pwn 0.5.708 → 0.5.710

data/spec/lib/pwn/plugins/binary_parser_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::BinaryParser do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'parses an ELF on this host' do
+    path = %w[/bin/ls /usr/bin/ls /bin/true /usr/bin/true].find { |p| File.file?(p) }
+    skip 'no ELF on PATH' unless path
+    info = described_class.info(path: path)
+    expect(info[:class].to_s).to match(/ELF|elf/i)
+    expect(described_class.sections(path: path)).to be_an(Array)
+  end
+end

data/spec/lib/pwn/plugins/credential_attack_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::CredentialAttack do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/exploit_db_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::ExploitDB do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/exploit_dev_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::ExploitDev do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'p32 packs little-endian' do
+    expect(described_class.p32(value: 0x41414141)).to eq('AAAA')
+  end
+
+  it 'cyclic_find locates a subsequence' do
+    blob = described_class.cyclic(length: 200)
+    sub = blob[40, 4]
+    expect(described_class.cyclic_find(value: sub, length: 200)).to eq(40)
+  end
+end

data/spec/lib/pwn/plugins/frida_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Frida do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/gdb_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::GDB do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/jobs_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Jobs do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/k8s_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::K8s do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/nuclei_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Nuclei do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/preflight_checker_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::PreflightChecker do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'bin? is false for a missing binary' do
+    expect(described_class.bin?(name: 'pwn-no-such-binary-xyz')).to be false
+  end
+
+  it 'check returns plugin status rows' do
+    rows = described_class.check
+    expect(rows).to be_an(Array)
+    expect(rows.first).to include(:plugin, :status)
+  end
+end

data/spec/lib/pwn/plugins/process_tube_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::ProcessTube do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/radare2_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Radare2 do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/recon_spec.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Recon do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'crt_sh falls back to certspotter when crt.sh is not JSON' do
+    html = '<html><head><title>502 Bad Gateway</title></head></html>'
+    spot = [{ 'dns_names' => ['www.0dayinc.com', 'vpn.0dayinc.com'] }]
+    allow(described_class).to receive(:http_json) do |h|
+      url = h[:url].to_s
+      raise JSON::ParserError, html if url.include?('crt.sh')
+
+      spot
+    end
+    names = described_class.crt_sh(domain: '0dayinc.com')
+    expect(names).to include('www.0dayinc.com', 'vpn.0dayinc.com')
+  end
+end

