pwn 0.5.509 → 0.5.510

data/lib/pwn/sast/test_case_engine.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to execute PWN::SAST::* modules
+    module TestCaseEngine
+      @@logger = PWN::Plugins::PWNLogger.create
+
+      # Supported Method Parameters::
+      # PWN::SAST::TestCaseEngine.execute(
+      #   test_case_filter: 'required - grep command to filter results',
+      #   security_references: 'required - Hash with keys :sast_module, :section, :nist_800_53_uri, :cwe_id, :cwe_uri',
+      #   dir_path: 'optional - path to dir defaults to .',
+      #   include_extensions: 'optional - array of file extensions to search for in scan (Defaults to all file types / i.e. [])',
+      #   exclude_extensions: 'optional - array of file extensions to exclude from scan (Defaults to [.bin, .dat, .JS-BEAUTIFIED, .o, .test, .png, .jpg, .jpeg, .gif, .svg, .ico, .so, .spec, .zip, .tar, .gz, .tgz, .7z, .mp3, .mp4, .mov, .avi, .wmv, .flv, .mkv])',
+      #   git_repo_root_uri: 'optional - http uri of git repo scanned'
+      # )
+
+      public_class_method def self.execute(opts = {})
+        test_case_filter = opts[:test_case_filter]
+        raise 'ERROR: test_case_filter must be nil' if test_case_filter.nil?
+
+        security_references = opts[:security_references]
+        raise 'ERROR: security_references must be a Hash' unless security_references.is_a?(Hash)
+
+        dir_path = opts[:dir_path] ||= '.'
+        include_extensions = opts[:include_extensions] ||= []
+        exclude_extensions = opts[:exclude_extentions] ||= %w[
+          .7z
+          .avi
+          .bin
+          .dat
+          .dll
+          .flv
+          .gif
+          .gz
+          .ico
+          .jpg
+          .jpeg
+          .JS-BEAUTIFIED
+          .markdown
+          .md
+          .mkv
+          .mov
+          .mp3
+          .mp4
+          .o
+          .png
+          .svg
+          .test
+          .so
+          .spec
+          .tar
+          .tgz
+          .webm
+          .wmv
+          .zip
+        ]
+
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        result_arr = []
+        logger_results = "AI Introspection => #{PWN::Env[:ai][:introspection]} => "
+
+        PWN::Plugins::FileFu.recurse_in_dir(
+          dir_path: dir_path,
+          include_extensions: include_extensions,
+          exclude_extensions: exclude_extensions
+        ) do |entry|
+          if File.file?(entry) && File.basename(entry) !~ /^pwn.+(html|json|db)$/ && entry !~ /test/i
+            line_no_and_contents_arr = []
+            entry_beautified = false
+
+            if File.extname(entry) == '.js' && (`wc -l #{entry}`.split.first.to_i < 20 || entry.include?('.min.js') || entry.include?('-all.js'))
+              js_beautify = `js-beautify #{entry} > #{entry}.JS-BEAUTIFIED 2> /dev/null`.to_s.scrub
+              entry = "#{entry}.JS-BEAUTIFIED"
+              entry_beautified = true
+            end
+
+            # Replace tokenized test_case_filter, PWN_ENTRY with actual entry
+            this_test_case_filter = test_case_filter.to_s.gsub('{PWN_SAST_SRC_TARGET}', entry.to_s.scrub).to_s.scrub
+            str = `#{this_test_case_filter}`.to_s.scrub
+
+            if str.to_s.empty?
+              # If str length is >= 64 KB do not include results. (Due to Mongo Document Size Restrictions)
+              logger_results = "#{logger_results}~" # Catching bugs is good :)
+            else
+              str = "1:Result larger than 64KB -> Size: #{str.to_s.length}.  Please click the \"Path\" link for more details." if str.to_s.length >= 64_000
+
+              hash_line = {
+                timestamp: Time.now.strftime('%Y-%m-%d %H:%M:%S.%9N %z').to_s,
+                security_references: security_references,
+                filename: { git_repo_root_uri: git_repo_root_uri, entry: entry },
+                line_no_and_contents: '',
+                raw_content: str,
+                test_case_filter: this_test_case_filter
+              }
+
+              # COMMMENT: Must be a better way to implement this (regex is kinda funky)
+              line_contents_split = str.split(/^(\d{1,}):|\n(\d{1,}):/)[1..-1]
+              line_no_count = line_contents_split.length # This should always be an even number
+              current_count = 0
+              while line_no_count > current_count
+                line_no = line_contents_split[current_count]
+                contents = line_contents_split[current_count + 1]
+                if Dir.exist?('.git')
+                  repo_root = '.'
