pwn 0.5.618 → 0.5.621

data/lib/pwn/ai/agent/tools/extrospection.rb

@@ -29,7 +29,7 @@ PWN::AI::Agent::Registry.register(
       type: 'object',
       properties: {
         persist: { type: 'boolean', default: true, description: 'Write to disk & rotate previous baseline.' },
-        sections: { type: 'array', items: { type: 'string', enum: %w[host net toolchain repo env] }, description: 'Subset of probes to run (default all).' }
+        sections: { type: 'array', items: { type: 'string', enum: %w[host net toolchain repo env rf web] }, description: 'Subset of probes to run (default all).' }
       },
       required: []
     }
@@ -86,7 +86,7 @@ PWN::AI::Agent::Registry.register(
       properties: {
         source: { type: 'string', description: 'Where it came from (nmap, shodan, burp, cve, human, ...).' },
         data: { type: 'string', description: 'The observation itself.' },
-        category: { type: 'string', enum: %w[recon vuln intel target network env misc], default: 'misc' },
+        category: { type: 'string', enum: %w[recon vuln intel target network env rf web misc], default: 'misc' },
         target: { type: 'string', description: 'Host / IP / URL / asset the observation is about.' },
         tags: { type: 'array', items: { type: 'string' } },
         ttl: { type: 'integer', description: 'Seconds until stale (omit = forever).' }
@@ -187,7 +187,10 @@ PWN::AI::Agent::Registry.register(
                  'against toolchain drift / missing binaries, (b) Learning ' \
                  'failures against host/net/repo drift on the same day, ' \
                  '(c) recorded :intel observations against installed ' \
-                 'component versions. Returns actionable findings so the ' \
+                 'component versions, (d) :web DOM drift on watched targets ' \
+                 'against Learning failures citing that host, (e) refuted ' \
+                 'extro_verify claims against stale PWN::Memory :fact ' \
+                 'entries. Returns actionable findings so the ' \
                  'agent can distinguish "I did it wrong" from "the world ' \
                  'changed under me".',
     parameters: {
@@ -278,3 +281,85 @@ PWN::AI::Agent::Registry.register(
     { previous: prev, current: ai[:agent][:auto_extrospect] ? true : false }
   }
 )
+
+PWN::AI::Agent::Registry.register(
+  name: 'extro_verify',
+  toolset: 'extrospection',
+  schema: {
+    name: 'extro_verify',
+    description: 'Browser-backed SELF FACT-CHECK. Drives ' \
+                 'PWN::Plugins::TransparentBrowser (:headless) against a ' \
+                 'canonical source for the claim class (NVD/CVE.org for ' \
+                 ':cve, rubygems/PyPI/GitHub for :version, the cited URL ' \
+                 'for :doc, DuckDuckGo HTML for :generic), renders the DOM ' \
+                 'with JS executed, and returns {claim:, kind:, verdict: ' \
+                 ':confirmed|:refuted|:unknown, confidence:, evidence:[], ' \
+                 'action_taken:}. On :refuted → Mistakes.record(tool:' \
+                 "'assumption') so KNOWN MISTAKES warns every future run; " \
+                 'on :confirmed → observe(:intel, ttl:30d); on :unknown → ' \
+                 'Learning.note_outcome(tags:[needs_human]). This is the ' \
+                 'PROACTIVE trigger that catches the model being wrong ' \
+                 'about the world before a human does — the extrospective ' \
+                 'mirror of mistakes_record.',
+    parameters: {
+      type: 'object',
+      properties: {
+        claim: { type: 'string', description: 'Factual claim to fact-check (a CVE assertion, "latest X is v1.2.3", a cited URL + quoted snippet, or free text).' },
+        kind: { type: 'string', enum: %w[cve version doc generic], description: 'Force a verifier. Omit to auto-detect from the claim.' },
+        url: { type: 'string', description: 'Explicit URL the claim cites (forces kind: :doc).' },
+        commit: { type: 'boolean', default: true, description: 'Write Mistakes/observe/Learning on the verdict.' },
+        proxy: { type: 'string', description: 'Upstream proxy for TransparentBrowser (e.g. "tor" or http://127.0.0.1:8080).' }
+      },
+      required: %w[claim]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Extrospection) && PWN::AI::Agent::Extrospection.respond_to?(:verify) },
+  handler: lambda { |args|
+    o = { claim: args[:claim] }
+    o[:kind]   = args[:kind]   if args[:kind]
+    o[:url]    = args[:url]    if args[:url]
+    o[:commit] = args[:commit] if args.key?(:commit)
