pwn 0.5.739 → 0.5.741

data/lib/pwn/plugins/transparent_browser.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
 require 'diffy'
+require 'digest'
 require 'fileutils'
+require 'json'
 require 'em/pure_ruby'
 require 'faye/websocket'
 require 'nokogiri'
@@ -11,7 +13,9 @@ require 'securerandom'
 require 'selenium/devtools'
 require 'selenium/webdriver'
 require 'socksify'
+require 'time'
 require 'timeout'
+require 'tmpdir'
 require 'watir'
 require 'yaml'
 
@@ -1560,25 +1564,87 @@ module PWN
         raise e
       end
 
+      # Capture screenshot, DOM snapshot, and HAR into the artifact store.
       public_class_method def self.evidence!(opts = {})
         browser_obj = opts[:browser_obj]
         label = (opts[:label] || 'capture').to_s.gsub(/[^\w.-]+/, '_')
-        sid = (opts[:session_id] || 'default').to_s
+        sid = (opts[:session_id] || 'web').to_s
+        sid = 'web' if sid.empty?
         dir = File.join(Dir.home, '.pwn', 'artifacts', sid, 'web', label)
         FileUtils.mkdir_p(dir)
-        browser = browser_obj.is_a?(Hash) ? browser_obj[:browser] : browser_obj
         shot = File.join(dir, 'screenshot.png')
-        html = File.join(dir, 'dom.html')
-        har = File.join(dir, 'har.json')
-        begin
-          browser.screenshot.save(shot) if browser.respond_to?(:screenshot)
-        rescue StandardError
-          File.binwrite(shot, "\x89PNG\r\n\x1a\n")
+        html_path = File.join(dir, 'dom.html')
+        har_path = File.join(dir, 'har.json')
+        png = png_bytes(opts)
+        html = html_body(opts)
+        har = har_document(opts)
+        har_json = JSON.generate(har)
+        File.binwrite(shot, png)
+        File.write(html_path, html)
+        File.write(har_path, har_json)
+        shot_art = spill_web(bytes: png, session_id: sid)
+        html_art = spill_web(bytes: html, session_id: sid)
+        har_art = spill_web(bytes: har_json, session_id: sid)
+        {
+          screenshot: shot,
+          dom: html_path,
+          har: har_path,
+          dir: dir,
+          screenshot_handle: shot_art[:handle],
+          dom_handle: html_art[:handle],
+          har_handle: har_art[:handle],
+          artifact_handles: [
+            { handle: shot_art[:handle], kind: 'screenshot', label: 'screenshot', sha256: shot_art[:sha256], path: shot_art[:path] },
+            { handle: html_art[:handle], kind: 'evidence', label: 'dom', sha256: html_art[:sha256], path: html_art[:path] },
+            { handle: har_art[:handle], kind: 'evidence', label: 'har', sha256: har_art[:sha256], path: har_art[:path] }
+          ]
+        }
+      end
+
+      # Navigate a page and optionally record screenshot, DOM, HAR, and a finding.
+      public_class_method def self.goto(opts = {})
+        browser_obj = opts[:browser_obj]
+        url = (opts[:url] || opts[:uri]).to_s
+        browser = browser_handle(browser_obj: browser_obj)
+        browser.goto(url) if browser.respond_to?(:goto) && !url.empty?
+        url = browser.url.to_s if url.empty? && browser.respond_to?(:url)
+        finding_opts = opts[:finding]
+        finding_opts = finding_opts.transform_keys(&:to_sym) if finding_opts.is_a?(Hash)
+        title = (opts[:title] || (finding_opts.is_a?(Hash) ? finding_opts[:title] : nil)).to_s
+        capture = opts[:capture]
+        capture = true if capture.nil? && !title.empty?
+        capture = [true, 'true', 1, '1'].include?(capture)
+        pack = nil
+        if capture
+          pack = evidence!(
+            browser_obj: browser_obj,
+            url: url,
+            label: opts[:label],
+            session_id: opts[:session_id],
+            screenshot: opts[:screenshot],
+            html: opts[:html],
+            dom: opts[:dom],
+            har: opts[:har],
+            har_json: opts[:har_json],
+            entries: opts[:entries]
+          )
+        end
+        finding = nil
+        unless title.empty?
+          finding = persist_web_finding(
+            title: title,
+            url: url,
+            severity: opts[:severity] || (finding_opts.is_a?(Hash) ? finding_opts[:severity] : nil),
+            session_id: opts[:session_id],
+            engagement_id: opts[:engagement_id],
+            capture_pack: pack,
+            browser_obj: browser_obj,
+            screenshot: opts[:screenshot],
+            html: opts[:html],
+            har: opts[:har]
+          )
         end
-        File.binwrite(shot, "\x89PNG\r\n\x1a\n") unless File.file?(shot)
-        File.write(html, browser.respond_to?(:html) ? browser.html.to_s : '')
-        File.write(har, '[]')
-        { screenshot: shot, dom: html, har: har, dir: dir }
+        { url: url, evidence: pack, finding: finding }
       end
 
