pwn 0.5.399 → 0.5.400
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG_BETWEEN_TAGS.txt +181 -180
- data/README.md +3 -3
- data/bin/pwn_zaproxy_active_rest_api_scan +6 -13
- data/bin/pwn_zaproxy_active_scan +2 -1
- data/lib/pwn/plugins/burp_suite.rb +1 -1
- data/lib/pwn/plugins/zaproxy.rb +22 -66
- data/lib/pwn/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 50e5c49a707126098497f95cb7a246b862f5a86c58941e4f7d739134b36a1f70
|
|
4
|
+
data.tar.gz: 24fc54a212c3b38749013f9182a5a5e27ea73cdd23c28df8fdbe3e83fe2dd873
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: de7931e719fa600cbe8e2b6774ce4f48f193cc836e15a9e4b5f5d47ccd3b94a72688fd43a045da2dc0f9ec966df49390b6f2f30ed6b270a1fc0739002571fcd6
|
|
7
|
+
data.tar.gz: 78aa16d0970eba2d1a711c83dc1ba2869b64e5d7d1cb939adeb9e1667b4bab646423c271040fa22383416c5ac22f72d06d3190f440daeadf28830f54b423779b
|
data/CHANGELOG_BETWEEN_TAGS.txt
CHANGED
|
@@ -1,180 +1,181 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
1
|
+
0e6a161 Merge pull request #815 from ninp0/master
|
|
2
|
+
cd06863 pwn_burp_*, pwn_zaproxy*, PWN::Plugins::BurpSuite, && PWN::Plugins::Zaproxy - sync dev patterns as closely as possible - iteration 1
|
|
3
|
+
e619eb4 Merge pull request #814 from ninp0/master
|
|
4
|
+
c91ef60 pwn_burp_suite_pro_active_rest_api_scan Driver - location in which the openapi_spec is dropped matters.
|
|
5
|
+
b083176 Merge pull request #813 from ninp0/master
|
|
6
|
+
2dbe8df PWN::Plugins::OpenAPI module - #bugfixes resolving properties $ref attributes when generating openapi spec #slight_tweak
|
|
7
|
+
d98e54b Merge pull request #812 from ninp0/master
|
|
8
|
+
125b69f PWN::Plugins::OpenAPI module - #bugfixes resolving properties $ref attributes when generating openapi spec
|
|
9
|
+
77e110b Merge pull request #811 from ninp0/master
|
|
10
|
+
ac7d1cf PWN::SAST::Logger && PWN::SAST::ThrowErrors modules - refine anti-patterns
|
|
11
|
+
8074714 Merge pull request #810 from ninp0/master
|
|
12
|
+
4db65d9 PWN::Reports::HTMLHeader && PWN::Reports::HTMLFooter modules - remove unncessary require statements
|
|
13
|
+
9350072 PWN::Reports::SAST - slight UI tweaks / change search label value to provide search example
|
|
14
|
+
e080194 Merge pull request #809 from ninp0/master
|
|
15
|
+
4399586 PWN::Reports::SAST - offload reusable footer code into PWN::Reports::HTMLFooter module
|
|
16
|
+
9968e44 Merge pull request #808 from ninp0/master
|
|
17
|
+
0ecc452 pwn_burp_suite_pro_active_rest_api_scan Driver - initial commit
|
|
18
|
+
6b47120 Merge pull request #807 from ninp0/master
|
|
19
|
+
0bc36c9 Gemfile and pwn.gemspec tweaks
|
|
20
|
+
4c969cd pwn_sast Driver && PWN::Reports::SAST module - UI enhancements
|
|
21
|
+
4aa4616 Merge pull request #806 from ninp0/master
|
|
22
|
+
bab13ac pwn_sast Driver && PWN::Reports::SAST module - Enhanced PDF and XLSX report exports, cell formatting fixes, include hyperlinks in reports, slight tweak to UI header
|
|
23
|
+
31960c5 Merge pull request #805 from ninp0/master
|
|
24
|
+
0de729f pwn_sast Driver && PWN::Reports::SAST module - Enhanced PDF and XLSX report exports #slight_tweaks
|
|
25
|
+
13027dd Merge pull request #804 from ninp0/master
|
|
26
|
+
f005e98 pwn_sast Driver && PWN::Reports::SAST module - Enhanced PDF and XLSX report exports
|
|
27
|
+
990fa89 pwn_sast Driver && PWN::Reports::SAST module - UI overhaul, implement export to PDF and XLSX in addition to JSON
|
|
28
|
+
6d40c0b Merge pull request #803 from ninp0/master
|
|
29
|
+
0c8c4b1 pwn_sast Driver - #bugfixes
|
|
30
|
+
78f98d4 pwn_sast Driver - #bugfixes
|
|
31
|
+
39f1853 pwn_sast Driver - #bugfixes
|
|
32
|
+
376f7bc pwn_sast Driver - #bugfixes
|
|
33
|
+
69a5f7f pwn_sast Driver - #bugfixes
|
|
34
|
+
60efd51 PWN::Plugins::FileFu module - create #recurse_in_dir method to support pwn_sast Driver scanning repos that are explicitly passed instead of scanning in current working directory. Update PWN::SAST::* modules to support this as well.
