pwn 0.5.508 → 0.5.509

data/bin/pwn_shodan_graphql_introspection

@@ -1,304 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'faker'
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-jFILE', '--json-results=FILE', 'Required - JSON results file from pwn_shodan_search driver') do |j|
-    opts[:json_results] = j
-  end
-end.parse!
-
-json_results_path = opts[:json_results]
-raise "ERROR: Shodan JSON Results File #{json_results_path} Does Not Exist." unless File.exist?(json_results_path)
-
-search_results = JSON.parse(
-  File.read(json_results_path),
-  symbolize_names: true
-)
-
-print 'Extracting URIs from Shodan search results...'
-uri_arr = PWN::Plugins::Shodan.get_uris(search_results: search_results)
-puts 'complete.'
-
-print "Extracting GraphQL URIs from #{uri_arr.count} URIs..."
-graphql_uris = uri_arr.uniq.select do |uri|
-  uri if uri =~ %r{.+/graphql/?$} ||
-         uri =~ %r{.+/graphiql/?$} ||
-         uri =~ %r{.+/playground/?$} ||
-         uri =~ %r{.+/console/?$} ||
-         uri =~ %r{.+/query/?$} ||
-         uri =~ %r{.+/gql/?$} ||
-         uri =~ %r{.+/index.php?graphql$}
-end
-puts 'complete.'
-
-browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: :rest)
-rest_client = browser_obj[:browser]::Request
-
-graphql_payloads_arr = []
-
-graphql_schema_payload = '{ "query": "{ __schema { types { name } } }" }'
-graphql_payloads_arr.push(graphql_schema_payload)
-
-graphql_introspection_payload1 = <<-END_OF_PAYLOAD
-  {
-    query IntrospectionQuery {
-      __schema {
-
-        queryType { name }
-        mutationType { name }
-        subscriptionType { name }
-        types { ...FullType }
-        directives {
-          name
-          description
-          locations
-          args { ...InputValue }
-        }
-      }
-    }
-
-    fragment FullType on __Type {
-      kind
-      name
-      description
-      fields(includeDeprecated: true) {
-        name
-        description
-        args { ...InputValue }
-        type { ...TypeRef }
-        isDeprecated
-        deprecationReason
-      }
-      inputFields {
-        ...InputValue
-      }
-      interfaces {
-        ...TypeRef
-      }
-      enumValues(includeDeprecated: true) {
-        name
-        description
-        isDeprecated
-        deprecationReason
-      }
-      possibleTypes {
-        ...TypeRef
-      }
-    }
-
-    fragment InputValue on __InputValue {
-      name
-      description
-      type { ...TypeRef }
-      defaultValue
-    }
-
-    fragment TypeRef on __Type {
-      kind
-      name
-      ofType {
-        kind
-        name
-        ofType {
-          kind
-          name
-          ofType {
-            kind
-            name
-            ofType {
-              kind
-              name
-              ofType {
-                kind
-                name
-                ofType {
-                  kind
-                  name
-                  ofType {
-                    kind
-                    name
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-END_OF_PAYLOAD
-graphql_payloads_arr.push(graphql_introspection_payload1)
-
-graphql_introspection_payload2 = <<-END_OF_PAYLOAD
-    {
-      "operationName":"IntrospectionQuery",
-      "variables":{},
-      "query":"
-        fragment FullType on __Type {
-          kind
-          name
-          description
-          fields(includeDeprecated: true) {
-            name
-            description
-            args { ...InputValue }
-            type { ...TypeRef }
-            isDeprecated    deprecationReason
-          }
-          inputFields { ...InputValue  }
-          interfaces { ...TypeRef  }
-          enumValues(includeDeprecated: true) {
-            name
-            description
-            isDeprecated
-            deprecationReason
-          }
-          possibleTypes { ...TypeRef }
-      }
-
-      fragment InputValue on __InputValue {
-        name
-        description
-        type { ...TypeRef }
-        defaultValue
-      }
-
-      fragment TypeRef on __Type {
-        kind
-        name
-        ofType {
-          kind
-          name
-          ofType {
-            kind
-            name
-            ofType {
-              kind
-              name
-              ofType {
-                kind
-                name
-                ofType {
-                  kind
-                  name
-                  ofType {
-                    kind
-                    name
-                    ofType {
-                      kind
-                      name
-                    }
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-
-      query IntrospectionQuery {
-        __schema {
-          queryType { name }
-          mutationType { name }
-          types { ...FullType }
-          directives {
-            name
-            description
-            locations
-            args { ...InputValue }
-          }
-        }
-      }"
-    }
-END_OF_PAYLOAD
-graphql_payloads_arr.push(graphql_introspection_payload2)
-
-# Math Part
-graphql_uri_tot = graphql_uris.length
-payload_tot = graphql_payloads_arr.length
-request_tot = payload_tot * graphql_uri_tot
-
-puts "Sending #{payload_tot} payloads to #{graphql_uris.count} GraphQL URIs..."
