pwn 0.5.316 → 0.5.318

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 987e7f6f41786a977a0e1dbd0977fe614dbaf90be3cc901d2d00e20f282085b3
-  data.tar.gz: 252b0917e5f09d430db0f4603a12cd7a49fdd13348e30d6dca9b9861bc3bb161
+  metadata.gz: f686b3b286fba8e530a257dbd5e51e8c47d7103c25d39a9306e6621addd50905
+  data.tar.gz: dc9004429f6545cbc9c11e95c134afbe1f67b23482336382c6fcbdb829095273
 SHA512:
-  metadata.gz: 970119688679e2e6fb8a3eb0e4ec80d7d995fd1e2bbb7b6aa55fc8c182a76efdfa9a9514dc9ff61dffa3849d8c3c78ca936fa3ab2c0b3ad67691e3d949a83f2e
-  data.tar.gz: c6c18e9ddf30be351947e11f7a04a082adeb0ac5c7ed951311a4f35ae8ec9d60f051e4b8133bfd4ac0ab2c635794dac642873942956c151f56b76a6701cfde1b
+  metadata.gz: ecfe213e36866e3faaa86feec1d7ad31ddfe687c8f69a3c3ad5ec99f79ddcd01d349e336a24cbe3d70bf8d6fa01a5b20168cab0f7a8a9f3aaa5ff7baa8aaa303
+  data.tar.gz: 22c4c983e03da55dd2f4ef550b21a59196784ed1d2f8d9c45bc9107e091cbdb7176ca4fb479bc1bf58ea5f131d21c5f7f6afb98f0283b0a44af537921de67843

data/Gemfile

@@ -41,7 +41,7 @@ gem 'htmlentities', '4.3.4'
 gem 'ipaddress', '0.8.3'
 gem 'jenkins_api_client2', '1.9.0'
 gem 'js-beautify', '0.1.8'
-gem 'json', '2.12.2'
+gem 'json', '2.13.0'
 gem 'jsonpath', '1.1.5'
 gem 'jwt', '3.1.2'
 gem 'libusb', '0.7.2'
@@ -64,7 +64,7 @@ gem 'open3', '0.2.1'
 # Relies on cargo, which is not available in OpenBSD via pkg_add atm.
 # gem 'openapi3_parser', '0.10.1'
 gem 'os', '1.1.4'
-gem 'ostruct', '0.6.2'
+gem 'ostruct', '0.6.3'
 gem 'packetfu', '2.0.0'
 gem 'packetgen', '4.1.0'
 gem 'pdf-reader', '2.14.1'
@@ -93,7 +93,7 @@ gem 'selenium-devtools', '0.138.0'
 # gem 'serialport', '1.3.2'
 # gem 'sinatra', '4.0.0'
 gem 'slack-ruby-client', '2.6.0'
-gem 'socksify', '1.7.1'
+gem 'socksify', '1.8.0'
 gem 'spreadsheet', '1.3.4'
 gem 'sqlite3', '2.7.2'
 gem 'thin', '2.0.1'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.316]:001 >>> PWN.help
+pwn[v0.5.318]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.316]:001 >>> PWN.help
+pwn[v0.5.318]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.316]:001 >>> PWN.help
+pwn[v0.5.318]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/transparent_browser.rb

@@ -488,11 +488,14 @@ module PWN
         raise e
       end
 
-      # Supported Method Parameters::
+      # Supported Method Parameters:
       # console_resp = PWN::Plugins::TransparentBrowser.view_dom_mutations(
-      #   browser_obj: browser_obj1,
+      #   browser_obj: 'required - browser_obj returned from #open method',
       #   index: 'optional - index of tab to switch to (defaults to active tab)',
-      #   target: 'optional - target JavaScript node to observe (defaults to document.body)'
+      #   target: 'optional - target JavaScript node to observe (defaults to document.body)',
+      #   observe_clobbering: 'optional - boolean to enable DOM Clobbering detection (defaults to true)',
+      #   observe_redirects: 'optional - boolean to enable Insecure Redirect detection (defaults to true)',
+      #   observe_resources: 'optional - boolean to enable resource load monitoring (defaults to true)'
       # )
 
       public_class_method def self.view_dom_mutations(opts = {})
@@ -503,6 +506,9 @@ module PWN
         jmp_tab(browser_obj: browser_obj, index: index) if index
 
         target = opts[:target] ||= 'undefined'
+        observe_clobbering = opts.fetch(:observe_clobbering, true)
+        observe_redirects = opts.fetch(:observe_redirects, true)
+        observe_resources = opts.fetch(:observe_resources, true)
 
         jmp_devtools_panel(
           browser_obj: browser_obj,
@@ -510,138 +516,147 @@ module PWN
         )
 
         js = <<~JAVASCRIPT
-          // Select the target node to observe (replace 'target-id' with your element's ID or use document.body)
+          // Select the target node to observe (default to document.body)
           const targetNode = document.getElementById(#{target}) || document.body;
 