|
|
35
|
+
2332dc6 Merge pull request #802 from ninp0/master
|
|
36
|
+
a207630 PWN::AI::OpenAI module - update default model to gpt-5-chat-latest in #chat method
|
|
37
|
+
4ca1f58 Merge pull request #801 from ninp0/master
|
|
38
|
+
de7ebe5 pwn_sast Driver && PWN::Reports::SAST module - enhanced progress reporting when generating report.
|
|
39
|
+
abbb0d5 pwn_sast Driver && PWN::Reports::SAST module - implement optional AI analysis of SAST results
|
|
40
|
+
62a6e88 Merge pull request #800 from ninp0/master
|
|
41
|
+
29f8925 Add new namespace, `PWN::AI` and move PWN::Plugins::OpenAI and PWN::Plugins::Ollama modules to the new namespace. Also new initial commit for `PWN::AI::Grok` module.
|
|
42
|
+
0f427b7 Merge pull request #799 from ninp0/master
|
|
43
|
+
18809bf PWN::Plugins::BurpSuite module - `require "yaml"` for brevity
|
|
44
|
+
9292522 Merge pull request #798 from ninp0/master
|
|
45
|
+
f60a31f PWN::Plugins::BurpSuite module - more robust example handling to reconstuct accurate HTTP requests for #import_openapi_to_sitemap method
|
|
46
|
+
7df2319 Merge pull request #797 from ninp0/master
|
|
47
|
+
2d83e69 PWN::Plugins::BurpSuite module - #bugfix in #add_to_sitemap
|
|
48
|
+
b7af7c3 PWN::Plugins::BurpSuite module - #bugfix in #add_to_sitemap
|
|
49
|
+
99e7070 Merge pull request #796 from ninp0/master
|
|
50
|
+
9f7b78e PWN::Plugins::BurpSuite module - update #import_openapi_to_sitemap method to support YAML for openapi_spec parameter
|
|
51
|
+
6959f27 Merge pull request #795 from ninp0/master
|
|
52
|
+
56db7de PWN::Plugins::BurpSuite module - crank up timeouts for adding requests to sitemap for really slow test envs
|
|
53
|
+
4a6a8f5 PWN::Plugins::BurpSuite module - crank up timeouts for adding requests to sitemap for really slow test envs
|
|
54
|
+
4eb9c03 Merge pull request #794 from ninp0/master
|
|
55
|
+
82a76a1 PWN::Plugins::BurpSuite module - crank up max heap memory constraints and set min heap memory to 4G within #start method
|
|
56
|
+
e9360cd Merge pull request #793 from ninp0/master
|
|
57
|
+
daffbe1 pwn_burp_suite_pro_active_scan Driver - #bugfix change ---in_scope to --in_scope parameter
|
|
58
|
+
f0b4139 Merge pull request #792 from ninp0/master
|
|
59
|
+
4956561 pwn_burp_suite_pro_active_scan Driver && PWN::Plugins::BurpSuite module - implement --exlude-path parameter to avoid scanning URLs that may terminate sessions prematurely
|
|
60
|
+
7e01c8e Merge pull request #791 from ninp0/master
|
|
61
|
+
a5b6b2b PWN::Plugins::BurpSuite module - update #stop method to gracefullly shutdown Burp UI and preserve any Extensions installed during the session
|
|
62
|
+
f49f25f Merge pull request #790 from ninp0/master
|
|
63
|
+
b55870e Nuke burp mock test reports
|
|
64
|
+
c56d5d9 Merge pull request #789 from ninp0/master
|
|
65
|
+
342dd5b PWN::Plugins::BurpSuite module - include query parameter in format_uri_from_sitemap_resp method
|
|
66
|
+
346393a Merge pull request #788 from ninp0/master
|
|
67
|
+
03e9e37 PWN::Reports::* modules - retain original report name for selected lines exported to JSON file
|
|
68
|
+
