pwn 0.5.497 → 0.5.499
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +3 -3
- data/lib/pwn/plugins/burp_suite.rb +230 -180
- data/lib/pwn/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 4e56e54848ac7ff737e0c074dba6ec24cd7fcb3eb60012eadd218b41fc951302
|
|
4
|
+
data.tar.gz: 2d2221ff56638e8bb30b7ce9e907f390e1bc84c3c63dddccb6a34b6e83d8e920
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: bfc2c1f2ffbf9447c7c2fa25de875d353f0ebc3a98158ea36a34459b7ae07c93aac81e98bf25657d2cde2ec640a09122724797563d24c3f57dc688246578e4fa
|
|
7
|
+
data.tar.gz: fbe74658bc1c81f3dd5e8da72a36edaa0ac58362ba8ee82d39089ade0e721924f49c8077afb6ae0775299fbbf03a5885ebc37ceea50fd6802885b962145ae382
|
data/README.md
CHANGED
|
@@ -37,7 +37,7 @@ $ cd /opt/pwn
|
|
|
37
37
|
$ ./install.sh
|
|
38
38
|
$ ./install.sh ruby-gem
|
|
39
39
|
$ pwn
|
|
40
|
-
pwn[v0.5.
|
|
40
|
+
pwn[v0.5.499]:001 >>> PWN.help
|
|
41
41
|
```
|
|
42
42
|
|
|
43
43
|
[](https://youtu.be/G7iLUY4FzsI)
|
|
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
|
|
|
52
52
|
$ gem uninstall --all --executables pwn
|
|
53
53
|
$ gem install --verbose pwn
|
|
54
54
|
$ pwn
|
|
55
|
-
pwn[v0.5.
|
|
55
|
+
pwn[v0.5.499]:001 >>> PWN.help
|
|
56
56
|
```
|
|
57
57
|
|
|
58
58
|
If you're using a multi-user install of RVM do:
|
|
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
|
|
|
62
62
|
$ rvmsudo gem uninstall --all --executables pwn
|
|
63
63
|
$ rvmsudo gem install --verbose pwn
|
|
64
64
|
$ pwn
|
|
65
|
-
pwn[v0.5.
|
|
65
|
+
pwn[v0.5.499]:001 >>> PWN.help
|
|
66
66
|
```
|
|
67
67
|
|
|
68
68
|
PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`. The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:
|
|
@@ -43,6 +43,182 @@ module PWN
|
|
|
43
43
|
raise e
|
|
44
44
|
end
|
|
45
45
|
|
|
46
|
+
# Supported Method Parameters::
|
|
47
|
+
# burp_obj = PWN::Plugins::BurpSuite.init_introspection_thread(
|
|
48
|
+
# burp_obj: 'required - burp_obj returned by #start method',
|
|
49
|
+
# enumerable_array: 'required - array of items to process in the thread'
|
|
50
|
+
# )
|
|
51
|
+
private_class_method def self.init_introspection_thread(opts = {})
|
|
52
|
+
# if PWN::Env[:ai][:introspection] is true,
|
|
53
|
+
# spin up Thread to:
|
|
54
|
+
# 1. Periodically call get_proxy_history(burp_obj: burp_obj) method
|
|
55
|
+
# 2. For each entry w/ empty comment,
|
|
56
|
+
# generate AI analysis via PWN::AI::Introspection.reflect_on
|
|
57
|
+
# and populate the comment field for the entry.
|
|
58
|
+
# 3. Update the highlight field based on EPSS score extracted from AI analysis.
|
|
59
|
+
# 4. Call update_proxy_history(burp_obj: burp_obj, entry: updated_entry)
|
|
60
|
+
burp_obj = opts[:burp_obj]
|
|
61
|
+
raise 'ERROR: burp_obj parameter is required' unless burp_obj.is_a?(Hash)
|
|
62
|
+
|
|
63
|
+
if PWN::Env[:ai][:introspection]
|
|
64
|
+
introspection_thread = Thread.new do
|
|
65
|
+
system_role_content = '
|
|
66
|
+
Your expertise lies in dissecting HTTP request/response pairs to identify high-impact vulnerabilities, including but not limited to XSS (reflected, stored, DOM-based), CSRF, SSRF, IDOR, open redirects, CORS misconfigurations, authentication bypasses, SQLi/NoSQLi, command/code injection, business logic flaws, and API abuse. You prioritize zero-days and novel chains, always focusing on exploitability, impact (e.g., account takeover, data exfiltration, RCE), and reproducibility.
|
|
67
|
+
|
|
68
|
+
When analyzing HTTP request/response pairs:
|
|
69
|
+
|
|
70
|
+
1. **Parse and Contextualize Traffic**:
|
|
71
|
+
- Break down every element: HTTP method, URI (path, query parameters), headers (e.g., Host, User-Agent, Cookies, Authorization, Referer, Origin, Content-Type), request body (e.g., form data, JSON payloads), response status code, response headers, and response body (HTML, JSON, XML, etc.).
