pwn 0.5.350 → 0.5.352

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f5425aceb9565fc34697e038fbfa7297c71a1b7a7f023a01ffdaa2b1ab9df3b2
-  data.tar.gz: 97a017685b3cb4095bc2274d6d9b9b8f2348d3ea5da636699c1b6f3a7aedc36c
+  metadata.gz: 0ed1ecac3031877ce2727dca9ed321e834c8a864de719923106c0e4630f88f15
+  data.tar.gz: ca5dff2fb03d1600932cdc4fad2dafc8ee1f1a4712262306d0a04b52074f552f
 SHA512:
-  metadata.gz: d45eeed76fb031fbf8cd8beaa810d624a933c74ddafdb926a19f5933caa9fb382c6e77fdd2e5b22f1bc3dc317711d0924d94cd9ed499ffd205feeaa83acf6a2d
-  data.tar.gz: 6966744d6da5e6f3632f4b8a56557103d4d0d8bf525f4309d62d3c40d60730012d2a927da1cecd6ee2482462725e922e9519a3c5306e888e016cda57fa2c800a
+  metadata.gz: 5b923dc37f4f57041c2667c1bacf4f7b7cb763fdb0d2528faf647a09c8196793916c1734357f36d69b06afe5daa462103861aab0f81585868b2d10d4bf749a86
+  data.tar.gz: 9db9f36b6586bcc58f6f825cd6ef3d4484f981df1666985b9d110a683dd521dac24fd9d23ae86b6210f5d26a77467dfc247eb64a376fd582551c254d72715d61

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.350]:001 >>> PWN.help
+pwn[v0.5.352]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.350]:001 >>> PWN.help
+pwn[v0.5.352]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.350]:001 >>> PWN.help
+pwn[v0.5.352]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/burp_suite.rb

@@ -204,6 +204,7 @@ module PWN
             break
           end
         end
+        print "\n"
 
         spider_json.merge!(spider_status_json)
       rescue StandardError => e
@@ -340,7 +341,7 @@ module PWN
         openapi_spec = opts[:openapi_spec]
         raise 'ERROR: openapi_spec parameter not found' unless File.exist?(openapi_spec)
 
-        additional_http_headers = opts[:additional_http_headers] || {}
+        additional_http_headers = opts[:additional_http_headers] ||= {}
         raise 'ERROR: additional_http_headers must be a Hash' unless additional_http_headers.is_a?(Hash)
 
         highlight = opts[:highlight] ||= 'NONE'
@@ -494,7 +495,7 @@ module PWN
                   request_path = full_path.dup
                   query_params = []
 
-                  all_parameters.each do |param|
+                  operation.each do |param|
                     next unless param.is_a?(Hash) && param[:name] && param[:in]
 
                     param_name = param[:name].to_s
@@ -518,6 +519,16 @@ module PWN
                     host: host
                   }
                   request_headers.merge!(additional_http_headers)
+                  # Aggregate remaining HTTP header names from spec,
+                  # reference as keys, and assign their respective
+                  # values to the request_headers hash
+                  operation[:parameters]&.each do |param|
+                    next unless param.is_a?(Hash) && param[:in] == 'header' && param[:name]
+
+                    header_name = param[:name].to_s.downcase
+                    header_value = param[:schema]&.dig(:example) || 'PLACEHOLDER'
+                    request_headers[header_name] = header_value.to_s
+                  end
 
                   # Construct request lines, including all headers
                   request_lines = [
@@ -526,7 +537,7 @@ module PWN
                   request_headers.each do |key, value|
                     # Capitalize header keys (e.g., 'host' to 'Host', 'authorization' to 'Authorization')
                     header_key = key.to_s.split('-').map(&:capitalize).join('-')
-                    request_lines << "#{header_key}: #{value}"
+                    request_lines.push("#{header_key}: #{value}")
                   end
                   request_lines << '' << '' # Add blank lines for HTTP request body separation
 

data/lib/pwn/reports/sast.rb

@@ -78,8 +78,8 @@ module PWN
                 word-wrap: break-word !important;
               }
 
-              .highlighted {
-                background-color: #F2F5A9 !important;
+              tr.highlighted td {
+                background-color: #FFF396 !important;
               }
             </style>
 
