pwn 0.5.508 → 0.5.509

data/lib/pwn/sast/php_input_mechanisms.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify HTTP input
-    # mechanisms that exist in PHP code (e.g. $_REQUEST, $_GET, etc.)
-    module PHPInputMechanisms
-      # Supported Method Parameters::
-      # PWN::SAST::PHPInputMechanisms.scan(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-
-        test_case_filter = "
-          grep -Fn \
-          -e '$_COOKIE' \
-          -e '$_FILES' \
-          -e '$_GET' \
-          -e '$_POST' \
-          -e '$_REQUEST' \
-          -e '$_SERVER' \
-          -e '$_SESSION' {PWN_SAST_SRC_TARGET} 2> /dev/null
-        "
-
-        include_extensions = %w[.phar .pht .phtm .phtml .php .php2 .php3 .php4 .php5 .php7 .php8 .phps .phpt .pgif .inc]
-
-        PWN::SAST::TestCaseEngine.execute(
-          test_case_filter: test_case_filter,
-          security_references: security_references,
-          dir_path: dir_path,
-          include_extensions: include_extensions,
-          git_repo_root_uri: git_repo_root_uri
-        )
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SA-17',
-          cwe_id: '661',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/661.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            :dir_path => 'optional path to dir defaults to .',
-            :git_repo_root_uri => 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end

data/lib/pwn/sast/php_type_juggling.rb

@@ -1,82 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify loose comparisons
-    # (i.e. == instead of ===) within PHP source code.
-    module PHPTypeJuggling
-      # Supported Method Parameters::
-      # PWN::SAST::PHPTypeJuggling.scan(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-
-        test_case_filter = "
-          grep -Fn \
-          -e '==' \
-          -e '!=' {PWN_SAST_SRC_TARGET} 2> /dev/null | \
-          grep -v \
-            -e '===' \
-            -e '!=='
-        "
-
-        include_extensions = %w[.phar .pht .phtm .phtml .php .php2 .php3 .php4 .php5 .php7 .php8 .phps .phpt .pgif .inc]
-
-        PWN::SAST::TestCaseEngine.execute(
-          test_case_filter: test_case_filter,
-          security_references: security_references,
-          dir_path: dir_path,
-          include_extensions: include_extensions,
-          git_repo_root_uri: git_repo_root_uri
-        )
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SA-17',
-          cwe_id: '661',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/661.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            :dir_path => 'optional path to dir defaults to .',
-            :git_repo_root_uri => 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end

