pwn 0.5.509 → 0.5.510

data/bin/pwn_char_url_encoding

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'cgi'
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-pSTRING', '--payload=STRING', '<Required - String to Encode>') do |p|
+    opts[:payload] = p
+  end
+end.parse!
+
+payload = opts[:payload].to_s.scrub
+puts CGI.escape(payload)

data/bin/pwn_crt_sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'nokogiri'
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-tDOMAIN', '--target-domain=DOMAIN', '<Required - Target Domain>') do |t|
+    opts[:target_domain] = t
+  end
+
+  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy || tor>') do |p|
+    opts[:proxy] = p
+  end
+
+  options.on('-rPATH', '--report-path=PATH', '<Optional - Path to save report (Default: "/tmp/pwn_crt_sh-TIMESTAMP.json">') do |r|
+    opts[:report_path] = r
+  end
+end.parse!
+
+begin
+  target_domain = opts[:target_domain]
+  raise 'No target domain provided' if target_domain.nil?
+
+  timestamp = Time.now.strftime('%Y-%m-%d_%H:%M:%S.%L')
+  report_path = opts[:report_path] ||= "/tmp/pwn_crt_sh-#{target_domain}-#{timestamp}.json"
+
+  proxy = opts[:proxy]
+  if proxy
+    browser_obj = PWN::Plugins::TransparentBrowser.open(
+      browser_type: :rest,
+      proxy: proxy
+    )
+
+    rest_client = browser_obj[:browser]::Request
+    rest_resp = rest_client.execute(
+      method: :get,
+      url: "https://crt.sh/?q=#{target_domain}",
+      verify_ssl: false
+    )
+  else
+    browser_obj = PWN::Plugins::TransparentBrowser.open(
+      browser_type: :rest
+    )
+
+    rest_client = browser_obj[:browser]::Request
+    rest_resp = rest_client.execute(
+      method: :get,
+      url: "https://crt.sh/?q=#{target_domain}"
+    )
+  end
+
+  nokogiri_obj = Nokogiri::HTML.parse(rest_resp.body)
+  uniq_subd_arr = nokogiri_obj.xpath('//td[@class="outer"]/table/tr/td[5]/text()').map(&:to_s).uniq.sort
+  uniq_subd_arr.each { |subd| puts subd }
+
+  report = {
+    target_domain: target_domain,
+    subdomains: uniq_subd_arr
+  }
+
+  File.write(report_path, JSON.pretty_generate(report))
+
+  puts "Report saved to: #{report_path}"
+rescue Interrupt
+  puts "\n#{File.basename($PROGRAM_NAME)} => Goodbye."
+rescue StandardError => e
+  puts 'ERROR: Something Happened'
+  raise e
+ensure
+  browser_obj = PWN::Plugins::TransparentBrowser.close(browser_obj: browser_obj) if browser_obj
+end

