pwn 0.5.372 → 0.5.373

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30f6af2864825daf73f441f4514d403f6ec8285c1aca533f12478897d311517d
-  data.tar.gz: d403f602bcf9dfc75d57d11cc96ab5a9fffc8cda9fcf81ef0dbc557c3a355ea1
+  metadata.gz: 1d53fa832e82071124a716c089d39ecff41d53ea434454c38f26091a2f20e0c0
+  data.tar.gz: 48c9ab88c5b07a6ff83b7f8e6f4598181fc1fd779ae517a034b0c29a85d9700b
 SHA512:
-  metadata.gz: 28741ba677e71a721874d623f6876e3ea68f8437ff58e102d45ba66f627b531bbcb788cd1d5997151b5f012b0e6a061fad98129a405af244b6dd0b3c4e712170
-  data.tar.gz: 842169d61f868c45c9c68259abe9cf547e559176a314a29a5d75e5a2702921e0a99c611f84237b0b85a1ebd8edf2d14d5012a327da26fa80fa0586dd9f1f9035
+  metadata.gz: d060f1a0ebf1330018ca27bbfce143336958ed2416181b22383438ce8a61739bafe7b725592a78cc6f11ad5ec1e887ec3474ea33f7c94d9e38dee68cb0ff29b2
+  data.tar.gz: eb35a40d3f69cb8ec3ad884d6502371c119094ec5358a0eb4224c193e0d11dc5768486c3019c75f263be0f526c6075d77e150e82404fba1604bbdd3bbf7dbb4d

data/.rubocop.yml

@@ -8,19 +8,19 @@ Lint/UselessRescue:
 Metrics/AbcSize:
   Max: 537.6
 Metrics/BlockLength:
-  Max: 220
+  Max: 292
 Metrics/BlockNesting:
-  Max: 5
+  Max: 6
 Metrics/ClassLength:
   Max: 134
 Metrics/CyclomaticComplexity:
-  Max: 123
+  Max: 157
 Metrics/MethodLength:
   Max: 485
 Metrics/ModuleLength:
   Max: 1000
 Metrics/PerceivedComplexity:
-  Max: 122
+  Max: 156
 Style/HashEachMethods:
   Enabled: true
 Style/HashSyntax:

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.372]:001 >>> PWN.help
+pwn[v0.5.373]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.372]:001 >>> PWN.help
+pwn[v0.5.373]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.372]:001 >>> PWN.help
+pwn[v0.5.373]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/burp_suite.rb

@@ -460,9 +460,14 @@ module PWN
         debug = opts[:debug] || false
 
         # Parse the OpenAPI JSON or YAML specification file
-        # If the opeenapi_spec is YAML, convert it to JSON
-        openapi = JSON.parse(File.read(openapi_spec), symbolize_names: true) if openapi_spec.end_with?('.json')
-        openapi = YAML.safe_load_file(openapi_spec, permitted_classes: [Symbol, Date, Time], aliases: true, symbolize_names: true) if openapi_spec.end_with?('.yaml', '.yml')
+        # If the openapi_spec is YAML, convert it to JSON
+        openapi = if openapi_spec.end_with?('.json')
+                    JSON.parse(File.read(openapi_spec), symbolize_names: true)
+                  elsif openapi_spec.end_with?('.yaml', '.yml')
+                    YAML.safe_load_file(openapi_spec, permitted_classes: [Symbol, Date, Time], aliases: true, symbolize_names: true)
+                  else
+                    raise "ERROR: Unsupported file extension for #{openapi_spec}. Expected .json, .yaml, or .yml."
+                  end
 
         # Initialize result array
         sitemap_arr = []
@@ -477,6 +482,19 @@ module PWN
         # Valid HTTP methods for validation
         valid_methods = %w[get post put patch delete head options trace connect]
 
+        # Helper lambda to resolve $ref in schemas
+        resolve_ref = lambda do |openapi, ref|
+          return nil unless ref&.start_with?('#/')
+
+          parts = ref.sub('#/', '').split('/')
+          resolved = openapi
+          parts.each do |part|
+            resolved = resolved[part.to_sym]
+            return nil unless resolved
+          end
+          resolved
+        end
+
         # Iterate through each server
         servers.each do |server|
           server_url = server[:url]
@@ -609,6 +627,88 @@ module PWN
                   all_parameters = path_parameters + operation_parameters
                   warn("[DEBUG] All parameters for #{method_str.upcase} #{full_path}: #{all_parameters.inspect}") if debug && !all_parameters.empty?
 