           // Configuration for MutationObserver
           const config = {
-            attributes: true, // Observe attribute changes
-            childList: true, // Observe additions/removals of child nodes
-            subtree: true, // Observe descendants
-            characterData: true, // Observe text content changes
+            attributes: true,
+            childList: true,
+            subtree: true,
+            characterData: true,
+            attributeOldValue: true
           };
 
+          // Exhaustive list of elements that can execute scripts or load resources
+          const xssElements = [
+            'SCRIPT', 'IFRAME', 'FRAME', 'OBJECT', 'EMBED', 'APPLET', 'SVG', 'IMG', 'VIDEO', 'AUDIO', 'LINK', 'META', 'BASE',
+            'INPUT', 'SOURCE', 'TRACK', 'FORM', 'BUTTON', 'AREA', 'NOSCRIPT', 'STYLE', 'HTML', 'BODY'
+          ];
+
+          // Exhaustive list of attributes that can contain URLs, scripts, or event handlers
+          const xssAttributes = [
+            'src', 'href', 'action', 'srcdoc', 'data', 'codebase', 'style', 'manifest', 'poster', 'background', 'lowsrc',
+            'formaction', 'cite', 'ping', 'icon', 'longdesc', 'usemap', 'content', 'value', 'pattern',
+            'onload', 'onerror', 'onclick', 'onmouseover', 'onmouseout', 'onfocus', 'onblur', 'onchange', 'onsubmit', 'onreset',
+            'onselect', 'ondblclick', 'onkeydown', 'onkeypress', 'onkeyup', 'onmousedown', 'onmousemove', 'onmouseup', 'onwheel',
+            'oncontextmenu', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onscroll',
+            'ontouchstart', 'ontouchmove', 'ontouchend', 'ontouchcancel', 'onanimationstart', 'onanimationend', 'onanimationiteration',
+            'ontransitionend'
+          ];
+
+          // Attributes that can cause navigation (for insecure redirects)
+          const redirectAttributes = ['href', 'action', 'src', 'formaction', 'content'];
+
+          // Attributes that load resources (for data exfiltration)
+          const resourceAttributes = ['src', 'href', 'poster', 'data', 'background', 'lowsrc', 'cite', 'ping', 'icon', 'longdesc'];
+
+          // Global properties that could be clobbered
+          const globalProperties = [
+            'document', 'window', 'location', 'navigator', 'history', 'screen', 'console', 'alert', 'confirm', 'prompt',
+            'fetch', 'XMLHttpRequest', 'WebSocket', 'localStorage', 'sessionStorage'
+          ];
+
           // Callback function to handle mutations
           const callback = (mutationList, observer) => {
-            console.group('DOM Mutation Detected');
-            mutationList.forEach((mutation, index) => {
-              console.log(`Mutation ${index + 1}:`, mutation.type);
-
+            mutationList.forEach((mutation) => {
               if (mutation.type === 'childList') {
                 if (mutation.addedNodes.length) {
                   mutation.addedNodes.forEach((node) => {
                     if (node.nodeType === Node.ELEMENT_NODE) {
-                      let logObj = {
-                        tagName: node.tagName,
-                        id: node.id || 'N/A',
-                        classList: node.className || 'N/A',
-                        outerHTML: node.outerHTML,
-                      };
-                      if (['SCRIPT', 'IFRAME', 'FRAME', 'OBJECT', 'EMBED', 'APPLET'].includes(node.tagName)) {
-                        console.warn('Potential XSS sink: Added', node.tagName, logObj);
-                      } else {
-                        console.log('Added Element:', logObj);
+                      const tagName = node.tagName.toUpperCase();
+                      // Check for XSS sinks
+                      if (xssElements.includes(tagName)) {
+                        console.warn('Potential DOM-XSS sink: Added element', {
+                          tagName: tagName,
+                          id: node.id || 'N/A',
+                          classList: node.className || 'N/A',
+                          outerHTML: node.outerHTML
+                        });
+                      }
+                      // Check for DOM Clobbering
+                      if (#{observe_clobbering} && (node.id || node.name) && globalProperties.includes(node.id || node.name)) {
+                        console.warn('Potential DOM Clobbering: Added element with id/name', {
+                          id: node.id || 'N/A',
+                          name: node.name || 'N/A',
+                          tagName: tagName,
+                          outerHTML: node.outerHTML
+                        });
                       }
-                    } else if (node.nodeType === Node.TEXT_NODE) {
-                      console.log('Added Text Node:', {
-                        textContent: node.textContent,
-                        parentTag: node.parentElement?.tagName || 'N/A',
-                      });
-                    }
-                  });
-                }
-                if (mutation.removedNodes.length) {
-                  mutation.removedNodes.forEach((node) => {
-                    if (node.nodeType === Node.ELEMENT_NODE) {
-                      console.log('Removed Element:', {
-                        tagName: node.tagName,
-                        id: node.id || 'N/A',
-                        classList: node.className || 'N/A',
-                        outerHTML: node.outerHTML,
-                      });
-                    } else if (node.nodeType === Node.TEXT_NODE) {