-puts "Total HTTP Requests: #{request_tot}"
-
-user_agent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36'
-introspection_arr_of_hashes = []
-graphql_uris.each do |this_uri|
-  puts "IN PROGRESS: #{this_uri}..."
-  graphql_payloads_arr.each_with_index do |this_payload, payload_index|
-    # user_agent = Faker::Internet.user_agent
-    timestamp = Time.now.strftime('%Y-%m-%d_%H:%M:%S')
-    introspection_hash = {
-      time: timestamp,
-      uri: this_uri,
-      payload_index: payload_index,
-      response_code: nil,
-      response_headers: nil,
-      response: nil
-    }
-    resp = rest_client.execute(
-      method: :post,
-      url: this_uri,
-      headers: {
-        content_type: 'application/json; charset=UTF-8',
-        user_agent: user_agent
-      },
-      payload: this_payload,
-      verify_ssl: false,
-      timeout: 3.0,
-      max_redirects: 3
-    )
-    introspection_hash[:response_code] = resp.code
-    introspection_hash[:response_headers] = resp.headers
-    json_resp = JSON.parse(
-      resp.body,
-      symbolize_names: true
-    )
-
-    introspection_hash[:response] = json_resp
-  rescue Errno::ECONNREFUSED,
-         Errno::ENETUNREACH,
-         JSON::ParserError,
-         OpenSSL::SSL::SSLError,
-         SocketError => e
-
-    introspection_hash[:response_code] = "#{e.class}: #{e.message}"
-
-    next
-  rescue RestClient::ExceptionWithResponse => e
-    introspection_hash[:response_code] = "#{e.class}: #{e.message}" if e.response.nil?
-
-    if e.response
-      introspection_hash[:response_code] = e.response.code
-      introspection_hash[:response_headers] = e.response.headers
-      introspection_hash[:response] = e.response.body
-    end
-
-    next
-  ensure
-    introspection_arr_of_hashes.push(introspection_hash)
-  end
-end
-puts 'complete.'
-
-timestamp = Time.now.strftime('%Y-%m-%d_%H:%M:%S')
-print 'Saving Introspection Results...'
-File.write(
-  "graphql_results-#{timestamp}-ALL.json",
-  JSON.pretty_generate(introspection_arr_of_hashes)
-)
-
-vulnerable_uris = introspection_arr_of_hashes.select do |h|
-  h if (h[:response].is_a?(Hash) && h[:response].keys.first.to_sym == :data) ||
-       (h[:response].is_a?(Integer) && h[:response_code] == 415) ||
-       (h[:response].is_a?(Integer) && h[:response_code] >= 500)
-end
-File.write(
-  "graphql_results-#{timestamp}-VULNERABLE.json",
-  JSON.pretty_generate(vulnerable_uris)
-)
-puts 'complete.'

data/bin/pwn_shodan_search

@@ -1,90 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-cYAML', '--config-yaml=YAML', '<Required - YAML config containing api_key from Shodan.io>') do |y|
-    opts[:yaml] = y
-  end
-
-  options.on('-qFILE', '--query-file=FILE', '<Required - File containing one Shodan.io query string per line>') do |q|
-    opts[:query_file] = q
-  end
-
-  options.on('-rFLOAT', '--rate-limit=FLOAT', '<Optional - Rate Limit Between API Calls (Default: 1.0, must be >= 1.0)>') do |r|
-    opts[:rate_limit_duration] = r
-  end
-
-  options.on('-oFILE', '--output-results-file=FILE', '<Optional - Defaults to ./shodan-results-Time.now.strftime("%y-%m-%d.%H:%M:%S").txt>') do |o|
-    opts[:output_results_file] = o
-  end
-end.parse!
