pwn 0.5.351 → 0.5.353

data/lib/pwn/reports/sast.rb

@@ -78,8 +78,8 @@ module PWN
                 word-wrap: break-word !important;
               }
 
-              .highlighted {
-                background-color: #F2F5A9 !important;
+              tr.highlighted td {
+                background-color: #FFF396 !important;
               }
             </style>
 
@@ -98,7 +98,11 @@ module PWN
             </h1><br /><br />
             <h2 id="report_name"></h2><br />
 
-            <div><button type="button" id="button">Rows Selected</button></div><br />
+            <div>
+              <!--<button type="button" id="button">Rows Selected</button>-->
+              <button type="button" id="export_selected">Export Selected to JSON</button>
+            </div><br />
+
             <div>
               <b>Toggle Column(s):</b>&nbsp;
               <a class="toggle-vis" data-column="1" href="#">Timestamp</a>&nbsp;|&nbsp;
@@ -127,12 +131,20 @@ module PWN
                     <th>Test Case (Anti-Pattern) Filter</th>
                   </tr>
                 </thead>
+                <col width="30px" />
+                <col width="60px" />
+                <col width="300px" />
+                <col width="90px" />
+                <col width="90px" />
+                <col width="300px" />
+                <col width="90px" />
                 <!-- DataTables <tbody> -->
               </table>
             </div>
 
             <script>
               var htmlEntityEncode = $.fn.dataTable.render.text().display;
+
               var line_entry_uri = "";
               $(document).ready(function() {
                 var oldStart = 0;
@@ -153,17 +165,6 @@ module PWN
                       $('html,body').animate({scrollTop: targetOffset}, 500);
                       oldStart = oSettings._iDisplayStart;
                     }
-                    // Select individual lines in a row
-                    $('#multi_line_select tbody').on('click', 'tr', function () {
-                      $(this).toggleClass('highlighted');
-                      if ($('#multi_line_select tr.highlighted').length > 0) {
-                        $('#multi_line_select tr td button').attr('disabled', 'disabled');
-                        // Remove multi-line bug button
-                      } else {
-                        $('#multi_line_select tr td button').removeAttr('disabled');
-                        // Add multi-line bug button
-                      }
-                    });
                   },
                   "ajax": "#{report_name}.json",
                   //"deferRender": true,
@@ -182,7 +183,7 @@ module PWN
                         var sast_module = data['sast_module'].split('::')[2];
                         var sast_test_case = sast_module.replace(/\\.?([A-Z])/g, function (x,y){ if (sast_module.match(/\\.?([A-Z][a-z])/g) ) { return "_" + y.toLowerCase(); } else { return y.toLowerCase(); } }).replace(/^_/g, "");
 
-                        return '<tr><td style="width:150px;" align="left"><a href="https://github.com/0dayinc/pwn/tree/master/lib/' + htmlEntityEncode(sast_dirname) + '/' + htmlEntityEncode(sast_test_case) + '.rb" target="_blank">' + htmlEntityEncode(data['sast_module'].split("::")[2]) + '</a><br /><br /><a href="' + htmlEntityEncode(data['nist_800_53_uri']) + '" target="_blank">NIST 800-53: ' + htmlEntityEncode(data['section'])  + '</a><br /><br /><a href="' + htmlEntityEncode(data['cwe_uri']) + '" target="_blank">CWE:' + htmlEntityEncode(data['cwe_id'])  + '</a></td></tr>';
+                        return '<table class="squish"><tr><td style="width:150px;" align="left"><a href="https://github.com/0dayinc/pwn/tree/master/lib/' + htmlEntityEncode(sast_dirname) + '/' + htmlEntityEncode(sast_test_case) + '.rb" target="_blank">' + htmlEntityEncode(data['sast_module'].split("::")[2]) + '</a><br /><br /><a href="' + htmlEntityEncode(data['nist_800_53_uri']) + '" target="_blank">NIST 800-53: ' + htmlEntityEncode(data['section'])  + '</a><br /><br /><a href="' + htmlEntityEncode(data['cwe_uri']) + '" target="_blank">CWE:' + htmlEntityEncode(data['cwe_id'])  + '</a></td></tr></table>';
                       }
                     },
                     {
@@ -194,30 +195,19 @@ module PWN
 
                         file = htmlEntityEncode(data['entry']);
 
