pwn 0.5.404 → 0.5.405

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43c98ee49b32ce9b04d3fdc660599c8b7fc47db6f5b5042169a1ffe96eb6bb77
-  data.tar.gz: a577bdac165bd2e96ec1ed87bb51c0d434276a00e8234f58c200e037ef1b83c0
+  metadata.gz: a4b31134e90c20f44f69f6b1fbf8b6e4c8e7911bbec857597c729c0801578d5f
+  data.tar.gz: 8774dc902ef4eadf6d32303cac8efe5fea2a909997a4d7d2c0fdb2e8c137e58a
 SHA512:
-  metadata.gz: 6bad0c2f1b20916b4245dc95a8b7a42f9a686e386fe475238b3890ea2287331e737d794b2a88e32437b50355fe4a3786420b3a756b40bc3f99b5fd76f3ce0496
-  data.tar.gz: fd6cb93dad15d5e55e824a6bdbe13a3260612a015054d4cff6637b5469f5aa88ce7bdbe5409f83f4102f0023ba4ba2c9ca486ffaf3bddd8a94db37d98c761506
+  metadata.gz: a583c93c1288496cb703e5b4e48a9a70f258c955b05d0dbbf9ffa27b1be25c0d1c2568537379ebe65ae63a423bf31cc022221074e3d8cdbfe100c59739d25099
+  data.tar.gz: b9b3af817aa7ccd08a05cbc6cbe1107c5760db93b6ec9343a01b74d3b7d992d6f72abe4c11ef5d156f96649268a51b3b1177daa97fff2b04d7c759c781a69884

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.404]:001 >>> PWN.help
+pwn[v0.5.405]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.404]:001 >>> PWN.help
+pwn[v0.5.405]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.404]:001 >>> PWN.help
+pwn[v0.5.405]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/zaproxy.rb

@@ -204,6 +204,192 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # PWN::Plugins::Zaproxy.add_requester_tab(
+      #   zap_obj: 'required - zap_obj returned from #open method',
+      #   request: 'required - base64 encoded HTTP request (e.g. from #get_sitemap method)'
+      # )
+
+      public_class_method def self.add_requester_tab(opts = {})
+        zap_obj = opts[:zap_obj]
+        api_key = zap_obj[:api_key].to_s.scrub
+        request = opts[:request]
+
+        dec_request = Base64.strict_decode64(request).force_encoding('ASCII-8BIT')
+
+        # Parse the full request string
+        parts = dec_request.split("\r\n\r\n", 2)
+        headers_part = parts[0]
+        body = parts[1] || ''
+
+        header_lines = headers_part.split("\r\n")
+        first_line = header_lines.shift
+        method, full_url, http_version = first_line.split
+
+        headers = []
+        header_lines.each do |line|
+          name, value = line.split(': ', 2)
+          headers << { name: name, value: value }
+        end
+
+        # Parse URL for queryString and adjust url
+        uri = URI.parse(full_url)
+        query_string = []
+        if uri.query
+          URI.decode_www_form(uri.query).each do |name, value|
+            query_string << { name: name, value: value }
+          end
+        end
+        url = "#{uri.scheme}://#{uri.host}"
+        url += ":#{uri.port}" if uri.port && uri.port != (uri.scheme == 'https' ? 443 : 80)
+        url += uri.path
+
+        # Determine content-type
+        content_type_header = headers.find { |h| h[:name].downcase == 'content-type' }
+        mime_type = content_type_header ? content_type_header[:value] : 'application/octet-stream'
+
+        # Handle postData
+        post_data = nil
+        methods_with_body = %w[POST PUT PATCH]
+        if methods_with_body.include?(method) && !body.empty?
+          post_data = {
+            mimeType: mime_type,
+            params: [],
+            text: body
+          }
+
+          temp_body = body.dup.force_encoding('UTF-8')
+          if temp_body.valid_encoding?
+            if mime_type.include?('application/x-www-form-urlencoded')
+              URI.decode_www_form(temp_body).each do |name, value|
+                post_data[:params] << { name: name, value: value }
+              end
+            end
+          else
+            post_data[:text] = Base64.encode64(body)
+            post_data[:encoding] = 'base64'
+          end
+        end
+
+        # Construct HAR request
+        har_request = {
+          method: method,
+          url: url,
+          httpVersion: http_version,
+          cookies: [],
+          headers: headers,
+          queryString: query_string,
+          headersSize: -1,
+          bodySize: -1
+        }
+        har_request[:postData] = post_data if post_data
+
+        har_json = JSON.generate(har_request)
+
+        params = {
+          apikey: api_key,
+          request: har_json,
+          followRedirects: 'true'
+        }
+
+        response = zap_rest_call(
+          zap_obj: zap_obj,
+          rest_call: 'OTHER/core/other/sendHarRequest/',
+          params: params
+        )
+
+        JSON.parse(response.body, symbolize_names: true)
+      rescue StandardError, SystemExit, Interrupt => e
+        stop(zap_obj: zap_obj) unless zap_obj.nil?
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # json_sitemap = PWN::Plugins::Zaproxy.get_sitemap(
+      #   zap_obj: 'required - zap_obj returned from #open method'
+      # )
+
+      public_class_method def self.get_sitemap(opts = {})
+        zap_obj = opts[:zap_obj]
+        api_key = zap_obj[:api_key].to_s.scrub
+
+        entries = []
+        start = 0
+        count = 1000
+
+        loop do
+          params = { apikey: api_key, start: start, count: count }
+
+          response = zap_rest_call(
+            zap_obj: zap_obj,
+            rest_call: 'OTHER/exim/other/exportHar/',
+            params: params
+          )
+
+          har_data = JSON.parse(response.body, symbolize_names: true)
+          new_entries = har_data[:log][:entries]
+          break if new_entries.empty?
+
+          entries += new_entries
+          start += count
+        end
+
+        # Deduplicate entries based on method + url
+        seen = Set.new
+        converted_messages = []
+
+        entries.each do |entry|
+          req = entry[:request]
+          key = [req[:method], req[:url]]
+          next if seen.include?(key)
+
+          seen.add(key)
+
+          # Build full request string
+          req_line = "#{req[:method]} #{req[:url]} #{req[:httpVersion]}\r\n"
+          req_headers = req[:headers].map { |h| "#{h[:name]}: #{h[:value]}\r\n" }.join
+          req_body = ''
+          if req[:postData] && req[:postData][:text]
+            req_body = req[:postData][:text]
+            req_body = Base64.decode64(req_body) if req[:postData][:encoding] == 'base64'
+          end
+          full_req = "#{req_line}#{req_headers}\r\n#{req_body}".force_encoding('ASCII-8BIT')
+          encoded_req = Base64.strict_encode64(full_req)
+
+          # Build full response string
+          res = entry[:response]
+          res_line = "#{res[:httpVersion]} #{res[:status]} #{res[:statusText]}\r\n"
+          res_headers = res[:headers].map { |h| "#{h[:name]}: #{h[:value]}\r\n" }.join
+          res_body = ''
+          if res[:content] && res[:content][:text]
+            res_body = res[:content][:text]
+            res_body = Base64.decode64(res_body) if res[:content][:encoding] == 'base64'
+          end
+          full_res = "#{res_line}#{res_headers}\r\n#{res_body}".force_encoding('ASCII-8BIT')
+          encoded_res = Base64.strict_encode64(full_res)
+
+          # Extract http_service
+          uri = URI.parse(req[:url])
+          http_service = {
+            host: uri.host,
+            port: uri.port,
+            protocol: uri.scheme
+          }
+
+          # Add to array
+          converted_messages << {
+            request: encoded_req,
+            response: encoded_res,
+            http_service: http_service
+          }
+        end
+
+        converted_messages
+      rescue StandardError, SystemExit, Interrupt => e
+        stop(zap_obj: zap_obj) unless zap_obj.nil?
+        raise e
+      end
+
       # Supported Method Parameters::
       # PWN::Plugins::Zaproxy.spider(
       #   zap_obj: 'required - zap_obj returned from #open method',
@@ -273,14 +459,41 @@ module PWN
         headers = opts[:headers] ||= {}
         raise 'ERROR: headers must be provided' if headers.empty? || !headers.is_a?(Hash)
 
