pwn 0.5.784 → 0.5.787

data/lib/pwn/plugins.rb

@@ -111,6 +111,7 @@ module PWN
     autoload :Volatility, 'pwn/plugins/volatility'
     autoload :Vsphere, 'pwn/plugins/vsphere'
     autoload :XXD, 'pwn/plugins/xxd'
+    autoload :YubiKey, 'pwn/plugins/yubikey'
     autoload :Zaproxy, 'pwn/plugins/zaproxy'
 
     # Display a List of Every PWN::Plugins Module

data/lib/pwn/redaction.rb

@@ -4,7 +4,7 @@ require 'digest'
 require 'json'
 
 module PWN
-  # Write-boundary redaction; reject cyclic or over-100-level containers before inspecting secrets. Never opens a credential store.
+  # Write-boundary redaction; redact never opens a credential store. Capture optionally stores ordinary secrets. Hardware/MFA fields use constant masks, never digest markers or loot capture.
   module Redaction
     PATTERNS = {
       pem: /-----BEGIN [A-Z ]*PRIVATE KEY-----.*?(?:-----END [A-Z ]*PRIVATE KEY-----|\z)/m,
@@ -17,6 +17,15 @@ module PWN
       cookie: /\bSet-Cookie:\s*(?!\[REDACTED:)[^\r\n]+/i
     }.freeze
     SECRET_FIELD = /\A(?:password|passwd|secret|api[_-]?key|authorization|proxy-authorization|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret)\z/i
+    CONSTANT_MASK = '[REDACTED]'
+    MASKED_NAME = /(?:
+      (?:(?:new|current|old|admin|user|fido2?|piv|openpgp)[_-])?(?:pin|puk) |
+      access[_-]?code | management[_-]?(?:key|password) | oath[_-]?secret | static[_-]?password |
+      scp(?:03|11)?(?:[_-](?:key|keys|enc|mac|dek)(?:[_-]key)?)? |
+      (?:mfa|otp|totp|hotp)(?:[_-](?:code|token|secret))? | (?:recovery|verification)[_-]?code
+    )/ix
+    MASKED_FIELD = /\A#{MASKED_NAME}\z/
+    MASKED_TEXT = /(?<![\w-])((?:--)?["']?#{MASKED_NAME}["']?\s*(?:=>|[:=])\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\[REDACTED(?::[^\]]+)?\]|[^\s,;}\])]+)/
 
     public_class_method def self.redact(opts = {})
       value = opts[:value]
@@ -46,7 +55,9 @@ module PWN
       case value
       when Hash
         value.to_h do |key, item|
-          clean = if key.to_s.match?(SECRET_FIELD) && !item.nil?
+          clean = if key.to_s.match?(MASKED_FIELD) && !item.nil?
+                    CONSTANT_MASK
+                  elsif key.to_s.match?(SECRET_FIELD) && !item.nil?
                     token(kind: key.to_s.downcase, value: item.to_s)
                   else
                     redact_value(value: item)
@@ -55,15 +66,58 @@ module PWN
         end
       when Array then value.map { |item| redact_value(value: item) }
       when String
-        PATTERNS.reduce(value.dup) do |text, (kind, regex)|
-          text.split(/(\[REDACTED:[^:\]]+:[0-9a-f]{8}\])/).map do |part|
-            part.start_with?('[REDACTED:') ? part : part.gsub(regex) { |match| token(kind: kind, value: match) }
+        PATTERNS.reduce(mask_fields(text: value)) do |text, (kind, regex)|
+          text.split(/(\[REDACTED(?::[^:\]]+:[0-9a-f]{8})?\])/).map do |part|
+            part.start_with?('[REDACTED') ? part : part.gsub(regex) { |match| token(kind: kind, value: match) }
           end.join
         end
       else value
       end
     end
 