-                        return '<table class="squish"><tr class="highlighted"><td style="width:150px;" align="left"><a href="' + line_entry_uri + '" target="_blank">' + file + '</a></td></tr></table>';
+                        return '<table class="squish"><tr><td style="width:150px;" align="left"><a href="' + line_entry_uri + '" target="_blank">' + file + '</a></td></tr></table>';
                       }
                     },
                     {
                       "data": "line_no_and_contents",
                       "render": function (data, type, row, meta) {
-                        var pwn_rows = '<td style="width: 669px"><table id="multi_line_select" class="display squish" style="width: 665px"><tbody>';
+                        var pwn_rows = '<table class="multi_line_select squish" style="width: 665px"><tbody>';
                         for (var i = 0; i < data.length; i++) {
                           var tr_class;
                           if (i % 2 == 0) { tr_class = "odd"; } else { tr_class = "even"; }
 
                           var filename_link = row.filename;
 
-                          var bug_comment = 'Timestamp: ' + row.timestamp + '\\n' +
-                                            'Test Case: http://' + window.location.hostname + ':8808/doc_root/pwn-0.1.0/' +
-                                              row.security_references['sast_module'].replace(/::/g, "/") + '\\n' +
-                                            'Source Code Impacted: ' + $("<div/>").html(filename_link).text() + '\\n\\n' +
-                                            'Test Case Request:\\n' +
-                                            $("<div/>").html(row.test_case_filter.replace(/\\s{2,}/g, " ")).text() + '\\n\\n' +
-                                            'Test Case Response:\\n' +
-                                            '\\tCommitted by: ' + $("<div/>").html(data[i]['author']).text() + '\\t' +
-                                              data[i]['line_no'] + ': ' +
-                                              $("<div/>").html(data[i]['contents'].replace(/\\s{2,}/g, " ")).text() + '\\n\\n';
-
                           var author_and_email_arr = data[i]['author'].split(" ");
                           var email = author_and_email_arr[author_and_email_arr.length - 1];
                           var email_user_arr = email.split("@");
@@ -225,13 +215,13 @@ module PWN
 
                           var uri = '#uri';
 
-                         var canned_email_results = 'Timestamp: ' + row.timestamp + '\\n' +
-                                                    'Source Code File Impacted: ' + $("<div/>").html(filename_link).text() + '\\n\\n' +
-                                                    'Source Code in Question:\\n\\n' +
-                                                    data[i]['line_no'] + ': ' +
-                                                    $("<div/>").html(data[i]['contents'].replace(/\\s{2,}/g, " ")).text() + '\\n\\n';
+                          var canned_email_results = 'Timestamp: ' + row.timestamp + '\\n' +
+                                                     'Source Code File Impacted: ' + $("<div/>").html(filename_link).text() + '\\n\\n' +
+                                                     'Source Code in Question:\\n\\n' +
+                                                     data[i]['line_no'] + ': ' +
+                                                     $("<div/>").html(data[i]['contents'].replace(/\\s{2,}/g, " ")).text() + '\\n\\n';
 
-                         var canned_email = email.replace("&lt;", "").replace("&gt;", "") + '?subject=Potential%20Bug%20within%20Source%20File:%20'+ encodeURIComponent(row.filename) +'&body=Greetings,%0A%0AThe%20following%20information%20likely%20represents%20a%20bug%20discovered%20through%20automated%20security%20testing%20initiatives:%0A%0A' + encodeURIComponent(canned_email_results) + 'Is%20this%20something%20that%20can%20be%20addressed%20immediately%20or%20would%20filing%20a%20bug%20be%20more%20appropriate?%20%20Please%20let%20us%20know%20at%20your%20earliest%20convenience%20to%20ensure%20we%20can%20meet%20security%20expectations%20for%20this%20release.%20%20Thanks%20and%20have%20a%20great%20day!';
+                          var canned_email = email.replace("&lt;", "").replace("&gt;", "") + '?subject=Potential%20Bug%20within%20Source%20File:%20'+ encodeURIComponent(row.filename) +'&body=Greetings,%0A%0AThe%20following%20information%20likely%20represents%20a%20bug%20discovered%20through%20automated%20security%20testing%20initiatives:%0A%0A' + encodeURIComponent(canned_email_results) + 'Is%20this%20something%20that%20can%20be%20addressed%20immediately%20or%20would%20filing%20a%20bug%20be%20more%20appropriate?%20%20Please%20let%20us%20know%20at%20your%20earliest%20convenience%20to%20ensure%20we%20can%20meet%20security%20expectations%20for%20this%20release.%20%20Thanks%20and%20have%20a%20great%20day!';
 