|
|
72
|
+
- Identify dynamic elements: User-controlled inputs (e.g., query params, POST data, headers like X-Forwarded-For), server-side echoes, redirects, and client-side processing.
|
|
73
|
+
- Trace data flow: Map how inputs propagate from request to response, including any client-side JavaScript execution where exploitation may be possible in the client without communicating with the server (e.g. DOM-XSS).
|
|
74
|
+
|
|
75
|
+
2. **Vulnerability Hunting Framework**:
|
|
76
|
+
- **Input Validation & Sanitization**: Check for unescaped/lack of encoding in outputs (e.g., HTML context for XSS, URL context for open redirects).
|
|
77
|
+
- **XSS Focus**: Hunt for sinks like innerHTML/outerHTML, document.write, eval, setTimeout/setInterval with strings, location.href/assign/replace, and history.pushState. Test payloads like <script>alert(1)</script>, javascript:alert(1), and polyglots. For DOM-based, simulate client-side execution.
|
|
78
|
+
- **JavaScript Library Analysis**: If JS is present (e.g., in response body or referenced scripts), deobfuscate and inspect:
|
|
79
|
+
- Objects/properties that could clobber DOM (e.g., window.name, document.cookie manipulation leading to prototype pollution).
|
|
80
|
+
- DOM XSS vectors: Analyze event handlers, querySelector, addEventListener with unsanitized data from location.hash/search, postMessage, or localStorage.
|
|
81
|
+
- Third-party libs (e.g., jQuery, React): Flag known sink patterns like .html(), dangerouslySetInnerHTML, or eval-like functions.
|
|
82
|
+
- **Server-Side Issues**: Probe for SSRF (e.g., via URL params fetching internal resources), IDOR (e.g., manipulating IDs in paths/bodies), rate limiting bypass, and insecure deserialization (e.g., in JSON/PHP objects).
|
|
83
|
+
- **Headers & Misc**: Examine for exposed sensitive info (e.g., debug headers, stack traces), misconfigured security headers (CSP, HSTS), and upload flaws (e.g., file extension bypass).
|
|
84
|
+
- **Chaining Opportunities**: Always consider multi-step exploits, like XSS leading to CSRF token theft or SSRF to internal metadata endpoints.
|
|
85
|
+
|
|
86
|
+
3. **PoC Generation**:
|
|
87
|
+
- Produce concise, step-by-step PoCs in a standardized format:
|
|
88
|
+
- **Description**: Clear vuln summary, CVSS-like severity, and impact.
|
|
89
|
+
- **Steps to Reproduce**: Numbered HTTP requests (use curl or Burp syntax, e.g., `curl -X POST -d "param=<payload>" https://target.com/endpoint`).
|
|
90
|
+
- **Payloads**: Provide working, minimal payloads with variations for evasion (e.g., encoded, obfuscated).
|
|
91
|
+
- **Screenshots/Evidence**: Suggest what to capture (e.g., alert popup for XSS, response diff for IDOR).
|
|
92
|
+
- **Mitigation Advice**: Recommend fixes (e.g., output encoding, input validation).
|
|
93
|
+
- Ensure PoCs are ethical: Target only in-scope assets, avoid DoS, and emphasize disclosure via proper channels (e.g., HackerOne, Bugcrowd).
|
|
94
|
+
- If no vuln found, explain why and suggest further tests (e.g., fuzzing params).
|
|
95
|
+
4. Risk Score:
|
|
96
|
+
For each analysis generate a risk score between 0% - 100% based on exploitability and impact. This should be reflected as { "risk_score": "nnn%" } in the final output JSON.
|
|
97
|
+
|
|
98
|
+
Analyze provided HTTP request/response pairs methodically: Start with a high-level overview, then dive into specifics, flag potential issues with evidence from the traffic, and end with PoC if applicable. Be verbose in reasoning but concise in output. Prioritize high-severity findings. If data is incomplete, request clarifications.
|
|
99
|
+
'
|
|
100
|
+
|
|
101
|
+
get_highlight_color = lambda do |opts = {}|
|
|
102
|
+
ai_analysis = opts[:ai_analysis]
|
|
103
|
+
|
|
104
|
+
highlight_color = 'GRAY'
|
|
105
|
+
if ai_analysis =~ /"risk_score":\s*"(\d{1,3})%"/
|
|
106
|
+
score = Regexp.last_match(1).to_i
|
|
107
|
+
highlight_color = case score
|
|
108
|
+
when 0..24
|
|
109
|
+
'GREEN'
|
|
110
|
+
when 25..49
|
|
111
|
+
'YELLOW'
|
|
112
|
+
when 50..74
|
|
113
|
+
'ORANGE'
|
|
114
|
+
when 75..100
|
|
115
|
+
'RED'
|
|
116
|
+
end
|
|
117
|
+
end
|
|
118
|
+
|
|
119
|
+
highlight_color
|
|
120
|
+
end
|
|
121
|
+
|
|
122
|
+
loop do
|
|
123
|
+
# TODO: Implement sitemap and repeater into the loop.
|
|
124
|
+
# Sitemap should work the same as proxy history.
|
|
125
|
+
# Repeater should analyze the reqesut/response pair and suggest
|
|
126
|
+
# modifications to the request to further probe for vulnerabilities.
|
|
127
|
+
sitemap = get_sitemap(burp_obj: burp_obj)
|
|
128
|
+
sitemap.each do |entry|
|
|
129
|
+
next unless entry.key?(:comment) && entry[:comment].to_s.strip.empty?