+    o[:proxy]  = args[:proxy]  if args[:proxy]
+    PWN::AI::Agent::Extrospection.verify(o)
+  }
+)
+
+PWN::AI::Agent::Registry.register(
+  name: 'extro_watch',
+  toolset: 'extrospection',
+  schema: {
+    name: 'extro_watch',
+    description: 'Passive change-detection on an external web artefact you ' \
+                 'care about (a target /api/version, a vendor changelog, a ' \
+                 'bug-bounty scope page). Renders the URL headlessly via ' \
+                 'PWN::Plugins::TransparentBrowser, hashes the RENDERED DOM ' \
+                 'text (JS-delivered changes count), captures title / TLS ' \
+                 'cert fp / screenshot, and persists it as observe(' \
+                 'category: :web). Re-running against the same URL returns ' \
+                 '{changed: true|false, prior_sha:, current:{…}}; a ' \
+                 'subsequent extro_snapshot(sections:["web"]) surfaces the ' \
+                 'delta in drift() as ~web.<host>.dom_sha exactly like ' \
+                 '~toolchain.nmap today.',
+    parameters: {
+      type: 'object',
+      properties: {
+        url: { type: 'string', description: 'URL to render, hash and watch.' },
+        selector: { type: 'string', description: 'CSS selector whose innerText to hash (default full body).' },
+        ttl: { type: 'integer', description: 'Seconds until this :web observation is stale (default 604800 = 7d).' },
+        tags: { type: 'array', items: { type: 'string' } },
+        proxy: { type: 'string', description: 'Upstream proxy for TransparentBrowser (e.g. "tor").' }
+      },
+      required: %w[url]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Extrospection) && PWN::AI::Agent::Extrospection.respond_to?(:watch) },
+  handler: lambda { |args|
+    PWN::AI::Agent::Extrospection.watch(
+      url: args[:url],
+      selector: args[:selector],
+      ttl: args[:ttl],
+      tags: args[:tags],
+      proxy: args[:proxy]
+    )
+  }
+)

data/lib/pwn/ai/agent/tools/mistakes.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+require 'pwn/ai/agent/mistakes'
+
+# Expose the negative-feedback ledger to the model so it can inspect its
+# own recurring failure patterns, RECORD mistakes it recognises
+# semantically (not just tool-dispatch errors), and — critically — RESOLVE
+# them with an explicit fix, which is then re-injected into every future
+# system prompt as an actionable "do THIS instead" lesson AND handed
+# straight back inline on the next recurrence via
+# Mistakes.correction_hint.
+
+PWN::AI::Agent::Registry.register(
+  name: 'mistakes_list',
+  toolset: 'learning',
+  schema: {
+    name: 'mistakes_list',
+    description: 'List recorded failure fingerprints from ~/.pwn/mistakes.json ' \
+                 '(signature, tool, normalised error, count, first/last seen, ' \
+                 'resolved, fix). Sorted by recurrence count. These are the ' \
+                 'specific mistakes the agent keeps making — inspect before ' \
+                 'attempting the same tool again, and call mistakes_resolve ' \
+                 'once a working alternative is found.',
+    parameters: {
+      type: 'object',
+      properties: {
+        limit: { type: 'integer', default: 20 },
+        unresolved_only: { type: 'boolean', default: true }
+      },
+      required: []
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Mistakes) },
+  handler: lambda { |args|
+    PWN::AI::Agent::Mistakes.top(
+      limit: args[:limit] || 20,
+      unresolved_only: args.key?(:unresolved_only) ? args[:unresolved_only] : true
+    )
+  }
+)
+
+PWN::AI::Agent::Registry.register(
+  name: 'mistakes_record',
+  toolset: 'learning',
+  schema: {
+    name: 'mistakes_record',
+    description: 'Proactively fingerprint a mistake YOU just made (wrong ' \
+                 'assumption, wrong file edited, bad approach, hallucinated ' \
+                 'API) so the negative-feedback loop captures failures that ' \
+                 'are NOT tool-dispatch errors. The (tool, error) pair is ' \
+                 'normalised and its cross-session count incremented; once ' \
+                 'count ≥ 3 it is flagged [REPEATING] in every future system ' \
+                 'prompt. Follow up with mistakes_resolve when you find the fix.',
+    parameters: {
+      type: 'object',
+      properties: {
+        tool: {
+          type: 'string',
+          description: 'Component / area the mistake was in (e.g. "assumption", "shell", "pwn_eval", "plan", a module name).'