       public_class_method def self.intercept(opts = {})
@@ -1625,6 +1691,111 @@ module PWN
         { status: resp.code.to_i, headers: resp.to_hash, body: resp.body.to_s[0, 65_536], url: url, method: method }
       end
 
+      private_class_method def self.browser_handle(opts = {})
+        obj = opts[:browser_obj] || opts[:browser]
+        obj.is_a?(Hash) ? obj[:browser] : obj
+      end
+
+      private_class_method def self.png_bytes(opts = {})
+        src = opts[:screenshot]
+        if src.is_a?(String) && File.file?(src)
+          return File.binread(src)
+        elsif src.is_a?(String) && src.b.start_with?("\x89PNG".b)
+          return src.b
+        end
+
+        browser = browser_handle(opts)
+        if browser.respond_to?(:screenshot)
+          begin
+            path = File.join(Dir.tmpdir, "pwn-tb-#{SecureRandom.hex(4)}.png")
+            browser.screenshot.save(path)
+            return File.binread(path) if File.file?(path)
+          rescue StandardError
+            nil
+          end
+        end
+        "\x89PNG\r\n\x1a\n".b
+      end
+
+      private_class_method def self.html_body(opts = {})
+        src = opts[:html] || opts[:dom]
+        return File.read(src) if src.is_a?(String) && File.file?(src)
+        return src.to_s unless src.nil?
+
+        browser = browser_handle(opts)
+        browser.respond_to?(:html) ? browser.html.to_s : ''
+      end
+
+      private_class_method def self.har_document(opts = {})
+        src = opts[:har] || opts[:har_json]
+        parsed = parse_har(src: src)
+        return parsed if parsed
+
+        entries = Array(opts[:entries])
+        browser_obj = opts[:browser_obj]
+        proxy = browser_obj.is_a?(Hash) ? browser_obj[:capture_proxy] : nil
+        if proxy.is_a?(Hash)
+          path = proxy[:har_path].to_s
+          parsed = parse_har(src: path) if File.file?(path)
+          return parsed if parsed
+
+          entries = Array(proxy[:entries]) if entries.empty?
+        end
+        entries = Array(@intercepted) if entries.empty?
+        url = opts[:url].to_s
+        html = html_body(opts)
+        if entries.empty? && !url.empty?
+          entries = [{
+            'startedDateTime' => Time.now.utc.iso8601,
+            'request' => { 'method' => 'GET', 'url' => url, 'headers' => [] },
+            'response' => { 'status' => 200, 'headers' => [], 'content' => { 'mimeType' => 'text/html', 'text' => html.to_s[0, 65_536] } }
+          }]
+        end
+        { 'log' => { 'version' => '1.2', 'creator' => { 'name' => 'PWN::Plugins::TransparentBrowser', 'version' => '1' }, 'entries' => entries } }
+      end
+
+      private_class_method def self.parse_har(opts = {})
+        src = opts[:src]
+        return nil if src.nil?
+
+        if src.is_a?(Hash)
+          return src['log'] || src[:log] ? src : { 'log' => src }
+        end
+
+        text = src.to_s
+        return nil if text.empty?
+
+        text = File.read(text) if File.file?(text)
+        JSON.parse(text)
+      rescue JSON::ParserError
+        nil
+      end
+
+      private_class_method def self.spill_web(opts = {})
+        bytes = opts[:bytes].to_s
+        sid = opts[:session_id].to_s
+        sid = 'web' if sid.empty?
+        PWN::Plugins::ArtifactRegistry.spill(bytes: bytes, session_id: sid)
+      end
+
+      private_class_method def self.persist_web_finding(opts = {})
+        pack = opts[:capture_pack]
+        pack = evidence!(opts) unless pack.is_a?(Hash)
+        url = opts[:url].to_s
+        arts = [pack[:screenshot], pack[:har], pack[:dom]].select { |path| File.file?(path.to_s) }
+        evidence = "pixel=#{pack[:screenshot]} har=#{pack[:har]} url=#{url} screenshot PNG and HAR log prove the navigation"
+        PWN::Plugins::Findings.record(
+          title: opts[:title].to_s,
+          severity: opts[:severity] || 'info',
+          host: url,
+          url: url,
+          poc_artifacts: arts,
+          evidence: evidence,
+          session_id: opts[:session_id],
+          engagement_id: opts[:engagement_id]
+        )
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors
@@ -1773,9 +1944,16 @@ module PWN
 