data/lib/pwn/sast/pom_version.rb

@@ -1,164 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify the versions
-    # of dependent software within source repos to ensure patching
-    # requirements for those dependencies can be met.
-    module PomVersion
-      # Supported Method Parameters::
-      # PWN::SAST::PomVersion.scan(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-        result_arr = []
-        ai_introspection = PWN::Env[:ai][:introspection]
-        logger_results = "AI Introspection => #{PWN::Env[:ai][:introspecction]} => "
-
-        PWN::Plugins::FileFu.recurse_in_dir(dir_path: dir_path) do |entry|
-          if File.file?(entry) && File.basename(entry) == 'pom.xml' && entry !~ /test/i
-            line_no_and_contents_arr = []
-            entry_beautified = false
-
-            if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
-              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
-              entry = "#{entry}.JS-BEAUTIFIED"
-              entry_beautified = true
-            end
-
-            test_case_filter = "
-              grep -in -B2 \
-              -e 'version' {PWN_SAST_SRC_TARGET} 2> /dev/null
-            "
-
-            str = `#{test_case_filter}`.to_s.scrub
-
-            if str.to_s.empty?
-              # If str length is >= 64 KB do not include results. (Due to Mongo Document Size Restrictions)
-              logger_results = "#{logger_results}~" # Catching bugs is good :)
-            else
-              str = "1:Result larger than 64KB -> Size: #{str.to_s.length}.  Please click the \"Path\" link for more details." if str.to_s.length >= 64_000
-
-              hash_line = {
-                timestamp: Time.now.strftime('%Y-%m-%d %H:%M:%S.%9N %z').to_s,
-                security_references: security_references,
-                filename: { git_repo_root_uri: git_repo_root_uri, entry: entry },
-                line_no_and_contents: '',
-                raw_content: str,
-                test_case_filter: test_case_filter
-              }
-
-              # COMMMENT: Must be a better way to implement this (regex is kinda funky)
-              multi_line_contents_split = str.split("\n--\n")
-              multi_line_contents_split.each do |this_multi_line_content|
-                line_contents_split = this_multi_line_content.split(/^(\d{1,}):|^(\d{1,})-/)[1..-1]
-                line_no_count = line_contents_split.length # This should always be an even number
-                current_count = 0
-                while line_no_count > current_count
-                  line_no = line_contents_split[current_count]
-                  contents = line_contents_split[current_count + 1]
-                  if Dir.exist?('.git')
-                    repo_root = '.'
-
-                    author = PWN::Plugins::Git.get_author(
-                      repo_root: repo_root,
-                      from_line: line_no,
-                      to_line: line_no,
-                      target_file: entry,
-                      entry_beautified: entry_beautified
-                    )
-                  end
-                  author ||= 'N/A'
-
-                  request = {
-                    scm_uri: "#{hash_line[:filename][:git_repo_root_uri]}/#{hash_line[:filename][:entry]}",
-                    line_no: line_no,
-                    source_code_snippet: contents
-                  }.to_json
-
-                  system_role_content = 'Your sole purpose is to analyze source code snippets and generate an Exploit Prediction Scoring System (EPSS) score between 0% - 100%.  Just generate a score unless score is >= 75% in which a PoC and code fix should also be included.'
-                  ai_analysis = PWN::AI::Introspection.reflect_on(
-                    system_role_content: system_role_content,
-                    request: request,
-                    suppress_pii_warning: true
-                  )
-                  ai_analysis ||= 'N/A'
-
-                  hash_line[:line_no_and_contents] = line_no_and_contents_arr.push(
-                    line_no: line_no,
-                    contents: contents,
-                    author: author,
-                    ai_analysis: ai_analysis
-                  )
-
-                  current_count += 2
-                end
-                hash_line[:line_no_and_contents] = line_no_and_contents_arr.push(
-                  line_no: '--',
-                  contents: '--',
-                  author: '--'
-                )
-              end
-              result_arr.push(hash_line)
-              logger_results = "#{logger_results}x" # Seeing progress is good :)
-            end
-          end
-        end
-        logger_banner = "http://#{Socket.gethostname}:8808/doc_root/pwn-#{PWN::VERSION.to_s.scrub}/#{to_s.scrub.gsub('::', '/')}.html"
-        if logger_results.empty?
-          @@logger.info("#{logger_banner}: No files applicable to this test case.\n")
-        else
-          @@logger.info("#{logger_banner} => #{logger_results}complete.\n")
-        end
-        result_arr
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'VULNERABILITY SCANNING',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=RA-05',
-          cwe_id: '.0',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/1104.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            dir_path: 'optional path to dir defaults to .',
-            git_repo_root_uri: 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end

data/lib/pwn/sast/port.rb

@@ -1,82 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify port
-    # declarations and network connections within source
-    # code to get a sense around appropriate secure network
-    # communications in place.
-    module Port
-      # Supported Method Parameters::
-      # PWN::SAST::Port.scan(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-
-        test_case_filter = %(
-          grep -niE \
-          -e "localhost:\\d" \
-          -e ":\/\/(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?):([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])" \
-          -e "port\\s=\\s([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])" \
-          -e "port=([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])" \
-          -e "port:([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])" \
-          -e "port:\\s([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])" {PWN_SAST_SRC_TARGET} 2> /dev/null
-        )
-
-        PWN::SAST::TestCaseEngine.execute(
-          test_case_filter: test_case_filter,
-          security_references: security_references,
-          dir_path: dir_path,
-          git_repo_root_uri: git_repo_root_uri
-        )
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'TRANSMISSION CONFIDENTIALITY AND INTEGRITY',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SC-08',
-          cwe_id: '319',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/319.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            dir_path: 'optional path to dir defaults to .',
-            git_repo_root_uri: 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end