data/bin/pwn_defectdojo_engagement_create

@@ -0,0 +1,148 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-uURL', '--url=URL', '<Required - DefectDojo URL>') do |u|
+    opts[:url] = u
+  end
+
+  options.on('-VVERSION', '--api-version=VERSION', '<Optional - DefectDojo API version v1 || v2 (Defaults to v2)>') do |v|
+    opts[:api_version] = v
+  end
+
+  options.on('-UUSER', '--username=USER', '<Optional - DefectDojo Username (Will Prompt if nil)>') do |u|
+    opts[:username] = u
+  end
+
+  options.on('-aKEY', '--api-key=KEY', '<Optional - DefectDojo API Key (Will Prompt if nil)>') do |a|
+    opts[:api_key] = a
+  end
+
+  options.on('-nNAME', '--enagagement-name=NAME', '<Required - Engagement Name to Create>') do |n|
+    opts[:name] = n
+  end
+
+  options.on('-dDESC', '--description=DESC', '<Optional - Engagement Description>') do |d|
+    opts[:description] = d
+  end
+
+  options.on('-xTYPE', '--enagagement-type=TYPE', '<Optional - type of engagement Interactive||CI/CD (Defaults to CI/CD)>') do |x|
+    opts[:engagement_name] = x
+  end
+
+  options.on('-sSTATUS', '--status=STATUS', '<Optional - status of the engagement In Progress || On Hold (defaults to In Progress)>') do |s|
+    opts[:status] = s
+  end
+
+  options.on('-lUSER', '--lead-username=USER', '<Optional - username of lead to tie to engagement (Defaults to username)>') do |l|
+    opts[:lead_username] = l
+  end
+
+  options.on('-pNAME', '--product-name=NAME', '<Required - product name in which to create engagement>') do |p|
+    opts[:product_name] = p
+  end
+
+  options.on('-tSTRATEGY', '--test-strategy=STRATEGY', '<Required - URL of test strategy documentation (e.g. OWASP ASVS URL)>') do |t|
+    opts[:test_strategy] = t
+  end
+
+  options.on('-bSERVER', '--build-server=SERVER', '<Optional - name of build server tied to CI/CD engagement>') do |b|
+    opts[:build_server] = b
+  end
+
+  options.on('-zSERVER', '--scm-server=SERVER', '<Optional - name of SCM server tied to CI/CD engagement>') do |z|
+    opts[:scm_server] = z
+  end
+
+  options.on('-oENGINE', '--orchestration-engine=ENGINE', '<Optional - name of orchestration engine tied to CI/CD engagement>') do |o|
+    opts[:orchestration_engine] = o
+  end
+
+  options.on('-A', '--[no-]api-test', '<Optional - API Test in Scope for Engagement (Defaults to false)>') do |a|
+    opts[:api_test] = a
+  end
+
+  options.on('-P', '--[no-]pen-test', '<Optional - Pen Test in Scope for Engagement (Defaults to false)>') do |p|
+    opts[:pen_test] = p
+  end
+
+  options.on('-T', '--[no-]threat-model', '<Optional - API Test in Scope for Engagement (Defaults to false)>') do |t|
+    opts[:threat_model] = t
+  end
+
+  options.on('-C', '--[no-]check-list', '<Optional - Checkbox Test in Scope for Engagement (Defaults to false)>') do |c|
+    opts[:check_list] = c
+  end
+
+  options.on('-cCONTACTED', '--first-contacted=CONTACTED', '<Optional - date of engagement request e.g. 2018-06-18 (Defaults to current day)>') do |c|
+    opts[:first_contacted] = c
+  end
+
+  options.on('-SSTART', '--target-start=START', '<Optional - date to start enagement e.g. 2018-06-19 (Defaults to current day)>') do |s|
+    opts[:target_start] = s
+  end
+
+  options.on('-EEND', '--target-end=END', '<Optional - date to end enagement e.g. 2018-06-20 (Defaults to current day)>') do |e|
+    opts[:target_end] = e
+  end
+end.parse!
+
+# Construct AuthN Args
+url = opts[:url]
+api_version = opts[:api_version]
+opts[:username] ? (username = opts[:username]) : (username = PWN::Plugins::AuthenticationHelper.username)
+opts[:api_key] ? (api_key = opts[:api_key]) : (api_key = PWN::Plugins::AuthenticationHelper.mask_password(prompt: 'API Key'))
+
+# Create Engagement Args
+name = opts[:name]
+description = opts[:description]
+engagement_type = opts[:engagement_type]
+status = opts[:status]
+opts[:lead_username] ? (lead_username = opts[:lead_username]) : (lead_username = username)
+product_name = opts[:product_name]
+test_strategy = opts[:test_strategy]
+orchestration_engine = opts[:orchestration_engine]
+build_server = opts[:build_server]
+scm_server = opts[:scm_server]
+api_test = opts[:api_test]
+pen_test = opts[:pen_test]
+threat_model = opts[:threat_model]
+check_list = opts[:check_list]
+first_contacted = opts[:first_contacted]
+target_start = opts[:target_start]
+target_end = opts[:target_end]
+
+begin
+  dd_obj = PWN::Plugins::DefectDojo.login(
+    url: url,
+    api_version: api_version,
+    username: username,
+    api_key: api_key
+  )
+
+  engagement_create_resp = PWN::Plugins::DefectDojo.engagement_create(
+    dd_obj: dd_obj,
+    name: name,
+    description: description,
+    engagement_type: engagement_type,
+    status: status,
+    lead_username: lead_username,
+    product_name: product_name,
+    test_strategy: test_strategy,
+    orchestration_engine: orchestration_engine,
+    build_server: build_server,
+    scm_server: scm_server,
+    api_test: api_test,
+    pen_test: pen_test,
+    threat_model: threat_model,
+    check_list: check_list,
+    first_contacted: first_contacted,
+    target_start: target_start,
+    target_end: target_end
+  )
+rescue StandardError => e
+  raise e
+end