-
-begin
-  yaml_file = opts[:yaml].to_s
-  raise "ERROR: #{yaml_file} does not exist." unless File.exist?(yaml_file)
-
-  yaml = YAML.load_file(yaml_file, symbolize_names: true)
-
-  api_key = yaml[:api_key]
-
-  query_file = opts[:query_file].to_s
-  raise "ERROR: #{query_file} does not exist." unless File.exist?(query_file)
-
-  rate_limit_duration = opts[:rate_limit_duration].to_f
-  rate_limit_duration = 1.0 if rate_limit_duration.zero?
-  raise 'ERROR: Rate Limit must be >= 1.0' unless rate_limit_duration.positive?
-
-  # Strip comments from query file when reading
-  queries = File.readlines(query_file).grep_v(/^#.*$/)
-
-  timestamp = Time.now.strftime('%Y-%m-%d.%H:%M:%S')
-  query_results_file = opts[:output_results_file]
-  query_results_file ||= "./shodan-results-#{timestamp}"
-
-  raw_query_results_arr_file = "#{query_results_file}-RAW.arr"
-  raw_query_results_file = "#{query_results_file}-RAW.json"
-  raw_results_arr = []
-  File.open(query_results_file, 'w') do |f|
-    queries.each do |query_line|
-      query = query_line.chomp
-      print "QUERY: '#{query}'"
-      f.puts("QUERY: '#{query}'")
-      search_results = PWN::Plugins::Shodan.search(
-        api_key: api_key,
-        query: query
-      )
-      puts " >>> Matches: #{search_results[:total]}"
-
-      raw_results = {}
-      raw_results[:query] = query
-      raw_results[:results] = search_results
-      raw_results_arr.push(raw_results)
-
-      search_results[:matches].select do |m|
-        f.puts "ORG: #{m[:org]} | PUBIP: #{m[:ip_str]} #{'*' * 36}"
-        f.puts "Product: #{m[:product]}"
-        f.puts "TCP Port: #{m[:port]}"
-        f.puts "Data: #{m[:data]}\n\n\n"
-      end
-
-      sleep rate_limit_duration
-    end
-  end
-  File.write(raw_query_results_arr_file, raw_results_arr)
-
-  # TODO: Avoid JSON::GeneratorError: source sequence is illegal/malformed utf-8
-  # in rare circumstances
-  File.write(raw_query_results_file, JSON.pretty_generate(raw_results_arr))
-rescue JSON::GeneratorError => e
-  puts '!!! SERIALIZATION DEBUG MODE !!!'
-  raw_results_arr.each do |r|
-    JSON.pretty_generate(r)
-  rescue JSON::GeneratorError => e
-    puts "#{e.message} FOUND IN: #{r.inspect}"
-  end
-rescue SystemExit, Interrupt
-  puts "\nGoodbye."
-end

data/bin/pwn_simple_http_server

@@ -1,44 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-pwn_driver = PWN::Driver::Parser.new do |options|
-  options.on('-iIP', '--bind-ip=IP', '<Optional - HTTP Bind IP to Listen> (Defaults to Localhost)') do |i|
-    opts[:bind_ip] = i
-  end
-
-  options.on('-pPORT', '--port=PORT', '<Optional - HTTP Port to Listen (Defaults to 3333)>') do |p|
-    opts[:port] = p
-  end
-end
-pwn_driver.auto_opts_help = false
-pwn_driver.parse!
-
-bind_ip = opts[:bind_ip] ||= '127.0.0.1'
-
-port = opts[:port].to_i
-port = 3333 if port.zero?
-
-begin
-  system(
-    'thin',
-    'start',
-    '--adapter',
-    'file',
-    '--address',
-    bind_ip,
-    '--port',
-    port.to_s,
-    '--threaded',
-    '--debug'
-  )
-rescue RuntimeError
-  puts "WARNING: Service Already Listening on TCP #{port}..."
-  port = Random.rand(1_025..65_535)
-  puts "Listen on #{bind_ip}:#{port}..."
-  retry
-rescue SystemExit, Interrupt
-  puts "\n#{File.basename($PROGRAM_NAME)} terminated."
