pwn 0.5.402 → 0.5.403

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13bfbc8e974f5f40d0e78a9081d9ade50ecbbcedbde8f7d6df60e43535e7a3ef
-  data.tar.gz: 275421f89482553cc5887d6806d84907230636db4b7a0a48c620fc69df7d3e68
+  metadata.gz: 3e5390f3bf6209a6f425edc5c920dbd6869add40979a7f25e8962356d5c9a6bd
+  data.tar.gz: 5cf631f4bc2838ed8f016bc0da2d34c4543b4610300783ce39ace423d501be57
 SHA512:
-  metadata.gz: c147247d6cc1214be92cf53af46318c63a5678183db2c743c247f9f1ae70ffb7c2719cb585e6074b55ce239a17c9167a88d00cc0823accb26feb5b517b645553
-  data.tar.gz: 6be749ad84718f956de12db9f47729eff67746177ffb3c568d7c17bebdcd948e2f97830e9c9c8ff3c2fb5dcea1c367ae27282843bd07ef02e9ad429cce3bfba8
+  metadata.gz: 36181bae24a6d150c6badf0f42a5c1e7a76fc0f385ffe775eaf0b1d2403fbbcb577aaf5dd746b0f5f6cacbcd34fdd3b40be5bf31006f1a701499906236f38b21
+  data.tar.gz: cabc729dc772df80d270bc43192db6127cf1f6c418f580031d909a1c66488d8e75c24212e137758b01fe94eb45ae955fdee2d803a1ca6da553c38a3966e7ed27

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.402]:001 >>> PWN.help
+pwn[v0.5.403]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.402]:001 >>> PWN.help
+pwn[v0.5.403]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.402]:001 >>> PWN.help
+pwn[v0.5.403]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/bin/pwn_zaproxy_active_rest_api_scan

@@ -106,8 +106,6 @@ begin
   )
 
   additional_http_headers = opts[:additional_http_headers]
-  additional_http_headers = JSON.parse(additional_http_headers, symbolize_names: true) if additional_http_headers.is_a?(String)
-
   exlude_paths = opts[:exclude_paths]
   exlude_paths = exlude_paths.split(',').map(&:strip) if exlude_paths.is_a?(String)
 
@@ -133,11 +131,17 @@ begin
     zap_obj: zap_obj,
     openapi_spec: openapi_spec
   )
-
-  # TODO: Initialize authorization header if required by API
-
   raise "ERROR: Failed to import OpenAPI/Swagger spec #{openapi_spec} into ZAP's Sitemap." if json_sitemap.nil? || json_sitemap.empty?
 
+  if additional_http_headers.is_a?(String)
+    additional_http_headers = JSON.parse(additional_http_headers, symbolize_names: true)
+    PWN::Plugins::Zaproxy.inject_additional_http_headers(
+      zap_obj: zap_obj,
+      target_regex: in_scope,
+      additional_http_headers: additional_http_headers
+    )
+  end
+
   PWN::Plugins::Zaproxy.add_to_scope(
     zap_obj: zap_obj,
     target_regex: in_scope

data/lib/pwn/plugins/zaproxy.rb

@@ -257,6 +257,52 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # PWN::Plugins::Zaproxy.inject_additional_http_headers(
+      #   zap_obj: 'required - zap_obj returned from #open method',
+      #   target_regex: 'required - url regex to inject headers into (e.g. https://test.domain.local.*)',
+      #   headers: 'required - hash of additional headers to inject into each request',
+      # )
+
+      public_class_method def self.inject_additional_http_headers(opts = {})
+        zap_obj = opts[:zap_obj]
+        api_key = zap_obj[:api_key].to_s.scrub
+        target_regex = opts[:target_regex]
+        raise 'ERROR: target_regex must be provided' if target_regex.nil?
+
+        headers = opts[:headers] ||= {}
+        raise 'ERROR: headers must be provided' if headers.empty? || !headers.is_a?(Hash)
+
+        replacer_resp_arr = []
+        headers.each_key do |header_key|
+          params = {
+            apikey: api_key,
+            description: header_key,
+            enabled: true,
+            matchType: 'REQ_HEADER',
+            matchRegex: false,
+            matchString: header_key,
+            replacement: "#{header_key}: #{headers[header_key]}",
+            initiators: '',
+            url: target_regex
+          }
+
+          response = zap_rest_call(
+            zap_obj: zap_obj,
+            rest_call: 'JSON/replacer/action/addRule/',
+            params: params
+          )
+
+          json_resp = JSON.parse(response.body, symbolize_names: true)
+          replacer_resp_arr.push(json_resp)
+        end
+
+        replacer_resp_arr
+      rescue StandardError, SystemExit, Interrupt => e
+        stop(zap_obj: zap_obj) unless zap_obj.nil?
+        raise e
+      end
+
       # Supported Method Parameters::
       # PWN::Plugins::Zaproxy.active_scan(
       #   zap_obj: 'required - zap_obj returned from #open method',
@@ -525,6 +571,18 @@ module PWN
             openapi_spec: 'required - path to OpenAPI JSON or YAML spec file'
           )
 
+          #{self}.add_to_scope(
+            zap_obj: 'required - zap_obj returned from #open method',
+            target_regex: 'required - url regex to add to scope (e.g. https://test.domain.local.*)',
+            context_name: 'optional - context name to add target_regex to (defaults to Default Context)'
+          )
+
+          #{self}.inject_additional_http_headers(
+            zap_obj: 'required - zap_obj returned from #open method',
+            target_regex: 'required - url regex to inject headers into (e.g. https://test.domain.local.*)',
+            headers: 'required - hash of additional headers to inject into each request'
+          )
+
           #{self}.active_scan(
             zap_obj: 'required - zap_obj returned from #open method'
             target_url: 'required - url to scan',

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.402'
+  VERSION = '0.5.403'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.402
+  version: 0.5.403
 platform: ruby
 authors:
 - 0day Inc.