+
+                  author = PWN::Plugins::Git.get_author(
+                    repo_root: repo_root,
+                    from_line: line_no,
+                    to_line: line_no,
+                    target_file: entry,
+                    entry_beautified: entry_beautified
+                  )
+                end
+                author ||= 'N/A'
+
+                request = {
+                  scm_uri: "#{hash_line[:filename][:git_repo_root_uri]}/#{hash_line[:filename][:entry]}",
+                  line_no: line_no,
+                  source_code_snippet: contents
+                }.to_json
+
+                system_role_content = 'Your sole purpose is to analyze source code snippets and generate an Exploit Prediction Scoring System (EPSS) score between 0% - 100%.  Just generate a score unless score is >= 75% in which a PoC and code fix should also be included.'
+                ai_analysis = PWN::AI::Introspection.reflect_on(
+                  system_role_content: system_role_content,
+                  request: request,
+                  suppress_pii_warning: true
+                )
+                ai_analysis ||= 'N/A'
+
+                hash_line[:line_no_and_contents] = line_no_and_contents_arr.push(
+                  line_no: line_no,
+                  contents: contents,
+                  author: author,
+                  ai_analysis: ai_analysis
+                )
+
+                current_count += 2
+              end
+              result_arr.push(hash_line)
+              logger_results = "#{logger_results}x" # Seeing progress is good :)
+            end
+          end
+        end
+        sast_module = security_references[:sast_module].to_s.scrub.gsub('::', '/')
+        logger_banner = "https://www.rubydoc.info/gems/pwn/#{sast_module}"
+
+        if logger_results.empty?
+          @@logger.info("#{logger_banner}: No files applicable to this test case.\n")
+        else
+          @@logger.info("#{logger_banner} => #{logger_results}complete.\n")
+        end
+        result_arr
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.execute(
+            test_case_filter: 'required grep command to filter results',
+            security_references: 'required Hash with keys :sast_module, :section, :nist_800_53_uri, :cwe_id, :cwe_uri',
+            dir_path: 'optional path to dir defaults to .',
+            include_extensions: 'optional array of file extensions to search for in scan (Defaults to all file types / i.e. [])',
+            exclude_extensions: 'optional array of file extensions to exclude from scan (Defaults to [.bin, .dat, .JS-BEAUTIFIED, .o, .test, .png, .jpg, .jpeg, .gif, .svg, .ico, .so, .spec, .zip, .tar, .gz, .tgz, .7z, .mp3, .mp4, .mov, .avi, .wmv, .flv, .mkv])',
+            git_repo_root_uri: 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast/throw_errors.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to identify whether
+    # error messages are sanitized properly.
+    module ThrowErrors
+      # Supported Method Parameters::
+      # PWN::SAST::ThrowErrors.scan(
+      #   dir_path: 'optional path to dir defaults to .'
+      #   git_repo_root_uri: 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        test_case_filter = %(
+          grep -in \
+          -e panic \
+          -e raise \
+          -e throw {PWN_SAST_SRC_TARGET} 2> /dev/null | \
+          grep '"'
+        )
+
+        PWN::SAST::TestCaseEngine.execute(
+          test_case_filter: test_case_filter,
+          security_references: security_references,
+          dir_path: dir_path,
+          git_repo_root_uri: git_repo_root_uri
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.security_references
+        {
+          sast_module: self,
+          section: 'ERROR HANDLING',
+          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SI-11',
+          cwe_id: '209',
+          cwe_uri: 'https://cwe.mitre.org/data/definitions/209.html'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            dir_path: 'optional path to dir defaults to .',
+            git_repo_root_uri: 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast/token.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to identify any
+    # reference within source code of authorization tokens.
+    module Token
+      # Supported Method Parameters::
+      # PWN::SAST::Token.scan(
+      #   dir_path: 'optional path to dir defaults to .'
+      #   git_repo_root_uri: 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        test_case_filter = "
+          grep -Fin \
+          -e 'token' \
+          -e 'oauth' \
+          -e 'decodeAndVerify' {PWN_SAST_SRC_TARGET} 2> /dev/null
+        "
+
+        PWN::SAST::TestCaseEngine.execute(
+          test_case_filter: test_case_filter,
+          security_references: security_references,
+          dir_path: dir_path,
+          git_repo_root_uri: git_repo_root_uri
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.security_references
+        {
+          sast_module: self,
+          section: 'CRYPTOGRAPHIC MODULE AUTHENTICATION',
+          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=IA-07',
+          cwe_id: '798',
+          cwe_uri: 'https://cwe.mitre.org/data/definitions/798.html'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            dir_path: 'optional path to dir defaults to .',
+            git_repo_root_uri: 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast/type_script_type_juggling.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to identify loose comparisons
+    # (i.e. == instead of ===) within TypeScript source code.
+    module TypeScriptTypeJuggling
+      # Supported Method Parameters::
+      # PWN::SAST::TypeScriptTypeJuggling.scan(
+      #   dir_path: 'optional path to dir defaults to .'