data/bin/pwn_defectdojo_importscan

@@ -0,0 +1,130 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-uURL', '--url=URL', '<Required - DefectDojo URL>') do |u|
+    opts[:url] = u
+  end
+
+  options.on('-VVERSION', '--api-version=VERSION', '<Optional - DefectDojo API version v1 || v2 (Defaults to v2)>') do |v|
+    opts[:api_version] = v
+  end
+
+  options.on('-UUSER', '--username=USER', '<Optional - DefectDojo Username (Will Prompt if nil)>') do |u|
+    opts[:username] = u
+  end
+
+  options.on('-aKEY', '--api-key=KEY', '<Optional - DefectDojo API Key (Will Prompt if nil)>') do |a|
+    opts[:api_key] = a
+  end
+
+  options.on('-nNAME', '--engagement-name=NAME', '<Required - name of engagement to associate w/ scan>') do |n|
+    opts[:engagement_name] = n
+  end
+
+  options.on('-sTYPE', '--scan-type=TYPE', '<Required - type of scan importing (see <DEFECTDOJO_URL>/admin/dojo/test_type/ for listing)>') do |t|
+    opts[:scan_type] = t
+  end
+
+  options.on('-fFILE', '--file-path=FILE', '<Required - path of scan results file>') do |f|
+    opts[:file] = f
+  end
+
+  options.on('-TNAME', '--test-title=NAME', '<Optional - name of test to associate w/ scan type (Defaults to --scan-type value>') do |t|
+    opts[:test_title] = t
+  end
+
+  options.on('-lUSER', '--lead-username=USER', '<Optional - username of lead to tie to engagement (Defaults to username)>') do |l|
+    opts[:lead_username] = l
+  end
+
+  options.on('-tTAGS', '--tags=TAGS', '<Optional - comma-delimited list of tag names to tie to scan>') do |t|
+    opts[:tags] = t
+  end
+
+  options.on('-mSEVERITY', '--min-severity=SEVERITY', '<Optional - minimum finding severity Info||Low||Medium||High||Critical (Defaults to Info)>') do |m|
+    opts[:minimum_severity] = m
+  end
+
+  options.on('-dDATE', '--scan-date=DATE', '<Optional - date in which scan was kicked off (Defaults to current day)>') do |d|
+    opts[:scan_date] = d
+  end
+
+  options.on('-v', '--[no-]verified', '<Optional - flag finding as verified by a tester (defaults to false)') do |v|
+    opts[:verified] = v
+  end
+
+  options.on('-GVALUE', '--group-by=VALUE', '<Optional - group findings by "component_name" || "component_name+component_version" || "file_path" || "finding_title" (defaults to nil)') do |g|
+    opts[:group_by] = g
+  end
+
+  options.on('-g', '--create-finding-groups', '<Optional - group similar findings into one finding (defaults to false)') do |g|
+    opts[:create_finding_groups] = g
+  end
+
+  options.on('-c', '--close-old-findings-product-scope', '<Optional - Select if close_old_findings applies to all findings of the same type in the product (defaults to false)') do |c|
+    opts[:close_old_findings_product_scope] = c
+  end
+
+  options.on('-C', '--close-old-findings', '<Optional - old findings no longer present in the report get closed as mitigated when importing (defaults to false)') do |c|
+    opts[:close_old_findings] = c
+  end
+
+  options.on('-j', '--push-to-jira', '<Optional - push findings to JIRA (defaults to false)') do |j|
+    opts[:push_to_jira] = j
+  end
+end.parse!
+
+# Construct AuthN Args
+url = opts[:url]
+api_version = opts[:api_version]
+opts[:username] ? (username = opts[:username]) : (username = PWN::Plugins::AuthenticationHelper.username)
+opts[:api_key] ? (api_key = opts[:api_key]) : (api_key = PWN::Plugins::AuthenticationHelper.mask_password(prompt: 'API Key'))
+
+# Create Engagement Args
+engagement_name = opts[:engagement_name]
+scan_type = opts[:scan_type]
+file = opts[:file]
+opts[:lead_username] ? (lead_username = opts[:lead_username]) : (lead_username = username)
+test_title = opts[:test_title]
+tags = opts[:tags]
+minimum_severity = opts[:minimum_severity]
+scan_date = opts[:scan_date]
+verified = opts[:verified]
+group_by = opts[:group_by]
+create_findings_groups = opts[:create_finding_groups]
+close_old_findings_product_scope = opts[:close_old_findings_product_scope]
+close_old_findings = opts[:close_old_findings]
+push_to_jira = opts[:push_to_jira]
+
+begin
+  dd_obj = PWN::Plugins::DefectDojo.login(
+    url: url,
+    api_version: api_version,
+    username: username,
+    api_key: api_key
+  )
+
+  importscan_response = PWN::Plugins::DefectDojo.importscan(
+    dd_obj: dd_obj,
+    engagement_name: engagement_name,
+    scan_type: scan_type,
+    file: file,
+    test_title: test_title,
+    lead_username: lead_username,
+    tags: tags,
+    minimum_severity: minimum_severity,
+    scan_date: scan_date,
+    verified: verified,
+    group_by: group_by,
+    create_findings_groups: create_findings_groups,
+    close_old_findings_product_scope: close_old_findings_product_scope,
+    close_old_findings: close_old_findings,
+    push_to_jira: push_to_jira
+  )
+rescue StandardError => e
+  raise e
+end

