pwn 0.4.931 → 0.4.933
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +15 -15
- data/README.md +3 -3
- data/bin/pwn_sast +1 -0
- data/lib/pwn/plugins/credit_card.rb +2 -2
- data/lib/pwn/sast/base64.rb +2 -4
- data/lib/pwn/sast/padding_oracle.rb +140 -0
- data/lib/pwn/sast.rb +1 -0
- data/lib/pwn/version.rb +1 -1
- data/spec/lib/pwn/sast/padding_oracle_spec.rb +25 -0
- metadata +47 -31
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 8d8484dcd365421038169dafb7025a555b0113b35ea403797d9908420b7a6d65
|
4
|
+
data.tar.gz: 30481b814dd758f19c221df667f97ad1d32ed39f47fe5b336a6f722e292bb5ce
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 2a9955f78cc4be05443bcc5e70671244fa0ebaa860a36665f7ba1d34cb12bcda3d648c32a12c1d217a71597181829f735dcfaede91e9c037c9ca5314ce866adf
|
7
|
+
data.tar.gz: d458845a6a1a259ec098757a54121f3890997d60b6479a5bf29fe1d5b9ee92d7800a93829da481e1a48fa14a0f818222a16ca11f100f12a0e7404d452e8472b7
|
data/Gemfile
CHANGED
@@ -11,22 +11,22 @@ gemspec
|
|
11
11
|
# In some circumstances custom flags are passed to gems in order
|
12
12
|
# to build appropriately. Defer to ./reinstall_pwn_gemset.sh
|
13
13
|
# to review these custom flags (e.g. pg, serialport, etc).
|
14
|
-
gem 'activesupport', '7.1.
|
14
|
+
gem 'activesupport', '7.1.2'
|
15
15
|
gem 'anemone', '0.7.2'
|
16
16
|
gem 'authy', '3.0.1'
|
17
|
-
gem 'aws-sdk', '3.
|
17
|
+
gem 'aws-sdk', '3.2.0'
|
18
18
|
# gem 'bettercap', '1.6.2'
|
19
19
|
gem 'barby', '0.6.8'
|
20
20
|
gem 'brakeman', '6.0.1'
|
21
21
|
gem 'bson', '4.15.0'
|
22
|
-
gem 'bundler', '>=2.4.
|
22
|
+
gem 'bundler', '>=2.4.22'
|
23
23
|
gem 'bundler-audit', '0.9.1'
|
24
24
|
gem 'bunny', '2.22.0'
|
25
25
|
gem 'colorize', '1.1.0'
|
26
|
-
|
26
|
+
gem 'credit_card_validations', '6.1.0'
|
27
27
|
gem 'eventmachine', '1.2.7'
|
28
28
|
gem 'executable-hooks', '1.6.1'
|
29
|
-
gem 'faker', '3.2.
|
29
|
+
gem 'faker', '3.2.2'
|
30
30
|
gem 'faye-websocket', '0.11.3'
|
31
31
|
gem 'ffi', '1.16.3'
|
32
32
|
gem 'fftw3', '0.3'
|
@@ -42,54 +42,54 @@ gem 'jsonpath', '1.1.5'
|
|
42
42
|
gem 'jwt', '2.7.1'
|
43
43
|
gem 'luhn', '1.0.2'
|
44
44
|
gem 'mail', '2.8.1'
|
45
|
-
gem 'mongo', '2.19.
|
45
|
+
gem 'mongo', '2.19.3'
|
46
46
|
gem 'msfrpc-client', '1.1.2'
|
47
47
|
gem 'netaddr', '2.0.6'
|
48
48
|
gem 'net-ldap', '0.18.0'
|
49
49
|
gem 'net-openvpn', '0.8.7'
|
50
50
|
gem 'net-smtp', '0.4.0'
|
51
51
|
gem 'nexpose', '7.3.0'
|
52
|
-
gem 'nokogiri', '1.15.