+    private_class_method def self.mask_fields(opts = {})
+      text = opts[:text]
+      clean = +''
+      offset = 0
+      while (match = MASKED_TEXT.match(text, offset))
+        clean << text[offset...match.begin(0)] << match[1] << CONSTANT_MASK
+        offset = masked_value_end(text: text, start: match.end(1), finish: match.end(0))
+      end
+      clean << text[offset..]
+    end
+
+    # Iterative scan prevents partial masks of serialized arrays/hashes of keys.
+    private_class_method def self.masked_value_end(opts = {})
+      text = opts[:text]
+      start = opts[:start]
+      pairs = { '[' => ']', '{' => '}' }
+      return opts[:finish] unless pairs.key?(text[start]) || ['"', "'"].include?(text[start])
+
+      stack = []
+      quote = nil
+      escaped = false
+      text[start..].each_char.with_index(start) do |char, index|
+        if quote
+          if escaped
+            escaped = false
+          elsif char == '\\'
+            escaped = true
+          elsif char == quote
+            quote = nil
+            return index + 1 if stack.empty?
+          end
+        elsif ['"', "'"].include?(char)
+          quote = char
+        elsif pairs.key?(char)
+          stack << pairs[char]
+        elsif pairs.value?(char)
+          return text.length unless stack.pop == char
+          return index + 1 if stack.empty?
+        end
+      end
+      text.length
+    end
+
     public_class_method def self.token(opts = {})
       value = opts[:value].to_s
       return value if value.match?(/\A\[REDACTED:[^:]+:[0-9a-f]{8}\]\z/)
@@ -75,19 +129,21 @@ module PWN
       value = opts[:value]
       return { redacted: redact(value: value), refs: [] } unless value.is_a?(String)
 
-      text = value.to_s
+      text = mask_fields(text: value)
       refs = []
       redacted = PATTERNS.reduce(text.dup) do |acc, (kind, regex)|
         acc.gsub(regex) do |match|
+          next match if match.match?(/\A[\w-]+\s*[:=]\s*\[REDACTED\]\z/)
+
           tok = token(kind: kind, value: match)
           refs << { kind: kind, token: tok }
-          PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
+          PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement], yubikey: opts[:yubikey]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
           tok
         rescue StandardError
           tok
         end
       end
-      redacted = capture_entropy(text: redacted, refs: refs, vault: opts[:vault], engagement: opts[:engagement]) if opts[:entropy] == true
+      redacted = capture_entropy(text: redacted, refs: refs, vault: opts[:vault], engagement: opts[:engagement], yubikey: opts[:yubikey]) if opts[:entropy] == true
       { redacted: redacted, refs: refs }
     end
 
@@ -100,10 +156,10 @@ module PWN
 
         tok = token(kind: 'entropy', value: match)
         refs << { kind: 'entropy', token: tok }
-        PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
+        PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement], yubikey: opts[:yubikey]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
         tok
       rescue StandardError
-        match
+        tok || token(kind: 'entropy', value: match)
       end
     end
 
@@ -122,7 +178,7 @@ module PWN
 
     public_class_method def self.help
       puts "USAGE:
-        # Redact secret patterns before persistence; reject cycles/depth above 100 with JSON::NestingError.
+        # Redact before persistence; hardware/MFA fields use constant masks. Reject cycles/depth above 100 with JSON::NestingError.
         #{self}.redact(
           value: 'required - string or nested JSON-compatible data'
         )
@@ -131,10 +187,11 @@ module PWN
           kind: 'required - secret type label',
           value: 'required - sensitive value to hash'
         )
-        # Capture secrets into Vault labels and return a redacted copy.
+        # Capture ordinary secrets into Vault labels; mask hardware/MFA fields without storing them.
         #{self}.capture(
           value: 'required - string that may contain credentials',
           vault: 'optional - false skips Vault.store',
+          yubikey: 'optional - selector Hash for hardware-encrypted captured loot; no software fallback on failure',
           engagement: 'optional - engagement name stored with the vault label',
           entropy: 'optional - true also captures high-entropy tokens'
         )

data/lib/pwn/session_trace.rb

@@ -91,6 +91,10 @@ module PWN
       timeout = Float(opts.fetch(:timeout, 30))
       raise ArgumentError, 'Invalid rerun deadline' unless timeout.positive? && timeout <= 300
 