-                      console.log('Removed Text Node:', {
-                        textContent: node.textContent,
-                        parentTag: node.parentElement?.tagName || 'N/A',
-                      });
                     }
                   });
                 }
               } else if (mutation.type === 'attributes') {
-                let logObj = {
-                  element: mutation.target.tagName,
-                  id: mutation.target.id || 'N/A',
-                  attribute: mutation.attributeName,
-                  oldValue: mutation.oldValue,
-                  newValue: mutation.target.getAttribute(mutation.attributeName),
-                  outerHTML: mutation.target.outerHTML,
-                };
-                if (
-                  (mutation.attributeName === 'src' && ['SCRIPT', 'IFRAME', 'FRAME', 'OBJECT', 'EMBED'].includes(mutation.target.tagName)) ||
-                  (mutation.attributeName === 'href' && ['A', 'AREA', 'LINK'].includes(mutation.target.tagName)) ||
-                  (mutation.attributeName === 'action' && mutation.target.tagName === 'FORM') ||
-                  mutation.attributeName.startsWith('on') ||
-                  (mutation.attributeName === 'srcdoc' && mutation.target.tagName === 'IFRAME') ||
-                  (mutation.attributeName === 'data' && mutation.target.tagName === 'OBJECT') ||
-                  (mutation.attributeName === 'codebase' && mutation.target.tagName === 'OBJECT')
-                ) {
-                  console.warn('Potential XSS sink: Attribute change', logObj);
-                } else {
-                  console.log('Attribute changed:', logObj);
+                const attrName = mutation.attributeName.toLowerCase();
+                const tagName = mutation.target.tagName.toUpperCase();
+                // Check for XSS sinks
+                if (xssAttributes.includes(attrName)) {
+                  console.warn('Potential DOM-XSS sink: Attribute change', {
+                    element: tagName,
+                    id: mutation.target.id || 'N/A',
+                    attribute: attrName,
+                    oldValue: mutation.oldValue,
+                    newValue: mutation.target.getAttribute(attrName),
+                    outerHTML: mutation.target.outerHTML
+                  });
                 }
-              } else if (mutation.type === 'characterData') {
-                if (mutation.target.parentElement && mutation.target.parentElement.tagName === 'SCRIPT') {
-                  console.warn('Potential XSS sink: Script content changed', {
-                    scriptId: mutation.target.parentElement.id || 'N/A',
+                // Check for insecure redirects
+                if (#{observe_redirects} && redirectAttributes.includes(attrName) &&
+                    (tagName === 'A' || tagName === 'FORM' || tagName === 'IFRAME' || tagName === 'BUTTON' || tagName === 'INPUT' ||
+                     (tagName === 'META' && mutation.target.getAttribute('http-equiv') === 'refresh'))) {
+                  console.warn('Potential Insecure Redirect: Attribute change', {
+                    element: tagName,
+                    id: mutation.target.id || 'N/A',
+                    attribute: attrName,
                     oldValue: mutation.oldValue,
-                    newValue: mutation.target.textContent,
+                    newValue: mutation.target.getAttribute(attrName),
+                    outerHTML: mutation.target.outerHTML
                   });
-                } else {
-                  console.log('Text Content Changed:', {
-                    element: mutation.target.parentElement?.tagName || 'N/A',
-                    id: mutation.target.parentElement?.id || 'N/A',
+                }
+                // Check for resource loads (data exfiltration)
+                if (#{observe_resources} && resourceAttributes.includes(attrName)) {
+                  console.warn('Potential Resource Load (Data Exfiltration): Attribute change', {
+                    element: tagName,
+                    id: mutation.target.id || 'N/A',
+                    attribute: attrName,
                     oldValue: mutation.oldValue,
-                    newValue: mutation.target.textContent,
-                    innerHTML: mutation.target.parentElement?.innerHTML || 'N/A',
+                    newValue: mutation.target.getAttribute(attrName),
+                    outerHTML: mutation.target.outerHTML
                   });
                 }
+              } else if (mutation.type === 'characterData') {
+                if (mutation.target.parentElement) {
+                  const parentTag = mutation.target.parentElement.tagName.toUpperCase();
+                  if (parentTag === 'SCRIPT') {
+                    console.warn('Potential DOM-XSS sink: Script content changed', {
+                      scriptId: mutation.target.parentElement.id || 'N/A',
+                      oldValue: mutation.oldValue,
+                      newValue: mutation.target.textContent
+                    });
+                  } else if (parentTag === 'STYLE') {
+                    console.warn('Potential DOM-XSS sink: Style content changed', {
+                      styleId: mutation.target.parentElement.id || 'N/A',
+                      oldValue: mutation.oldValue,
+                      newValue: mutation.target.textContent
+                    });
+                  }
+                }
               }
             });
-            console.groupEnd();
           };
 
