pwn 0.5.320 → 0.5.322

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3345d8d2650b34e2e1f18b2bb66d02fc9cbd24805bb115fb395b161c5a0133e7
-  data.tar.gz: a2dbe1818c8bba10dc03aec5d518191fc001d1803787c643e7a403853e9ff2bf
+  metadata.gz: 7eea62d63d5aca2a542137bc5e33843f932593cc739a672402c82011a34f0e12
+  data.tar.gz: b386f87050ccb4732458c054f682814ae773b2ac707b0416c066483cde789f84
 SHA512:
-  metadata.gz: dd4c499818137e8cfb71c8633199367cb33653b1bf284ef483f5ac5c2e75d4a5f43051072eaed10c90350a43b23ffab3941b300cdb544494aa6df4a81763ea14
-  data.tar.gz: c69355e3035a7d3833a12f1a3d0f4ea3c40420e53c3e000f0a6aa51889216933b190060aec48529d678b7790ee2d97ad937f79341ef13f562cabe74bc58a9952
+  metadata.gz: 643a5f55c8dcd1c636a60cbe5e6d3ce66a0764a86277f855329a025713271a85bdc94dc423ae5b97346b417ae628c30ff5c4df9310079005cd44fa3a195c6ca1
+  data.tar.gz: 5df64318d972e0e265b34047461484b179916c32e9e56034b301bb4077cb6792addb8161e1b25e39ca8a59471c36f6155d3a14bedb8276b972e1c449298656fc

data/Gemfile

@@ -18,7 +18,7 @@ gem 'aws-sdk', '3.3.0'
 # gem 'bettercap', '1.6.2'
 gem 'barby', '0.7.0'
 gem 'base32', '0.3.4'
-gem 'brakeman', '7.0.2'
+gem 'brakeman', '7.1.0'
 gem 'bson', '5.1.1'
 gem 'bundler', '>=2.7.0'
 gem 'bundler-audit', '0.9.2'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.320]:001 >>> PWN.help
+pwn[v0.5.322]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.320]:001 >>> PWN.help
+pwn[v0.5.322]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.320]:001 >>> PWN.help
+pwn[v0.5.322]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/bin/pwn_burp_suite_pro_active_scan

@@ -30,6 +30,10 @@ OptionParser.new do |options|
     opts[:navigation_instruct] = i
   end
 
+  options.on('-iURL', '---in_scope=URL', '<Optional - URL to add include in scope (Defaults to value of --target_url)>') do |s|
+    opts[:in_scope] = s
+  end
+
   options.on('-cFILE', '--target-config=FILE', '<Optional - Path to Target Config JSON File>') do |c|
     opts[:target_config] = c
   end
@@ -51,6 +55,7 @@ begin
   navigation_instruct = opts[:navigation_instruct]
   raise 'Invalid path to browser instructions.  Please check your spelling and try again.' unless File.exist?(navigation_instruct)
 
+  in_scope = opts[:in_scope] ||= target_url
   target_config = opts[:target_config]
 
   # ------
@@ -88,6 +93,12 @@ begin
     browser.instance_eval(instruction.to_s.scrub.strip.chomp)
   end
 
+  # Add URL to Target >> Scope >> Inclue in scope
+  PWN::Plugins::BurpSuite.add_to_scope(
+    burp_obj: burp_obj,
+    target_url: in_scope
+  )
+
   duration = 9
   print "Waiting #{duration} seconds prior to kicking off active scan..."
   sleep duration # Sleep for now so everything loads the way we expect - blech.
@@ -107,7 +118,7 @@ begin
 