|
|
130
|
+
|
|
131
|
+
request = entry[:request]
|
|
132
|
+
response = entry[:response]
|
|
133
|
+
host = entry[:http_service][:host]
|
|
134
|
+
port = entry[:http_service][:port]
|
|
135
|
+
protocol = entry[:http_service][:protocol]
|
|
136
|
+
next if request.nil? || response.nil? || host.nil? || port.nil? || protocol.nil?
|
|
137
|
+
|
|
138
|
+
request = Base64.strict_decode64(request)
|
|
139
|
+
response = Base64.strict_decode64(response)
|
|
140
|
+
http_request_response = PWN::Plugins::Char.force_utf8("#{request}\r\n\r\n#{response}")
|
|
141
|
+
ai_analysis = PWN::AI::Introspection.reflect_on(
|
|
142
|
+
system_role_content: system_role_content,
|
|
143
|
+
request: http_request_response,
|
|
144
|
+
suppress_pii_warning: true
|
|
145
|
+
)
|
|
146
|
+
|
|
147
|
+
next if ai_analysis.nil? || ai_analysis.strip.empty?
|
|
148
|
+
|
|
149
|
+
entry[:comment] = ai_analysis
|
|
150
|
+
entry[:highlight] = get_highlight_color.call(ai_analysis: ai_analysis)
|
|
151
|
+
|
|
152
|
+
update_sitemap(
|
|
153
|
+
burp_obj: burp_obj,
|
|
154
|
+
entry: entry
|
|
155
|
+
)
|
|
156
|
+
end
|
|
157
|
+
|
|
158
|
+
proxy_history = get_proxy_history(burp_obj: burp_obj)
|
|
159
|
+
proxy_history.each do |entry|
|
|
160
|
+
next unless entry.key?(:comment) && entry[:comment].to_s.strip.empty?
|
|
161
|
+
|
|
162
|
+
request = entry[:request]
|
|
163
|
+
response = entry[:response]
|
|
164
|
+
host = entry[:http_service][:host]
|
|
165
|
+
port = entry[:http_service][:port]
|
|
166
|
+
protocol = entry[:http_service][:protocol]
|
|
167
|
+
next if request.nil? || response.nil? || host.nil? || port.nil? || protocol.nil?
|
|
168
|
+
|
|
169
|
+
request = Base64.strict_decode64(request)
|
|
170
|
+
response = Base64.strict_decode64(response)
|
|
171
|
+
|
|
172
|
+
# If sitemap comment and highlight color exists, use that instead of re-analyzing
|
|
173
|
+
sitemap_entry = sitemap.find do |sitemap_item|
|
|
174
|
+
sitemap_item[:http_service][:host] == host &&
|
|
175
|
+
sitemap_item[:http_service][:port] == port &&
|
|
176
|
+
sitemap_item[:http_service][:protocol] == protocol &&
|
|
177
|
+
sitemap_item[:request] == entry[:request]
|
|
178
|
+
end
|
|
179
|
+
|
|
180
|
+
if sitemap_entry.nil?
|
|
181
|
+
http_request_response = PWN::Plugins::Char.force_utf8("#{request}\r\n\r\n#{response}")
|
|
182
|
+
ai_analysis = PWN::AI::Introspection.reflect_on(
|
|
183
|
+
system_role_content: system_role_content,
|
|
184
|
+
request: http_request_response,
|
|
185
|
+
suppress_pii_warning: true
|
|
186
|
+
)
|
|
187
|
+
|
|
188
|
+
next if ai_analysis.nil? || ai_analysis.strip.empty?
|
|
189
|
+
|
|
190
|
+
entry[:comment] = ai_analysis
|
|
191
|
+
entry[:highlight] = get_highlight_color.call(ai_analysis: ai_analysis)
|
|
192
|
+
else
|
|
193
|
+
entry[:comment] = sitemap_entry[:comment]
|
|
194
|
+
entry[:highlight] = sitemap_entry[:highlight]
|
|
195
|
+
end
|
|
196
|
+
|
|
197
|
+
update_proxy_history(
|
|
198
|
+
burp_obj: burp_obj,
|
|
199
|
+
entry: entry
|
|
200
|
+
)
|
|
201
|
+
end
|
|
202
|
+
sleep 3
|
|
203
|
+
end
|
|
204
|
+
rescue Errno::ECONNREFUSED
|
|
205
|
+
puts 'Thread Terminating...'
