pwn 0.5.359 → 0.5.360

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 272efcde05f9647e0381816e4e0e93dc437e9f06741b7d2c1a49135c1b10a105
-  data.tar.gz: e8b8d514aeb2c1f06d5eb7d679977eba26c42fae836212b2f69f97601a8e6c17
+  metadata.gz: eeee337e9a2c5177f741508eb5eef6f451bc40226122d5c7c4715bdb90c500e3
+  data.tar.gz: d9b0ee1d04259d8178498ec800bb755c2197c4864ba016932e1d3a4515daf529
 SHA512:
-  metadata.gz: feebd177386f87be762943b99b4eecdd71dc5a9f15251d92ae13caf91addce8170f25f6e4fe29c38434cd28ba42182943ff5bcb73ba8f852fa6585176268decf
-  data.tar.gz: 411e7a14e69cb8440c624702c0f0aa3e0e594f46faa3e78af08b857340b064d6845fac7a98d07eef04a22f4f33ae0e8e5fddf25d462d20f54800daf7d1981748
+  metadata.gz: eecefbeebc5a8efd78c0d41bd54f86ad463ec2d988b08d8dbdd35d717964b261899aea17245c614f385eb2a696ad943d2d96b1d015dce69a09c56d15a6c7424b
+  data.tar.gz: 665a85e6cbb2179696c88872ebe3d9eac6b2e3ed58230106e9d8358e328d095f7e476208de43e61d7d83babff2f25678fa4aed9563d269e416de5f7e56a2ca65

data/.rubocop.yml

@@ -8,13 +8,13 @@ Lint/UselessRescue:
 Metrics/AbcSize:
   Max: 537.6
 Metrics/BlockLength:
-  Max: 200
+  Max: 220
 Metrics/BlockNesting:
   Max: 5
 Metrics/ClassLength:
   Max: 134
 Metrics/CyclomaticComplexity:
-  Max: 121
+  Max: 122
 Metrics/MethodLength:
   Max: 485
 Metrics/ModuleLength:

data/Gemfile

@@ -90,7 +90,7 @@ gem 'ruby-nmap', '1.0.3'
 gem 'ruby-saml', '1.18.1'
 gem 'rvm', '1.11.3.9'
 gem 'savon', '2.15.1'
-gem 'selenium-devtools', '0.138.0'
+gem 'selenium-devtools', '0.139.0'
 # gem 'serialport', '1.3.2'
 # gem 'sinatra', '4.0.0'
 gem 'slack-ruby-client', '2.7.0'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.359]:001 >>> PWN.help
+pwn[v0.5.360]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.359]:001 >>> PWN.help
+pwn[v0.5.360]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.359]:001 >>> PWN.help
+pwn[v0.5.360]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/burp_suite.rb

@@ -615,15 +615,15 @@ module PWN
                       # reference as keys, and assign their respective
                       # values to the request_headers hash
                       param_key = param_name.downcase
-                      param_value = param[:schema]&.dig(:example) || 'PLACEHOLDER'
+                      param_value = param[:schema]&.dig(:example) || 'FUZZ'
                       request_headers[param_key] = param_value.to_s
                     when 'path'
-                      # Substitute path parameter with a default value (e.g., 'PLACEHOLDER')
-                      param_value = param[:schema]&.dig(:example) || 'PLACEHOLDER'
+                      # Substitute path parameter with a default value (e.g., 'FUZZ')
+                      param_value = param[:schema]&.dig(:example) || 'FUZZ'
                       request_path.gsub!("{#{param_name}}", param_value.to_s)
                     when 'query'
                       # Collect query parameters
-                      param_value = param[:schema]&.dig(:example) || 'PLACEHOLDER'
+                      param_value = param[:schema]&.dig(:example) || 'FUZZ'
                       query_params.push("#{URI.encode_www_form_component(param_name)}=#{URI.encode_www_form_component(param_value.to_s)}")
                     end
                   end
@@ -648,8 +648,8 @@ module PWN
                   # Determine response code from operation[:responses].keys
                   fallback_response_code = 200
                   response_keys = operation[:responses].keys
-                  response_code = response_keys.find { |key| key.to_s.to_i.between?(100, 599) }.to_s.to_i
-                  response_code ||= fallback_response_code
+                  response_key = response_keys.find { |key| key.to_s.to_i.between?(100, 599) } || fallback_response_code.to_s
+                  response_code = response_key.to_s.to_i
 
                   response_status = case response_code
                                     when 200 then '200 OK'
@@ -672,17 +672,53 @@ module PWN
                                     else "#{fallback_response_code} OK"
                                     end
 
-                  # Construct response body
-                  response_body = operation[:responses][response_code]&.dig(:description) ||
-                                  "Endpoint #{method_str.upcase} #{request_path} response"
-
-                  # Safely determine Content-Type
-                  content_type = if operation[:responses][response_code]
-                                   content = operation[:responses][response_code][:content]
-                                   content&.keys&.first || 'text/plain'
-                                 else
-                                   'text/plain'
-                                 end
+                  # Construct response body from operation responses schema example, schema $ref example, etc.
+                  response_obj = operation[:responses][response_key] || {}
+                  content = response_obj[:content] || {}
+                  content_type = content.keys.first&.to_s || 'text/plain'
+
+                  response_body = ''
+                  unless [204, 304].include?(response_code)
+                    content_obj = content[content_type.to_sym] || {}
+                    example = content_obj[:example]
+                    if example.nil? && content_obj[:examples].is_a?(Hash)
+                      ex_key = content_obj[:examples].keys.first
+                      example = content_obj[:examples][ex_key][:value] if ex_key
+                    end
+
+                    if example.nil?
+                      schema = content_obj[:schema]
+                      if schema
+                        if schema[:$ref]
+                          ref = schema[:$ref]
+                          if ref.start_with?('#/')
+                            parts = ref.sub('#/', '').split('/')
+                            resolved = openapi
+                            parts.each do |part|
+                              resolved = resolved[part.to_sym]
+                              break unless resolved
+                            end
+                            schema = resolved if resolved
+                          end
+                        end
+
+                        example = schema[:example]
+                        if example.nil? && schema[:examples].is_a?(Hash)
+                          ex_key = schema[:examples].keys.first
+                          example = schema[:examples][ex_key][:value] if ex_key
+                        end
+                      end
+                    end
+
+                    response_body = example || response_obj[:description] || "INFO: Unable to resolve response body from #{openapi_spec} => { 'http_method': '#{method_str.upcase}', 'path': '#{request_path}', 'response_code': '#{response_code}' }"
+
+                    # Serialize based on content_type
+                    if content_type =~ /json/i && (response_body.is_a?(Hash) || response_body.is_a?(Array))
+                      response_body = JSON.generate(response_body)
+                    else
+                      response_body = response_body.to_s
+                    end
+                  end
 
                   response_lines = [
                     "HTTP/1.1 #{response_status}",

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.359'
+  VERSION = '0.5.360'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.359
+  version: 0.5.360
 platform: ruby
 authors:
 - 0day Inc.
@@ -1051,14 +1051,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.138.0
+        version: 0.139.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.138.0
+        version: 0.139.0
 - !ruby/object:Gem::Dependency
   name: slack-ruby-client
   requirement: !ruby/object:Gem::Requirement