           # Save screenshot.png, dom.html, and har.json under ~/.pwn/artifacts.
           #{self}.evidence!(
-            browser_obj: 'required - browser_obj returned from #open',
+            browser_obj: 'optional - browser_obj returned from open; omit when html or har fixtures are supplied',
             label: 'optional - folder name for this capture (defaults to capture)',
-            session_id: 'optional - artifacts session folder (defaults to default)'
+            session_id: 'optional - artifacts session folder (defaults to web)',
+            screenshot: 'optional - PNG path used when no live screenshot is available',
+            html: 'optional - DOM HTML string or file used when no live browser is available',
+            dom: 'optional - alias for html',
+            har: 'optional - HAR JSON string, Hash, or file used when no live capture is available',
+            har_json: 'optional - alias for har',
+            entries: 'optional - Array of HAR entries used when har is omitted',
+            url: 'optional - navigated URL embedded into a synthetic HAR entry'
           )
 
           # Enable CDP Fetch interception (Burp-like hook without Burp).
@@ -1798,6 +1976,26 @@ module PWN
             mutations: 'optional - Hash of url/method/headers/body overlays'
           )
 
+          # Navigate then optionally capture screenshot, DOM, and HAR; record a finding when title is set.
+          #{self}.goto(
+            browser_obj: 'optional - browser_obj returned from open; omit when html or har fixtures are supplied',
+            url: 'optional - HTTP(S) URL to open; required unless uri is set',
+            uri: 'optional - alias for url',
+            capture: 'optional - true spills screenshot DOM HAR (defaults true when title is set)',
+            title: 'optional - finding title; records pixel and HAR proof without a second call',
+            finding: 'optional - Hash with title and severity overlay for the recorded finding',
+            severity: 'optional - finding severity string (defaults to info)',
+            session_id: 'optional - artifact session id (defaults to web)',
+            engagement_id: 'optional - findings engagement id',
+            label: 'optional - capture folder name under the session web dir',
+            screenshot: 'optional - PNG path used when no live screenshot is available',
+            html: 'optional - DOM HTML string or file used when no live browser is available',
+            dom: 'optional - alias for html',
+            har: 'optional - HAR JSON string, Hash, or file used when no live capture is available',
+            har_json: 'optional - alias for har',
+            entries: 'optional - Array of HAR entries used when har is omitted'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/vault.rb