|
52
|
+
gem 'nokogiri', '1.15.5'
|
53
53
|
gem 'nokogiri-diff', '0.2.0'
|
54
54
|
gem 'oily_png', '1.2.1'
|
55
|
-
gem 'open3', '0.
|
55
|
+
gem 'open3', '0.2.0'
|
56
56
|
gem 'os', '1.1.4'
|
57
57
|
gem 'packetfu', '2.0.0'
|
58
58
|
gem 'pdf-reader', '2.11.0'
|
59
59
|
gem 'pg', '1.5.4'
|
60
60
|
gem 'pry', '0.14.2'
|
61
61
|
gem 'pry-doc', '1.4.0'
|
62
|
-
gem 'rake', '13.0
|
62
|
+
gem 'rake', '13.1.0'
|
63
63
|
gem 'rb-readline', '0.5.5'
|
64
64
|
gem 'rbvmomi', '3.0.0'
|
65
|
-
gem 'rdoc', '6.
|
65
|
+
gem 'rdoc', '6.6.0'
|
66
66
|
gem 'rest-client', '2.1.0'
|
67
67
|
gem 'rex', '2.0.13'
|
68
68
|
gem 'rmagick', '5.3.0'
|
69
69
|
gem 'rqrcode', '2.2.0'
|
70
70
|
gem 'rspec', '3.12.0'
|
71
71
|
gem 'rtesseract', '3.1.3'
|
72
|
-
gem 'rubocop', '1.57.
|
72
|
+
gem 'rubocop', '1.57.2'
|
73
73
|
gem 'rubocop-rake', '0.6.0'
|
74
|
-
gem 'rubocop-rspec', '2.
|
74
|
+
gem 'rubocop-rspec', '2.25.0'
|
75
75
|
gem 'ruby-audio', '1.6.1'
|
76
76
|
gem 'ruby-nmap', '1.0.2'
|
77
77
|
gem 'ruby-saml', '1.16.0'
|
78
78
|
gem 'rvm', '1.11.3.9'
|
79
79
|
gem 'savon', '2.14.0'
|
80
|
-
gem 'selenium-devtools', '0.
|
80
|
+
gem 'selenium-devtools', '0.119.0'
|
81
81
|
gem 'serialport', '1.3.2'
|
82
82
|
gem 'sinatra', '3.1.0'
|
83
83
|
gem 'slack-ruby-client', '2.2.0'
|
84
84
|
gem 'socksify', '1.7.1'
|
85
85
|
gem 'spreadsheet', '1.3.0'
|
86
|
-
gem 'sqlite3', '1.6.
|
86
|
+
gem 'sqlite3', '1.6.9'
|
87
87
|
gem 'thin', '1.8.2'
|
88
88
|
gem 'tty-prompt', '0.23.1'
|
89
89
|
gem 'tty-spinner', '0.9.3'
|
90
90
|
gem 'watir', '7.3.0'
|
91
91
|
gem 'waveform', '0.1.3'
|
92
92
|
gem 'webrick', '1.8.1'
|
93
|
-
gem 'whois', '5.1.
|
93
|
+
gem 'whois', '5.1.1'
|
94
94
|
gem 'whois-parser', '2.0.0'
|
95
95
|
gem 'wicked_pdf', '2.7.0'
|
data/README.md
CHANGED
@@ -37,7 +37,7 @@ $ cd /opt/pwn
|
|
37
37
|
$ ./install.sh
|
38
38
|
$ ./install.sh ruby-gem
|
39
39
|
$ pwn
|
40
|
-
pwn[v0.4.
|
40
|
+
pwn[v0.4.933]:001 >>> PWN.help
|
41
41
|
```
|
42
42
|
|
43
43
|
[![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
|
@@ -52,7 +52,7 @@ $ rvm use ruby-3.2.2@pwn
|
|
52
52
|
$ gem uninstall --all --executables pwn
|
53
53
|
$ gem install --verbose pwn
|
54
54
|
$ pwn
|
55
|
-
pwn[v0.4.