+        },
+        error: { type: 'string', description: 'What went wrong, in your own words.' },
+        args: { type: 'string', description: 'Optional sample of the input that triggered it.' }
+      },
+      required: %w[tool error]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Mistakes) },
+  handler: lambda { |args|
+    sid = (PWN::Env.dig(:ai, :session_id) if defined?(PWN::Env))
+    PWN::AI::Agent::Mistakes.record(
+      tool: args[:tool], error: args[:error], args: args[:args],
+      session_id: sid, source: :model
+    )
+  }
+)
+
+PWN::AI::Agent::Registry.register(
+  name: 'mistakes_resolve',
+  toolset: 'learning',
+  schema: {
+    name: 'mistakes_resolve',
+    description: 'Mark a recorded mistake as RESOLVED and attach the fix ' \
+                 '(what to do INSTEAD). The fix is (a) promoted to a ' \
+                 'PWN::Memory :lesson so every future run sees "AVOID X — ' \
+                 'FIX: Y" in its system prompt, AND (b) handed straight back ' \
+                 'inline via correction_hint the next time that signature ' \
+                 'recurs. If the same signature recurs after resolution it is ' \
+                 'automatically re-opened and tagged [REGRESSED]. Call this ' \
+                 'the moment you find a working alternative to a ' \
+                 'previously-failing approach.',
+    parameters: {
+      type: 'object',
+      properties: {
+        signature: { type: 'string', description: 'Mistake signature from mistakes_list / KNOWN MISTAKES block / correction_hint.' },
+        fix: { type: 'string', description: 'What to do instead next time.' }
+      },
+      required: %w[signature fix]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Mistakes) },
+  handler: lambda { |args|
+    PWN::AI::Agent::Mistakes.resolve(signature: args[:signature], fix: args[:fix])
+  }
+)
+
+PWN::AI::Agent::Registry.register(
+  name: 'mistakes_reset',
+  toolset: 'learning',
+  schema: {
+    name: 'mistakes_reset',
+    description: 'Wipe ~/.pwn/mistakes.json (all recorded failure fingerprints ' \
+                 'and their fixes). Use only when moving to a new host/engagement ' \
+                 'where prior failure patterns no longer apply. IRREVERSIBLE — ' \
+                 'must pass confirm:true.',
+    parameters: {
+      type: 'object',
+      properties: {
+        confirm: { type: 'boolean', description: 'Must be true to actually reset.' }
+      },
+      required: %w[confirm]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Mistakes) },
+  handler: lambda { |args|
+    raise ArgumentError, 'refusing to reset mistakes without confirm:true' unless args[:confirm] == true
+
+    before = PWN::AI::Agent::Mistakes.load.keys.length
+    PWN::AI::Agent::Mistakes.reset
+    { reset: true, mistakes_cleared: before, file: PWN::AI::Agent::Mistakes::MISTAKES_FILE }
+  }
+)

data/lib/pwn/ai/agent.rb

@@ -25,6 +25,7 @@ module PWN
       autoload :Loop,          'pwn/ai/agent/loop'
       autoload :Metrics,       'pwn/ai/agent/metrics'
       autoload :Learning,      'pwn/ai/agent/learning'
+      autoload :Mistakes,      'pwn/ai/agent/mistakes'
       autoload :Extrospection, 'pwn/ai/agent/extrospection'
       autoload :Introspection, 'pwn/ai/agent/introspection'
       autoload :Swarm,         'pwn/ai/agent/swarm'

data/lib/pwn/plugins/jira_data_center.rb

@@ -522,7 +522,7 @@ module PWN
               if elem.is_a?(Hash)
                 # Retain common identifier keys; if none present keep full hash
                 keys_to_keep = %i[id key name value]
-                elem.keys.any? { |kk| keys_to_keep.include?(kk) } ? elem.slice(*keys_to_keep) : elem
+                elem.keys.intersect?(keys_to_keep) ? elem.slice(*keys_to_keep) : elem
               else
                 elem
               end
@@ -530,7 +530,7 @@ module PWN
           when Hash
             keys_to_keep = %i[id key name value]
             filtered_fields[k] =
-              if v.keys.any? { |kk| keys_to_keep.include?(kk) }
+              if v.keys.intersect?(keys_to_keep)
                 v.slice(*keys_to_keep)
               else
                 v

data/lib/pwn/sdr/decoder/adsb.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # Pure-Ruby ADS-B (1090 MHz Mode-S / 978 MHz UAT) activity detector.