@@ -5,6 +5,8 @@ require 'openssl'
 require 'yaml'
 require 'json'
 require 'fileutils'
+require 'securerandom'
+require 'time'
 
 module PWN
   module Plugins
@@ -300,25 +302,83 @@ module PWN
         raise e
       end
 
+      # Store an engagement-scoped secret with host, finding, and source provenance.
       public_class_method def self.store(opts = {})
-        label = opts[:label].to_s
         secret = opts[:secret].to_s
-        raise 'ERROR: label and secret are required' if label.empty? || secret.empty?
+        raise 'ERROR: secret is required' if secret.empty?
 
-        box = load_box
-        box[label] = encrypt_secret(secret: secret)
-        save_box(box: box)
-        { label: label, stored: true }
+        eng = engagement_id(opts)
+        label = opts[:label].to_s
+        label = "#{opts[:host] || 'loot'}:#{opts[:username] || 'user'}:#{SecureRandom.hex(4)}" if label.empty?
+        records = load_records(engagement: eng)
+        record = {
+          id: SecureRandom.hex(6),
+          label: label,
+          kind: (opts[:kind] || 'password').to_s,
+          engagement: eng,
+          host: opts[:host].to_s,
+          service: opts[:service].to_s,
+          username: opts[:username].to_s,
+          secret: encrypt_secret(secret: secret),
+          source: (opts[:source] || 'manual').to_s,
+          where: (opts[:where] || opts[:path]).to_s,
+          finding_id: (opts[:finding_id] || opts[:finding]).to_s,
+          at: Time.now.utc.iso8601
+        }
+        records.reject! { |row| row[:label] == label }
+        records << record
+        save_records(engagement: eng, records: records)
+        record.except(:secret).merge(stored: true)
       end
 
       public_class_method def self.fetch(opts = {})
         label = opts[:label].to_s
         raise 'ERROR: label is required' if label.empty?
 
-        row = load_box[label]
+        rows = opts[:engagement] || opts[:engagement_id] ? load_records(opts) : load_all_records
+        row = rows.find { |item| item[:label] == label }
         return nil unless row
 
-        decrypt_secret(row: row)
+        decrypt_secret(row: row[:secret] || row)
+      end
+
+      # List loot metadata for lateral-movement planning (no plaintext secrets).
+      public_class_method def self.query(opts = {})
+        host = opts[:host].to_s.downcase
+        service = opts[:service].to_s
+        kind = opts[:kind].to_s
+        finding = (opts[:finding_id] || opts[:finding]).to_s
+        load_records(opts).filter_map do |row|
+          next if !host.empty? && !host_match?(host: host, row: row)
+          next if !service.empty? && !row[:service].to_s.empty? && row[:service].to_s != service
+          next if !kind.empty? && row[:kind].to_s != kind
+          next if !finding.empty? && row[:finding_id].to_s != finding
+
+          row.except(:secret).merge(has_secret: true)
+        end
+      end
+
+      # Return decrypted creds that match a service auth prompt.
+      public_class_method def self.offer(opts = {})
+        query(
+          host: opts[:host],
+          service: opts[:service],
+          kind: opts[:kind],
+          finding_id: opts[:finding_id] || opts[:finding],
+          engagement: opts[:engagement] || opts[:engagement_id]
+        ).map do |row|
+          row.merge(secret: fetch(label: row[:label], engagement: row[:engagement]))
+        end
+      end
+
+      # Parse username/password (or token) strings from recon evidence into the loot store.
+      public_class_method def self.ingest(opts = {})
+        text = opts[:text].to_s
+        username = text[/\buser(?:name)?\s*[=:]\s*(\S+)/i, 1]
+        password = text[/\b(?:password|passwd|secret|token|api[_-]?key)\s*[=:]\s*(\S+)/i, 1]
+        return [] if password.to_s.empty?
+
+        [store(opts.merge(username: username, secret: password.to_s.sub(/[.,;]+$/, ''), kind: opts[:kind] || 'password'))]
       end
 
       public_class_method def self.expand(opts = {})
@@ -328,20 +388,41 @@ module PWN
 
       public_class_method def self.redact(opts = {})
         text = opts[:text].to_s
-        load_box.each do |label, row|
-          val = decrypt_secret(row: row).to_s
+        load_all_records.each do |row|
+          val = decrypt_secret(row: row[:secret] || row).to_s
           next if val.empty?
 