5c86dcb Merge pull request #787 from ninp0/master
|
|
69
|
+
5fa1cdf PWN::Plugins::BurpSuite module - #enhancements in #import_openapi_to_sitemap method to constuct more accurate http response in the Sitemap
|
|
70
|
+
bae133e Merge pull request #786 from ninp0/master
|
|
71
|
+
b1249c8 PWN::Plugins::BurpSuite module - #bugfix in #import_openapi_to_sitemap method
|
|
72
|
+
1141fdf Merge pull request #785 from ninp0/master
|
|
73
|
+
40d3f72 pwn_burp_suite_pro_active_scan Driver - optimize for both authenticated and unauthenticated scanning
|
|
74
|
+
3129c28 Merge pull request #784 from ninp0/master
|
|
75
|
+
e348a61 Merge branch 'master' of ssh://github.com/ninp0/pwn
|
|
76
|
+
f4cf106 PWN::Plugins::BurpSuite module - cleaner status output to STDOUT when running #invoke_active_scan method #rubocop
|
|
77
|
+
b30e6e1 Merge pull request #783 from ninp0/master
|
|
78
|
+
929d818 PWN::Plugins::BurpSuite module - cleaner status output to STDOUT when running #invoke_active_scan method
|
|
79
|
+
02e0b17 PWN::Plugins::BurpSuite module - implement proxy listener CRUD and allow for concurrent burp active scan sessions
|
|
80
|
+
1890ed8 Merge pull request #782 from ninp0/master
|
|
81
|
+
1d2a495 PWN::Reports::* modules - support multi-line select and exporting selected lines to external JSON file
|
|
82
|
+
1e072e8 pwn_fuzz_net_app_proto Driver - #bugfixes && PWN::Reports::* modules begin extending all reports to support multi-line select and exporting selecting lines to external JSON file
|
|
83
|
+
de63465 Merge pull request #781 from ninp0/master
|
|
84
|
+
d39dd94 PWN::Reports::SAST module - implement multi-line select/highlighting and export highlighted results to JSON file for consumption by tools like DefectDojo
|
|
85
|
+
ccf4692 Merge pull request #780 from ninp0/master
|
|
86
|
+
5b08c3b PWN::Plugins::BurpSuite module - update #import_openapi_to_sitemap method to aggregate remaining HTTP header names from spec, reference as keys, and assign their respective values to the request_headers hash
|
|
87
|
+
1fe2155 Merge pull request #779 from ninp0/master
|
|
88
|
+
2afb327 PWN::Plugins::BurpSuite module - update #import_openapi_to_sitemap method to include more obvious placeholders when schema examples cannot be found in the spec
|
|
89
|
+
a2e3ff5 Merge pull request #778 from ninp0/master
|
|
90
|
+
d5673d4 PWN::Plugins::OpenAPI module - suppoort aliases when parsing YAML documents
|
|
91
|
+
0411777 Merge pull request #777 from ninp0/master
|
|
92
|
+
70b6ceb PWN::Plugins::BurpSuite module - update usage in #help method && prettier STDOUT in pwn_burp_suite_pro_active_scan Driver
|
|
93
|
+
8f28ff1 Merge pull request #776 from ninp0/master
|
|
94
|
+
1917900 PWN::Plugins::BurpSuite module - #bugfix remove #stop method from #in_scope method
|
|
95
|
+
1431ad9 Merge pull request #775 from ninp0/master
|
|
96
|
+
cec08c6 PWN::Plugins::BurpSuite module - #bugfix remove #stop method from #in_scope method
|
|
97
|
+
a490ed7 Merge pull request #774 from ninp0/master
|
|
98
|
+
5d8ecfb PWN::Plugins::BurpSuite module - more debugging in #invoke_active_scan method && Enhanced search capabilities for PWN::Reports::* modules