-end

data/bin/pwn_web_cache_deception

@@ -1,205 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-tURL', '--target-url=URL', '<Required - URL to Target>') do |t|
-    opts[:target_url] = t
-  end
-
-  options.on('-rRESULTS', '--output-results=RESULTS', '<Required - Path of Results File>') do |r|
-    opts[:output_results] = r
-  end
-
-  options.on('-l', '---list-pwn-www-mods', '<Optional - Provide a List of PWN::WWW Modules to Support Post-AuthN w/ -m Flag') do |l|
-    opts[:list_pwn_mods] = l
-  end
-
-  options.on('-mMOD', '--pwn-www-mod=MOD', '<Optional - PWN::WWW Module to Support Post-AuthN (-l to list Modules)') do |m|
-    opts[:pwn_www_mod_str] = m
-  end
-
-  options.on('-uUSER', '--username=USER', '<Optional - PWN::WWW Module username') do |u|
-    opts[:username] = u
-  end
-
-  options.on('-pPASS', '--password=PASS', '<Optional - PWN::WWW Module password (Will Prompt if nil)') do |p|
-    opts[:password] = p
-  end
-
-  options.on('-f', '--[no-]mfa', '<Optional - Enable MFA PWN::WWW Module') do |f|
-    opts[:mfa] = f
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy || tor>') do |p|
-    opts[:proxy] = p
-  end
-end.parse!
-
-# Colors!
-@dark_red = "\e[1m\e[31m"
-@green = "\e[32m"
-@yellow = "\e[33m"
-@end_of_color = "\e[0m"
-
-# if -l Flag is passed, list all PWN::WWW Modules and exit
-if opts[:list_pwn_mods]
-  puts "#{@green}Available PWN::WWW modules to obtain a Post AuthN state:#{@end_of_color}:"
-  puts "#{@yellow}#{PWN::WWW.help.join(',').tr(',', "\n")}#{@end_of_color}"
-  exit
-end
-
-# Required Flag Variables
-target_url = opts[:target_url].to_s.scrub.strip.chomp
-output_results = opts[:output_results].to_s.scrub.strip.chomp
-
-# Optional Flag Variables
-pwn_www_mod_str = opts[:pwn_www_mod_str].to_s.scrub.strip.chomp
-
-username = opts[:username].to_s.scrub.strip.chomp
-
-password = opts[:password] # Don't cast to string to detect if PWN::Plugins::AuthenticationHelper is necessary
-if password.nil?
-  password = PWN::Plugins::AuthenticationHelper.mask_password
-else
-  password = opts[:password].to_s.scrub.strip.chomp
-end
-
-if opts[:mfa]
-  mfa = true
-else
-  mfa = false
-end
-
-proxy = opts[:proxy].to_s.scrub.strip.chomp unless opts[:proxy].nil?
-
-begin
-  def get_web_cache_deception(opts = {})
-    browser_obj = opts[:browser_obj]
-    target_url = opts[:target_url].to_s.scrub.chomp.strip
-    payload = opts[:payload].to_s.scrub.chomp.strip
-
-    # Browse to original page to compare response lengths
-    browser = browser_obj[:browser]
-    browser.goto(target_url)
-    orig_url_response_length = browser.html.length
-
-    http_result = ''
-    if target_url.include?('?')
