pwn 0.5.321 → 0.5.323

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 349ddd1370a5b868db2bdae174401fb63b8ada6e60cd8b78c97cbe45a2c90176
-  data.tar.gz: 57ee03f785c621c45dc2447210dde1436ccc1a35058afc8b6bae14d0a4f69844
+  metadata.gz: 489d28655a398392c8563966dfe04887f65edf719b799a767e667b3b0851c033
+  data.tar.gz: 1d8e8e536b39b57b82570f87251111996e3882b1ca6f592381227fb09ebf0840
 SHA512:
-  metadata.gz: 2aa9651cc3d56c99fa1c95700c2ce682845329d95acb3eb3c7dfe783a2fd82f0a50bc49b7ef327a0d5adae021b8190a8d8cd84f652e80f5d2c3878ab87396658
-  data.tar.gz: 96e3d1cf3940d2ec27c35d6340f2201d30e8550607f95db2aa34793b7194f14fd3983caa7e382da29c6eb96a14ffa93ff43edff552d6edf463509280ca3be316
+  metadata.gz: c2bd7b7a743a9ceea59b67396389314d344cd7d93e04c32eacb33d6ad76b3c72e0f0981ebaa79170c99829f33e8decfa8dec959ede5d71d02afee658c72a2464
+  data.tar.gz: da8291ff61704bbd4e0073334817b2ec1bf82b0ec1bb36bdc9d3c3dad9861d3f2fdf195031369bd7545c5e3a304dba18a60ddf6b6610657baf4f188efb38c3b3

data/Gemfile

@@ -18,7 +18,7 @@ gem 'aws-sdk', '3.3.0'
 # gem 'bettercap', '1.6.2'
 gem 'barby', '0.7.0'
 gem 'base32', '0.3.4'
-gem 'brakeman', '7.0.2'
+gem 'brakeman', '7.1.0'
 gem 'bson', '5.1.1'
 gem 'bundler', '>=2.7.0'
 gem 'bundler-audit', '0.9.2'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.321]:001 >>> PWN.help
+pwn[v0.5.323]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.321]:001 >>> PWN.help
+pwn[v0.5.323]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.321]:001 >>> PWN.help
+pwn[v0.5.323]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/bin/pwn_burp_suite_pro_active_scan

@@ -30,6 +30,10 @@ OptionParser.new do |options|
     opts[:navigation_instruct] = i
   end
 
+  options.on('-iURL', '---in_scope=URL', '<Optional - URL to add include in scope (Defaults to value of --target_url)>') do |s|
+    opts[:in_scope] = s
+  end
+
   options.on('-cFILE', '--target-config=FILE', '<Optional - Path to Target Config JSON File>') do |c|
     opts[:target_config] = c
   end
@@ -51,6 +55,7 @@ begin
   navigation_instruct = opts[:navigation_instruct]
   raise 'Invalid path to browser instructions.  Please check your spelling and try again.' unless File.exist?(navigation_instruct)
 
+  in_scope = opts[:in_scope] ||= target_url
   target_config = opts[:target_config]
 
   # ------
@@ -88,6 +93,12 @@ begin
     browser.instance_eval(instruction.to_s.scrub.strip.chomp)
   end
 
+  # Add URL to Target >> Scope >> Inclue in scope
+  PWN::Plugins::BurpSuite.add_to_scope(
+    burp_obj: burp_obj,
+    target_url: in_scope
+  )
+
   duration = 9
   print "Waiting #{duration} seconds prior to kicking off active scan..."
   sleep duration # Sleep for now so everything loads the way we expect - blech.
@@ -107,7 +118,7 @@ begin
 
     PWN::Plugins::BurpSuite.generate_scan_report(
       burp_obj: burp_obj,
-      target_url: target_url,
+      target_url: in_scope,
       report_type: report_type,
       output_path: this_output_path
     )