|
|
206
|
+
rescue StandardError => e
|
|
207
|
+
puts "BurpSuite AI Introspection Thread Error: #{e}"
|
|
208
|
+
puts e.backtrace
|
|
209
|
+
raise e
|
|
210
|
+
ensure
|
|
211
|
+
puts 'BurpSuite AI Introspection Thread >>> Goodbye.'
|
|
212
|
+
end
|
|
213
|
+
|
|
214
|
+
burp_obj[:introspection_thread] = introspection_thread
|
|
215
|
+
end
|
|
216
|
+
|
|
217
|
+
burp_obj
|
|
218
|
+
rescue StandardError => e
|
|
219
|
+
raise e
|
|
220
|
+
end
|
|
221
|
+
|
|
46
222
|
# Supported Method Parameters::
|
|
47
223
|
# burp_obj1 = PWN::Plugins::BurpSuite.start(
|
|
48
224
|
# burp_jar_path: 'optional - path of burp suite pro jar file (defaults to /opt/burpsuite/burpsuite_pro.jar)',
|
|
@@ -124,117 +300,7 @@ module PWN
|
|
|
124
300
|
enabled: true
|
|
125
301
|
)
|
|
126
302
|
|
|
127
|
-
|
|
128
|
-
# spin up PWN::Plugins::ThreadPool to
|
|
129
|
-
# 1. Periodically call get_proxy_history(burp_obj: burp_obj) method
|
|
130
|
-
# 2. For each entry w/ empty comment,
|
|
131
|
-
# generate AI analysis via PWN::AI::Introspection.reflect_on
|
|
132
|
-
# and populate the comment field for the entry.
|
|
133
|
-
# 3. Update the highlight field based on EPSS score extracted from AI analysis.
|
|
134
|
-
# 4. Call update_proxy_history(burp_obj: burp_obj, entry: updated_entry)
|
|
135
|
-
if PWN::Env[:ai][:introspection]
|
|
136
|
-
proxy_history_introspection = Thread.new do
|
|
137
|
-
loop do
|
|
138
|
-
proxy_history = get_proxy_history(burp_obj: burp_obj)
|
|
139
|
-
proxy_history.each do |entry|
|
|
140
|
-
next unless entry.key?(:comment) && entry[:comment].to_s.strip.empty?
|
|
141
|
-
|
|
142
|
-
request = entry[:request]
|
|
143
|
-
response = entry[:response]
|
|
144
|
-
host = entry[:http_service][:host]
|
|
145
|
-
port = entry[:http_service][:port]
|
|
146
|
-
protocol = entry[:http_service][:protocol]
|
|
147
|
-
next if request.nil? || response.nil? || host.nil? || port.nil? || protocol.nil?
|
|
148
|
-
|
|
149
|
-
request = Base64.strict_decode64(request)
|
|
150
|
-
response = Base64.strict_decode64(response)
|
|
151
|
-
|
|
152
|
-
http_request_response = PWN::Plugins::Char.force_utf8("#{request}\r\n\r\n#{response}")
|
|
153
|
-
system_role_content = '
|
|
154
|
-
Your expertise lies in dissecting HTTP request/response pairs to identify high-impact vulnerabilities, including but not limited to XSS (reflected, stored, DOM-based), CSRF, SSRF, IDOR, open redirects, CORS misconfigurations, authentication bypasses, SQLi/NoSQLi, command/code injection, business logic flaws, and API abuse. You prioritize zero-days and novel chains, always focusing on exploitability, impact (e.g., account takeover, data exfiltration, RCE), and reproducibility.
|
|
155
|
-
|
|
156
|
-
When analyzing HTTP request/response pairs:
|
|
157
|
-
|
|
158
|
-
1. **Parse and Contextualize Traffic**:
|
|
159
|
-
- Break down every element: HTTP method, URI (path, query parameters), headers (e.g., Host, User-Agent, Cookies, Authorization, Referer, Origin, Content-Type), request body (e.g., form data, JSON payloads), response status code, response headers, and response body (HTML, JSON, XML, etc.).
|
|
160
|
-
- Identify dynamic elements: User-controlled inputs (e.g., query params, POST data, headers like X-Forwarded-For), server-side echoes, redirects, and client-side processing.
|
|
161
|
-
- Trace data flow: Map how inputs propagate from request to response, including any client-side JavaScript execution where exploitation may be possible in the client without communicating with the server (e.g. DOM-XSS).
|
|
162
|
-
|
|
163
|
-
2. **Vulnerability Hunting Framework**:
|
|
164
|
-
- **Input Validation & Sanitization**: Check for unescaped/lack of encoding in outputs (e.g., HTML context for XSS, URL context for open redirects).