|
55
|
+
pwn[v0.4.933]:001 >>> PWN.help
|
56
56
|
```
|
57
57
|
|
58
58
|
If you're using a multi-user install of RVM do:
|
@@ -62,7 +62,7 @@ $ rvm use ruby-3.2.2@pwn
|
|
62
62
|
$ rvmsudo gem uninstall --all --executables pwn
|
63
63
|
$ rvmsudo gem install --verbose pwn
|
64
64
|
$ pwn
|
65
|
-
pwn[v0.4.
|
65
|
+
pwn[v0.4.933]:001 >>> PWN.help
|
66
66
|
```
|
67
67
|
|
68
68
|
|
data/bin/pwn_sast
CHANGED
data/lib/pwn/sast/base64.rb
CHANGED
@@ -10,7 +10,7 @@ module PWN
|
|
10
10
|
@@logger = PWN::Plugins::PWNLogger.create
|
11
11
|
|
12
12
|
# Supported Method Parameters::
|
13
|
-
# PWN::SAST::
|
13
|
+
# PWN::SAST::Base64.scan(
|
14
14
|
# dir_path: 'optional path to dir defaults to .'
|
15
15
|
# git_repo_root_uri: 'optional http uri of git repo scanned'
|
16
16
|
# )
|
@@ -34,9 +34,7 @@ module PWN
|
|
34
34
|
|
35
35
|
# TODO: Include regex to search for Base64 strings
|
36
36
|
test_case_filter = "
|
37
|
-
grep -
|
38
|
-
-e 'base64' \
|
39
|
-
-e 'Base64' \
|
37
|
+
grep -Ein \
|
40
38
|
-e 'BASE64' #{entry}
|
41
39
|
"
|
42
40
|
|
@@ -0,0 +1,140 @@
|
|
1
|
+
# frozen_string_literal: false
|
2
|
+
|
3
|
+
require 'socket'
|
4
|
+
|
5
|
+
module PWN
|
6
|
+
module SAST
|
7
|
+
# SAST Module used to identify padding oracle vulnerabilities involving weak CBC block cipher padding.
|
8
|
+
module PaddingOracle
|
9
|
+
@@logger = PWN::Plugins::PWNLogger.create
|
10
|
+
|
11
|
+
# Supported Method Parameters::
|
12
|
+
# PWN::SAST::PaddingOracle.scan(
|
13
|
+
# dir_path: 'optional path to dir defaults to .'
|
14
|
+
# git_repo_root_uri: 'optional http uri of git repo scanned'
|
15
|
+
# )
|
16
|
+
|
17
|
+
public_class_method def self.scan(opts = {})
|
18
|
+
dir_path = opts[:dir_path]
|
19
|
+
git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
|
20
|
+
result_arr = []
|
21
|
+
logger_results = ''
|
22
|
+
|
23
|
+
PWN::Plugins::FileFu.recurse_dir(dir_path: dir_path) do |entry|
|
24
|
+
if File.file?(entry) && File.basename(entry) !~ /^pwn.+(html|json|db)$/ && File.basename(entry) !~ /\.JS-BEAUTIFIED$/ && entry !~ /test/i
|
25
|
+
line_no_and_contents_arr = []
|
26
|
+
entry_beautified = false
|
27
|
+
|
28
|
+
if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
|
29
|
+
js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
|
30
|
+
entry = "#{entry}.JS-BEAUTIFIED"
|
31
|
+
entry_beautified = true
|
32
|
+
end
|
33
|
+
|
34
|
+
# TODO: Include regex to search for weak CBC block cipher padding
|
35
|
+
test_case_filter = "
|
36
|
+
grep -Ein \
|
37
|
+
-e 'AES/CBC/PKCS' #{entry}
|
38
|
+
"
|
39
|
+
|
40
|
+
str = `#{test_case_filter}`.to_s.scrub
|
41
|
+
|
42
|
+
if str.to_s.empty?