+      #
+      # Mode-S Extended Squitter is 2 Mbit/s PPM with 8/120 μs frames on a
+      # 2 MHz-wide channel — physically unrecoverable from GQRX's 48 kHz
+      # demodulated-audio tap. Rather than shell out to `dump1090`, this
+      # module runs Base.run_detector to characterise squitter density
+      # (bursts/sec, peak dBFS, floor) natively in Ruby. `parse_line` is
+      # retained for offline SBS-1 CSV analysis.
+      module ADSB
+        SBS_FIELDS = %i[
+          msg_type tx_type session_id aircraft_id icao24 flight_id
+          date_gen time_gen date_log time_log callsign altitude_ft
+          ground_speed_kt track_deg lat lon vertical_rate_fpm squawk
+          alert emergency spi on_ground
+        ].freeze
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::ADSB.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          hz  = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          uat = hz.between?(977_000_000, 979_000_000)
+          PWN::SDR::Decoder::Base.run_detector(
+            freq_obj: freq_obj,
+            protocol: uat ? 'ADSB-UAT978' : 'ADSB-1090ES',
+            note: '2 Mbit/s PPM squitters exceed the 48 kHz audio-tap Nyquist limit; native mode reports squitter-burst density only. Feed captured SBS-1 CSV to .parse_line for full field decode.',
+            describe: proc { |b| { modulation: 'PPM', frame_len_us: 120, classification: b[:duration_ms] < 5 ? 'squitter' : 'interrogation-train' } }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::ADSB.parse_line(line: 'MSG,3,1,1,ABCDEF,...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          return { protocol: 'ADSB-UAT', summary: line.strip } unless line.start_with?('MSG,')
+
+          f   = line.split(',', -1)
+          out = { protocol: 'ADSB' }
+          SBS_FIELDS.each_with_index { |k, i| out[k] = f[i] unless f[i].to_s.empty? }
+          bits = []
+          bits << "ICAO=#{out[:icao24]}" if out[:icao24]
+          bits << "CS=#{out[:callsign].to_s.strip}" if out[:callsign]
+          bits << "ALT=#{out[:altitude_ft]}ft" if out[:altitude_ft]
+          bits << "POS=#{out[:lat]},#{out[:lon]}" if out[:lat] && out[:lon]
+          bits << "GS=#{out[:ground_speed_kt]}kt" if out[:ground_speed_kt]
+          bits << "SQK=#{out[:squawk]}" if out[:squawk]
+          out[:summary] = "ADSB #{bits.join(' ')}".strip
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE (ruby-native detector, no external binaries):
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'MSG,3,1,1,ABCDEF,1,...')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/apt.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # Pure-Ruby NOAA APT (Automatic Picture Transmission) decoder for the
+      # 137 MHz polar-orbiting weather satellites (NOAA-15/18/19).