|
|
99
|
+
3447154 Merge pull request #773 from ninp0/master
|
|
100
|
+
226d7df PWN::Plugins::BurpSuite module - more debugging in #invoke_active_scan method
|
|
101
|
+
cb8d237 Merge pull request #772 from ninp0/master
|
|
102
|
+
9245fe1 Merge branch 'master' of ssh://github.com/ninp0/pwn
|
|
103
|
+
5ef6539 Merge pull request #771 from ninp0/master
|
|
104
|
+
11c6bac PWN::Plugins::BurpSuite module - more debugging in #invoke_active_scan method
|
|
105
|
+
94d17f9 PWN::Plugins::BurpSuite module - more debugging in #invoke_active_scan method
|
|
106
|
+
fa54fe9 Merge pull request #770 from ninp0/master
|
|
107
|
+
f4a32fe PWN::Plugins::BurpSuite module - #bugfix in #spider method
|
|
108
|
+
9007671 Merge pull request #769 from ninp0/master
|
|
109
|
+
574301b PWN::Plugins::BurpSuite module - temporarily remove stop in ensure block for #invoke_active_scan method
|
|
110
|
+
3fc144b Merge pull request #768 from ninp0/master
|
|
111
|
+
47f2828 PWN::Plugins::BurpSuite module - begin working towards supporting proxy listener settings within #start method
|
|
112
|
+
857cab9 PWN::Plugins::BurpSuite module - implement a #spider method and include this feature as an option within the pwn_burp_suite_pro_active_scan Driver. #enhancements
|
|
113
|
+
663c25d Merge pull request #767 from ninp0/master
|
|
114
|
+
0f3c593 PWN::Plugins::BurpSuite module - implement a #spider method and include this feature as an option within the pwn_burp_suite_pro_active_scan Driver.
|
|
115
|
+
f302712 Merge pull request #766 from ninp0/master
|
|
116
|
+
83812a4 PWN::Plugins::BurpSuite module - #bugfix when attempting to scan URI that responds w code other than 200 #keepitmoving
|
|
117
|
+
70fea2b PWN::Plugins::BurpSuite module - #bugfix when attempting to scan URI that responds w code other than 200 #keepitmoving
|
|
118
|
+
1eedf4b Merge pull request #765 from ninp0/master
|
|
119
|
+
0f72609 PWN::Plugins::BurpSuite module - #bugfix when attempting to scan URI that responds w code other than 200 #keepitmoving
|
|
120
|
+
4d8469b Merge pull request #764 from ninp0/master
|
|
121
|
+
4942a7b PWN::Plugins::BurpSuite module - a lot of integrations for pwn-burp.jar Burp Extension && PWN::Plugins::OpenAPI module - oh buddy...
|
|
122
|
+
4126d2f Merge pull request #763 from ninp0/master
|
|
123
|
+
72f8a5a PWN::Plugins::OpenAPI module - initial commit
|
|
124
|
+
da3de9e Merge pull request #762 from ninp0/master
|
|
125
|
+
ed0272c VERSION.rb - bump version to align w/ rubygems
|
|
126
|
+
a4d508d third_party/*.jar - remove burp extensions
|
|
127
|
+
1cd05db Merge pull request #761 from ninp0/master
|
|
128
|
+
9fdd26f third party - replace BurpSuite extension, BurpBuddy w/ PWNBurpRestAPI
|
|
129
|
+
1a97d75 Merge pull request #760 from ninp0/master
|
|
130
|
+
806e5a2 pwn_burp_suite_pro_active_scan Driver - output each instruction to STDOUT while redacting sensitive data. #slight_tweak
|
|
131
|
+
87984b9 Merge pull request #759 from ninp0/master
|
|
132
|
+
ad0db78 pwn_burp_suite_pro_active_scan Driver - output each instruction to STDOUT while redacting sensitive data.