|
43
|
+
# If str length is >= 64 KB do not include results. (Due to Mongo Document Size Restrictions)
|
44
|
+
logger_results = "#{logger_results}~" # Catching bugs is good :)
|
45
|
+
else
|
46
|
+
str = "1:Result larger than 64KB -> Size: #{str.to_s.length}. Please click the \"Path\" link for more details." if str.to_s.length >= 64_000
|
47
|
+
|
48
|
+
hash_line = {
|
49
|
+
timestamp: Time.now.strftime('%Y-%m-%d %H:%M:%S.%9N %z').to_s,
|
50
|
+
security_references: security_references,
|
51
|
+
filename: { git_repo_root_uri: git_repo_root_uri, entry: entry },
|
52
|
+
line_no_and_contents: '',
|
53
|
+
raw_content: str,
|
54
|
+
test_case_filter: test_case_filter
|
55
|
+
}
|
56
|
+
|
57
|
+
# COMMMENT: Must be a better way to implement this (regex is kinda funky)
|
58
|
+
line_contents_split = str.split(/^(\d{1,}):|\n(\d{1,}):/)[1..-1]
|
59
|
+
line_no_count = line_contents_split.length # This should always be an even number
|
60
|
+
current_count = 0
|
61
|
+
while line_no_count > current_count
|
62
|
+
line_no = line_contents_split[current_count]
|
63
|
+
contents = line_contents_split[current_count + 1]
|
64
|
+
if Dir.exist?("#{dir_path}/.git") ||
|
65
|
+
Dir.exist?('.git')
|
66
|
+
|
67
|
+
repo_root = dir_path
|
68
|
+
repo_root = '.' if Dir.exist?('.git')
|
69
|
+
|
70
|
+
author = PWN::Plugins::Git.get_author(
|
71
|
+
repo_root: repo_root,
|
72
|
+
from_line: line_no,
|
73
|
+
to_line: line_no,
|
74
|
+
target_file: entry,
|
75
|
+
entry_beautified: entry_beautified
|
76
|
+
)
|
77
|
+
else
|
78
|
+
author = 'N/A'
|
79
|
+
end
|
80
|
+
hash_line[:line_no_and_contents] = line_no_and_contents_arr.push(
|
81
|
+
line_no: line_no,
|
82
|
+
contents: contents,
|
83
|
+
author: author
|
84
|
+
)
|
85
|
+
|
86
|
+
current_count += 2
|
87
|
+
end
|
88
|
+
result_arr.push(hash_line)
|
89
|
+
logger_results = "#{logger_results}x" # Seeing progress is good :)
|
90
|
+
end
|
91
|
+
end
|
92
|
+
end
|
93
|
+
logger_banner = "http://#{Socket.gethostname}:8808/doc_root/pwn-#{PWN::VERSION.to_s.scrub}/#{to_s.scrub.gsub('::', '/')}.html"
|
94
|
+
if logger_results.empty?
|
95
|
+
@@logger.info("#{logger_banner}: No files applicable to this test case.\n")
|
96
|
+
else
|
97
|
+
@@logger.info("#{logger_banner} => #{logger_results}complete.\n")