     PWN::Plugins::BurpSuite.generate_scan_report(
       burp_obj: burp_obj,
-      target_url: target_url,
+      target_url: in_scope,
       report_type: report_type,
       output_path: this_output_path
     )

data/lib/pwn/plugins/burp_suite.rb

@@ -9,6 +9,37 @@ module PWN
   module Plugins
     # This plugin was created to interact w/ Burp Suite Pro in headless mode to kick off spidering/live scanning
     module BurpSuite
+      # Supported Method Parameters::
+      # uri = PWN::Plugins::BurpSuite.format_uri_from_sitemap_resp(
+      #   scheme: 'required - scheme of the URI (http|https)',
+      #   host: 'required - host of the URI',
+      #   port: 'optional - port of the URI',
+      #   path: 'optional - path of the URI'
+      # )
+      private_class_method def self.format_uri_from_sitemap_resp(opts = {})
+        scheme = opts[:scheme]
+        raise 'ERROR: scheme parameter is required' if scheme.nil?
+
+        host = opts[:host]
+        raise 'ERROR: host parameter is required' if host.nil?
+
+        port = opts[:port]
+        path = opts[:path]
+
+        implicit_http_ports_arr = [
+          80,
+          443
+        ]
+
+        if implicit_http_ports_arr.include?(port)
+          uri = "#{scheme}://#{host}#{path}"
+        else
+          uri = "#{scheme}://#{host}:#{port}#{path}"
+        end
+      rescue StandardError => e
+        raise e
+      end
+
       # Supported Method Parameters::
       # burp_obj = PWN::Plugins::BurpSuite.start(
       #   burp_jar_path: 'options - path of burp suite pro jar file (defaults to /opt/burpsuite/burpsuite_pro.jar)',
@@ -166,6 +197,27 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # json_in_scope = PWN::Plugins::BurpSuite.add_to_scope(
+      #   burp_obj: 'required - burp_obj returned by #start method',
+      #   target_url: 'required - target url to add to scope'
+      # )
+
+      public_class_method def self.add_to_scope(opts = {})
+        burp_obj = opts[:burp_obj]
+        target_url = opts[:target_url]
+        rest_browser = burp_obj[:rest_browser]
+        burpbuddy_api = burp_obj[:burpbuddy_api]
+
+        post_body = { url: target_url }.to_json
+
+        in_scope = rest_browser.post("http://#{burpbuddy_api}/scope", post_body, content_type: 'application/json; charset=UTF8')
+        JSON.parse(in_scope)
+      rescue StandardError => e
+        stop(burp_obj: burp_obj) unless burp_obj.nil?
+        raise e
+      end
+
       # Supported Method Parameters::
       # active_scan_url_arr = PWN::Plugins::BurpSuite.invoke_active_scan(
       #   burp_obj: 'required - burp_obj returned by #start method',
@@ -178,7 +230,7 @@ module PWN
         burpbuddy_api = burp_obj[:burpbuddy_api]
         target_url = opts[:target_url].to_s.scrub.strip.chomp
         target_scheme = URI.parse(target_url).scheme
-        target_domain_name = URI.parse(target_url).host
+        target_host = URI.parse(target_url).host
         target_port = URI.parse(target_url).port.to_i
         if target_scheme == 'http'
           use_https = false
@@ -196,23 +248,25 @@ module PWN
           json_port = json_http_svc['port'].to_i
           json_path = json_req['path']
 
-          implicit_http_ports_arr = [
-            80,
-            443
-          ]
-
-          if implicit_http_ports_arr.include?(json_port)
-            json_uri = "#{json_protocol}://#{json_host}#{json_path}"
-          else
-            json_uri = "#{json_protocol}://#{json_host}:#{json_port}#{json_path}"
-          end
+          json_uri = format_uri_from_sitemap_resp(
+            scheme: json_protocol,
+            host: json_host,
+            port: json_port,
+            path: json_path
+          )
 
-          next unless json_host == target_domain_name && json_port == target_port
+          next unless json_host == target_host && json_port == target_port
 
+          # More info on the BurpBuddy API can be found here:
+          # https://github.com/tomsteele/burpbuddy/blob/master/src/main/kotlin/burp/API.kt
           puts "Adding #{json_uri} to Active Scan"
           active_scan_url_arr.push(json_uri)
-          # post_body = "{ \"host\": \"#{json_host}\", \"port\": \"#{json_port}\", \"useHttps\": #{use_https}, \"request\": \"#{json_req['raw']}\" }"
-          post_body = "{ \"host\": \"#{json_host}\", \"port\": \"#{json_port}\", \"useHttps\": \"#{use_https}\", \"request\": \"#{json_req['raw']}\" }"
+          post_body = {
+            host: json_host,
+            port: json_port,
+            use_https: use_https,
+            request: json_req['raw']
+          }.to_json
           # Kick off an active scan for each given page in the json_sitemap results
           rest_browser.post("http://#{burpbuddy_api}/scan/active", post_body, content_type: 'application/json')
         end
@@ -284,25 +338,20 @@ module PWN
         host = URI.parse(target_url).host
         port = URI.parse(target_url).port
 
