pwn 0.5.508 → 0.5.509

data/bin/pwn_www_checkip

@@ -1,77 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-pwn_driver = PWN::Driver::Parser.new do |options|
-  options.on('-tIP_HOST', '--target=IP_HOST', '<Optional - IP or Host to Check (Default - Your Public IP)>') do |t|
-    opts[:target] = t
-  end
-
-  options.on('-PPORT', '--tls-port=PORT', '<Optional - TLS Port to Check (Default - 443).  Will not execute if --proxy parameter is set.>') do |p|
-    opts[:tls_port] = p
-  end
-
-  options.on('-i', '--[no-]ipinfo', '<Optional - Return Details about Public IP Returned from CheckIP>') do |i|
-    opts[:ipinfo] = i
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy || tor>') do |p|
-    opts[:proxy] = p
-  end
-end
-pwn_driver.auto_opts_help = false
-pwn_driver.parse!
-
-pwn_env_path = opts[:pwn_env_path]
-pwn_dec_path = opts[:pwn_dec_path]
-
-target = opts[:target]
-tls_port = opts[:tls_port]
-ipinfo = opts[:ipinfo]
-proxy = opts[:proxy].to_s.scrub.strip.chomp unless opts[:proxy].nil?
-
-begin
-  if proxy && opts[:target].nil?
-    browser_obj = PWN::Plugins::TransparentBrowser.open(
-      browser_type: :rest,
-      proxy: proxy
-    )
-    browser = browser_obj[:browser]::Request
-    target = browser.execute(
-      method: :get,
-      url: 'https://checkip.amazonaws.com',
-      verify_ssl: false
-    ).to_s.chomp
-  elsif opts[:target].nil?
-    browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: :rest)
-    browser = browser_obj[:browser]::Request
-    target = browser.execute(
-      method: :get,
-      url: 'https://checkip.amazonaws.com'
-    ).to_s.chomp
-  end
-
-  puts "[ { \"target\": \"#{target}\" } ]" if ipinfo.nil? && opts[:target].nil?
-
-  ipinfo = true if ipinfo.nil? && opts[:target]
-  if ipinfo
-    ip_info_obj = PWN::Plugins::IPInfo.get(
-      target: target,
-      proxy: proxy,
-      tls_port: tls_port
-    )
-    puts JSON.pretty_generate(ip_info_obj)
-  end
-rescue Interrupt
-  puts "\n#{File.basename($PROGRAM_NAME)} => Goodbye."
-rescue StandardError => e
-  raise e
-ensure
-  if browser_obj
-    browser_obj = PWN::Plugins::TransparentBrowser.close(
-      browser_obj: browser_obj
-    )
-  end
-end

data/bin/pwn_www_uri_buster

@@ -1,363 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'cgi'
-require 'faker'
-require 'htmlentities'
-require 'pwn'
-require 'time'
-require 'uri'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-uURL', '--target-url=URL', '<Required - Target URL)>') do |t|
-    opts[:target_url] = t
-  end
-
-  options.on('-wFILE', '--word-list=FILE', '<Required - Wordlist File to Use>') do |w|
-    opts[:wordlist] = w
-  end
-
-  options.on('-aPATTERN', '--append=PATTERN', '<Optional - Append Pattern to Each Entry in the Wordlist (e.g .inc, .BAK, .git, etc>') do |a|
-    opts[:append_pattern] = a
-  end
-
-  options.on('-TFLOAT', '--max-timeout=FLOAT', '<Optional - HTTP Request Timeout (Default 6.0 Seconds)>') do |t|
-    opts[:max_timeout] = t
-  end
-
-  options.on('-TFLOAT', '--max-retries=FLOAT', '<Optional - HTTP Request Retries (Default 3)>') do |r|
-    opts[:max_retries] = r
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - Proxy SCHEME://ADDRESS:PORT || tor>') do |p|
-    opts[:proxy] = p
-  end
-
-  options.on('-tTHREADS', '--max-threads=THREADS', '<Optional # HTTP Requests to Run Simultaneously (Default 25)>') do |t|
-    opts[:max_threads] = t
-  end
-
-  options.on('-rHEADERS', '--request-headers=HEADERS', '<Optional - HTTP Request Headers in JSON Format)>') do |h|
-    opts[:http_request_headers] = h
-  end
-
-  options.on('-ICODES', '--include-response-codes=CODES', '<Optional - Comma-Delimited List of Response Codes to Include in Report)>') do |i|
-    opts[:include_http_response_codes] = i
-  end
-
-  options.on('-ECODES', '--exclude-response-codes=CODES', '<Optional - Comma-Delimited List of Response Codes to Exclude in Report)>') do |e|
-    opts[:exclude_http_response_codes] = e
-  end
-
-  options.on('-dDIR', '--dir-path=DIR', '<Optional - Report Output Directory (Defaults to ".")>') do |w|
-    opts[:wordlist] = w
-  end
-
-  options.on('-nREPORTNAME', '--report-name=REPORTNAME', '<Optional Report Name (Defaults to, "<TARGET_URL_HOST>-<File.basename(wordlist)>-<Time.now.strftime("%Y-%m-%d_%H-%M-%S")>")>') do |n|
-    opts[:report_name] = n
-  end
-
-  options.on('-s', '--[no-]start-reporting-server', '<Optional - Start Simple HTTP Server for Reporting>') do |s|
-    opts[:start_reporting_server] = s
-  end
-end.parse!