|
98
|
+
end
|
99
|
+
result_arr
|
100
|
+
rescue StandardError => e
|
101
|
+
raise e
|
102
|
+
end
|
103
|
+
|
104
|
+
# Used to dictate Security Control Requirements for a Given SAST module.
|
105
|
+
|
106
|
+
public_class_method def self.security_references
|
107
|
+
{
|
108
|
+
sast_module: self,
|
109
|
+
section: 'PUBLIC KEY INFRASTRUCTURE CERTIFICATES',
|
110
|
+
nist_800_53_uri: 'https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control/?version=5.1&number=SC-17',
|
111
|
+
cwe_id: '310',
|
112
|
+
cwe_uri: 'https://cwe.mitre.org/data/definitions/310.html'
|
113
|
+
}
|
114
|
+
rescue StandardError => e
|
115
|
+
raise e
|
116
|
+
end
|
117
|
+
|
118
|
+
# Author(s):: 0day Inc. <request.pentest@0dayinc.com>
|
119
|
+
|
120
|
+
public_class_method def self.authors
|
121
|
+
"AUTHOR(S):
|
122
|
+
0day Inc. <request.pentest@0dayinc.com>
|
123
|
+
"
|
124
|
+
end
|
125
|
+
|
126
|
+
# Display Usage for this Module
|
127
|
+
|
128
|
+
public_class_method def self.help
|
129
|
+
puts "USAGE:
|
130
|
+
sast_arr = #{self}.scan(
|
131
|
+
dir_path: 'optional path to dir defaults to .',
|
132
|
+
git_repo_root_uri: 'optional http uri of git repo scanned'
|
133
|
+
)
|
134
|
+
|
135
|
+
#{self}.authors
|
136
|
+
"
|
137
|
+
end
|
138
|
+
end
|
139
|
+
end
|
140
|
+
end
|
data/lib/pwn/sast.rb
CHANGED
@@ -29,6 +29,7 @@ module PWN
|
|
29
29
|
autoload :Logger, 'pwn/sast/logger'
|
30
30
|
autoload :MD5, 'pwn/sast/md5'
|
31
31
|
autoload :OuterHTML, 'pwn/sast/outer_html'
|
32
|
+
autoload :PaddingOracle, 'pwn/sast/padding_oracle'
|
32
33
|
autoload :Password, 'pwn/sast/password'
|
33
34
|
autoload :PHPInputMechanisms, 'pwn/sast/php_input_mechanisms'
|
34
35
|
autoload :PHPTypeJuggling, 'pwn/sast/php_type_juggling'
|
data/lib/pwn/version.rb
CHANGED
@@ -0,0 +1,25 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
require 'spec_helper'
|
4
|
+
|
5
|
+
describe PWN::SAST::PaddingOracle do
|
6
|
+
it 'scan method should exist' do
|
7
|
+
scan_response = PWN::SAST::PaddingOracle
|
8
|
+
expect(scan_response).to respond_to :scan
|
9
|
+
end
|
10
|
+
|
11
|
+
it 'should display information for security_references' do
|
12
|
+
security_references_response = PWN::SAST::PaddingOracle
|
13
|
+
expect(security_references_response).to respond_to :security_references
|
14
|
+
end
|
15
|
+
|
16
|
+
it 'should display information for authors' do
|
17
|
+
authors_response = PWN::SAST::PaddingOracle
|
18
|
+
expect(authors_response).to respond_to :authors
|
19
|
+
end
|
20
|
+
|
21
|
+
it 'should display information for existing help method' do
|
22
|
+
help_response = PWN::SAST::PaddingOracle
|
23
|
+
expect(help_response).to respond_to :help
|
24
|
+
end
|
25
|
+
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: pwn
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.4.
|
4
|
+
version: 0.4.933
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- 0day Inc.
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-
|
11
|
+
date: 2023-11-28 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: activesupport
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 7.1.
|
19
|
+
version: 7.1.2
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 7.1.
|
26
|
+
version: 7.1.2
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: anemone
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -58,14 +58,14 @@ dependencies:
|
|
58
58
|
requirements:
|
59
59
|
- - '='
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: 3.
|
61
|
+
version: 3.2.0
|
62
62
|
type: :runtime
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
66
|
- - '='
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: 3.
|
68
|
+
version: 3.2.0
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
70
|
name: barby
|
71
71
|
requirement: !ruby/object:Gem::Requirement
|
@@ -114,14 +114,14 @@ dependencies:
|
|
114
114
|
requirements:
|
115
115
|
- - ">="
|
116
116
|
- !ruby/object:Gem::Version
|
117
|
-
version: 2.4.
|
117
|
+
version: 2.4.22
|
118
118
|
type: :development
|
119
119
|
prerelease: false
|
120
120
|
version_requirements: !ruby/object:Gem::Requirement
|
121
121
|
requirements:
|
122
122
|
- - ">="
|
123
123
|
- !ruby/object:Gem::Version
|
124
|
-
version: 2.4.