-        implicit_http_ports_arr = [
-          80,
-          443
-        ]
-
-        if implicit_http_ports_arr.include?(port)
-          target_domain = "#{scheme}://#{host}"
-        else
-          target_domain = "#{scheme}://#{host}:#{port}"
-        end
+        target_domain = format_uri_from_sitemap_resp(
+          scheme: scheme,
+          host: host,
+          port: port
+        )
 
         report_url = Base64.strict_encode64(target_domain)
         # Ready scanreport API call in burpbuddy to support HTML & XML report generation
-        report_resp = rest_browser.get(
-          "http://#{burpbuddy_api}/scanreport/#{report_type.to_s.upcase}/#{report_url}"
-        )
         # report_resp = rest_browser.get(
-        #   "http://#{burpbuddy_api}/scanreport/#{report_url}"
+        #   "http://#{burpbuddy_api}/scanreport/#{report_type.to_s.upcase}/#{report_url}"
         # )
+        report_resp = rest_browser.get(
+          "http://#{burpbuddy_api}/scanreport/#{report_url}"
+        )
         File.open(output_path, 'w') do |f|
           f.puts(report_resp.body.gsub("\r\n", "\n"))
         end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.320'
+  VERSION = '0.5.322'
 end

data/third_party/pwn_rdoc.jsonl

@@ -500,7 +500,7 @@
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.get_scan_issues Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.get_scan_issues`: Supported Method Parameters\n\njson_scan_issues = PWN::Plugins::BurpSuite.get_scan_issues(\n\nburp_obj: 'required - burp_obj returned by #start method'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.help Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.invoke_active_scan Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.invoke_active_scan`: Supported Method Parameters\n\nactive_scan_url_arr = PWN::Plugins::BurpSuite.invoke_active_scan(\n\nburp_obj: 'required - burp_obj returned by #start method',\ntarget_url: 'required - target url to scan in sitemap (should be loaded & authenticated w/ burp_obj[:burp_browser])'\n\n)\n"}]}
-{"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.start Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.start`: Supported Method Parameters\n\nburp_obj = PWN::Plugins::BurpSuite.start(\n\nburp_jar_path: 'required - path of burp suite pro jar file',\nheadless: 'optional - run burp headless if set to true',\nbrowser_type: 'optional - defaults to :firefox. See PWN::Plugins::TransparentBrowser.help for a list of types',\ntarget_config: 'optional - path to burp suite pro target config JSON file'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.start Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.start`: Supported Method Parameters\n\nburp_obj = PWN::Plugins::BurpSuite.start(\n\nburp_jar_path: 'options - path of burp suite pro jar file (defaults to /opt/burpsuite/burpsuite_pro.jar)',\nheadless: 'optional - run burp headless if set to true',\nbrowser_type: 'optional - defaults to :firefox. See PWN::Plugins::TransparentBrowser.help for a list of types',\ntarget_config: 'optional - path to burp suite pro target config JSON file'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.stop Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.stop`: Supported Method Parameters\n\nPWN::Plugins::BurpSuite.stop(\n\nburp_obj: 'required - burp_obj returned by #start method'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.update_burp_jar Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.update_burp_jar`: Supported Method Parameters\n\nPWN::Plugins::BurpSuite.update_burp_jar( )\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.uri_in_scope Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.uri_in_scope`: Supported Method Parameters\n\nuri_in_scope_bool = PWN::Plugins::BurpSuite.uri_in_scope(\n\ntarget_config: 'required - path to burp suite pro target config JSON file',\nuri: 'required - URI to determine if in scope'\n\n)\n"}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.320
+  version: 0.5.322
 platform: ruby
 authors:
 - 0day Inc.
@@ -99,14 +99,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.2
+        version: 7.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.2
+        version: 7.1.0
 - !ruby/object:Gem::Dependency
   name: bson
   requirement: !ruby/object:Gem::Requirement