|
|
165
|
-
- **XSS Focus**: Hunt for sinks like innerHTML/outerHTML, document.write, eval, setTimeout/setInterval with strings, location.href/assign/replace, and history.pushState. Test payloads like <script>alert(1)</script>, javascript:alert(1), and polyglots. For DOM-based, simulate client-side execution.
|
|
166
|
-
- **JavaScript Library Analysis**: If JS is present (e.g., in response body or referenced scripts), deobfuscate and inspect:
|
|
167
|
-
- Objects/properties that could clobber DOM (e.g., window.name, document.cookie manipulation leading to prototype pollution).
|
|
168
|
-
- DOM XSS vectors: Analyze event handlers, querySelector, addEventListener with unsanitized data from location.hash/search, postMessage, or localStorage.
|
|
169
|
-
- Third-party libs (e.g., jQuery, React): Flag known sink patterns like .html(), dangerouslySetInnerHTML, or eval-like functions.
|
|
170
|
-
- **Server-Side Issues**: Probe for SSRF (e.g., via URL params fetching internal resources), IDOR (e.g., manipulating IDs in paths/bodies), rate limiting bypass, and insecure deserialization (e.g., in JSON/PHP objects).
|
|
171
|
-
- **Headers & Misc**: Examine for exposed sensitive info (e.g., debug headers, stack traces), misconfigured security headers (CSP, HSTS), and upload flaws (e.g., file extension bypass).
|
|
172
|
-
- **Chaining Opportunities**: Always consider multi-step exploits, like XSS leading to CSRF token theft or SSRF to internal metadata endpoints.
|
|
173
|
-
|
|
174
|
-
3. **PoC Generation**:
|
|
175
|
-
- Produce concise, step-by-step PoCs in a standardized format:
|
|
176
|
-
- **Description**: Clear vuln summary, CVSS-like severity, and impact.
|
|
177
|
-
- **Steps to Reproduce**: Numbered HTTP requests (use curl or Burp syntax, e.g., `curl -X POST -d "param=<payload>" https://target.com/endpoint`).
|
|
178
|
-
- **Payloads**: Provide working, minimal payloads with variations for evasion (e.g., encoded, obfuscated).
|
|
179
|
-
- **Screenshots/Evidence**: Suggest what to capture (e.g., alert popup for XSS, response diff for IDOR).
|
|
180
|
-
- **Mitigation Advice**: Recommend fixes (e.g., output encoding, input validation).
|
|
181
|
-
- Ensure PoCs are ethical: Target only in-scope assets, avoid DoS, and emphasize disclosure via proper channels (e.g., HackerOne, Bugcrowd).
|
|
182
|
-
- If no vuln found, explain why and suggest further tests (e.g., fuzzing params).
|
|
183
|
-
4. Risk Score:
|
|
184
|
-
For each analysis generate a risk score between 0% - 100% based on exploitability and impact. This should be reflected as { "risk_score": "nnn%" } in the final output JSON.
|
|
185
|
-
|
|
186
|
-
Analyze provided HTTP request/response pairs methodically: Start with a high-level overview, then dive into specifics, flag potential issues with evidence from the traffic, and end with PoC if applicable. Be verbose in reasoning but concise in output. Prioritize high-severity findings. If data is incomplete, request clarifications.
|
|
187
|
-
'
|
|
188
|
-
|
|
189
|
-
ai_analysis = PWN::AI::Introspection.reflect_on(
|
|
190
|
-
system_role_content: system_role_content,
|
|
191
|
-
request: http_request_response,
|
|
192
|
-
suppress_pii_warning: true
|
|
193
|
-
)
|
|
194
|
-
|
|
195
|
-
next if ai_analysis.nil? || ai_analysis.strip.empty?
|
|
196
|
-
|
|
197
|
-
entry[:comment] = ai_analysis
|
|
198
|
-
# Extract score and assign color highlight based on severity
|
|
199
|
-
if ai_analysis =~ /"risk_score":\s*"(\d{1,3})%"/
|
|
200
|
-
score = Regexp.last_match(1).to_i
|
|
201
|
-
highlight_color = case score
|
|
202
|
-
when 0..24
|
|
203
|
-
'GREEN'
|
|
204
|
-
when 25..49
|
|
205
|
-
'YELLOW'
|
|
206
|
-
when 50..74
|
|
207
|
-
'ORANGE'
|
|
208
|
-
when 75..100
|
|
209
|
-
'RED'
|
|
210
|
-
end
|
|
211
|
-
end
|
|
212
|
-
highlight_color ||= 'GRAY'
|
|
213
|
-
entry[:highlight] = highlight_color
|
|
214
|
-
|
|
215
|
-
entry.delete(:request)
|
|
216
|
-
entry.delete(:response)
|
|
217
|
-
entry.delete(:http_service)
|
|
218
|
-
|
|
219
|
-
update_proxy_history(
|
|
220
|
-
burp_obj: burp_obj,
|
|
221
|
-
entry: entry
|
|
222
|
-
)
|
|
223
|
-
end
|
|
224
|
-
sleep 10
|
|
225
|
-
end
|
|
226
|
-
rescue Errno::ECONNREFUSED
|
|
227
|
-
puts 'BurpSuite Proxy History AI Introspection Thread Terminating...'