-          text = text.gsub(val, "{{vault:#{label}}}")
+          text = text.gsub(val, "{{vault:#{row[:label]}}}")
         end
         text
       end
 
+      private_class_method def self.engagement_id(opts = {})
+        value = (opts[:engagement] || opts[:engagement_id] || 'default').to_s
+        value = 'default' if value.empty?
+        raise ArgumentError, 'engagement_id must be a simple identifier' unless value.match?(/\A[a-zA-Z0-9_-]+\z/)
+
+        value
+      end
+
+      private_class_method def self.host_match?(opts = {})
+        want = opts[:host].to_s.downcase
+        have = opts[:row][:host].to_s.downcase
+        return false if have.empty?
+
+        have == want || have.end_with?(".#{want}") || want.end_with?(".#{have}")
+      end
+
       private_class_method def self.key_path
         File.join(Dir.home, '.pwn-vault.key')
       end
 
-      private_class_method def self.box_path
+      private_class_method def self.box_path(opts = {})
+        File.join(Dir.home, '.pwn', 'engagements', engagement_id(opts), 'loot.json')
+      end
+
+      private_class_method def self.legacy_box_path(opts = {})
+        _n = opts[:n]
         File.join(Dir.home, '.pwn', 'vault-secrets.json')
       end
 
@@ -376,21 +457,49 @@ module PWN
         cipher.auth_tag = Base64.strict_decode64(row[:tag] || row['tag'].to_s)
         cipher.auth_data = 'pwn-vault'
         cipher.update(Base64.strict_decode64(row[:ct] || row['ct'].to_s)) + cipher.final
+      rescue StandardError
+        ''
+      end
+
+      private_class_method def self.load_records(opts = {})
+        path = box_path(opts)
+        rows = parse_box(path: path)
+        rows.concat(parse_box(path: legacy_box_path)) if engagement_id(opts) == 'default' && path != legacy_box_path
+        rows
       end
 
-      private_class_method def self.load_box(opts = {})
-        return {} unless opts.is_a?(Hash)
-        return {} unless File.file?(box_path)
+      private_class_method def self.load_all_records(opts = {})
+        _n = opts[:n]
+        paths = Dir.glob(File.join(Dir.home, '.pwn', 'engagements', '*', 'loot.json'))
+        paths << legacy_box_path
+        paths.uniq.flat_map { |path| parse_box(path: path) }
+      end
+
+      private_class_method def self.parse_box(opts = {})
+        path = opts[:path].to_s
+        return [] unless File.file?(path)
 
-        JSON.parse(File.read(box_path))
+        data = JSON.parse(File.read(path), symbolize_names: true)
+        if data.is_a?(Hash) && data[:records].is_a?(Array)
+          data[:records].map { |row| row.transform_keys(&:to_sym) }
+        elsif data.is_a?(Hash)
+          data.map do |label, row|
+            next unless row.is_a?(Hash)
+
+            { label: label.to_s, secret: row.transform_keys(&:to_sym), engagement: 'default', host: '', source: 'legacy' }
+          end.compact
+        else
+          []
+        end
       rescue StandardError
-        {}
+        []
       end
 
-      private_class_method def self.save_box(opts = {})
-        FileUtils.mkdir_p(File.dirname(box_path))
-        File.write(box_path, JSON.pretty_generate(opts[:box] || {}))
-        File.chmod(0o600, box_path)
+      private_class_method def self.save_records(opts = {})
+        path = box_path(opts)
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, JSON.pretty_generate(version: 2, records: opts[:records] || []))
+        File.chmod(0o600, path)
       end
 