data/lib/pwn/plugins/burp_suite.rb

@@ -9,6 +9,37 @@ module PWN
   module Plugins
     # This plugin was created to interact w/ Burp Suite Pro in headless mode to kick off spidering/live scanning
     module BurpSuite
+      # Supported Method Parameters::
+      # uri = PWN::Plugins::BurpSuite.format_uri_from_sitemap_resp(
+      #   scheme: 'required - scheme of the URI (http|https)',
+      #   host: 'required - host of the URI',
+      #   port: 'optional - port of the URI',
+      #   path: 'optional - path of the URI'
+      # )
+      private_class_method def self.format_uri_from_sitemap_resp(opts = {})
+        scheme = opts[:scheme]
+        raise 'ERROR: scheme parameter is required' if scheme.nil?
+
+        host = opts[:host]
+        raise 'ERROR: host parameter is required' if host.nil?
+
+        port = opts[:port]
+        path = opts[:path]
+
+        implicit_http_ports_arr = [
+          80,
+          443
+        ]
+
+        if implicit_http_ports_arr.include?(port)
+          uri = "#{scheme}://#{host}#{path}"
+        else
+          uri = "#{scheme}://#{host}:#{port}#{path}"
+        end
+      rescue StandardError => e
+        raise e
+      end
+
       # Supported Method Parameters::
       # burp_obj = PWN::Plugins::BurpSuite.start(
       #   burp_jar_path: 'options - path of burp suite pro jar file (defaults to /opt/burpsuite/burpsuite_pro.jar)',
@@ -166,6 +197,27 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # json_in_scope = PWN::Plugins::BurpSuite.add_to_scope(
+      #   burp_obj: 'required - burp_obj returned by #start method',
+      #   target_url: 'required - target url to add to scope'
+      # )
+
+      public_class_method def self.add_to_scope(opts = {})
+        burp_obj = opts[:burp_obj]
+        target_url = opts[:target_url]
+        rest_browser = burp_obj[:rest_browser]
+        burpbuddy_api = burp_obj[:burpbuddy_api]
+
+        post_body = { url: target_url }.to_json
+
+        in_scope = rest_browser.post("http://#{burpbuddy_api}/scope", post_body, content_type: 'application/json; charset=UTF8')
+        JSON.parse(in_scope)
+      rescue StandardError => e
+        stop(burp_obj: burp_obj) unless burp_obj.nil?
+        raise e
+      end
+
       # Supported Method Parameters::
       # active_scan_url_arr = PWN::Plugins::BurpSuite.invoke_active_scan(
       #   burp_obj: 'required - burp_obj returned by #start method',
@@ -178,7 +230,7 @@ module PWN
         burpbuddy_api = burp_obj[:burpbuddy_api]
         target_url = opts[:target_url].to_s.scrub.strip.chomp
         target_scheme = URI.parse(target_url).scheme
-        target_domain_name = URI.parse(target_url).host
+        target_host = URI.parse(target_url).host
         target_port = URI.parse(target_url).port.to_i
         if target_scheme == 'http'
           use_https = false
@@ -196,24 +248,25 @@ module PWN
           json_port = json_http_svc['port'].to_i
           json_path = json_req['path']
 
-          implicit_http_ports_arr = [
-            80,
-            443
-          ]
-
-          if implicit_http_ports_arr.include?(json_port)
-            json_uri = "#{json_protocol}://#{json_host}#{json_path}"
-          else
-            json_uri = "#{json_protocol}://#{json_host}:#{json_port}#{json_path}"
-          end
+          json_uri = format_uri_from_sitemap_resp(
+            scheme: json_protocol,
+            host: json_host,
+            port: json_port,
+            path: json_path
+          )
 
-          next unless json_host == target_domain_name && json_port == target_port
+          next unless json_host == target_host && json_port == target_port
 
           # More info on the BurpBuddy API can be found here:
           # https://github.com/tomsteele/burpbuddy/blob/master/src/main/kotlin/burp/API.kt
           puts "Adding #{json_uri} to Active Scan"
           active_scan_url_arr.push(json_uri)
-          post_body = "{ \"host\": \"#{json_host}\", \"port\": \"#{json_port}\", \"use_https\": #{use_https}, \"request\": \"#{json_req['raw']}\" }"
+          post_body = {
+            host: json_host,
+            port: json_port,
+            use_https: use_https,
+            request: json_req['raw']
+          }.to_json
           # Kick off an active scan for each given page in the json_sitemap results
           rest_browser.post("http://#{burpbuddy_api}/scan/active", post_body, content_type: 'application/json')
         end
@@ -285,28 +338,26 @@ module PWN
         host = URI.parse(target_url).host
         port = URI.parse(target_url).port
 
-        implicit_http_ports_arr = [
-          80,
-          443
-        ]
-
-        if implicit_http_ports_arr.include?(port)
-          target_domain = "#{scheme}://#{host}"
-        else
-          target_domain = "#{scheme}://#{host}:#{port}"
-        end
+        target_domain = format_uri_from_sitemap_resp(
+          scheme: scheme,
+          host: host,
+          port: port
+        )
 
         report_url = Base64.strict_encode64(target_domain)
         # Ready scanreport API call in burpbuddy to support HTML & XML report generation
+        # This is for the older burpbuddy-3.1.1-SNAPSHOT-all.jar
         report_resp = rest_browser.get(
           "http://#{burpbuddy_api}/scanreport/#{report_type.to_s.upcase}/#{report_url}"
         )
+        # This is for the older burpbuddy-3.1.0-SNAPSHOT-all.jar
         # report_resp = rest_browser.get(
         #   "http://#{burpbuddy_api}/scanreport/#{report_url}"
         # )
         File.open(output_path, 'w') do |f|
           f.puts(report_resp.body.gsub("\r\n", "\n"))
         end
+      rescue RestClient::Exceptions::NotFound
       rescue StandardError => e
         stop(burp_obj: burp_obj) unless burp_obj.nil?
         raise e