                           domain = line_entry_uri.replace('http://','').replace('https://','').split(/[/?#]/)[0];
                           if (domain.includes('stash') || domain.includes('bitbucket') || domain.includes('gerrit')) {
@@ -243,7 +233,7 @@ module PWN
 
                           pwn_rows = pwn_rows.concat('<tr class="' + tr_class + '"><td style="width:90px" align="left"><a href="' + htmlEntityEncode(to_line_number) + '" target="_blank">' + htmlEntityEncode(data[i]['line_no']) + '</a>:&nbsp;</td><td style="width:300px" align="left">' + htmlEntityEncode(data[i]['contents']) + '</td><td style="width:200px" align="right"><a href="mailto:' + canned_email + '">' + htmlEntityEncode(data[i]['author']) + '</a></td></tr>');
                         }
-                        pwn_rows = pwn_rows.concat('</tbody></table></td>');
+                        pwn_rows = pwn_rows.concat('</tbody></table>');
                         return pwn_rows;
                       }
                     },
@@ -255,7 +245,14 @@ module PWN
                       "data": "test_case_filter",
                       "render": $.fn.dataTable.render.text()
                     }
-                  ]
+                  ],
+                  "initComplete": function(settings, json) {
+                    $('#report_name').text(json.report_name);
+                  }
+                });
+
+                $('#pwn_scan_git_source_results tbody').on('click', '.multi_line_select tr', function () {
+                  $(this).toggleClass('highlighted');
                 });
 
                 // Custom advanced search handling
@@ -318,19 +315,72 @@ module PWN
                   column.visible( ! column.visible() );
                 });
 
-                // TODO: Open bug for highlighted rows ;)
                 $('#button').click( function () {
-                  alert($('#multi_line_select tr.highlighted').length +' row(s) highlighted');
+                  alert($('.multi_line_select tr.highlighted').length +' row(s) highlighted');
                 });
-              });
 
-              function multi_line_select() {
-                // Select all lines in a row
-                //$('#pwn_scan_git_source_results tbody').on('click', 'tr', function () {
-                //  $(this).children('td').children('#multi_line_select').children('tbody').children('tr').toggleClass('highlighted');
-                //});
+                $('#export_selected').click( function () {
+                  if ($('.multi_line_select tr.highlighted').length === 0) {
+                    alert('No rows selected');
+                    return;
+                  }
 
-              }
+                  $.getJSON(table.ajax.url(), function(original_json) {
+                    var selected_results = {};
+
+                    $('.multi_line_select tr.highlighted').each(function() {
+                      var inner_tr = $(this);
+                      var main_tr = inner_tr.closest('td').parent();
+                      var row = table.row(main_tr);
+                      var row_index = row.index();
+                      var line_index = inner_tr.index();
+
+                      if (selected_results[row_index] === undefined) {
+                        selected_results[row_index] = {
+                          row: row,
+                          lines: []
+                        };
+                      }
+
+                      selected_results[row_index].lines.push(line_index);
+                    });
+
+                    var new_data = [];
+
+                    Object.keys(selected_results).forEach(function(ri) {
+                      var sel = selected_results[ri];
+                      var orig_row_data = sel.row.data();
+                      var new_row_data = JSON.parse(JSON.stringify(orig_row_data));
+
+                      sel.lines.sort((a, b) => a - b);
+                      new_row_data.line_no_and_contents = sel.lines.map(function(li) {
+                        return orig_row_data.line_no_and_contents[li];
+                      });
+
+                      new_row_data.raw_content = new_row_data.line_no_and_contents.map(l => l.contents).join('\\n');
+
+                      new_data.push(new_row_data);
+                    });
+
+                    original_json.data = new_data;
+
+                    if (original_json.report_name) {
+                      original_json.report_name += '_selected';
+                    }
+
+                    var json_str = JSON.stringify(original_json, null, 2);
+                    var blob = new Blob([json_str], { type: 'application/json' });
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = (original_json.report_name || 'selected') + '.json';
+                    document.body.appendChild(a);
+                    a.click();
+                    document.body.removeChild(a);
+                    URL.revokeObjectURL(url);
+                  });
+                });
+              });
             </script>
           </body>
         </html>

data/lib/pwn/reports/uri_buster.rb

@@ -71,8 +71,8 @@ module PWN
                 word-wrap: break-word !important;
               }
 