@@ -98,7 +98,7 @@ module PWN
             </h1><br /><br />
             <h2 id="report_name"></h2><br />
 
-            <div><button type="button" id="button">Rows Selected</button></div><br />
+            <div><button type="button" id="button">Rows Selected</button> <button type="button" id="export_selected">Export Selected to JSON</button></div><br />
             <div>
               <b>Toggle Column(s):</b>&nbsp;
               <a class="toggle-vis" data-column="1" href="#">Timestamp</a>&nbsp;|&nbsp;
@@ -153,17 +153,6 @@ module PWN
                       $('html,body').animate({scrollTop: targetOffset}, 500);
                       oldStart = oSettings._iDisplayStart;
                     }
-                    // Select individual lines in a row
-                    $('#multi_line_select tbody').on('click', 'tr', function () {
-                      $(this).toggleClass('highlighted');
-                      if ($('#multi_line_select tr.highlighted').length > 0) {
-                        $('#multi_line_select tr td button').attr('disabled', 'disabled');
-                        // Remove multi-line bug button
-                      } else {
-                        $('#multi_line_select tr td button').removeAttr('disabled');
-                        // Add multi-line bug button
-                      }
-                    });
                   },
                   "ajax": "#{report_name}.json",
                   //"deferRender": true,
@@ -182,7 +171,7 @@ module PWN
                         var sast_module = data['sast_module'].split('::')[2];
                         var sast_test_case = sast_module.replace(/\\.?([A-Z])/g, function (x,y){ if (sast_module.match(/\\.?([A-Z][a-z])/g) ) { return "_" + y.toLowerCase(); } else { return y.toLowerCase(); } }).replace(/^_/g, "");
 
-                        return '<tr><td style="width:150px;" align="left"><a href="https://github.com/0dayinc/pwn/tree/master/lib/' + htmlEntityEncode(sast_dirname) + '/' + htmlEntityEncode(sast_test_case) + '.rb" target="_blank">' + htmlEntityEncode(data['sast_module'].split("::")[2]) + '</a><br /><br /><a href="' + htmlEntityEncode(data['nist_800_53_uri']) + '" target="_blank">NIST 800-53: ' + htmlEntityEncode(data['section'])  + '</a><br /><br /><a href="' + htmlEntityEncode(data['cwe_uri']) + '" target="_blank">CWE:' + htmlEntityEncode(data['cwe_id'])  + '</a></td></tr>';
+                        return '<table class="squish"><tr><td style="width:150px;" align="left"><a href="https://github.com/0dayinc/pwn/tree/master/lib/' + htmlEntityEncode(sast_dirname) + '/' + htmlEntityEncode(sast_test_case) + '.rb" target="_blank">' + htmlEntityEncode(data['sast_module'].split("::")[2]) + '</a><br /><br /><a href="' + htmlEntityEncode(data['nist_800_53_uri']) + '" target="_blank">NIST 800-53: ' + htmlEntityEncode(data['section'])  + '</a><br /><br /><a href="' + htmlEntityEncode(data['cwe_uri']) + '" target="_blank">CWE:' + htmlEntityEncode(data['cwe_id'])  + '</a></td></tr></table>';
                       }
                     },
                     {
@@ -194,13 +183,13 @@ module PWN
 
                         file = htmlEntityEncode(data['entry']);
 
-                        return '<table class="squish"><tr class="highlighted"><td style="width:150px;" align="left"><a href="' + line_entry_uri + '" target="_blank">' + file + '</a></td></tr></table>';
+                        return '<table class="squish"><tr><td style="width:150px;" align="left"><a href="' + line_entry_uri + '" target="_blank">' + file + '</a></td></tr></table>';
                       }
                     },
                     {
                       "data": "line_no_and_contents",
                       "render": function (data, type, row, meta) {
-                        var pwn_rows = '<td style="width: 669px"><table id="multi_line_select" class="display squish" style="width: 665px"><tbody>';
+                        var pwn_rows = '<table class="multi_line_select squish" style="width: 665px"><tbody>';
                         for (var i = 0; i < data.length; i++) {
                           var tr_class;
                           if (i % 2 == 0) { tr_class = "odd"; } else { tr_class = "even"; }
@@ -243,7 +232,7 @@ module PWN
 