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.321'
+  VERSION = '0.5.323'
 end

data/packer/provisioners/burpsuite.sh

@@ -8,12 +8,13 @@ grok_error
 $screen_cmd "${apt} install -y libgconf-2-4 ${assess_update_errors}"
 grok_error
 
-curl --silent 'https://api.github.com/repos/tomsteele/burpbuddy/releases/latest' > /tmp/latest_burpbuddy.json
-latest_burpbuddy_jar=$(ruby -e "require 'json'; pp JSON.parse(File.read('/tmp/latest_burpbuddy.json'), symbolize_names: true)[:assets][0][:browser_download_url]")
-burpbuddy_jar_url=`echo ${latest_burpbuddy_jar} | sed 's/"//g'`
-wget $burpbuddy_jar_url -P /tmp/
+# curl --silent 'https://api.github.com/repos/tomsteele/burpbuddy/releases/latest' > /tmp/latest_burpbuddy.json
+# latest_burpbuddy_jar=$(ruby -e "require 'json'; pp JSON.parse(File.read('/tmp/latest_burpbuddy.json'), symbolize_names: true)[:assets][0][:browser_download_url]")
+# burpbuddy_jar_url=`echo ${latest_burpbuddy_jar} | sed 's/"//g'`
+# wget $burpbuddy_jar_url -P /tmp/
 burp_root="/opt/burpsuite"
-sudo /bin/bash --login -c "mkdir ${burp_root} && cp /tmp/burpbuddy*.jar ${burp_root} && rm /tmp/latest_burpbuddy.json && rm /tmp/burpbuddy*.jar"
+# sudo /bin/bash --login -c "mkdir ${burp_root} && cp /tmp/burpbuddy*.jar ${burp_root} && rm /tmp/latest_burpbuddy.json && rm /tmp/burpbuddy*.jar"
+sudo cp /opt/pwn/third-party/burpbuddy-3.1.1-SNAPSHOT.jar $burp_root/burpbuddy-3.1.1-SNAPSHOT.jar
 
 ls $burp_root/burpbuddy*.jar | while read bb_latest; do 
   sudo ln -s $bb_latest $burp_root/burpbuddy.jar 

data/third_party/pwn_rdoc.jsonl

@@ -500,7 +500,7 @@
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.get_scan_issues Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.get_scan_issues`: Supported Method Parameters\n\njson_scan_issues = PWN::Plugins::BurpSuite.get_scan_issues(\n\nburp_obj: 'required - burp_obj returned by #start method'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.help Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.invoke_active_scan Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.invoke_active_scan`: Supported Method Parameters\n\nactive_scan_url_arr = PWN::Plugins::BurpSuite.invoke_active_scan(\n\nburp_obj: 'required - burp_obj returned by #start method',\ntarget_url: 'required - target url to scan in sitemap (should be loaded & authenticated w/ burp_obj[:burp_browser])'\n\n)\n"}]}
-{"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.start Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.start`: Supported Method Parameters\n\nburp_obj = PWN::Plugins::BurpSuite.start(\n\nburp_jar_path: 'required - path of burp suite pro jar file',\nheadless: 'optional - run burp headless if set to true',\nbrowser_type: 'optional - defaults to :firefox. See PWN::Plugins::TransparentBrowser.help for a list of types',\ntarget_config: 'optional - path to burp suite pro target config JSON file'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.start Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.start`: Supported Method Parameters\n\nburp_obj = PWN::Plugins::BurpSuite.start(\n\nburp_jar_path: 'options - path of burp suite pro jar file (defaults to /opt/burpsuite/burpsuite_pro.jar)',\nheadless: 'optional - run burp headless if set to true',\nbrowser_type: 'optional - defaults to :firefox. See PWN::Plugins::TransparentBrowser.help for a list of types',\ntarget_config: 'optional - path to burp suite pro target config JSON file'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.stop Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.stop`: Supported Method Parameters\n\nPWN::Plugins::BurpSuite.stop(\n\nburp_obj: 'required - burp_obj returned by #start method'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.update_burp_jar Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.update_burp_jar`: Supported Method Parameters\n\nPWN::Plugins::BurpSuite.update_burp_jar( )\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::BurpSuite.uri_in_scope Usage"},{"role":"assistant","content":"`PWN::Plugins::BurpSuite.uri_in_scope`: Supported Method Parameters\n\nuri_in_scope_bool = PWN::Plugins::BurpSuite.uri_in_scope(\n\ntarget_config: 'required - path to burp suite pro target config JSON file',\nuri: 'required - URI to determine if in scope'\n\n)\n"}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.321
+  version: 0.5.323
 platform: ruby
 authors:
 - 0day Inc.
@@ -99,14 +99,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.2
+        version: 7.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.2
+        version: 7.1.0
 - !ruby/object:Gem::Dependency
   name: bson
   requirement: !ruby/object:Gem::Requirement