|
|
228
|
-
rescue StandardError => e
|
|
229
|
-
puts "BurpSuite Proxy History AI Introspection Thread Error: #{e}"
|
|
230
|
-
puts e.backtrace
|
|
231
|
-
raise e
|
|
232
|
-
end
|
|
233
|
-
|
|
234
|
-
burp_obj[:proxy_history_introspection_thread] = proxy_history_introspection
|
|
235
|
-
end
|
|
236
|
-
|
|
237
|
-
burp_obj
|
|
303
|
+
init_introspection_thread(burp_obj: burp_obj)
|
|
238
304
|
rescue StandardError => e
|
|
239
305
|
stop(burp_obj: burp_obj) unless burp_obj.nil?
|
|
240
306
|
raise e
|
|
@@ -665,7 +731,7 @@ module PWN
|
|
|
665
731
|
end
|
|
666
732
|
|
|
667
733
|
# Supported Method Parameters::
|
|
668
|
-
#
|
|
734
|
+
# json_proxy_history = PWN::Plugins::BurpSuite.update_proxy_history(
|
|
669
735
|
# burp_obj: 'required - burp_obj returned by #start method',
|
|
670
736
|
# entry: 'required - hash of the proxy history entry to update'
|
|
671
737
|
# )
|
|
@@ -683,6 +749,11 @@ module PWN
|
|
|
683
749
|
rest_browser = burp_obj[:rest_browser]
|
|
684
750
|
mitm_rest_api = burp_obj[:mitm_rest_api]
|
|
685
751
|
|
|
752
|
+
# Only allow updating of comment and highlight fields
|
|
753
|
+
entry.delete(:request)
|
|
754
|
+
entry.delete(:response)
|
|
755
|
+
entry.delete(:http_service)
|
|
756
|
+
|
|
686
757
|
put_body = entry.to_json
|
|
687
758
|
|
|
688
759
|
proxy_history_resp = rest_browser.put(
|
|
@@ -906,70 +977,6 @@ module PWN
|
|
|
906
977
|
sitemap = opts[:sitemap] ||= {}
|
|
907
978
|
debug = opts[:debug] || false
|
|
908
979
|
|
|
909
|
-
request = Base64.strict_decode64(sitemap[:request])
|
|
910
|
-
response = Base64.strict_decode64(sitemap[:response])
|
|
911
|
-
|
|
912
|
-
http_request_response = PWN::Plugins::Char.force_utf8("#{request}\r\n\r\n#{response}")
|
|
913
|
-
|
|
914
|
-
system_role_content = '
|
|
915
|
-
Your expertise lies in dissecting HTTP request/response pairs to identify high-impact vulnerabilities, including but not limited to XSS (reflected, stored, DOM-based), CSRF, SSRF, IDOR, open redirects, CORS misconfigurations, authentication bypasses, SQLi/NoSQLi, command/code injection, business logic flaws, and API abuse. You prioritize zero-days and novel chains, always focusing on exploitability, impact (e.g., account takeover, data exfiltration, RCE), and reproducibility.
|
|
916
|
-
|
|
917
|
-
When analyzing HTTP request/response pairs:
|
|
918
|
-
|
|
919
|
-
1. **Parse and Contextualize Traffic**:
|
|
920
|
-
- Break down every element: HTTP method, URI (path, query parameters), headers (e.g., Host, User-Agent, Cookies, Authorization, Referer, Origin, Content-Type), request body (e.g., form data, JSON payloads), response status code, response headers, and response body (HTML, JSON, XML, etc.).
|
|
921
|
-
- Identify dynamic elements: User-controlled inputs (e.g., query params, POST data, headers like X-Forwarded-For), server-side echoes, redirects, and client-side processing.
|
|
922
|
-
- Trace data flow: Map how inputs propagate from request to response, including any client-side JavaScript execution where exploitation may be possible in the client without communicating with the server (e.g. DOM-XSS).
|
|
923
|
-
|
|
924
|
-
2. **Vulnerability Hunting Framework**:
|
|
925
|
-
- **Input Validation & Sanitization**: Check for unescaped/lack of encoding in outputs (e.g., HTML context for XSS, URL context for open redirects).
|
|
926
|
-
- **XSS Focus**: Hunt for sinks like innerHTML/outerHTML, document.write, eval, setTimeout/setInterval with strings, location.href/assign/replace, and history.pushState. Test payloads like <script>alert(1)</script>, javascript:alert(1), and polyglots. For DOM-based, simulate client-side execution.