data/bin/pwn_defectdojo_reimportscan

@@ -0,0 +1,118 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-uURL', '--url=URL', '<Required - DefectDojo URL>') do |u|
+    opts[:url] = u
+  end
+
+  options.on('-VVERSION', '--api-version=VERSION', '<Optional - DefectDojo API version v1 || v2 (Defaults to v2)>') do |v|
+    opts[:api_version] = v
+  end
+
+  options.on('-UUSER', '--username=USER', '<Optional - DefectDojo Username (Will Prompt if nil)>') do |u|
+    opts[:username] = u
+  end
+
+  options.on('-aKEY', '--api-key=KEY', '<Optional - DefectDojo API Key (Will Prompt if nil)>') do |a|
+    opts[:api_key] = a
+  end
+
+  options.on('-nNAME', '--enagagement-name=NAME', '<Required - name of engagement to associate w/ scan>') do |n|
+    opts[:engagement_name] = n
+  end
+
+  options.on('-sTYPE', '--scan-type=TYPE', '<Required - type of scan importing (see <DEFECTDOJO_URL>/admin/dojo/test_type/ for listing)>') do |t|
+    opts[:scan_type] = t
+  end
+
+  options.on('-fFILE', '--file-path=FILE', '<Required - path of scan results file>') do |f|
+    opts[:file] = f
+  end
+
+  options.on('-TPATH', '--test-resource-uri=PATH', '<Required - test resource URI (e.g. /api/v1/tests/1/)>') do |p|
+    opts[:test_resource_uri] = p
+  end
+
+  options.on('-tTAGS', '--tags=TAGS', '<Optional - comma-delimited list of tag names to tie to scan>') do |t|
+    opts[:tags] = t
+  end
+
+  options.on('-mSEVERITY', '--min-severity=SEVERITY', '<Optional - minimum finding severity Info||Low||Medium||High||Critical (Defaults to Info)>') do |m|
+    opts[:minimum_severity] = m
+  end
+
+  options.on('-dDATE', '--scan-date=DATE', '<Optional - date in which scan was kicked off (Defaults to current day)>') do |d|
+    opts[:scan_date] = d
+  end
+
+  options.on('-v', '--[no-]verified', '<Optional - flag finding as verified by a tester (defaults to false)') do |v|
+    opts[:verified] = v
+  end
+
+  options.on('-g', '--create-finding-groups', '<Optional - group similar findings into one finding (defaults to false)') do |g|
+    opts[:create_finding_groups] = g
+  end
+
+  options.on('-c', '--close-old-findings-product-scope', '<Optional - Select if close_old_findings applies to all findings of the same type in the product (defaults to false)') do |c|
+    opts[:close_old_findings_product_scope] = c
+  end
+
+  options.on('-C', '--close-old-findings', '<Optional - old findings no longer present in the report get closed as mitigated when importing (defaults to false)') do |c|
+    opts[:close_old_findings] = c
+  end
+
+  options.on('-j', '--push-to-jira', '<Optional - push findings to JIRA (defaults to false)') do |j|
+    opts[:push_to_jira] = j
+  end
+end.parse!
+
+# Construct AuthN Args
+url = opts[:url]
+api_version = opts[:api_version]
+opts[:username] ? (username = opts[:username]) : (username = PWN::Plugins::AuthenticationHelper.username)
+opts[:api_key] ? (api_key = opts[:api_key]) : (api_key = PWN::Plugins::AuthenticationHelper.mask_password(prompt: 'API Key'))
+
+# Create Engagement Args
+engagement_name = opts[:engagement_name]
+scan_type = opts[:scan_type]
+file = opts[:file]
+test_resource_uri = opts[:test_resource_uri]
+tags = opts[:tags]
+minimum_severity = opts[:minimum_severity]
+scan_date = opts[:scan_date]
+verified = opts[:verified]
+create_finding_groups = opts[:create_finding_groups]
+close_old_findings_product_scope = opts[:close_old_findings_product_scope]
+close_old_findings = opts[:close_old_findings]
+push_to_jira = opts[:push_to_jira]
+
+begin
+  dd_obj = PWN::Plugins::DefectDojo.login(
+    url: url,
+    api_version: api_version,
+    username: username,
+    api_key: api_key
+  )
+
+  reimportscan_response = PWN::Plugins::DefectDojo.reimportscan(
+    dd_obj: dd_obj,
+    engagement_name: engagement_name,
+    scan_type: scan_type,
+    file: file,
+    test_resource_uri: test_resource_uri,
+    tags: tags,
+    minimum_severity: minimum_severity,
+    scan_date: scan_date,
+    verified: verified,
+    create_finding_groups: create_finding_groups,
+    close_old_findings_product_scope: close_old_findings_product_scope,
+    close_old_findings: close_old_findings,
+    push_to_jira: push_to_jira
+  )
+rescue StandardError => e
+  raise e
+end