-
-def request_path(opts = {})
-  target_url = opts[:target_url]
-  proxy = opts[:proxy]
-  http_request_headers = opts[:http_request_headers]
-  wordlist_line = opts[:wordlist_line]
-  http_method = opts[:http_method]
-  max_timeout = opts[:max_timeout]
-  timeout = opts[:max_timeout] ||= max_timeout / 21.0
-  max_retries = opts[:max_retries]
-
-  rest_client_resp_hash = {}
-
-  # request_count && timeout values to begin with
-  request_count = 1
-
-  if proxy
-    browser_obj = PWN::Plugins::TransparentBrowser.open(
-      browser_type: :rest,
-      proxy: proxy
-    )
-  else
-    browser_obj = PWN::Plugins::TransparentBrowser.open(
-      browser_type: :rest
-    )
-  end
-  rest_client = browser_obj[:browser]::Request
-
-  headers = {
-    user_agent: Faker::Internet.user_agent
-  }
-
-  http_uri = "#{target_url}/#{wordlist_line}"
-
-  if http_request_headers
-    headers = JSON.parse(
-      http_request_headers,
-      symbolize_names: true
-    )
-  end
-
-  timestamp_fmt = '%Y-%m-%d %H:%M:%S.%L'
-
-  begin
-    request_timestamp = Time.now.strftime(timestamp_fmt)
-    response = rest_client.execute(
-      method: http_method,
-      url: http_uri,
-      headers: headers,
-      verify_ssl: false,
-      timeout: timeout
-    )
-    response_timestamp = Time.now.strftime(timestamp_fmt)
-
-    # duration in milliseconds
-    duration = Time.parse(response_timestamp) - Time.parse(request_timestamp)
-
-    rest_client_resp_hash = {
-      request_timestamp: request_timestamp,
-      response_timestamp: response_timestamp,
-      duration: duration,
-      http_uri: http_uri,
-      http_method: http_method,
-      http_resp_code: response.code,
-      http_resp_length: response.body.length,
-      http_resp_headers: JSON.pretty_generate(response.headers),
-      http_resp: "#{response.body[0..300]}..."
-    }
-  rescue Errno::ECONNREFUSED,
-         Errno::ECONNRESET,
-         NoMethodError,
-         OpenSSL::SSL::SSLError,
-         RestClient::Exceptions::ReadTimeout,
-         RestClient::Exceptions::OpenTimeout,
-         RestClient::ServerBrokeConnection,
-         SOCKSError => e
-
-    timeout += 0.1
-    retry if timeout < max_timeout
-
-    # May be best to switch Tor channel if SOCKSError is rescued
-    response_timestamp = Time.now.strftime(timestamp_fmt)
-    duration = Time.parse(response_timestamp) - Time.parse(request_timestamp)
-    rest_client_resp_hash = {
-      request_timestamp: request_timestamp,
-      response_timestamp: response_timestamp,
-      duration: duration,
-      http_uri: http_uri,
-      http_method: http_method,
-      http_resp_code: e.class,
-      http_resp_length: 'N/A',
-      http_resp_headers: 'N/A',
-      http_resp: "ERROR: #{e.message}"
-    }
-  rescue RestClient::ExceptionWithResponse => e
-    response_timestamp = Time.now.strftime(timestamp_fmt)
-    duration = Time.parse(response_timestamp) - Time.parse(request_timestamp)
-
-    if e.respond_to?(:response)
-      rest_client_resp_hash = {
-        request_timestamp: request_timestamp,
-        response_timestamp: response_timestamp,
-        duration: duration,
-        http_uri: http_uri,
-        http_method: http_method,
-        http_resp_code: e.response.code,
-        http_resp_length: e.response.body.length,
-        http_resp_headers: JSON.pretty_generate(e.response.headers),
-        http_resp: "#{e.response.body[0..300]}..."