|
|
133
|
+
b953b32 Merge pull request #758 from ninp0/master
|
|
134
|
+
b2c8755 pwn_burp_suite_pro_active_scan Driver - Add to scope prior to executing navigation instructions
|
|
135
|
+
2dcee71 Merge pull request #757 from ninp0/master
|
|
136
|
+
7ee1968 PWN::Plugins::BurpSuite - #bugfix within #generate_scan_report method
|
|
137
|
+
3e9d42b PWN::Plugins::BurpSuite - #bugfix within #generate_scan_report method
|
|
138
|
+
ffdf5c1 PWN::Plugins::BurpSuite - #bugfix within #generate_scan_report method
|
|
139
|
+
41e7d90 Merge pull request #756 from ninp0/master
|
|
140
|
+
180c187 PWN::Plugins::BurpSuite - test use_https values in post_body variable within #invoke_scan_method
|
|
141
|
+
88fb7790 Merge pull request #755 from ninp0/master
|
|
142
|
+
5abaf61 PWN::Plugins::BurpSuite - #bugfix in json_uri generation within #invoke_active_scan method
|
|
143
|
+
b59b53b Merge pull request #754 from ninp0/master
|
|
144
|
+
cd30423 PWN::Plugins::BurpSuite - test useHttps values in post_body variable within #invoke_scan_method
|
|
145
|
+
2dad6b1 Merge pull request #753 from ninp0/master
|
|
146
|
+
9620af0 PWN::Reports::* modules - Update # of entries / page options to be 10, 25, 50, 100, 250, 500, 1000, 2500, 5000
|
|
147
|
+
703564f Merge pull request #752 from ninp0/master
|
|
148
|
+
2a04764 PWN::Plugins::TransparentBrowser module - more efficient / stable #list_tabs method
|
|
149
|
+
c52492e Merge pull request #751 from ninp0/master
|
|
150
|
+
5a1a72c Gemfile - comment out openapi3_parser for REST API testing as dependencies break pwn install in OpenBSD
|
|
151
|
+
dbf3bb3 Merge pull request #750 from ninp0/master
|
|
152
|
+
a0a3af6 PWN::Plugins::TransparentBrowser module - specify optional `index` parameter to dictate which DOM mutations to view or hide
|
|
153
|
+
10f9d15 Merge pull request #749 from ninp0/master
|
|
154
|
+
94abfa8 Gemfile - pull in openapi3_parser for REST API testing && PWN::Plugins::TransparentBrowser module - overhaul on tab management
|
|
155
|
+
5ba895a Merge pull request #748 from ninp0/master
|
|
156
|
+
ac80447 PWN::Plugins::TransparentBrowser module - change `keyword` parameter in #jmp_tab method to optional, defaulting to switching to the next inactive tab from the list returned by the #list_tabs method
|
|
157
|
+
651a7e0 Merge pull request #747 from ninp0/master
|
|
158
|
+
efcc3af PWN::Plugins::TransparentBrowser module - multi-tab support within #view_dom_mutations #hide_dom_mutations methods
|
|
159
|
+
317c7f8 Merge pull request #746 from ninp0/master
|
|
160
|
+
c9a9917 PWN::Plugins::TransparentBrowser module - enhancements in #view_dom_mutations methods to include common sinks for DOM XSS
|
|
161
|
+
30184bd Merge pull request #745 from ninp0/master
|
|
162
|
+
99de13a PWN::Plugins::TransparentBrowser module - enhancements in #console and #view_dom_mutations methods. #bugfixes in #hide_dom_mutations method
|
|
163
|
+
c113537 Merge pull request #744 from ninp0/master
|
|
164
|
+
4db450b PWN::Plugins::TransparentBrowser module - add methods to output DOM mutations in the console when devtools = true #bugfixes
|
|
165
|
+
5efdc25 Merge pull request #743 from ninp0/master
|
|
166
|
+
6223de5 PWN::Plugins::TransparentBrowser module - add methods to output DOM mutations in the console when devtools = true
|
|
167
|
+
924f1d5 Merge pull request #742 from ninp0/master
|
|
168
|
+
4bf4f16 PWN::Plugins::TransparentBrowser module - add methods to output DOM mutations in the console when devtools = true
|
|
169
|
+
c0c716c Merge pull request #741 from ninp0/master
|
|
170
|
+
0aa8cd5 PWN::Plugins::TransparentBrowser module - begin supporting BiDi for browsers that support this more standardized approach to automating browser navigation
|
|
171
|
+
c0770a1 Merge pull request #740 from ninp0/master
|
|
172
|
+
30627ca PWN::Report::SAST module - extend proper line anchor formatting for different git source code managment software solutions
|
|
173
|
+
ee79c1d Merge pull request #739 from ninp0/master
|
|
174
|
+
a6e05f5 PWN::Plugins::JiraServer module - #bugfix in #issue_comment method
|
|
175
|
+
a8d9da7 Merge pull request #738 from ninp0/master
|
|
176
|
+
0226316 PWN::Plugins::JiraServer module - always return value of #get_issue when performing issue CRUD actions within other methods (except delete, cause well, issue == nil)
|
|
177
|
+
7bd820b Merge pull request #737 from ninp0/master
|
|
178
|
+
624738f PWN::Plugins::JiraServer module - support attaching multiple files in issue w/ one call to either #create_issue or #update_issue. Additionally, implement the ability to delete attachments via #delete_attachment method and manage comments for an issue via #issue_comment method.