-              .highlighted {
-                background-color: #F2F5A9 !important;
+              tr.highlighted td {
+                background-color: #FFF396 !important;
               }
             </style>
 
@@ -92,7 +92,11 @@ module PWN
             </h1><br /><br />
             <h2 id="report_name"></h2><br />
 
-            <div><button type="button" id="button">Rows Selected</button></div><br />
+            <div>
+              <!--<button type="button" id="button">Rows Selected</button>-->
+              <button type="button" id="export_selected">Export Selected to JSON</button>
+            </div><br />
+
             <div>
               <b>Toggle Column(s):</b>&nbsp;
               <a class="toggle-vis" data-column="1" href="#">Request Time</a>&nbsp;|&nbsp;
@@ -127,6 +131,16 @@ module PWN
                     <th>HTTP Response Body (300 bytes)</th>
                   </tr>
                 </thead>
+                <col width="30px" />
+                <col width="60px" />
+                <col width="60px" />
+                <col width="30px" />
+                <col width="90px" />
+                <col width="30px" />
+                <col width="30px" />
+                <col width="30px" />
+                <col width="300px" />
+                <col width="300px" />
                 <!-- DataTables <tbody> -->
               </table>
             </div>
@@ -153,17 +167,6 @@ module PWN
                       $('html,body').animate({scrollTop: targetOffset}, 500);
                       oldStart = oSettings._iDisplayStart;
                     }
-                    // Select individual lines in a row
-                    $('#multi_line_select tbody').on('click', 'tr', function () {
-                      $(this).toggleClass('highlighted');
-                      if ($('#multi_line_select tr.highlighted').length > 0) {
-                        $('#multi_line_select tr td button').attr('disabled', 'disabled');
-                        // Remove multi-line bug button
-                      } else {
-                        $('#multi_line_select tr td button').removeAttr('disabled');
-                        // Add multi-line bug button
-                      }
-                    });
                   },
                   "ajax": "#{report_name}.json",
                   //"deferRender": true,
@@ -272,19 +275,72 @@ module PWN
                   column.visible( ! column.visible() );
                 });
 
-                // TODO: Open bug for highlighted rows ;)
                 $('#button').click( function () {
-                  alert($('#multi_line_select tr.highlighted').length +' row(s) highlighted');
+                  alert($('.multi_line_select tr.highlighted').length +' row(s) highlighted');
                 });
-              });
 
-              function multi_line_select() {
-                // Select all lines in a row
-                //$('#pwn_www_uri_buster_results tbody').on('click', 'tr', function () {
-                //  $(this).children('td').children('#multi_line_select').children('tbody').children('tr').toggleClass('highlighted');
-                //});
+                $('#export_selected').click( function () {
+                  if ($('.multi_line_select tr.highlighted').length === 0) {
+                    alert('No rows selected');
+                    return;
+                  }
 
-              }
+                  $.getJSON(table.ajax.url(), function(original_json) {
+                    var selected_results = {};
+
+                    $('.multi_line_select tr.highlighted').each(function() {
+                      var inner_tr = $(this);
+                      var main_tr = inner_tr.closest('td').parent();
+                      var row = table.row(main_tr);
+                      var row_index = row.index();
+                      var line_index = inner_tr.index();
+
+                      if (selected_results[row_index] === undefined) {
+                        selected_results[row_index] = {
+                          row: row,
+                          lines: []
+                        };
+                      }
+
+                      selected_results[row_index].lines.push(line_index);
+                    });
+
+                    var new_data = [];
+
+                    Object.keys(selected_results).forEach(function(ri) {
+                      var sel = selected_results[ri];
+                      var orig_row_data = sel.row.data();
+                      var new_row_data = JSON.parse(JSON.stringify(orig_row_data));
+
+                      sel.lines.sort((a, b) => a - b);
+                      new_row_data.line_no_and_contents = sel.lines.map(function(li) {
+                        return orig_row_data.line_no_and_contents[li];
+                      });
+
+                      new_row_data.raw_content = new_row_data.line_no_and_contents.map(l => l.contents).join('\\n');
+
+                      new_data.push(new_row_data);
+                    });
+
+                    original_json.data = new_data;
+
+                    if (original_json.report_name) {
+                      original_json.report_name += '_selected';
+                    }
+
+                    var json_str = JSON.stringify(original_json, null, 2);
+                    var blob = new Blob([json_str], { type: 'application/json' });
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = (original_json.report_name || 'selected') + '.json';
+                    document.body.appendChild(a);
+                    a.click();
+                    document.body.removeChild(a);
+                    URL.revokeObjectURL(url);
+                  });
+                });
+              });
             </script>
           </body>
         </html>