-      }
-    else
-      resp_client_resp_hash = {
-        request_timestamp: request_timestamp,
-        response_timestamp: response_timestamp,
-        duration: duration,
-        http_uri: http_uri,
-        http_method: http_method,
-        http_resp_code: 'N/A',
-        http_resp_length: 'N/A',
-        http_resp_headers: 'N/A',
-        http_resp: 'N/A'
-      }
-    end
-  rescue URI::InvalidURIError
-    url_encoded_wordlist_arr = []
-    wordlist_line.split('/').each do |path|
-      url_encoded_wordlist_arr.push(CGI.escape(path))
-    end
-    wordlist_line = url_encoded_wordlist_arr.join('/')
-  rescue RestClient::TooManyRequests
-    request_count += 1
-    sleep 60
-
-    retry if request_count < max_retries
-  rescue SystemExit, Interrupt
-    puts "\n#{File.basename($PROGRAM_NAME)}.#{__method__} Goodbye."
-  end
-
-  rest_client_resp_hash
-ensure
-  browser_obj = PWN::Plugins::TransparentBrowser.close(
-    browser_obj: browser_obj
-  )
-end
-
-begin
-  pwn_provider = 'ruby-gem'
-  # pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.select { |s| s == 'PWN_PROVIDER' }.any?
-  pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.any? { |s| s == 'PWN_PROVIDER' }
-  $stdout.sync = true
-
-  target_url = opts[:target_url]
-  parsed_target_url = URI.parse(target_url)
-
-  wordlist = opts[:wordlist]
-  raise "ERROR: #{wordlist} Does Not Exist." unless File.exist?(wordlist)
-
-  append_pattern = opts[:append_pattern]
-  max_timeout = opts[:max_timeout] ||= 6
-  if max_timeout
-    max_timeout = max_timeout.to_f
-    raise 'ERROR: --max-timeout must be a positive float.' unless max_timeout.positive?
-  end
-
-  max_retries = opts[:max_retries] ||= 3
-  if max_retries
-    max_retries = max_retries.to_i
-    raise 'ERROR: --max-retries must be a positive integer.' unless max_retries.positive?
-  end
-
-  proxy = opts[:proxy]
-  max_threads = opts[:max_threads] ||= 25
-  if max_threads
-    max_threads = max_threads.to_i
-    raise 'ERROR: --max-threads must be a positive integer.' unless max_threads.positive?
-  end
-
-  http_request_headers = opts[:http_request_headers]
-  include_http_response_codes = opts[:include_http_response_codes]
-  include_http_response_codes = include_http_response_codes.to_s.delete("\s").split(',') if include_http_response_codes
-
-  exclude_http_response_codes = opts[:exclude_http_response_codes]
-  exclude_http_response_codes = exclude_http_response_codes.to_s.delete("\s").split(',') if exclude_http_response_codes
-
-  raise 'ERROR: Flags --include-response-codes and --exclude-response-codes cannot be used together.' if include_http_response_codes && exclude_http_response_codes
-
-  dir_path = opts[:dir_path] ||= '.'
-
-  report_name = opts[:report_name]
-  report_name ||= "#{parsed_target_url.host}-#{File.basename(wordlist)}-#{Time.now.strftime('%Y-%m-%d_%H-%M-%S')}"
-
-  start_reporting_server = opts[:start_reporting_server]
-
-  mutex = Mutex.new
-
-  results_hash = {
-    report_name: HTMLEntities.new.encode(
-      report_name.to_s.scrub.strip.chomp
-    ),
-    data: []
-  }
-
-  wordlist_arr = File.readlines(wordlist)
-  PWN::Plugins::ThreadPool.fill(
-    enumerable_array: wordlist_arr,
-    max_threads: max_threads
-  ) do |this_wl_line|
-    wordlist_line = this_wl_line.to_s.scrub.strip.chomp
-
-    next if wordlist_line.match?(/^#/)
-
-    http_methods = %i[
-      DELETE
-      GET
-      HEAD
-      OPTIONS
-      PATCH
-      POST
-      PUT
-      TRACE
-    ].shuffle
-
-    timeout = nil
-    http_methods.each do |http_method|
-      # TODO: Implement HTTP response timeout
-      prev_rest_client_resp_hash = results_hash[:data].last
-      rest_client_resp_hash = request_path(
-        target_url: target_url,
-        proxy: proxy,
-        http_request_headers: http_request_headers,
-        wordlist_line: "#{wordlist_line}#{append_pattern}",
-        http_method: http_method,
-        max_timeout: max_timeout,
-        timeout: timeout,
-        max_retries: max_retries
-      )
-
-      mutex.synchronize do
-        ret_http_resp_code = rest_client_resp_hash[:http_resp_code].to_s
-        # Better waY to implement this?