       # Author(s):: 0day Inc. <support@0dayinc.com>
@@ -468,13 +577,62 @@ module PWN
 
           # Store a secret outside the transcript (AES-GCM; key in ~/.pwn-vault.key).
           #{self}.store(
-            label: 'required - vault label',
-            secret: 'required - secret value'
+            secret: 'required - secret value (password, token, or key material)',
+            label: 'optional - vault label; defaults to host:user:hex',
+            engagement: 'optional - engagement id scoping the loot file (defaults to default)',
+            engagement_id: 'optional - alias for engagement',
+            host: 'optional - hostname or IP this secret authenticates',
+            service: 'optional - service name such as http or ssh',
+            username: 'optional - account name recovered with the secret',
+            kind: 'optional - password, token, or key (defaults to password)',
+            source: 'optional - provenance source such as recon or redaction',
+            where: 'optional - URL, banner, or path where the secret was found',
+            path: 'optional - alias for where',
+            finding_id: 'optional - finding id this secret is linked to',
+            finding: 'optional - alias for finding_id'
           )
 
           # Fetch a stored secret by label.
           #{self}.fetch(
-            label: 'required - vault label'
+            label: 'required - vault label',
+            engagement: 'optional - engagement id to search first',
+            engagement_id: 'optional - alias for engagement'
+          )
+
+          # List loot metadata for lateral-movement planning without plaintext secrets.
+          #{self}.query(
+            host: 'optional - hostname or IP to match',
+            service: 'optional - service name such as http or ssh',
+            kind: 'optional - password, token, or key',
+            finding_id: 'optional - finding id this secret is linked to',
+            finding: 'optional - alias for finding_id',
+            engagement: 'optional - engagement id scoping the loot file (defaults to default)',
+            engagement_id: 'optional - alias for engagement'
+          )
+
+          # Return decrypted creds that match a service auth prompt.
+          #{self}.offer(
+            host: 'optional - hostname or IP to match',
+            service: 'optional - service name such as http or ssh',
+            kind: 'optional - password, token, or key',
+            finding_id: 'optional - finding id this secret is linked to',
+            finding: 'optional - alias for finding_id',
+            engagement: 'optional - engagement id scoping the loot file (defaults to default)',
+            engagement_id: 'optional - alias for engagement'
+          )
+
+          # Parse username/password strings from recon evidence into the loot store.
+          #{self}.ingest(
+            text: 'required - recon banner, .env, or HTML containing creds',
+            host: 'optional - hostname or IP this secret authenticates',
+            service: 'optional - service name such as http or ssh',
+            source: 'optional - provenance source such as recon',
+            where: 'optional - URL, banner, or path where the secret was found',
+            engagement: 'optional - engagement id scoping the loot file (defaults to default)',
+            engagement_id: 'optional - alias for engagement',
+            finding_id: 'optional - finding id this secret is linked to',
+            kind: 'optional - password, token, or key (defaults to password)',
+            label: 'optional - vault label; defaults to host:user:hex'
           )
 