data/lib/pwn/sast/amqp_connect_as_guest.rb

@@ -28,7 +28,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -36,7 +36,7 @@ module PWN
             test_case_filter = "
               grep -in \
               -e amqp \
-              -e rabbit #{entry} | \
+              -e rabbit #{entry} 2> /dev/null | \
               grep guest
             "
 

data/lib/pwn/sast/apache_file_system_util_api.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -35,7 +35,7 @@ module PWN
             test_case_filter = "
               grep -n \
               -e 'import org.apache.commons.io.FileSystemUtils' \
-              -e 'freeSpaceKb' #{entry}
+              -e 'freeSpaceKb' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/aws.rb

@@ -26,7 +26,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -36,7 +36,7 @@ module PWN
               -e 'ec2-' \
               -e 'access.key' \
               -e 'secret.access' \
-              -e 'secret.key' #{entry}
+              -e 'secret.key' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/banned_function_calls_c.rb

@@ -28,7 +28,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -163,7 +163,7 @@ module PWN
               -e 'memcpy' \
               -e 'RtlCopyMemory' \
               -e 'CopyMemory' \
-              -e 'wmemcpy' #{entry}
+              -e 'wmemcpy' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/base64.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -35,7 +35,7 @@ module PWN
             # TODO: Include regex to search for Base64 strings
             test_case_filter = "
               grep -Ein \
-              -e 'BASE64' #{entry}
+              -e 'BASE64' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/beef_hook.rb

@@ -27,14 +27,14 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
 
             test_case_filter = "
               grep -Fin \
-              -e 'hook.js' #{entry}
+              -e 'hook.js' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/cmd_execution_java.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -36,7 +36,7 @@ module PWN
               grep -Fn \
               -e 'getEngineByName(' \
               -e 'ProcessBuilder(' \
-              -e '.exec(' #{entry}
+              -e '.exec(' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/cmd_execution_python.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -38,7 +38,7 @@ module PWN
               -e 'os.popen' \
               -e 'os.system' \
               -e 'subprocess.call' \
-              -e 'subprocess.Popen' #{entry}
+              -e 'subprocess.Popen' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/cmd_execution_ruby.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -46,7 +46,7 @@ module PWN
               -e 'Facter::Util::Resolution::exec' \
               -e 'PTY.spawn' \
               -e 'Process.fork' \
-              -e '%x' #{entry}
+              -e '%x' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/cmd_execution_scala.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -36,7 +36,7 @@ module PWN
               grep -Fn \
               -e 'Process(' \
               -e '.!' \
-              -e '.!!' #{entry}
+              -e '.!!' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/csrf.rb

@@ -28,14 +28,14 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
 
             test_case_filter = "
               grep -ni \
-              -e 'csrf' #{entry}
+              -e 'csrf' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/deserial_java.rb

@@ -29,7 +29,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -43,7 +43,7 @@ module PWN
               -e readResolve \
               -e readExternal \
               -e readUnshared \
-              -e Serializable #{entry}
+              -e Serializable #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/emoticon.rb

@@ -27,7 +27,7 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
@@ -41,7 +41,7 @@ module PWN
               -e '\_o_/' \
               -e '\_O_/' \
               -e '\_0_/' \
-              -e ':-O' #{entry}
+              -e ':-O' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub

data/lib/pwn/sast/eval.rb

@@ -28,14 +28,14 @@ module PWN
             entry_beautified = false
 
             if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED`.to_s.scrub
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
               entry = "#{entry}.JS-BEAUTIFIED"
               entry_beautified = true
             end
 
             test_case_filter = "
               grep -n \
-              -e 'eval(' #{entry}
+              -e 'eval(' #{entry} 2> /dev/null
             "
 
             str = `#{test_case_filter}`.to_s.scrub