-        if include_http_response_codes.is_a?(Array)
-          # If include_http_response_codes is an array, only include
-          # the response into the results_hash if the response code
-          # is in the include_http_response_codes array
-          results_hash[:data].push(rest_client_resp_hash) if include_http_response_codes.include?(ret_http_resp_code) &&
-                                                             prev_rest_client_resp_hash != rest_client_resp_hash &&
-                                                             rest_client_resp_hash.any?
-        else
-          # If exclude_http_response_codes is an array, only include
-          # the response into the results_hash if the response code
-          # is not in the exclude_http_response_codes array
-          results_hash[:data].push(rest_client_resp_hash) unless exclude_http_response_codes.is_a?(Array) &&
-                                                                 exclude_http_response_codes.include?(ret_http_resp_code) &&
-                                                                 prev_rest_client_resp_hash != rest_client_resp_hash &&
-                                                                 rest_client_resp_hash.any?
-        end
-        # Finally puts the last line of the results_hash to STDOUT
-        puts results_hash[:data].last if results_hash[:data].last.any?
-        timeout = results_hash[:data].last[:duration].to_f if results_hash[:data].last.any?
-      end
-    end
-  end
-
-  # Generate HTML Report
-  print "#{File.basename($PROGRAM_NAME)} Generating Report..."
-  PWN::Reports::URIBuster.generate(
-    dir_path: dir_path,
-    results_hash: results_hash
-  )
-  puts 'complete.'
-
-  # Start Simple HTTP Server (If Requested)
-  if start_reporting_server
-    listen_port = PWN::Plugins::Sock.get_random_unused_port.to_s
-
-    if pwn_provider == 'docker'
-      listen_ip = '0.0.0.0'
-    else
-      listen_ip = '127.0.0.1'
-    end
-
-    puts "For Scan Results Navigate to: http://127.0.0.1:#{listen_port}/#{report_name}.html"
-    Dir.chdir(dir_path)
-    system(
-      'pwn_simple_http_server',
-      '-i',
-      listen_ip,
-      '-p',
-      listen_port
-    )
-  end
-# rescue SystemExit, Interrupt
-#   puts "\nGoodbye."
-rescue Interrupt
-  puts "\n#{File.basename($PROGRAM_NAME)} Goodbye."
-rescue StandardError => e
-  puts e.backtrace
-  raise e
-end

data/bin/pwn_xss_dom_vectors

@@ -1,149 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-tFQDN', '--target-fqdn=FQDN', '<Required - FQDN to Target>') do |t|
-    opts[:target_fqdn] = t
-  end
-
-  options.on('-dDIR', '--output-dir=DIR', '<Required - Directory to Save Results>') do |d|
-    opts[:output_dir] = d
-  end
-
-  options.on('-uURI', '--uri-source-root=URI', '<Required - URI to Source Root (for pwn_sast Results)>') do |u|
-    opts[:uri_source_root] = u
-  end
-
-  options.on('-bTYPE', '--browser-type=BROWSER', '<Optional - Browser Type chrome|firefox|headless (Default)>') do |b|
-    opts[:browser_type] = b
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy || tor>') do |p|
-    opts[:proxy] = p
-  end
-
-  options.on('-S', '--[no-]spider-fqdn', '<Optional - Spider Target FQDN>') do |s|
-    opts[:spider] = s
-  end
-end.parse!