                           pwn_rows = pwn_rows.concat('<tr class="' + tr_class + '"><td style="width:90px" align="left"><a href="' + htmlEntityEncode(to_line_number) + '" target="_blank">' + htmlEntityEncode(data[i]['line_no']) + '</a>:&nbsp;</td><td style="width:300px" align="left">' + htmlEntityEncode(data[i]['contents']) + '</td><td style="width:200px" align="right"><a href="mailto:' + canned_email + '">' + htmlEntityEncode(data[i]['author']) + '</a></td></tr>');
                         }
-                        pwn_rows = pwn_rows.concat('</tbody></table></td>');
+                        pwn_rows = pwn_rows.concat('</tbody></table>');
                         return pwn_rows;
                       }
                     },
@@ -255,7 +244,14 @@ module PWN
                       "data": "test_case_filter",
                       "render": $.fn.dataTable.render.text()
                     }
-                  ]
+                  ],
+                  "initComplete": function(settings, json) {
+                    $('#report_name').text(json.report_name);
+                  }
+                });
+
+                $('#pwn_scan_git_source_results tbody').on('click', '.multi_line_select tr', function () {
+                  $(this).toggleClass('highlighted');
                 });
 
                 // Custom advanced search handling
@@ -318,19 +314,72 @@ module PWN
                   column.visible( ! column.visible() );
                 });
 
-                // TODO: Open bug for highlighted rows ;)
                 $('#button').click( function () {
-                  alert($('#multi_line_select tr.highlighted').length +' row(s) highlighted');
+                  alert($('.multi_line_select tr.highlighted').length +' row(s) highlighted');
                 });
-              });
 
-              function multi_line_select() {
-                // Select all lines in a row
-                //$('#pwn_scan_git_source_results tbody').on('click', 'tr', function () {
-                //  $(this).children('td').children('#multi_line_select').children('tbody').children('tr').toggleClass('highlighted');
-                //});
+                $('#export_selected').click( function () {
+                  if ($('.multi_line_select tr.highlighted').length === 0) {
+                    alert('No rows selected');
+                    return;
+                  }
 
-              }
+                  $.getJSON(table.ajax.url(), function(original_json) {
+                    var selected_results = {};
+
+                    $('.multi_line_select tr.highlighted').each(function() {
+                      var inner_tr = $(this);
+                      var main_tr = inner_tr.closest('td').parent();
+                      var row = table.row(main_tr);
+                      var row_index = row.index();
+                      var line_index = inner_tr.index();
+
+                      if (selected_results[row_index] === undefined) {
+                        selected_results[row_index] = {
+                          row: row,
+                          lines: []
+                        };
+                      }
+
+                      selected_results[row_index].lines.push(line_index);
+                    });
+
+                    var new_data = [];
+
+                    Object.keys(selected_results).forEach(function(ri) {
+                      var sel = selected_results[ri];
+                      var orig_row_data = sel.row.data();
+                      var new_row_data = JSON.parse(JSON.stringify(orig_row_data));
+
+                      sel.lines.sort((a, b) => a - b);
+                      new_row_data.line_no_and_contents = sel.lines.map(function(li) {
+                        return orig_row_data.line_no_and_contents[li];
+                      });
+
+                      new_row_data.raw_content = new_row_data.line_no_and_contents.map(l => l.contents).join('\\n');
+
+                      new_data.push(new_row_data);
+                    });
+
+                    original_json.data = new_data;
+
+                    if (original_json.report_name) {
+                      original_json.report_name += '_selected';
+                    }
+
+                    var json_str = JSON.stringify(original_json, null, 2);
+                    var blob = new Blob([json_str], { type: 'application/json' });
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = (original_json.report_name || 'selected') + '.json';
+                    document.body.appendChild(a);
+                    a.click();
+                    document.body.removeChild(a);
+                    URL.revokeObjectURL(url);
+                  });
+                });
+              });
             </script>
           </body>
         </html>

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.350'
+  VERSION = '0.5.352'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.350
+  version: 0.5.352
 platform: ruby
 authors:
 - 0day Inc.