|
124
|
+
version: 2.4.22
|
125
125
|
- !ruby/object:Gem::Dependency
|
126
126
|
name: bundler-audit
|
127
127
|
requirement: !ruby/object:Gem::Requirement
|
@@ -164,6 +164,20 @@ dependencies:
|
|
164
164
|
- - '='
|
165
165
|
- !ruby/object:Gem::Version
|
166
166
|
version: 1.1.0
|
167
|
+
- !ruby/object:Gem::Dependency
|
168
|
+
name: credit_card_validations
|
169
|
+
requirement: !ruby/object:Gem::Requirement
|
170
|
+
requirements:
|
171
|
+
- - '='
|
172
|
+
- !ruby/object:Gem::Version
|
173
|
+
version: 6.1.0
|
174
|
+
type: :runtime
|
175
|
+
prerelease: false
|
176
|
+
version_requirements: !ruby/object:Gem::Requirement
|
177
|
+
requirements:
|
178
|
+
- - '='
|
179
|
+
- !ruby/object:Gem::Version
|
180
|
+
version: 6.1.0
|
167
181
|
- !ruby/object:Gem::Dependency
|
168
182
|
name: eventmachine
|
169
183
|
requirement: !ruby/object:Gem::Requirement
|
@@ -198,14 +212,14 @@ dependencies:
|
|
198
212
|
requirements:
|
199
213
|
- - '='
|
200
214
|
- !ruby/object:Gem::Version
|
201
|
-
version: 3.2.
|
215
|
+
version: 3.2.2
|
202
216
|
type: :runtime
|
203
217
|
prerelease: false
|
204
218
|
version_requirements: !ruby/object:Gem::Requirement
|
205
219
|
requirements:
|
206
220
|
- - '='
|
207
221
|
- !ruby/object:Gem::Version
|
208
|
-
version: 3.2.
|
222
|
+
version: 3.2.2
|
209
223
|
- !ruby/object:Gem::Dependency
|
210
224
|
name: faye-websocket
|
211
225
|
requirement: !ruby/object:Gem::Requirement
|
@@ -422,14 +436,14 @@ dependencies:
|
|
422
436
|
requirements:
|
423
437
|
- - '='
|
424
438
|
- !ruby/object:Gem::Version
|
425
|
-
version: 2.19.
|
439
|
+
version: 2.19.3
|
426
440
|
type: :runtime
|
427
441
|
prerelease: false
|
428
442
|
version_requirements: !ruby/object:Gem::Requirement
|
429
443
|
requirements:
|
430
444
|
- - '='
|
431
445
|
- !ruby/object:Gem::Version
|
432
|
-
version: 2.19.
|
446
|
+
version: 2.19.3
|
433
447
|
- !ruby/object:Gem::Dependency
|
434
448
|
name: msfrpc-client
|
435
449
|
requirement: !ruby/object:Gem::Requirement
|
@@ -520,14 +534,14 @@ dependencies:
|
|
520
534
|
requirements:
|
521
535
|
- - '='
|
522
536
|
- !ruby/object:Gem::Version
|
523
|
-
version: 1.15.
|
537
|
+
version: 1.15.5
|
524
538
|
type: :runtime
|
525
539
|
prerelease: false
|
526
540
|
version_requirements: !ruby/object:Gem::Requirement
|
527
541
|
requirements:
|
528
542
|
- - '='
|
529
543
|
- !ruby/object:Gem::Version
|
530
|
-
version: 1.15.
|
544
|
+
version: 1.15.5
|
531
545
|
- !ruby/object:Gem::Dependency
|
532
546
|
name: nokogiri-diff
|
533
547
|
requirement: !ruby/object:Gem::Requirement
|
@@ -562,14 +576,14 @@ dependencies:
|
|
562
576
|
requirements:
|
563
577
|
- - '='
|
564
578
|
- !ruby/object:Gem::Version
|
565
|
-
version: 0.