+      #
+      # APT is a 2400 Hz AM subcarrier inside a ~34 kHz-wide FM downlink
+      # carrying two 909-pixel image channels at 2 lines/second (4160
+      # words/line). This module envelope-demodulates the 2400 Hz carrier
+      # from GQRX's 48 kHz UDP audio, resamples to 4160 words/sec, aligns
+      # each line on the 7-pulse Sync-A pattern, and appends the resulting
+      # 8-bit greyscale rows to a Netpbm PGM (P5) file — all in Ruby.
+      # No `sox`, no `noaa-apt`.
+      module APT
+        WORDS_PER_LINE = 4160
+        LINES_PER_SEC  = 2
+        WORD_RATE      = WORDS_PER_LINE * LINES_PER_SEC # 8320 Hz
+        # Sync-A: 7 cycles of 1040 Hz square = 1 1 0 0 repeated 7 times
+        SYNC_A = ([1, 1, 0, 0] * 7).freeze
+
+        # Streaming APT demodulator fed by Base.run_native.
+        class Demod
+          def initialize(rate: 48_000, out_path: nil)
+            @rate     = rate
+            @carrier  = 2400.0
+            @env_win  = (rate / @carrier).round # ≈20 samples per cycle
+            @stamp    = Time.now.strftime('%Y%m%d_%H%M%S')
+            @pgm_path = out_path || "/tmp/apt_#{@stamp}.pgm"
+            @rows     = []
+            @word_buf = []
+            @minv     = 1.0
+            @maxv     = 0.0
+          end
+
+          def feed(samples, &)
+            env   = PWN::SDR::Decoder::DSP.envelope(samples: samples, window: @env_win)
+            words = PWN::SDR::Decoder::DSP.resample(samples: env, src_rate: @rate, dst_rate: WORD_RATE)
+            @word_buf.concat(words)
+            extract_lines(&)
+          end
+
+          private
+
+          def extract_lines
+            while @word_buf.length >= WORDS_PER_LINE * 2
+              off = sync_offset(@word_buf[0, WORDS_PER_LINE])
+              @word_buf.shift(off) if off.positive?
+              break if @word_buf.length < WORDS_PER_LINE
+
+              row = @word_buf.shift(WORDS_PER_LINE)
+              lo, hi = row.minmax
+              @minv = lo if lo < @minv
+              @maxv = hi if hi > @maxv
+              @rows << row
+              write_pgm if (@rows.length % 20).zero?
+              yield(
+                protocol: 'NOAA-APT',
+                lines: @rows.length,
+                seconds: @rows.length / LINES_PER_SEC,
+                pgm: @pgm_path,
+                summary: "APT line #{@rows.length} (#{@rows.length / LINES_PER_SEC}s) → #{@pgm_path}"
+              )
+            end
+          end
+
+          def sync_offset(row)
+            mid = row.sum / row.length
+            best_off = 0
+            best_cor = -1.0
+            (0..(row.length - SYNC_A.length)).each do |o|
+              cor = 0.0
+              SYNC_A.each_with_index do |s, i|
+                cor += (row[o + i] - mid) * (s.zero? ? -1.0 : 1.0)
+              end
+              if cor > best_cor
+                best_cor = cor
+                best_off = o
+              end
+            end
+            best_off
+          end
+
+          def write_pgm
+            span = @maxv - @minv
+            span = 1.0 if span <= 0
+            File.open(@pgm_path, 'wb') do |f|
+              f.write("P5\n#{WORDS_PER_LINE} #{@rows.length}\n255\n")
+              @rows.each do |row|
+                bytes = row.map { |v| (((v - @minv) / span) * 255).clamp(0, 255).round }
+                f.write(bytes.pack('C*'))
+              end
+            end
+          end
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::APT.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          PWN::SDR::Decoder::Base.run_native(
+            freq_obj: freq_obj,
+            protocol: 'NOAA-APT',
+            demod: Demod.new
+          )
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE (ruby-native, no external binaries):
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Set GQRX to WFM (mono), ~34 kHz filter. Writes an 8-bit
+                  greyscale Netpbm P5 image to /tmp/apt_<ts>.pgm every 10 s
+                  of received pass. Both A/B channels are in one strip.
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end