+                  # Determine response code from operation[:responses].keys
+                  fallback_response_code = 200
+                  response_keys = operation[:responses].keys
+                  response_key = response_keys.find { |key| key.to_s.to_i.between?(100, 599) } || fallback_response_code.to_s
+                  response_code = response_key.to_s.to_i
+
+                  # Construct response body from operation responses schema example, schema $ref example, etc.
+                  response_obj = operation[:responses][response_key] || {}
+                  content = response_obj[:content] || {}
+                  content_type = content.keys.first&.to_s || 'text/plain'
+
+                  response_body = ''
+                  unless [204, 304].include?(response_code)
+                    content_obj = content[content_type.to_sym] || {}
+                    example = content_obj[:example]
+                    if example.nil? && content_obj[:examples].is_a?(Hash)
+                      ex_key = content_obj[:examples].keys.first
+                      if ex_key
+                        ex = content_obj[:examples][ex_key]
+                        if ex[:$ref]
+                          resolved_ex = resolve_ref.call(openapi, ex[:$ref])
+                          example = resolved_ex[:value] if resolved_ex
+                        else
+                          example = ex[:value]
+                        end
+                      end
+                    end
+
+                    if example.nil?
+                      schema = content_obj[:schema]
+                      if schema
+                        if schema[:$ref]
+                          ref = schema[:$ref]
+                          if ref.start_with?('#/')
+                            parts = ref.sub('#/', '').split('/')
+                            resolved = openapi
+                            parts.each do |part|
+                              resolved = resolved[part.to_sym]
+                              break unless resolved
+                            end
+                            schema = resolved if resolved
+                          end
+                        end
+
+                        example = schema[:example]
+                        if example.nil? && schema[:examples].is_a?(Hash)
+                          ex_key = schema[:examples].keys.first
+                          if ex_key
+                            ex = schema[:examples][ex_key]
+                            if ex[:$ref]
+                              resolved_ex = resolve_ref.call(openapi, ex[:$ref])
+                              example = resolved_ex[:value] if resolved_ex
+                            else
+                              example = ex[:value]
+                            end
+                          end
+                        end
+                      end
+                    end
+
+                    response_body = example || response_obj[:description] || "INFO: Unable to resolve response body from #{openapi_spec} => { 'http_method': '#{method_str.upcase}', 'path': '#{full_path}', 'response_code': '#{response_code}' }"
+                  end
+
+                  # Try to extract query samples from response example if it's a links object
+                  query_hash = nil
+                  if response_body.is_a?(Hash) && response_body[:links]
+                    href = response_body.dig(:links, :self, :href)
+                    # href ||= response_body[:links].values.first&.dig(:href) rescue nil
+                    if href.nil? && response_body[:links].is_a?(Hash) && !response_body[:links].empty?
+                      first_value = response_body[:links].values.first
+                      href = first_value[:href] if first_value.is_a?(Hash)
+                    end
+                    if href
+                      begin
+                        parsed_uri = URI.parse(href)
+                        query_hash = URI.decode_www_form(parsed_uri.query).to_h if parsed_uri.path.end_with?(path_str) && parsed_uri.query
+                      rescue URI::InvalidURIError => e
+                        warn("[DEBUG] Invalid href in response example: #{href} - #{e.message}") if debug
+                      end
+                    end
+                  end
+
                   # Process path parameters for substitution
                   request_path = full_path.dup
                   query_params = []
@@ -617,21 +717,67 @@ module PWN
                     next unless param.is_a?(Hash) && param[:name] && param[:in]
 