           // Create and start the MutationObserver
           const observer = new MutationObserver(callback);
           observer.observe(targetNode, config);
 
-          // Optional: Add event listeners to capture user interactions
-          const logUserInteraction = (event) => {
-            console.group('User Interaction Detected');
-            console.log('Event Type:', event.type);
-            console.log('Target:', {
-              tagName: event.target.tagName,
-              id: event.target.id || 'N/A',
-              classList: event.target.className || 'N/A',
-              value: 'value' in event.target ? event.target.value : 'N/A',
-              innerHTML: event.target.innerHTML || 'N/A',
-            });
-            console.groupEnd();
-          };
-
-          // Attach listeners for keyboard and click events
-          document.addEventListener('input', logUserInteraction); // For form inputs, contenteditable
-          document.addEventListener('click', logUserInteraction); // For clicks
-
-          // Function to stop the observer (run in console when needed)
+          // Function to stop the observer
           window.hide_dom_mutations = () => {
             observer.disconnect();
-            document.removeEventListener('input', logUserInteraction);
-            document.removeEventListener('click', logUserInteraction);
-            console.log('MutationObserver and event listeners stopped.');
+            console.log('MutationObserver stopped.');
           };
 
           // Log instructions to console
-          console.log('MutationObserver started. To stop, run: hide_dom_mutations()');
+          console.log('MutationObserver started for DOM-based vulnerabilities. To stop, run: hide_dom_mutations()');
         JAVASCRIPT
 
         console(browser_obj: browser_obj, js: 'clear();')
@@ -724,30 +739,30 @@ module PWN
         browser_obj = opts[:browser_obj]
         verify_devtools_browser(browser_obj: browser_obj)
 
-        browser = browser_obj[:browser]
-        current_window_handle = browser.driver.current_window_handle
+        current_window_handle = browser_obj[:browser].driver.window_handle
 
         tabs_arr_hash = []
-        browser.driver.window_handles.each_with_index do |window_handle, idx|
+        browser_obj[:browser].driver.window_handles.each do |window_handle|
           # Skip DevTools tabs
-          next if browser.driver.switch_to.window(window_handle).url.include?('devtools://')
+          browser_obj[:browser].driver.switch_to.window(window_handle)
+          title = browser_obj[:browser].execute_script('return document.title')
+          url = browser_obj[:browser].execute_script('return document.location.href')
+          next if url.include?('devtools://')
 
           # Get title and URL without switching tabs
-          title = browser.execute_script('return document.title')
-          url = browser.url
 
           state = window_handle == current_window_handle ? :active : :inactive
 
           tabs_arr_hash << { index: window_handle, title: title, url: url, state: state }
         ensure
           # Ensure we return to the original active tab
-          browser.driver.switch_to.window(current_window_handle)
+          browser_obj[:browser].driver.switch_to.window(current_window_handle)
         end
 
