Defaults to 3)>') do |t|
-    opts[:max_threads] = t
-  end
-
-  options.on('-bPATH', '--baresip-binary=PATH', '<Optional - Path to baresip Binary (Defaults to /usr/bin/baresip)>') do |bs|
-    opts[:baresip_bin] = bs
-  end
-
-  options.on('-SSOX', '--sox-path=SOX', '<Optional - Path to SoX Binary, the Swiss Army knife of Audio (Defaults to /usr/bin/sox)>') do |sox|
-    opts[:sox_bin] = sox
-  end
-
-  options.on('-rDIR', '--session-root=DIR', '<Optional - Directory to Store Session Files (Defaults to Present Working Directory))>') do |sr|
-    opts[:session_root] = sr
-  end
-
-  options.on('-R', '--[no-]randomize', '<Optional - Randomize Number Range (Defaults to false)>') do |r|
-    opts[:randomize] = r
-  end
-
-  options.on('-H', '--[no-]start-reporting-server', '<Optional - Start Simple HTTP Server for Reporting>') do |s|
-    opts[:start_reporting_server] = s
-  end
-
-  options.on('-X', '--[no-]speech-to-text', '<Optional - Speech to Text from Audio Recordings>') do |x|
-    opts[:speech_to_text] = x
-  end
-
-  options.on('-xRULES', '--source-num-rules=RULES', '<Optional - Comma-delimited list of rules for src_num format (i.e. XXXXXXXXXX, self, same_country, same_area, and/or same_prefix [Defaults to random src_num w/ same length as target_num])>') do |x|
-    opts[:src_num_rules] = x
-  end
-
-  # TODO: Add an hours of operation flag.
-  # TODO: Add a resume feature to resume session following an interruption.
-  # TODO: Append results to pwn_phone_results.json as things are running #save_memory.
-end.parse!
-
-if opts.empty?
-  puts `#{$PROGRAM_NAME} --help`
-  exit 1
-end
-
-begin
-  pwn_provider = 'ruby-gem'
-  pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.select { |s| s == 'PWN_PROVIDER' }.any?
-  $stdout.sync = true
-
-  # Required Flag Variables
-  target_file = opts[:target_file]
-  max_threads = opts[:max_threads]
-  seconds_to_record = opts[:seconds_to_record]
-  baresip_bin = opts[:baresip_bin]
-  sox_bin = opts[:sox_bin]
-  session_root = opts[:session_root]
-  session_root ||= Dir.pwd
-
-  # Optional Flag Variables
-  randomize = opts[:randomize]
-  start_reporting_server = opts[:start_reporting_server]
-  speech_to_text = opts[:speech_to_text]
-  src_num_rules = opts[:src_num_rules]
-
-  # Initiallize Phone Reconaissance
-  results_hash = PWN::Plugins::BareSIP.recon(
-    baresip_bin: baresip_bin,
-    session_root: session_root,
-    target_file: target_file,
-    randomize: randomize,
-    src_num_rules: src_num_rules,
-    seconds_to_record: seconds_to_record,
-    sox_bin: sox_bin,
-    speech_to_text: speech_to_text
-  )
-
-  # Generate HTML Report
-  print "#{$PROGRAM_NAME} Generating Report..."
-  PWN::Reports::Phone.generate(
-    dir_path: session_root,
-    results_hash: results_hash
-  )
-  puts 'complete.'
-
-  # Start Simple HTTP Server (If Requested)
-  if start_reporting_server
-    listen_port = Random.rand(1_025..65_535).to_s
-
-    if pwn_provider == 'docker'
-      listen_ip = '0.0.0.0'
-    else
-      listen_ip = '127.0.0.1'
-    end
-
-    puts "For Scan Results Navigate to: http://127.0.0.1:#{listen_port}/pwn_phone.html"
-    Dir.chdir(session_root)
-    system(
-      'pwn_simple_http_server',
-      '-i',
-      listen_ip,
-      '-p',
-      listen_port
-    )
-  end
-rescue StandardError => e
-  raise e.message
-rescue SystemExit, Interrupt
-  puts "\nGoodbye."
-end