-      injected_target_url = URI.parse(target_url)
-      # Add non-existent file at the end of the path
-      injected_target_url.path = "#{injected_target_url.path.to_s.chomp('/')}/wcd.#{payload}"
-      web_cache_deception_url = injected_target_url.to_s
-
-      browser.goto(injected_target_url.to_s)
-      injected_url_response_length = browser.html.length
-
-      if injected_url_response_length == orig_url_response_length
-        # TODO: Add incognito Chrome browser
-        puts "\n#{@dark_red}Alert! Potential Candidate: #{web_cache_deception_url}#{@end_of_color}\n"
-        http_result = "Alert! Potential Candidate: #{web_cache_deception_url}"
-      else
-        print "#{@yellow}.#{@end_of_color}"
-        http_result = "Response Length Mismatch: Orig Len: #{orig_url_response_length} | Inj Len: #{injected_url_response_length} | WCD: #{web_cache_deception_url}"
-      end
-    else
-      web_cache_deception_url = "#{target_url.chomp('/')}/wcd.#{payload}"
-      browser.goto(web_cache_deception_url)
-      wcd_url_response_length = browser.html.length
-
-      if orig_url_response_length == wcd_url_response_length
-        # TODO: Add incognito Chrome browser
-        puts "\n#{@dark_red}Alert! Potential Candidate: #{web_cache_deception_url}#{@end_of_color}\n"
-        http_result = "Alert! Potential Candidate: #{web_cache_deception_url}"
-      else
-        print "#{@yellow}.#{@end_of_color}"
-        http_result = "Response Length Mismatch: Orig Len: #{orig_url_response_length} | WCD Len: #{wcd_url_response_length} | WCD: #{web_cache_deception_url}"
-      end
-    end
-  rescue Net::ReadTimeout => e
-    http_result = "#{e} Orig: #{target_url} | WCD: #{web_cache_deception_url}"
-  rescue StandardError => e
-    raise e
-  ensure
-    http_result
-  end
-
-  # Script starts crunching here...
-  if pwn_www_mod_str != ''
-    begin
-      pwn_www_mod = PWN::WWW.const_get(pwn_www_mod_str)
-      unless pwn_www_mod.respond_to?('open') && pwn_www_mod.respond_to?('login') && pwn_www_mod.respond_to?('logout')
-        puts "#{@dark_red}Module PWN::WWW::#{pwn_www_mod_str} Missing #open #login and/or #logout Method(s)#{@end_of_color}"
-        puts `#{File.basename($PROGRAM_NAME)} -l`
-        exit
-      end
-    rescue NAME_ERROR => e
-      puts "#{@dark_red}Invalid module PWN::WWW::#{pwn_www_mod_str}#{@end_of_color}"
-      puts `#{File.basename($PROGRAM_NAME)} -l`
-      exit
-    end
-
-    puts "#{@green}Leveraging PWN::WWW::#{pwn_www_mod_str} to Obtain a Post AuhN State...#{@end_of_color}"
-    if proxy
-      browser_obj = pwn_www_mod.open(
-        browser_type: :chrome,
-        proxy: proxy
-      )
-    else
-      browser_obj = pwn_www_mod.open(browser_type: :chrome)
-    end
-    # Now AuthN via PWN::WWW::<MODULE>
-    browser_obj = pwn_www_mod.login(
-      browser_obj: browser_obj,
-      username: username,
-      password: password,
-      mfa: mfa
-    )
-    puts "#{@green}complete.#{@end_of_color}\n\n\n"
-  elsif pwn_www_mod_str == '' && proxy
-    browser_obj = PWN::Plugins::TransparentBrowser.open(
-      browser_type: :chrome,
-      proxy: proxy
-    )
-  else
-    browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: :chrome)
-  end
-
-  browser = browser_obj[:browser]
-
-  puts "#{@green}Navigating to Target URL: #{target_url}#{@end_of_color}\n\n\n"
-  browser.goto(target_url)
-
-  web_cache_deception_payload_arr = %w[
-    aif aiff au avi bin bmp cab carb cct cdf class css doc dcr dtd gcf gff gif grv hdml hqx ico ini jpeg jpg js mov mp3 mp4 nc pct ppc pws swa swf txt vbs w32 wav wbmp wml wmlc wmls wmlsc xsd zip
-  ]
-
-  File.open(output_results, 'w') do |f|
-    web_cache_deception_payload_arr.each do |payload|
-      http_result = get_web_cache_deception(
-        browser_obj: browser_obj,
-        target_url: target_url,
-        payload: payload
-      )
-
-      f.puts http_result
-    end
-  end
-  puts "\n#{@yellow}Results Location: #{output_results}#{@end_of_color}\n\n\n"
-  puts "#{@green}complete.#{@end_of_color}"
-rescue StandardError => e
-  raise e
-ensure
-  if browser_obj &&
-     pwn_www_mod
-
-    browser_obj = pwn_www_mod.logout(browser_obj: browser_obj)
-    browser_obj = pwn_www_mod.close(browser_obj: browser_obj)
-  else
-    browser_obj = PWN::Plugins::TransparentBrowser.close(
-      browser_obj: browser_obj
-    )
-  end
-end