|
579
|
+
version: 0.2.0
|
566
580
|
type: :runtime
|
567
581
|
prerelease: false
|
568
582
|
version_requirements: !ruby/object:Gem::Requirement
|
569
583
|
requirements:
|
570
584
|
- - '='
|
571
585
|
- !ruby/object:Gem::Version
|
572
|
-
version: 0.
|
586
|
+
version: 0.2.0
|
573
587
|
- !ruby/object:Gem::Dependency
|
574
588
|
name: os
|
575
589
|
requirement: !ruby/object:Gem::Requirement
|
@@ -660,14 +674,14 @@ dependencies:
|
|
660
674
|
requirements:
|
661
675
|
- - '='
|
662
676
|
- !ruby/object:Gem::Version
|
663
|
-
version: 13.0
|
677
|
+
version: 13.1.0
|
664
678
|
type: :development
|
665
679
|
prerelease: false
|
666
680
|
version_requirements: !ruby/object:Gem::Requirement
|
667
681
|
requirements:
|
668
682
|
- - '='
|
669
683
|
- !ruby/object:Gem::Version
|
670
|
-
version: 13.0
|
684
|
+
version: 13.1.0
|
671
685
|
- !ruby/object:Gem::Dependency
|
672
686
|
name: rb-readline
|
673
687
|
requirement: !ruby/object:Gem::Requirement
|
@@ -702,14 +716,14 @@ dependencies:
|
|
702
716
|
requirements:
|
703
717
|
- - '='
|
704
718
|
- !ruby/object:Gem::Version
|
705
|
-
version: 6.
|
719
|
+
version: 6.6.0
|
706
720
|
type: :development
|
707
721
|
prerelease: false
|
708
722
|
version_requirements: !ruby/object:Gem::Requirement
|
709
723
|
requirements:
|
710
724
|
- - '='
|
711
725
|
- !ruby/object:Gem::Version
|
712
|
-
version: 6.
|
726
|
+
version: 6.6.0
|
713
727
|
- !ruby/object:Gem::Dependency
|
714
728
|
name: rest-client
|
715
729
|
requirement: !ruby/object:Gem::Requirement
|
@@ -800,14 +814,14 @@ dependencies:
|
|
800
814
|
requirements:
|
801
815
|
- - '='
|
802
816
|
- !ruby/object:Gem::Version
|
803
|
-
version: 1.57.
|
817
|
+
version: 1.57.2
|
804
818
|
type: :runtime
|
805
819
|
prerelease: false
|
806
820
|
version_requirements: !ruby/object:Gem::Requirement
|
807
821
|
requirements:
|
808
822
|
- - '='
|
809
823
|
- !ruby/object:Gem::Version
|
810
|
-
version: 1.57.
|
824
|
+
version: 1.57.2
|
811
825
|
- !ruby/object:Gem::Dependency
|
812
826
|
name: rubocop-rake
|
813
827
|
requirement: !ruby/object:Gem::Requirement
|
@@ -828,14 +842,14 @@ dependencies:
|
|
828
842
|
requirements:
|
829
843
|
- - '='
|
830
844
|
- !ruby/object:Gem::Version
|
831
|
-
version: 2.
|
845
|
+
version: 2.25.0
|
832
846
|
type: :runtime
|
833
847
|
prerelease: false
|
834
848
|
version_requirements: !ruby/object:Gem::Requirement
|
835
849
|
requirements:
|
836
850
|
- - '='
|
837
851
|
- !ruby/object:Gem::Version
|
838
|
-
version: 2.
|
852
|
+
version: 2.25.0
|
839
853
|
- !ruby/object:Gem::Dependency
|
840
854
|
name: ruby-audio
|
841
855
|
requirement: !ruby/object:Gem::Requirement
|
@@ -912,14 +926,14 @@ dependencies:
|
|
912
926
|
requirements:
|
913
927
|
- - '='
|
914
928
|
- !ruby/object:Gem::Version
|
915
|
-
version: 0.