|
|
179
|
+
33f1303 Merge pull request #736 from ninp0/master
|
|
180
|
+
4dd158d PWN::Plugins::JiraServer module - attachment #bugfixes
|
|
181
|
+
720bdb9 Merge pull request #735 from ninp0/master
|
data/README.md
CHANGED
|
@@ -37,7 +37,7 @@ $ cd /opt/pwn
|
|
|
37
37
|
$ ./install.sh
|
|
38
38
|
$ ./install.sh ruby-gem
|
|
39
39
|
$ pwn
|
|
40
|
-
pwn[v0.5.
|
|
40
|
+
pwn[v0.5.400]:001 >>> PWN.help
|
|
41
41
|
```
|
|
42
42
|
|
|
43
43
|
[](https://youtu.be/G7iLUY4FzsI)
|
|
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
|
|
|
52
52
|
$ gem uninstall --all --executables pwn
|
|
53
53
|
$ gem install --verbose pwn
|
|
54
54
|
$ pwn
|
|
55
|
-
pwn[v0.5.
|
|
55
|
+
pwn[v0.5.400]:001 >>> PWN.help
|
|
56
56
|
```
|
|
57
57
|
|
|
58
58
|
If you're using a multi-user install of RVM do:
|
|
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
|
|
|
62
62
|
$ rvmsudo gem uninstall --all --executables pwn
|
|
63
63
|
$ rvmsudo gem install --verbose pwn
|
|
64
64
|
$ pwn
|
|
65
|
-
pwn[v0.5.
|
|
65
|
+
pwn[v0.5.400]:001 >>> PWN.help
|
|
66
66
|
```
|
|
67
67
|
|
|
68
68
|
PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`. The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:
|
|
@@ -20,8 +20,8 @@ OptionParser.new do |options|
|
|
|
20
20
|
opts[:target_url] = t
|
|
21
21
|
end
|
|
22
22
|
|
|
23
|
-
options.on('-
|
|
24
|
-
opts[:
|
|
23
|
+
options.on('-oDIR', '--report_output_dir=DIR', '<Required - Output Directory for Active Scan Report>') do |o|
|
|
24
|
+
opts[:output_dir] = o
|
|
25
25
|
end
|
|
26
26
|
|
|
27
27
|
options.on('-dSWAGGER', '--swagger_definitions=SWAGGER', '<Required - Comma-delimited list of Swagger JSON/YAML files to import>') do |s|
|
|
@@ -72,8 +72,8 @@ begin
|
|
|
72
72
|
target_url = opts[:target_url]
|
|
73
73
|
raise 'ERROR: --target_url is required.' if target_url.nil?
|
|
74
74
|
|
|
75
|
-
|
|
76
|
-
raise 'ERROR: --
|
|
75
|
+
output_dir = opts[:output_dir]
|
|
76
|
+
raise 'ERROR: --report_output_dir is required.' if output_dir.nil?
|
|
77
77
|
|
|
78
78
|
swagger_definitions = opts[:swagger_definitions]
|
|
79
79
|
raise 'ERROR: --swagger_definitions is required.' if swagger_definitions.nil?
|
|
@@ -141,19 +141,13 @@ begin
|
|
|
141
141
|
# puts scan_issues
|
|
142
142
|
|
|
143
143
|
# Once DefectDojo begins to support XML report results
|
|
144
|
-
report_types = %i[html xml]
|
|
144
|
+
report_types = %i[html markdown xml]
|
|
145
145
|
report_types.each do |report_type|
|
|
146
|
-
this_output_path = "#{output_path}.html"
|
|
147
|
-
# this_output_path = "#{File.dirname(output_path)}/#{File.basename(output_path, File.extname(output_path))}.html"
|
|
148
|
-
|
|
149
|
-
this_output_path = "#{output_path}.xml" if report_type == :xml
|
|
150
|
-
# this_output_path = "#{File.dirname(output_path)}/#{File.basename(output_path, File.extname(output_path))}.xml" if report_type == :xml
|
|
151
|
-
|
|
152
146
|
PWN::Plugins::Zaproxy.generate_scan_report(
|
|
153
147
|
zap_obj: zap_obj,
|
|
154
148
|
target_url: in_scope,
|
|
155
149
|
report_type: report_type,
|
|
156
|
-
|
|
150
|
+
output_dir: output_dir
|
|
157
151
|
)
|
|
158
152
|
end
|
|
159
153
|
|
|
@@ -161,6 +155,5 @@ begin
|
|
|
161
155
|
rescue StandardError => e
|
|
162
156
|
raise e
|
|
163
157
|
ensure
|
|
164
|
-
FileUtils.rm_f(openapi_spec) unless debug
|
|
165
158
|
zap_obj = PWN::Plugins::Zaproxy.stop(zap_obj: zap_obj) unless zap_obj.nil?