-
-# Required Flag Variables
-target_fqdn = opts[:target_fqdn].to_s.scrub.strip.chomp
-output_dir = opts[:output_dir].to_s.scrub.strip.chomp if Dir.exist?(opts[:output_dir].to_s.scrub.strip.chomp)
-uri_source_root = opts[:uri_source_root].to_s.scrub
-
-if opts[:browser_type]
-  browser_type = opts[:browser_type].to_s.scrub.chomp.strip.to_sym
-else
-  browser_type = :headless
-end
-
-proxy = opts[:proxy].to_s.scrub.strip.chomp unless opts[:proxy].nil?
-
-if opts[:spider]
-  spider = true
-else
-  spider = false
-end
-
-spider_results = "#{output_dir}/#{File.basename($PROGRAM_NAME)}.spider"
-
-# Colors!
-@dark_red = "\e[1m\e[31m"
-@green = "\e[32m"
-@yellow = "\e[33m"
-@end_of_color = "\e[0m"
-
-begin
-  def grab_js_in_page(opts = {})
-    browser_obj = opts[:browser_obj]
-    target_page = opts[:url].to_s.scrub.chomp.strip
-    output_dir = opts[:output_dir].to_s.scrub.chomp.strip
-
-    browser = browser_obj[:browser]
-    puts "#{@green}Navigating to Page #{target_page}#{@end_of_color}"
-    browser.goto(target_page)
-    browser.scripts.each do |script|
-      if script.src == ''
-        # Save a copy of the outer_html
-        puts "#{@yellow}Saving OuterHTML of Native '<script>' Element#{@end_of_color}"
-        sha256_hexdigest = OpenSSL::Digest::SHA256.hexdigest(script.outer_html)
-        script_results = "#{output_dir}/#{sha256_hexdigest}.js"
-        File.open(script_results, 'w') do |f|
-          f.puts script.outer_html
-        end
-      else
-        # Save a copy of the script
-        puts "#{@yellow}Navigating to #{script.src}#{@end_of_color}"
-        browser.goto(script.src)
-        sha256_hexdigest = OpenSSL::Digest::SHA256.hexdigest(browser.text)
-        uri = URI.parse(browser.url)
-        script_filename = File.basename(uri.path)
-        script_results = "#{output_dir}/#{File.basename(script_filename, '.*')}-#{sha256_hexdigest}#{File.extname(script_filename)}".to_s.scrub.chomp.strip
-        File.open(script_results, 'w') do |f|
-          f.puts browser.text
-        end
-        browser.back
-      end
-      puts "#{@green}Saved #{script_results}#{@end_of_color}\n\n\n"
-    end
-  rescue StandardError => e
-    raise e
-  end
-
-  if proxy
-    browser_obj = PWN::Plugins::TransparentBrowser.open(
-      browser_type: browser_type,
-      proxy: proxy
-    )
-  else
-    browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: browser_type)
-  end
-
-  browser = browser_obj[:browser]
-
-  puts "#{@green}Navigating to Target FQDN: #{target_fqdn}#{@end_of_color}\n\n\n"
-  browser.goto(target_fqdn)
-
-  if spider
-    if File.exist?(spider_results)
-      puts "#{@dark_red}Using Existing Spider Results: #{spider_results}#{@end_of_color}"
-    else
-      puts "#{@dark_red}Spidering Target FQDN: #{target_fqdn}#{@end_of_color}"
-      PWN::Plugins::Spider.crawl(
-        target_fqdn: target_fqdn,
-        results_path: spider_results
-      )
-    end
-  end
-
-  # Grab JavaScript for Each Page Discovered
-  if spider
-    File.readlines(spider_results).uniq.each do |this_page|
-      grab_js_in_page(browser_obj: browser_obj, url: this_page, output_dir: output_dir)
-    end
-  else
-    grab_js_in_page(browser_obj: browser_obj, url: target_fqdn, output_dir: output_dir)
-  end
-
-  # Run DOM XSS SAST Test Cases
-  puts `pwn_sast -d #{output_dir} -t 1 -T 'InnerHTML, OuterHTML, WindowLocationHash' -u #{uri_source_root}`
-
-  # For future use
-  # page_script_elements = browser_obj.execute_script("
-  #   // JavaScript Goes Here
-  #   var script_elements = [];
-  #   var script_query = document.querySelectorAll('script');
-  #   for (var i = 0; i < script_query.length; i++) {
-  #     script_elements.push(script_query[i]);
-  #   }
-  #   return script_elements;
-  # ")
-rescue StandardError => e
-  raise e
-ensure
-  browser_obj = PWN::Plugins::TransparentBrowser.close(browser_obj: browser_obj) unless browser_obj.nil?
-end