|
929
|
+
version: 0.119.0
|
916
930
|
type: :runtime
|
917
931
|
prerelease: false
|
918
932
|
version_requirements: !ruby/object:Gem::Requirement
|
919
933
|
requirements:
|
920
934
|
- - '='
|
921
935
|
- !ruby/object:Gem::Version
|
922
|
-
version: 0.
|
936
|
+
version: 0.119.0
|
923
937
|
- !ruby/object:Gem::Dependency
|
924
938
|
name: serialport
|
925
939
|
requirement: !ruby/object:Gem::Requirement
|
@@ -996,14 +1010,14 @@ dependencies:
|
|
996
1010
|
requirements:
|
997
1011
|
- - '='
|
998
1012
|
- !ruby/object:Gem::Version
|
999
|
-
version: 1.6.
|
1013
|
+
version: 1.6.9
|
1000
1014
|
type: :runtime
|
1001
1015
|
prerelease: false
|
1002
1016
|
version_requirements: !ruby/object:Gem::Requirement
|
1003
1017
|
requirements:
|
1004
1018
|
- - '='
|
1005
1019
|
- !ruby/object:Gem::Version
|
1006
|
-
version: 1.6.
|
1020
|
+
version: 1.6.9
|
1007
1021
|
- !ruby/object:Gem::Dependency
|
1008
1022
|
name: thin
|
1009
1023
|
requirement: !ruby/object:Gem::Requirement
|
@@ -1094,14 +1108,14 @@ dependencies:
|
|
1094
1108
|
requirements:
|
1095
1109
|
- - '='
|
1096
1110
|
- !ruby/object:Gem::Version
|
1097
|
-
version: 5.1.
|
1111
|
+
version: 5.1.1
|
1098
1112
|
type: :runtime
|
1099
1113
|
prerelease: false
|
1100
1114
|
version_requirements: !ruby/object:Gem::Requirement
|
1101
1115
|
requirements:
|
1102
1116
|
- - '='
|
1103
1117
|
- !ruby/object:Gem::Version
|
1104
|
-
version: 5.1.
|
1118
|
+
version: 5.1.1
|
1105
1119
|
- !ruby/object:Gem::Dependency
|
1106
1120
|
name: whois-parser
|
1107
1121
|
requirement: !ruby/object:Gem::Requirement
|
@@ -1758,6 +1772,7 @@ files:
|
|
1758
1772
|
- lib/pwn/sast/logger.rb
|
1759
1773
|
- lib/pwn/sast/md5.rb
|
1760
1774
|
- lib/pwn/sast/outer_html.rb
|
1775
|
+
- lib/pwn/sast/padding_oracle.rb
|
1761
1776
|
- lib/pwn/sast/password.rb
|
1762
1777
|
- lib/pwn/sast/php_input_mechanisms.rb
|
1763
1778
|
- lib/pwn/sast/php_type_juggling.rb
|
@@ -2072,6 +2087,7 @@ files:
|
|
2072
2087
|
- spec/lib/pwn/sast/logger_spec.rb
|
2073
2088
|
- spec/lib/pwn/sast/md5_spec.rb
|
2074
2089
|
- spec/lib/pwn/sast/outer_html_spec.rb
|
2090
|
+
- spec/lib/pwn/sast/padding_oracle_spec.rb
|
2075
2091
|
- spec/lib/pwn/sast/password_spec.rb
|
2076
2092
|
- spec/lib/pwn/sast/php_input_mechanisms_spec.rb
|
2077
2093
|
- spec/lib/pwn/sast/php_type_juggling_spec.rb
|
@@ -2168,7 +2184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
2168
2184
|
- !ruby/object:Gem::Version
|
2169
2185
|
version: '0'
|
2170
2186
|
requirements: []
|
2171
|
-
rubygems_version: 3.4.
|
2187
|
+
rubygems_version: 3.4.22
|
2172
2188
|
signing_key:
|
2173
2189
|
specification_version: 4
|
2174
2190
|
summary: Automated Security Testing for CI/CD Pipelines & Beyond
|