|
|
166
159
|
end
|
data/bin/pwn_zaproxy_active_scan
CHANGED
|
@@ -56,7 +56,7 @@ module PWN
|
|
|
56
56
|
|
|
57
57
|
public_class_method def self.start(opts = {})
|
|
58
58
|
burp_jar_path = opts[:burp_jar_path] ||= '/opt/burpsuite/burpsuite-pro.jar'
|
|
59
|
-
raise
|
|
59
|
+
raise "ERROR: #{burp_jar_path} not found." unless File.exist?(burp_jar_path)
|
|
60
60
|
|
|
61
61
|
raise 'ERROR: /opt/burpsuite/pwn-burp.jar not found. For more details about installing this extension, checkout https://github.com/0dayinc/pwn_burp' unless File.exist?('/opt/burpsuite/pwn-burp.jar')
|
|
62
62
|
|
data/lib/pwn/plugins/zaproxy.rb
CHANGED
|
@@ -81,42 +81,34 @@ module PWN
|
|
|
81
81
|
|
|
82
82
|
public_class_method def self.start(opts = {})
|
|
83
83
|
zap_obj = {}
|
|
84
|
-
api_key = opts[:api_key]
|
|
84
|
+
api_key = opts[:api_key]
|
|
85
|
+
raise 'ERROR: api_key must be provided' if api_key.nil?
|
|
86
|
+
|
|
85
87
|
zap_obj[:api_key] = api_key
|
|
86
88
|
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
raise "ERROR: zap.sh not found at #{zap_bin_path}" unless File.exist?(zap_bin_path)
|
|
90
|
-
else
|
|
91
|
-
underlying_os = PWN::Plugins::DetectOS.type
|
|
92
|
-
|
|
93
|
-
case underlying_os
|
|
94
|
-
when :linux
|
|
95
|
-
zap_bin_path = '/usr/share/zaproxy/zap.sh'
|
|
96
|
-
when :osx
|
|
97
|
-
zap_bin_path = '/Applications/OWASP\ ZAP.app/Contents/Java/zap.sh'
|
|
98
|
-
else
|
|
99
|
-
raise "ERROR: zap.sh not found for #{underlying_os}. Please pass the :zap_bin_path parameter to this method for proper execution"
|
|
100
|
-
end
|
|
101
|
-
end
|
|
89
|
+
zap_bin_path = opts[:zap_bin_path] ||= '/usr/share/zaproxy/zap.sh'
|
|
90
|
+
raise "ERROR: #{zap_bin_path} not found." unless File.exist?(zap_bin_path)
|
|
102
91
|
|
|
103
92
|
zap_bin = File.basename(zap_bin_path)
|
|
104
|
-
|
|
93
|
+
zap_root = File.dirname(zap_bin_path)
|
|
105
94
|
|
|
106
95
|
headless = opts[:headless] || false
|
|
107
96
|
browser_type = opts[:browser_type] ||= :firefox
|
|
108
97
|
zap_ip = opts[:zap_ip] ||= '127.0.0.1'
|
|
109
98
|
zap_port = opts[:zap_port] ||= PWN::Plugins::Sock.get_random_unused_port
|
|
110
99
|
|
|
111
|
-
zap_rest_ip =
|
|
112
|
-
zap_rest_port =
|
|
100
|
+
zap_rest_ip = zap_ip
|
|
101
|
+
zap_rest_port = zap_port
|
|
113
102
|
|
|
114
103
|
if headless
|
|
115
|
-
zaproxy_cmd = "cd #{
|
|
104
|
+
zaproxy_cmd = "cd #{zap_root} && ./#{zap_bin} -daemon"
|
|
116
105
|
else
|
|
117
|
-
zaproxy_cmd = "cd #{
|
|
106
|
+
zaproxy_cmd = "cd #{zap_root} && ./#{zap_bin}"
|
|
118
107
|
end
|
|
119
108
|
|
|
109
|
+
zaproxy_cmd = "#{zaproxy_cmd} -host #{zap_ip} -port #{zap_port}"
|
|
110
|
+
|
|
111
|
+
zap_obj[:pid] = Process.spawn(zaproxy_cmd)
|
|
120
112
|