data/spec/lib/pwn/plugins/semgrep_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Semgrep do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/sqlmap_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Sqlmap do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/volatility_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Volatility do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/req_queue_spec.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'socket'
+require 'tmpdir'
+
+describe 'pwn_debug REQ queue remaining surface' do
+  describe PWN::Plugins::ExploitDev do
+    it 'catalogs per-arch execve_bin_sh shellcode as opcodes' do
+      sc = described_class.shellcode(arch: 'x86_64', kind: 'execve_bin_sh')
+      expect(sc.to_s).not_to be_empty
+      expect(sc.to_s).not_to eq("\x90")
+    end
+
+    it 'one_gadget returns a structured miss when the binary is absent' do
+      allow(PWN::Plugins::PreflightChecker).to receive(:bin?).and_call_original
+      allow(PWN::Plugins::PreflightChecker).to receive(:bin?).with(name: 'one_gadget').and_return(false)
+      row = described_class.one_gadget(path: '/lib/x86_64-linux-gnu/libc.so.6')
+      expect(row).to be_a(Hash)
+      expect(row[:error].to_s).to match(/one_gadget/i)
+    end
+
+    it 'libc_offsets extracts named symbols from an ELF' do
+      path = %w[/bin/ls /usr/bin/ls /bin/true /usr/bin/true].find { |p| File.file?(p) }
+      skip 'no ELF on host' unless path
+
+      row = described_class.libc_offsets(path: path)
+      expect(row).to include(:path)
+      expect(row[:symbols]).to be_a(Hash)
+    end
+  end
+
+  describe PWN::Plugins::GDB do
+    it 'core raises without a core path' do
+      expect { described_class.core(core: '') }.to raise_error(/core is required/)
+    end
+
+    it 'breakpoints includes break commands in the gdb batch' do
+      allow(Open3).to receive(:capture3).and_return(['ok', '', instance_double(Process::Status, exitstatus: 0)])
+      described_class.breakpoints(binary: '/bin/true', breakpoints: ['main', '*0x401000'])
+      expect(Open3).to have_received(:capture3) do |*argv|
+        joined = argv.flatten.join(' ')
+        expect(joined).to include('break main')
+        expect(joined).to include('break *0x401000')
+      end
+    end
+  end
+
+  describe PWN::Plugins::ProcessTube do
+    it 'connect uses the same write_line/recvuntil API over TCP' do
+      server = TCPServer.new('127.0.0.1', 0)
+      port = server.addr[1]
+      thr = Thread.new do
+        sock = server.accept
+        sock.write("banner\n")
+        sock.flush
+        line = sock.gets
+        sock.write("ack #{line}")
+        sock.close
+      end
+      tube = described_class.connect(host: '127.0.0.1', port: port)
+      described_class.recvuntil(id: tube[:id], until: "\n", timeout: 2)
+      described_class.write_line(id: tube[:id], line: 'hi')
+      out = described_class.recvuntil(id: tube[:id], until: 'hi', timeout: 2)
+      expect(out).to include('ack')
+    ensure
+      described_class.close(id: tube[:id]) if tube
+      thr&.kill
+      server&.close
+    end
+  end
+
+  describe PWN::Setup do
+    it 're profile includes pwndbg, ropper, and rizin' do
+      bins = PWN::Setup::PROFILES[:re][:bins]
+      expect(bins).to include('pwndbg', 'ropper', 'rizin')
+    end
+  end
+
+  describe PWN::Plugins::PreflightChecker do
+    it 'check includes missing_services' do
+      row = described_class.check.find { |r| r[:plugin].to_s.include?('Packet') }
+      expect(row).to include(:missing_services)
+    end
+
+    it 'service? is false for a missing unix socket' do
+      expect(described_class.service?(name: 'no-such-pwn-svc', path: '/tmp/pwn-no-such.sock')).to be false
+    end
+  end
+
+  describe PWN::Plugins::Sock do
+    it 'protocol :raw demands CAP_NET_RAW' do
+      allow(PWN::Plugins::PreflightChecker).to receive(:cap_net_raw?).and_return(false)
+      expect do
+        described_class.connect(target: '127.0.0.1', port: 9, protocol: :raw)
+      end.to raise_error(PWN::Plugins::PreflightChecker::MissingCapability)
+    end
+  end
+
+  describe PWN::Plugins::Nuclei do
+    it 'to_findings maps JSONL rows into report-shaped hashes' do
+      rows = [{ 'info' => { 'name' => 'xss', 'severity' => 'high' }, 'matched-at' => 'https://x/' }]
+      out = described_class.to_findings(rows: rows)
+      expect(out.first).to include(:title, :severity, :url)
+    end
+  end
+
+  describe PWN::Plugins::Fuzz do
+    it 'http mutates a request with dictionary payloads' do
+      reqs = described_class.http(
+        request: "GET /FUZZ HTTP/1.1\r\nHost: x\r\n\r\n",
+        dictionary: %w[admin ../]
+      )
+      expect(reqs.length).to eq(2)
+      expect(reqs.first).to include('admin')
+    end
+
+    it 'file_format mutates a seed with dictionary blobs' do
+      Dir.mktmpdir do |dir|
+        seed = File.join(dir, 'seed.bin')
+        File.binwrite(seed, 'AAAA')
+        out = described_class.file_format(path: seed, dictionary: ["\xff\xff"])
+        expect(out).to be_an(Array)
+        expect(out.first).to be_a(String)
+      end
+    end
+  end
+
+  describe PWN::Plugins::ArtifactRegistry do
+    it 'lists artifacts for a session id' do
+      Dir.mktmpdir do |dir|
+        stub_const('PWN::Plugins::ArtifactRegistry::ROOT', dir)
+        src = File.join(dir, 'loot.txt')
+        File.write(src, 'x')
+        described_class.register(session_id: 'sess1', path: src, kind: 'loot')
+        rows = described_class.list(session_id: 'sess1')
+        expect(rows.first[:kind]).to eq('loot')
+      end
+    end
+  end
+
+  describe PWN::Plugins::Frida do
+    it 'ssl_pinning_script returns injectable javascript' do
+      js = described_class.ssl_pinning_script
+      expect(js).to match(/SSL_CTX|TrustManager|pinning/i)
+    end
+  end
+
+  describe PWN::Plugins::Semgrep do
+    it 'responds to scan' do
+      expect(described_class).to respond_to(:scan)
+    end
+  end
+
+  describe PWN::Plugins::ExploitDB do
+    it 'responds to search and cve_for_cpe' do
+      expect(described_class).to respond_to(:search)
+      expect(described_class).to respond_to(:cve_for_cpe)
+    end
+  end
+
+  describe PWN::Plugins::K8s do
+    it 'responds to trivy and kube_hunter' do
+      expect(described_class).to respond_to(:trivy)
+      expect(described_class).to respond_to(:kube_hunter)
+    end
+  end
+end