data/bin/pwn_diff_csv_files_w_column_exclude

@@ -0,0 +1,171 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'csv'
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.banner = "USAGE:
+    #{File.basename($PROGRAM_NAME)} [opts]
+    EXAMPLE w/ Tenable Nessus Results:
+    #{File.basename($PROGRAM_NAME)} \\
+      --csv-a vuln_scan1.csv \\
+      --csv-b vuln_scan2.csv \\
+      --csv-diff vuln_scan_diff.csv \\
+      --exclude-column-names 'Synopsis,Description,Solution,See Also,Plugin Output,Asset UUID,Vulnerability State,IP Address,FQDN,NetBios,OS,MAC Address,Plugin Family,CVSS Base Score,CVSS Temporal Score,CVSS Temporal Vector,CVSS Vector,CVSS3 Base Score,CVSS3 Temporal Score,CVSS3 Temporal Vector,CVSS3 Vector,System Type,Host Start,Host End,Vulnerability Priority Rating (VPR),First Found,Last Found,Host Scan Schedule ID,Host Scan ID,Indexed At,Last Authenticated Results Date,Last Unauthenticated Results Date,Tracked,Risk Factor,Severity,Original Severity,Modification,Plugin Family ID,Plugin Type,Plugin Version,Service,Plugin Modification Date,Plugin Publication Date,Checks for Malware,Exploit Available,Exploited by Malware,Exploited by Nessus,CANVAS,D2 Elliot,Metasploit,Core Exploits,ExploitHub,Default Account,Patch Available,In The News,Unsupported By Vendor,Last Fixed'
+
+    EXAMPLE w/ OpenVAS Results:
+    #{File.basename($PROGRAM_NAME)} \\
+      --csv-a vuln_scan1.csv \\
+      --csv-b vuln_scan2.csv \\
+      --csv-diff vuln_scan_diff.csv \\
+      --exclude-column-names 'Timestamp, Result ID'
+  "
+
+  options.on('-aCSV', '--csv-a=CSV', '<Required - First CSV to Compare)>') do |c1|
+    opts[:c1_path] = c1
+  end
+
+  options.on('-bCSV', '--csv-b=CSV', '<Required - Second CSV to Compare)>') do |c2|
+    opts[:c2_path] = c2
+  end
+
+  options.on('-dDIFF', '--csv-diff=DIFF', '<Required - Path of CSV Diff to Generate)>') do |d|
+    opts[:diff_path] = d
+  end
+
+  options.on('-eNAMES', '--exclude-column-names=NAMES', '<Optional - Comma-Delimited List of Column Names to Exclude)>') do |n|
+    opts[:column_names_to_exclude] = n
+  end
+
+  options.on('-n', '--no-headers', '<Optional - Redact CSV Headers in CSV Diff>') do |h|
+    opts[:no_headers] = h
+  end
+end.parse!
+
+def ommit_columns_by_index(opts = {})
+  csv = opts[:csv]
+  columns_index_arr = opts[:columns_index_arr]
+
+  csv.each do |line_arr|
+    line_arr.delete_if.with_index do |_, index|
+      columns_index_arr.include?(index)
+    end
+  end
+end
+
+def csv_diff(opts = {})
+  c1_path = opts[:c1_path]
+  c2_path = opts[:c2_path]
+  diff_path = opts[:diff_path]
+  no_headers = opts[:no_headers]
+  column_names_to_exclude = opts[:column_names_to_exclude].to_s.split(',')
+
+  csv1 = CSV.open(
+    c1_path,
+    'rb',