         # Ensure we have a visible tab that's active
         active_tab = tabs_arr_hash.find { |tab| tab[:state] == :active } || tabs_arr_hash.first
         # Switch to the active tab if it exists
-        browser.driver.switch_to.window(active_tab[:index]) if active_tab
+        browser_obj[:browser].driver.switch_to.window(active_tab[:index]) if active_tab
 
         tabs_arr_hash
       rescue Selenium::WebDriver::Error::NoSuchWindowError => e
@@ -757,40 +772,6 @@ module PWN
         raise "Failed to list tabs: #{e.message}"
       end
 
-      # Supported Method Parameters::
-      # tabs = PWN::Plugins::TransparentBrowser.list_tabs_legacy(
-      #   browser_obj: 'required - browser_obj returned from #open method)'
-      # )
-
-      public_class_method def self.list_tabs_legacy(opts = {})
-        browser_obj = opts[:browser_obj]
-        verify_devtools_browser(browser_obj: browser_obj)
-
-        idx = 0
-        current_window_handle = browser_obj[:browser].driver.window_handle
-
-        tabs_arr_hash = browser_obj[:browser].windows.map do |tab|
-          next if tab.url.include?('devtools://')
-
-          state = :inactive
-          window_handle = browser_obj[:browser].driver.window_handles[idx]
-          state = :active if window_handle == current_window_handle
-
-          idx += 1
-
-          { index: window_handle, title: tab.title, url: tab.url, state: state }
-        end.compact
-
-        # Ensure we have a visible tab that's active
-        active_tab = tabs_arr_hash.find { |tab| tab[:state] == :active } || tabs_arr_hash.first
-        # Ensure we're back to the active tab
-        browser_obj[:browser].driver.switch_to.window(active_tab[:index])
-
-        tabs_arr_hash
-      rescue StandardError => e
-        raise e
-      end
-
       # Supported Method Parameters::
       # tab = PWN::Plugins::TransparentBrowser.jmp_tab(
       #   browser_obj: 'required - browser_obj returned from #open method)',

data/lib/pwn/reports/fuzz.rb

@@ -142,6 +142,7 @@ module PWN
                 var oldStart = 0;
                 var table = $('#pwn_fuzz_net_app_proto').DataTable( {
                   "paging": true,
+                  "lengthMenu": [10, 25, 50, 100, 250, 500, 1000, 2500, 5000],
                   "pagingType": "full_numbers",
                   "fnDrawCallback": function ( oSettings ) {
                     /* Need to redo the counters if filtered or sorted */

data/lib/pwn/reports/phone.rb

@@ -143,6 +143,7 @@ module PWN
                 var oldStart = 0;
                 var table = $('#pwn_phone_results').DataTable( {
                   "paging": true,
+                  "lengthMenu": [10, 25, 50, 100, 250, 500, 1000, 2500, 5000],
                   "pagingType": "full_numbers",
                   "fnDrawCallback": function ( oSettings ) {
                     /* Need to redo the counters if filtered or sorted */

data/lib/pwn/reports/sast.rb

@@ -134,6 +134,7 @@ module PWN
                 var oldStart = 0;
                 var table = $('#pwn_scan_git_source_results').DataTable( {
                   "paging": true,
+                  "lengthMenu": [10, 25, 50, 100, 250, 500, 1000, 2500, 5000],
                   "pagingType": "full_numbers",
                   "fnDrawCallback": function ( oSettings ) {
                     /* Need to redo the counters if filtered or sorted */

data/lib/pwn/reports/uri_buster.rb

@@ -134,6 +134,7 @@ module PWN
                 var oldStart = 0;
                 var table = $('#pwn_www_uri_buster_results').DataTable( {
                   "paging": true,
+                  "lengthMenu": [10, 25, 50, 100, 250, 500, 1000, 2500, 5000],
                   "pagingType": "full_numbers",
                   "fnDrawCallback": function ( oSettings ) {
                     /* Need to redo the counters if filtered or sorted */

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.316'
+  VERSION = '0.5.318'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.316
+  version: 0.5.318
 platform: ruby
 authors:
 - 0day Inc.
@@ -407,14 +407,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.12.2
+        version: 2.13.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.12.2
+        version: 2.13.0
 - !ruby/object:Gem::Dependency
   name: jsonpath
   requirement: !ruby/object:Gem::Requirement
@@ -687,14 +687,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.6.2
+        version: 0.6.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.6.2
+        version: 0.6.3
 - !ruby/object:Gem::Dependency
   name: packetfu
   requirement: !ruby/object:Gem::Requirement
@@ -1065,14 +1065,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.7.1
+        version: 1.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.7.1
+        version: 1.8.0
 - !ruby/object:Gem::Dependency
   name: spreadsheet
   requirement: !ruby/object:Gem::Requirement