|
|
927
|
-
- **JavaScript Library Analysis**: If JS is present (e.g., in response body or referenced scripts), deobfuscate and inspect:
|
|
928
|
-
- Objects/properties that could clobber DOM (e.g., window.name, document.cookie manipulation leading to prototype pollution).
|
|
929
|
-
- DOM XSS vectors: Analyze event handlers, querySelector, addEventListener with unsanitized data from location.hash/search, postMessage, or localStorage.
|
|
930
|
-
- Third-party libs (e.g., jQuery, React): Flag known sink patterns like .html(), dangerouslySetInnerHTML, or eval-like functions.
|
|
931
|
-
- **Server-Side Issues**: Probe for SSRF (e.g., via URL params fetching internal resources), IDOR (e.g., manipulating IDs in paths/bodies), rate limiting bypass, and insecure deserialization (e.g., in JSON/PHP objects).
|
|
932
|
-
- **Headers & Misc**: Examine for exposed sensitive info (e.g., debug headers, stack traces), misconfigured security headers (CSP, HSTS), and upload flaws (e.g., file extension bypass).
|
|
933
|
-
- **Chaining Opportunities**: Always consider multi-step exploits, like XSS leading to CSRF token theft or SSRF to internal metadata endpoints.
|
|
934
|
-
|
|
935
|
-
3. **PoC Generation**:
|
|
936
|
-
- Produce concise, step-by-step PoCs in a standardized format:
|
|
937
|
-
- **Description**: Clear vuln summary, CVSS-like severity, and impact.
|
|
938
|
-
- **Steps to Reproduce**: Numbered HTTP requests (use curl or Burp syntax, e.g., `curl -X POST -d "param=<payload>" https://target.com/endpoint`).
|
|
939
|
-
- **Payloads**: Provide working, minimal payloads with variations for evasion (e.g., encoded, obfuscated).
|
|
940
|
-
- **Screenshots/Evidence**: Suggest what to capture (e.g., alert popup for XSS, response diff for IDOR).
|
|
941
|
-
- **Mitigation Advice**: Recommend fixes (e.g., output encoding, input validation).
|
|
942
|
-
- Ensure PoCs are ethical: Target only in-scope assets, avoid DoS, and emphasize disclosure via proper channels (e.g., HackerOne, Bugcrowd).
|
|
943
|
-
- If no vuln found, explain why and suggest further tests (e.g., fuzzing params).
|
|
944
|
-
4. Risk Score:
|
|
945
|
-
For each analysis generate a risk score between 0% - 100% based on exploitability and impact. This should be reflected as { "risk_score": "nnn%" } in the final output JSON.
|
|
946
|
-
|
|
947
|
-
Analyze provided HTTP request/response pairs methodically: Start with a high-level overview, then dive into specifics, flag potential issues with evidence from the traffic, and end with PoC if applicable. Be verbose in reasoning but concise in output. Prioritize high-severity findings. If data is incomplete, request clarifications.
|
|
948
|
-
'
|
|
949
|
-
|
|
950
|
-
ai_analysis = PWN::AI::Introspection.reflect_on(
|
|
951
|
-
system_role_content: system_role_content,
|
|
952
|
-
request: http_request_response,
|
|
953
|
-
spinner: true
|
|
954
|
-
)
|
|
955
|
-
sitemap[:comment] = ai_analysis unless ai_analysis.nil?
|
|
956
|
-
# Extract score and assign color highlight based on severity
|
|
957
|
-
if ai_analysis =~ /"risk_score":\s*"(\d{1,3})%"/
|
|
958
|
-
score = Regexp.last_match(1).to_i
|
|
959
|
-
highlight_color = case score
|
|
960
|
-
when 0..24
|
|
961
|
-
'GREEN'
|
|
962
|
-
when 25..49
|
|
963
|
-
'YELLOW'
|
|
964
|
-
when 50..74
|
|
965
|
-
'ORANGE'
|
|
966
|
-
when 75..100
|
|
967
|
-
'RED'
|
|
968
|
-
end
|
|
969
|
-
end
|
|
970
|
-
highlight_color ||= 'GRAY'
|
|
971
|
-
sitemap[:highlight] = highlight_color
|
|
972
|
-
|
|
973
980
|
rest_client = rest_browser::Request
|
|
974
981
|
response = rest_client.execute(
|
|
975
982
|
method: :post,
|
|
@@ -995,6 +1002,40 @@ module PWN
|
|
|
995
1002
|
raise e
|
|
996
1003