                     param_name = param[:name].to_s
+
+                    # Get param_value with precedence: param.examples > param.example > schema.examples > schema.example > 'FUZZ'
+                    param_value = if param[:examples].is_a?(Hash) && !param[:examples].empty?
+                                    first_ex = param[:examples].values.first
+                                    if first_ex.is_a?(Hash)
+                                      if first_ex[:$ref]
+                                        # Resolve $ref for example if present
+                                        resolved_ex = resolve_ref.call(openapi, first_ex[:$ref])
+                                        resolved_ex[:value] if resolved_ex
+                                      else
+                                        first_ex[:value]
+                                      end
+                                    else
+                                      first_ex
+                                    end || 'FUZZ'
+                                  elsif param.key?(:example)
+                                    param[:example]
+                                  else
+                                    schema = param[:schema]
+                                    if schema
+                                      if schema[:$ref]
+                                        resolved_schema = resolve_ref.call(openapi, schema[:$ref])
+                                        schema = resolved_schema if resolved_schema
+                                      end
+                                      if schema[:examples].is_a?(Hash) && !schema[:examples].empty?
+                                        first_ex = schema[:examples].values.first
+                                        if first_ex.is_a?(Hash)
+                                          if first_ex[:$ref]
+                                            resolved_ex = resolve_ref.call(openapi, first_ex[:$ref])
+                                            resolved_ex[:value] if resolved_ex
+                                          else
+                                            first_ex[:value]
+                                          end
+                                        else
+                                          first_ex
+                                        end || 'FUZZ'
+                                      elsif schema.key?(:example)
+                                        schema[:example]
+                                      else
+                                        'FUZZ'
+                                      end
+                                    else
+                                      'FUZZ'
+                                    end
+                                  end
+
+                    # If still 'FUZZ' and it's a query param, try to get from response example query_hash
+                    param_value = query_hash[param_name] if param_value == 'FUZZ' && param[:in] == 'query' && query_hash&.key?(param_name)
+
                     case param[:in]
                     when 'header'
                       # Aggregate remaining HTTP header names from spec,
                       # reference as keys, and assign their respective
                       # values to the request_headers hash
                       param_key = param_name.downcase
-                      param_value = param[:schema]&.dig(:example) || 'FUZZ'
                       request_headers[param_key] = param_value.to_s
                     when 'path'
-                      # Substitute path parameter with a default value (e.g., 'FUZZ')
-                      param_value = param[:schema]&.dig(:example) || 'FUZZ'
+                      # Substitute path parameter with the resolved value
                       request_path.gsub!("{#{param_name}}", param_value.to_s)
                     when 'query'
                       # Collect query parameters
-                      param_value = param[:schema]&.dig(:example) || 'FUZZ'
                       query_params.push("#{URI.encode_www_form_component(param_name)}=#{URI.encode_www_form_component(param_value.to_s)}")
                     end
                   end
@@ -653,12 +799,6 @@ module PWN
                   request = request_lines.join("\r\n")
                   encoded_request = Base64.strict_encode64(request)
 
-                  # Determine response code from operation[:responses].keys
-                  fallback_response_code = 200
-                  response_keys = operation[:responses].keys
-                  response_key = response_keys.find { |key| key.to_s.to_i.between?(100, 599) } || fallback_response_code.to_s
-                  response_code = response_key.to_s.to_i
-
                   response_status = case response_code
                                     when 200 then '200 OK'
                                     when 201 then '201 Created'
@@ -680,52 +820,11 @@ module PWN
                                     else "#{fallback_response_code} OK"
                                     end
 
-                  # Construct response body from operation responses schema example, schema $ref example, etc.
-                  response_obj = operation[:responses][response_key] || {}
-                  content = response_obj[:content] || {}
-                  content_type = content.keys.first&.to_s || 'text/plain'
-
-                  response_body = ''
-                  unless [204, 304].include?(response_code)
-                    content_obj = content[content_type.to_sym] || {}
-                    example = content_obj[:example]
-                    if example.nil? && content_obj[:examples].is_a?(Hash)
-                      ex_key = content_obj[:examples].keys.first
-                      example = content_obj[:examples][ex_key][:value] if ex_key
-                    end
-
-                    if example.nil?
-                      schema = content_obj[:schema]
-                      if schema
-                        if schema[:$ref]
-                          ref = schema[:$ref]
-                          if ref.start_with?('#/')
-                            parts = ref.sub('#/', '').split('/')
-                            resolved = openapi
-                            parts.each do |part|
-                              resolved = resolved[part.to_sym]
-                              break unless resolved
-                            end
-                            schema = resolved if resolved
-                          end
-                        end
-
-                        example = schema[:example]
-                        if example.nil? && schema[:examples].is_a?(Hash)
-                          ex_key = schema[:examples].keys.first
-                          example = schema[:examples][ex_key][:value] if ex_key
-                        end
-                      end
-                    end
-
-                    response_body = example || response_obj[:description] || "INFO: Unable to resolve response body from #{openapi_spec} => { 'http_method': '#{method_str.upcase}', 'path': '#{request_path}', 'response_code': '#{response_code}' }"
-
-                    # Serialize based on content_type
-                    if content_type =~ /json/i && (response_body.is_a?(Hash) || response_body.is_a?(Array))
-                      response_body = JSON.generate(response_body)
-                    else
-                      response_body = response_body.to_s
-                    end
+                  # Serialize response_body based on content_type
+                  if content_type =~ /json/i && (response_body.is_a?(Hash) || response_body.is_a?(Array))
+                    response_body = JSON.generate(response_body)
+                  else
+                    response_body = response_body.to_s
                   end
 
                   response_lines = [

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.372'
+  VERSION = '0.5.373'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.372
+  version: 0.5.373
 platform: ruby
 authors:
 - 0day Inc.