browser_obj1 = PWN::Plugins::TransparentBrowser.open(browser_type: :rest)
|
|
121
113
|
rest_browser = browser_obj1[:browser]
|
|
122
114
|
|
|
@@ -124,8 +116,6 @@ module PWN
|
|
|
124
116
|
zap_obj[:zap_rest_api] = zap_obj[:mitm_proxy]
|
|
125
117
|
zap_obj[:rest_browser] = rest_browser
|
|
126
118
|
|
|
127
|
-
zaproxy_cmd = "#{zaproxy_cmd} -host #{zap_ip} -port #{zap_port}"
|
|
128
|
-
|
|
129
119
|
browser_obj2 = PWN::Plugins::TransparentBrowser.open(
|
|
130
120
|
browser_type: browser_type,
|
|
131
121
|
proxy: "http://#{zap_obj[:mitm_proxy]}",
|
|
@@ -134,52 +124,18 @@ module PWN
|
|
|
134
124
|
|
|
135
125
|
zap_obj[:zap_browser] = browser_obj2
|
|
136
126
|
|
|
137
|
-
|
|
138
|
-
pwn_stdout_log = File.new(pwn_stdout_log_path, 'w')
|
|
139
|
-
# Immediately writes all buffered data in IO to disk
|
|
140
|
-
pwn_stdout_log.sync = true
|
|
141
|
-
pwn_stdout_log.fsync
|
|
142
|
-
|
|
143
|
-
fork_pid = Process.fork do
|
|
144
|
-
PTY.spawn(zaproxy_cmd) do |stdout, _stdin, _pid|
|
|
145
|
-
stdout.each do |line|
|
|
146
|
-
puts line
|
|
147
|
-
pwn_stdout_log.puts line
|
|
148
|
-
end
|
|
149
|
-
end
|
|
150
|
-
rescue PTY::ChildExited, SystemExit, Interrupt, Errno::EIO
|
|
151
|
-
puts 'Spawned OWASP Zap PTY exiting...'
|
|
152
|
-
File.unlink(pwn_stdout_log_path)
|
|
153
|
-
rescue StandardError => e
|
|
154
|
-
puts 'Spawned process exiting...'
|
|
155
|
-
File.unlink(pwn_stdout_log_path)
|
|
156
|
-
raise e
|
|
157
|
-
end
|
|
158
|
-
Process.detach(fork_pid)
|
|
159
|
-
|
|
160
|
-
zap_obj[:pid] = fork_pid
|
|
161
|
-
zap_obj[:stdout_log] = pwn_stdout_log_path
|
|
162
|
-
# This is how we'll know OWSAP Zap is in a ready state.
|
|
163
|
-
# if headless
|
|
164
|
-
# return_pattern = '[ZAP-daemon] INFO org.zaproxy.zap.DaemonBootstrap - ZAP is now listening'
|
|
165
|
-
# else
|
|
166
|
-
# case underlying_os
|
|
167
|
-
# when :linux
|
|
168
|
-
# return_pattern = '[AWT-EventQueue-1] INFO hsqldb.db..ENGINE - Database closed'
|
|
169
|
-
# when :osx
|
|
170
|
-
# return_pattern = '[AWT-EventQueue-0] INFO hsqldb.db..ENGINE - Database closed'
|
|
171
|
-
# end
|
|
172
|
-
# end
|
|
173
|
-
return_pattern = 'Started callback service on'
|
|
174
|
-
|
|
127
|
+
# Wait for pwn_burp_port to open prior to returning burp_obj
|
|
175
128
|
loop do
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
129
|
+
s = TCPSocket.new(zap_rest_ip, zap_rest_port)
|
|
130
|
+
s.close
|
|
131
|
+
break
|
|
132
|
+
rescue Errno::ECONNREFUSED
|
|
133
|
+
print '.'
|
|
181
134
|
sleep 3
|
|
135
|
+
next
|
|
182
136
|
end
|
|
137
|
+
|
|
138
|
+
zap_obj
|
|
183
139
|
rescue StandardError, SystemExit, Interrupt => e
|
|
184
140
|
stop(zap_obj) unless zap_obj.nil?
|
|
185
141
|
raise e
|
data/lib/pwn/version.rb
CHANGED