+      #   git_repo_root_uri: 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        test_case_filter = "
+          grep -Fn \
+          -e '==' \
+          -e '!=' {PWN_SAST_SRC_TARGET} 2>/dev/null | \
+          grep -v \
+            -e '===' \
+            -e '!=='
+        "
+
+        include_extensions = %w[.ts .tsx .mts .cts .d.ts .d.mts .d.cts .js .mjs .cjs .map .tsbuildinfo]
+
+        PWN::SAST::TestCaseEngine.execute(
+          test_case_filter: test_case_filter,
+          security_references: security_references,
+          dir_path: dir_path,
+          include_extensions: include_extensions,
+          git_repo_root_uri: git_repo_root_uri
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.security_references
+        {
+          sast_module: self,
+          section: 'DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN',
+          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SA-17',
+          cwe_id: '661',
+          cwe_uri: 'https://cwe.mitre.org/data/definitions/661.html'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            :dir_path => 'optional path to dir defaults to .',
+            :git_repo_root_uri => 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast/use_after_free.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to identify banned function
+    # calls in C & C++ code per:
+    # https://msdn.microsoft.com/en-us/library/bb288454.aspx
+    module UseAfterFree
+      # Supported Method Parameters::
+      # PWN::SAST::UseAfterFree.scan(
+      #   :dir_path => 'optional path to dir defaults to .'
+      #   :git_repo_root_uri => 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        test_case_filter = "
+          grep -Fn \
+          -e 'calloc(' \
+          -e 'free(' \
+          -e 'malloc(' \
+          -e 'realloc(' {PWN_SAST_SRC_TARGET} 2> /dev/null
+        "
+
+        include_extensions = %w[.c .cats .idc .cpp .cc .cxx .c++ .cp .CPP .C .cppm .ixx .h .hpp .hxx .hh .h++ .inc .inl .ipp .tcc .tpp .txx .i .s .asm .o .obj .a .so .lib .dll .exe .pdb .vcxproj .sln .dsp .dsw .cbp .cmake .make .mk]
+
+        PWN::SAST::TestCaseEngine.execute(
+          test_case_filter: test_case_filter,
+          security_references: security_references,
+          dir_path: dir_path,
+          include_extensions: include_extensions,
+          git_repo_root_uri: git_repo_root_uri
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.security_references
+        {
+          sast_module: self,
+          section: 'MEMORY PROTECTION',
+          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SI-16',
+          cwe_id: '416',
+          cwe_uri: 'https://cwe.mitre.org/data/definitions/416.html'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            :dir_path => 'optional path to dir defaults to .',
+            :git_repo_root_uri => 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast/version.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to detect version
+    # information within all files in a source repo
+    module Version
+      # Supported Method Parameters::
+      # PWN::SAST::Version.scan(
+      #   dir_path: 'optional path to dir defaults to .'
+      #   git_repo_root_uri: 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        test_case_filter = %(
+          grep -in \
+          -e "version\\s=\\s" {PWN_SAST_SRC_TARGET} 2> /dev/null | \
+          grep -F '"'
+        )
+
+        PWN::SAST::TestCaseEngine.execute(
+          test_case_filter: test_case_filter,
+          security_references: security_references,
+          dir_path: dir_path,
+          git_repo_root_uri: git_repo_root_uri
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.security_references
+        {
+          sast_module: self,
+          section: 'VULNERABILITY SCANNING',
+          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=RA-05',
+          cwe_id: '672',
+          cwe_uri: 'https://cwe.mitre.org/data/definitions/672.html'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            dir_path: 'optional path to dir defaults to .',
+            git_repo_root_uri: 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/sast/window_location_hash.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: false
+
+require 'json'
+require 'socket'
+
+module PWN
+  module SAST
+    # SAST Module used to identify the potential
+    # for DOM-based XSS in the application.
+    module WindowLocationHash
+      # Supported Method Parameters::
+      # PWN::SAST::WindowLocationHash.scan(
+      #   dir_path: 'optional path to dir defaults to .'
+      #   git_repo_root_uri: 'optional http uri of git repo scanned'
+      # )
+
+      public_class_method def self.scan(opts = {})
+        dir_path = opts[:dir_path]
+        git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
+
+        test_case_filter = "
+          grep -n \
+          -e 'window.location.hash' {PWN_SAST_SRC_TARGET} 2> /dev/null
+        "
+
+        PWN::SAST::TestCaseEngine.execute(
+          test_case_filter: test_case_filter,
+          security_references: security_references,
+          dir_path: dir_path,
+          git_repo_root_uri: git_repo_root_uri
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Used primarily to map NIST 800-53 Revision 4 Security Controls
+      # https://web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH
+      # to PWN Exploit & Static Code Anti-Pattern Matching Modules to
+      # Determine the level of Testing Coverage w/ PWN.
+
+      public_class_method def self.security_references
+        {
+          sast_module: self,
+          section: 'MALICIOUS CODE PROTECTION',
+          nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SI-03',
+          cwe_id: '79',
+          cwe_uri: 'https://cwe.mitre.org/data/definitions/79.html'
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          sast_arr = #{self}.scan(
+            dir_path: 'optional path to dir defaults to .',
+            git_repo_root_uri: 'optional http uri of git repo scanned'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end