+        # Check if replacer rule already exists
+        params = { apikey: api_key }
+        response = zap_rest_call(
+          zap_obj: zap_obj,
+          rest_call: 'JSON/replacer/view/rules/',
+          params: params
+        )
+        replacer = JSON.parse(response.body, symbolize_names: true)
+
         replacer_resp_arr = []
         headers.each_key do |header_key|
+          this_header = { header: header_key }
+          rule_exists = replacer[:rules].any? { |rule| rule[:description] == header_key.to_s && rule[:url] == target_regex }
+
+          if rule_exists
+            # Remove existing rule first
+            puts "Removing existing replacer rule for header key: #{header_key}..."
+            params = {
+              apikey: api_key,
+              description: header_key
+            }
+            zap_rest_call(
+              zap_obj: zap_obj,
+              rest_call: 'JSON/replacer/action/removeRule/',
+              params: params
+            )
+          end
+
+          puts "Adding replacer rule for header key: #{header_key}..."
           params = {
             apikey: api_key,
             description: header_key,
-            enabled: true,
+            enabled: 'true',
             matchType: 'REQ_HEADER',
-            matchRegex: false,
+            matchRegex: 'false',
             matchString: header_key,
             replacement: headers[header_key],
             initiators: '',
@@ -294,7 +507,8 @@ module PWN
           )
 
           json_resp = JSON.parse(response.body, symbolize_names: true)
-          replacer_resp_arr.push(json_resp)
+          this_header[:Result] = json_resp[:Result]
+          replacer_resp_arr.push(this_header)
         end
 
         replacer_resp_arr
@@ -577,6 +791,19 @@ module PWN
             context_name: 'optional - context name to add target_regex to (defaults to Default Context)'
           )
 
+          #{self}.add_requester_tab(
+            zap_obj: 'required - zap_obj returned from #open method',
+            request: 'required - base64 encoded HTTP request (e.g. from #get_sitemap method)'
+          )
+
+          #{self}.get_sitemap(
+            zap_obj: 'required - zap_obj returned from #open method'
+          )
+
+          json_sitemap = #{self}.spider(
+            zap_obj: 'required - zap_obj returned from #open method'
+          )
+
           #{self}.inject_additional_http_headers(
             zap_obj: 'required - zap_obj returned from #open method',
             target_regex: 'required - url regex to inject headers into (e.g. https://test.domain.local.*)',

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.404'
+  VERSION = '0.5.405'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.404
+  version: 0.5.405
 platform: ruby
 authors:
 - 0day Inc.