data/lib/pwn/sast/post_message.rb

@@ -1,76 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify any postMessage function/method
-    # declarations within source code in an effort to
-    # determine if XSS is possible
-    module PostMessage
-      # Supported Method Parameters::
-      # PWN::SAST::PostMessage.scan(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-
-        test_case_filter = "
-          grep -n \
-          -e 'postMessage(' {PWN_SAST_SRC_TARGET} 2> /dev/null
-        "
-
-        PWN::SAST::TestCaseEngine.execute(
-          test_case_filter: test_case_filter,
-          security_references: security_references,
-          dir_path: dir_path,
-          git_repo_root_uri: git_repo_root_uri
-        )
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'MALICIOUS CODE PROTECTION',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SI-03',
-          cwe_id: '79',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/79.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            dir_path: 'optional path to dir defaults to .',
-            git_repo_root_uri: 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end

data/lib/pwn/sast/private_key.rb

@@ -1,75 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify private keys used for authenticating
-    # with remote hosts.
-    module PrivateKey
-      # Supported Method Parameters::
-      # PWN::SAST::PrivateKey(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-
-        test_case_filter = "
-          grep -n \
-          -e 'PRIVATE KEY' {PWN_SAST_SRC_TARGET} 2> /dev/null
-        "
-
-        PWN::SAST::TestCaseEngine.execute(
-          test_case_filter: test_case_filter,
-          security_references: security_references,
-          dir_path: dir_path,
-          git_repo_root_uri: git_repo_root_uri
-        )
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'CRYPTOGRAPHIC MODULE AUTHENTICATION',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=IA-07',
-          cwe_id: '321',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/321.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            dir_path: 'optional path to dir defaults to .',
-            git_repo_root_uri: 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end

data/lib/pwn/sast/redirect.rb

@@ -1,77 +0,0 @@
-# frozen_string_literal: false
-
-require 'json'
-require 'socket'
-
-module PWN
-  module SAST
-    # SAST Module used to identify if applications
-    # allow arbritrary redirects to third-party URLs w/o a whitelist
-    module Redirect
-      # Supported Method Parameters::
-      # PWN::SAST::Redirect.scan(
-      #   dir_path: 'optional path to dir defaults to .'
-      #   git_repo_root_uri: 'optional http uri of git repo scanned'
-      # )
-
-      public_class_method def self.scan(opts = {})
-        dir_path = opts[:dir_path]
-        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
-
-        test_case_filter = %(
-          grep -Ein \
-          -e "redirect(\\s=|=)" \
-          -e "redirect_url(\\s=|=)" \
-          -e "redirect_uri(\\s=|=)" {PWN_SAST_SRC_TARGET} 2> /dev/null
-        )
-
-        PWN::SAST::TestCaseEngine.execute(
-          test_case_filter: test_case_filter,
-          security_references: security_references,
-          dir_path: dir_path,
-          git_repo_root_uri: git_repo_root_uri
-        )
-      rescue StandardError => e
-        raise e
-      end
-
-      # Used primarily to map NIST 800-53 Revision 4 Security Controls
-      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
-      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
-      # Determine the level of Testing Coverage w/ PWN.
-
-      public_class_method def self.security_references
-        {
-          sast_module: self,
-          section: 'LEAST PRIVILEGE',
-          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-06',
-          cwe_id: '601',
-          cwe_uri: 'https://cwe.mitre.org/data/definitions/601.html'
-        }
-      rescue StandardError => e
-        raise e
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          sast_arr = #{self}.scan(
-            dir_path: 'optional path to dir defaults to .',
-            git_repo_root_uri: 'optional http uri of git repo scanned'
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end