           # Replace {{vault:label}} tokens with stored secrets.

data/lib/pwn/plugins.rb

@@ -7,6 +7,7 @@ module PWN
   module Plugins
     autoload :Android, 'pwn/plugins/android'
     autoload :AFLplusplus, 'pwn/plugins/aflplusplus'
+    autoload :AISandbox, 'pwn/plugins/ai_sandbox'
     autoload :ArtifactRegistry, 'pwn/plugins/artifact_registry'
     autoload :Assembly, 'pwn/plugins/assembly'
     autoload :BinaryParser, 'pwn/plugins/binary_parser'
@@ -45,6 +46,7 @@ module PWN
     autoload :Git, 'pwn/plugins/git'
     autoload :GDB, 'pwn/plugins/gdb'
     autoload :GDBMI, 'pwn/plugins/gdbmi'
+    autoload :GDBMi, 'pwn/plugins/gdbmi'
     autoload :Ghidra, 'pwn/plugins/ghidra'
     autoload :GhidraHeadless, 'pwn/plugins/ghidra_headless'
     autoload :Github, 'pwn/plugins/github'
@@ -52,6 +54,7 @@ module PWN
     autoload :HackerOne, 'pwn/plugins/hacker_one'
     autoload :Handler, 'pwn/plugins/handler'
     autoload :Hunter, 'pwn/plugins/hunter'
+    autoload :Httpx, 'pwn/plugins/httpx'
     autoload :IPInfo, 'pwn/plugins/ip_info'
     autoload :IRC, 'pwn/plugins/irc'
     autoload :Jenkins, 'pwn/plugins/jenkins'
@@ -62,6 +65,7 @@ module PWN
     autoload :Log, 'pwn/plugins/log'
     autoload :MailAgent, 'pwn/plugins/mail_agent'
     autoload :Metasploit, 'pwn/plugins/metasploit'
+    autoload :MethodCatalog, 'pwn/plugins/method_catalog'
     autoload :MitmProxy, 'pwn/plugins/mitm_proxy'
     autoload :MonkeyPatch, 'pwn/plugins/monkey_patch'
     autoload :MSR206, 'pwn/plugins/msr206'

data/lib/pwn/reports/engagement.rb

@@ -19,10 +19,16 @@ module PWN
       public_class_method def self.generate(opts = {})
         name = (opts[:engagement] || opts[:name] || 'default').to_s
         rows = if opts[:findings]
-                 Array(opts[:findings])
+                 Array(opts[:findings]).select do |row|
+                   engagement = (row[:engagement_id] || row['engagement_id']).to_s
+                   engagement.empty? || engagement == name
+                 end
                elsif defined?(PWN::Plugins::Findings)
                  rows = PWN::Plugins::Findings.report
-                 rows = rows.select { |row| row[:engagement_id].to_s == name || name == 'default' }
+                 rows.select do |row|
+                   engagement = (row[:engagement_id] || row['engagement_id']).to_s
+                   engagement == name || (name == 'default' && engagement.empty?)
+                 end
                else
                  []
                end