|
end
|
|
997
1004
|
|
|
1005
|
+
# Supported Method Parameters::
|
|
1006
|
+
# json_sitemap = PWN::Plugins::BurpSuite.update_sitemap(
|
|
1007
|
+
# burp_obj: 'required - burp_obj returned by #start method',
|
|
1008
|
+
# entry: 'required - hash of the sitemap entry to update'
|
|
1009
|
+
# )
|
|
1010
|
+
|
|
1011
|
+
public_class_method def self.update_sitemap(opts = {})
|
|
1012
|
+
burp_obj = opts[:burp_obj]
|
|
1013
|
+
raise 'ERROR: burp_obj parameter is required' unless burp_obj.is_a?(Hash)
|
|
1014
|
+
|
|
1015
|
+
entry = opts[:entry]
|
|
1016
|
+
raise 'ERROR: entry parameter is required and must be a hash' unless entry.is_a?(Hash)
|
|
1017
|
+
|
|
1018
|
+
rest_browser = burp_obj[:rest_browser]
|
|
1019
|
+
mitm_rest_api = burp_obj[:mitm_rest_api]
|
|
1020
|
+
|
|
1021
|
+
# Only allow updating of comment and highlight fields
|
|
1022
|
+
# NOTE we need the request as its used to identify the sitemap entry to update
|
|
1023
|
+
entry.delete(:response)
|
|
1024
|
+
entry.delete(:http_service)
|
|
1025
|
+
|
|
1026
|
+
put_body = entry.to_json
|
|
1027
|
+
|
|
1028
|
+
sitemap_resp = rest_browser.put(
|
|
1029
|
+
"http://#{mitm_rest_api}/sitemap",
|
|
1030
|
+
put_body,
|
|
1031
|
+
content_type: 'application/json; charset=UTF8'
|
|
1032
|
+
)
|
|
1033
|
+
|
|
1034
|
+
JSON.parse(sitemap_resp, symbolize_names: true)
|
|
1035
|
+
rescue StandardError => e
|
|
1036
|
+
raise e
|
|
1037
|
+
end
|
|
1038
|
+
|
|
998
1039
|
# Supported Method Parameters:
|
|
999
1040
|
# json_sitemap = PWN::Plugins::BurpSuite.import_openapi_to_sitemap(
|
|
1000
1041
|
# burp_obj: 'required - burp_obj returned by #start method',
|
|
@@ -1826,16 +1867,15 @@ module PWN
|
|
|
1826
1867
|
|
|
1827
1868
|
public_class_method def self.stop(opts = {})
|
|
1828
1869
|
burp_obj = opts[:burp_obj]
|
|
1870
|
+
|
|
1829
1871
|
browser_obj = burp_obj[:mitm_browser]
|
|
1830
1872
|
rest_browser = burp_obj[:rest_browser]
|
|
1831
1873
|
mitm_rest_api = burp_obj[:mitm_rest_api]
|
|
1832
|
-
|
|
1833
|
-
|
|
1874
|
+
introspection_thread = burp_obj[:introspection_thread]
|
|
1875
|
+
introspection_thread.kill unless introspection_thread.nil?
|
|
1834
1876
|
|
|
1835
|
-
proxy_intruder_thread.kill unless proxy_intruder_thread.nil?
|
|
1836
1877
|
PWN::Plugins::TransparentBrowser.close(browser_obj: browser_obj)
|
|
1837
1878
|
rest_browser.post("http://#{mitm_rest_api}/shutdown", '')
|
|
1838
|
-
# Process.kill('TERM', burp_pid)
|
|
1839
1879
|
|
|
1840
1880
|
burp_obj = nil
|
|
1841
1881
|
rescue StandardError => e
|
|
@@ -1913,6 +1953,11 @@ module PWN
|
|
|
1913
1953
|
return_as: 'optional - :base64 or :har (defaults to :base64)'
|
|
1914
1954
|
)
|
|
1915
1955
|
|
|
1956
|
+
json_proxy_history = #{self}.update_proxy_history(
|
|
1957
|
+
burp_obj: 'required - burp_obj returned by #start method',
|
|
1958
|
+
entry: 'required - proxy history entry hash to update'
|
|
1959
|
+
)
|
|
1960
|
+
|
|
1916
1961
|
json_sitemap = #{self}.get_sitemap(
|
|
1917
1962
|
burp_obj: 'required - burp_obj returned by #start method',
|
|
1918
1963
|
keyword: 'optional - keyword to filter sitemap results (default: nil)',
|
|
@@ -1941,6 +1986,11 @@ module PWN
|
|
|
1941
1986
|
}
|
|
1942
1987
|
)
|
|
1943
1988
|
|
|
1989
|
+
json_sitemap = #{self}.update_sitemap(
|
|
1990
|
+
burp_obj: 'required - burp_obj returned by #start method',
|
|
1991
|
+
entry: 'required - sitemap entry hash to update'
|
|
1992
|
+
)
|
|
1993
|
+
|
|
1944
1994
|
json_sitemap = #{self}.import_openapi_to_sitemap(
|
|
1945
1995
|
burp_obj: 'required - burp_obj returned by #start method',
|
|
1946
1996
|
openapi_spec: 'required - path to OpenAPI JSON or YAML specification file',
|
data/lib/pwn/version.rb
CHANGED