+    col_sep: ',',
+    quote_char: '"',
+    force_quotes: true
+  ).read
+
+  csv2 = CSV.open(
+    c2_path,
+    'rb',
+    col_sep: ',',
+    quote_char: '"',
+    force_quotes: true
+  ).read
+
+  if csv1.length >= csv2.length
+    larger_csv = csv1
+    larger_csv_orig = CSV.open(
+      c1_path,
+      'rb',
+      col_sep: ',',
+      quote_char: '"',
+      force_quotes: true
+    ).read
+
+    smaller_csv = csv2
+  end
+
+  if csv2.length >= csv1.length
+    larger_csv = csv2
+    larger_csv_orig = CSV.open(
+      c2_path,
+      'rb',
+      col_sep: ',',
+      quote_char: '"',
+      force_quotes: true
+    ).read
+
+    smaller_csv = csv1
+  end
+
+  # Exclude the column values for diff to ensure the same rows
+  # with for example different timestamps aren't included.
+  columns_index_arr = []
+  column_names_to_exclude&.each do |cn|
+    column_name = cn.strip.chomp
+    column_index = smaller_csv.first.find_index(column_name)
+    columns_index_arr.push(column_index)
+  end
+
+  if columns_index_arr.any?
+    larger_csv = ommit_columns_by_index(
+      csv: larger_csv,
+      columns_index_arr: columns_index_arr
+    )
+
+    smaller_csv = ommit_columns_by_index(
+      csv: smaller_csv,
+      columns_index_arr: columns_index_arr
+    )
+  end
+
+  # Write diff with redacted columns (to find differences we care about)
+  CSV.open(diff_path, 'w', col_sep: ',', quote_char: '"', force_quotes: true) do |csv|
+    larger_csv.each do |line_arr|
+      line = line_arr.join(',')
+      # csv.puts line_arr if smaller_csv.select { |sc| sc.join(',') == line }.empty?
+      csv.puts line_arr if smaller_csv.none? { |sc| sc.join(',') == line }
+    end
+  end
+  diff_csv = CSV.open(
+    diff_path,
+    'rb',
+    col_sep: ',',
+    quote_char: '"',
+    force_quotes: true
+  ).read
+
+  # Write diff again with all columns.
+  CSV.open(diff_path, 'w', col_sep: ',', quote_char: '"', force_quotes: true) do |csv|
+    csv.puts larger_csv_orig.first unless no_headers
+    larger_csv_orig.each_with_index do |line_arr, index|
+      # Use larger_csv instead of orig to compare column redaction to diff_csv
+      line = larger_csv[index].join(',')
+      # csv.puts line_arr if diff_csv.select { |dc| dc.join(',') == line }.any?
+      csv.puts line_arr if diff_csv.any? { |dc| dc.join(',') == line }
+    end
+  end
+end
+
+c1_path = opts[:c1_path]
+c2_path = opts[:c2_path]
+diff_path = opts[:diff_path]
+column_names_to_exclude = opts[:column_names_to_exclude]
+
+no_headers = true if opts[:no_headers]
+no_headers ||= false
+
+# Compare which two is larger
+csv_diff(
+  c1_path: c1_path,
+  c2_path: c2_path,
+  diff_path: diff_path,
+  no_headers: no_headers,
+  column_names_to_exclude: column_names_to_exclude
+)