data/lib/pwn/reports/html.rb

@@ -6,16 +6,34 @@ module PWN
     module HTML
       public_class_method def self.generate(opts = {})
         out = PWN::Reports.resolve_path(opts.merge(ext: 'html'))
-        payload = PWN::Reports.report_payload(opts)
-        rows = payload[:findings].map do |row|
-          "<tr><td>#{h(text: row['id'])}</td><td>#{h(text: row['title'])}</td><td>#{h(text: row['severity'])}</td><td>#{h(text: row['cvss'])}</td><td>#{h(text: row['description'])}</td><td>#{h(text: row['poc'])}</td><td>#{h(text: row['recommendation'])}</td></tr>"
+        payload = PWN::Reports.package_evidence(payload: PWN::Reports.report_payload(opts), path: out)
+        rows = Array(payload[:priorities]).each_with_index.map do |priority, index|
+          "<tr><td>#{index + 1}</td><td>#{h(text: priority[:title])}</td><td>#{h(text: priority[:combined_severity])}</td><td>#{h(text: priority[:kind])}</td><td>#{h(text: priority[:rationale])}</td></tr>"
         end
         details = payload[:findings].map do |row|
-          fields = row.map { |key, value| "<dt>#{h(text: key)}</dt><dd>#{h(text: value)}</dd>" }.join
-          "<section><h2>#{h(text: row['title'])}</h2><dl>#{fields}</dl></section>"
+          fields = row.except('reproduction_steps', 'severity_justification', 'poc', 'evidence_artifacts', 'poc_export')
+                      .map { |key, value| "<dt>#{h(text: key)}</dt><dd>#{h(text: value)}</dd>" }.join
+          steps = Array(row['reproduction_steps']).map { |step| "<li>#{h(text: step)}</li>" }.join
+          steps = steps.empty? ? '<p>Not supplied</p>' : "<ol>#{steps}</ol>"
+          justification = row['severity_justification'].to_s
+          code = PWN::Reports.poc_preview(text: row['poc'])
+          evidence = (Array(row['evidence_artifacts']) + [row['poc_export']].compact).map do |artifact|
+            link = "<a download href=\"#{h(text: artifact['attachment'])}\">#{h(text: artifact['label'])}</a>"
+            image = artifact['inline_image'] ? "<img src=\"#{h(text: artifact['attachment'])}\" alt=\"#{h(text: artifact['label'])}\">" : ''
+            "<li>#{link}#{image}<p>Kind: #{h(text: artifact['kind'])}; Handle: #{h(text: artifact['handle'])}; SHA-256: #{h(text: artifact['sha256'])}; Size: #{h(text: artifact['size'])} bytes</p></li>"
+          end.join
+          "<section><h2>#{h(text: row['title'])}</h2><dl>#{fields}</dl><h3>Reproduction steps</h3>#{steps}<h3>Severity justification</h3><p>#{h(text: justification.empty? ? 'Not supplied' : justification)}</p><h3>PoC command/code</h3><pre><code>#{h(text: code.empty? ? 'Not supplied' : code)}</code></pre><h3>Evidence</h3><ul>#{evidence}</ul></section>"
         end.join
         chains = payload[:attack_chains].map do |chain|
-          "<li>#{h(text: chain[:finding_ids].join(' -> '))}: #{h(text: chain[:combined_severity])}. #{h(text: chain[:rationale])}</li>"
+          steps = Array(chain[:reproduction_steps]).map { |step| "<li>#{h(text: step)}</li>" }.join
+          links = Array(chain[:links]).map { |link| "<li>#{h(text: link[:from])} -&gt; #{h(text: link[:to])}</li>" }.join
+          evidence = Array(chain[:evidence_artifacts]).map do |artifact|
+            artifact = artifact.transform_keys(&:to_s)
+            label = h(text: artifact['label'])
+            label = "<a download href=\"#{h(text: artifact['attachment'])}\">#{label}</a>" if artifact['attachment']
+            "<li>#{label}; Kind: #{h(text: artifact['kind'])}; Handle: #{h(text: artifact['handle'])}; SHA-256: #{h(text: artifact['sha256'])}; Size: #{h(text: artifact['size'])} bytes</li>"
+          end.join
+          "<section><h3>#{h(text: chain[:title])}</h3><p>Directed path: #{h(text: chain[:finding_ids].join(' -> '))}</p><p>Combined severity: #{h(text: chain[:combined_severity])}; Assessment: #{h(text: chain[:assessment_status])}</p><p>#{h(text: chain[:rationale])}</p><h4>Directed links</h4><ul>#{links}</ul><h4>PoC reproduction steps</h4><ol>#{steps}</ol><h4>Evidence</h4><ul>#{evidence}</ul></section>"
         end.join
         body = <<~HTML
           <!DOCTYPE html>
@@ -27,16 +45,17 @@ module PWN
           <body>
             <h1>#{h(text: payload[:title])}</h1>
             #{summary_html(text: payload[:executive_summary])}
+            <h2>Ranked priorities</h2>
             <table>
               <thead>
-                <tr><th>id</th><th>title</th><th>severity</th><th>cvss</th><th>description</th><th>poc</th><th>recommendation</th></tr>
+                <tr><th>rank</th><th>title</th><th>severity</th><th>kind</th><th>rationale</th></tr>
               </thead>
               <tbody>
                 #{rows.join("\n")}
               </tbody>
             </table>
-            #{details}
-            <h2>Attack chains</h2><ul>#{chains}</ul>
+            <h2>Attack chains</h2>#{chains}
+            <h2>Finding technical details</h2>#{details}
           </body>
           </html>
         HTML