+      # A user-namespace caller that is not uid 0 may still hold capabilities.
+      # Bubblewrap rejects those. Uid 0 can already create the nested map;
+      # dropping every capability there makes the uid-map setup fail.
+      argv.unshift('setpriv', '--ambient-caps=-all', '--inh-caps=-all', '--bounding-set=-all', '--') if PWN::AI::Agent::MissionNamespace.prepared? && !Process.uid.zero?
       Open3.popen3(*argv, unsetenv_others: true, pgroup: true) do |stdin, stdout, stderr, wait|
         readers = [Thread.new { stdout.read }, Thread.new { stderr.read }]
         begin

data/lib/pwn/setup.rb

@@ -129,10 +129,44 @@ module PWN
       }
     }.freeze
 
+    # Optional runtime libraries, not executables or Ruby build dependencies.
+    # macOS provides PC/SC as a system framework. Linux PC/SC also needs a
+    # daemon and CCID reader driver for actual I/O; doctor only loads libraries.
+    NATIVE_LIBRARIES = {
+      'hidapi' => {
+        apt: %w[libhidapi-hidraw0], dnf: %w[hidapi], pacman: %w[hidapi],
+        brew: %w[hidapi], port: %w[hidapi],
+        libraries: {
+          unix: %w[libhidapi-hidraw.so.0 libhidapi-hidraw.so libhidapi-libusb.so.0 libhidapi-libusb.so libhidapi.so],
+          macos: %w[libhidapi.dylib /opt/homebrew/lib/libhidapi.dylib /usr/local/lib/libhidapi.dylib /opt/local/lib/libhidapi.dylib],
+          windows: %w[hidapi.dll]
+        },
+        plugins: %w[PWN::Plugins::YubiKey]
+      },
+      'pcsc' => {
+        apt: %w[libpcsclite1 pcscd libccid], dnf: %w[pcsc-lite-libs pcsc-lite pcsc-lite-ccid],
+        pacman: %w[pcsclite ccid], brew: %w[], port: %w[],
+        libraries: {
+          unix: %w[libpcsclite.so.1 libpcsclite.so],
+          macos: %w[/System/Library/Frameworks/PCSC.framework/PCSC],
+          windows: %w[winscard.dll]
+        },
+        plugins: %w[PWN::Plugins::YubiKey]
+      }
+    }.freeze
+
     # External binaries PWN wraps → OS packages that provide them.
     # (Extrospection.probe_toolchain already knows how to *detect* these;
     #  this table knows how to *install* them.)
     TOOLCHAIN = {
+      'setpriv' => {
+        apt: %w[util-linux], dnf: %w[util-linux], pacman: %w[util-linux], brew: %w[], port: %w[],
+        plugins: %w[PWN::SessionTrace]
+      },
+      'unshare' => {
+        apt: %w[util-linux], dnf: %w[util-linux], pacman: %w[util-linux], brew: %w[], port: %w[],
+        plugins: %w[PWN::AI::Agent::MissionNamespace]
+      },
       'nmap' => {
         apt: %w[nmap], dnf: %w[nmap], pacman: %w[nmap], brew: %w[nmap], port: %w[nmap],
         plugins: %w[PWN::Plugins::NmapIt]
@@ -408,7 +442,7 @@ module PWN
       ai: {
         desc: 'verify at least one AI engine key/oauth in ~/.pwn/pwn.yaml',
         gems: %w[],
-        bins: %w[jq]
+        bins: %w[jq unshare setpriv]
       },
       web: {
         desc: 'TransparentBrowser · BurpSuite · Zaproxy · extro_verify · extro_watch',
@@ -446,9 +480,10 @@ module PWN
         bins: %w[msfconsole sqlmap]
       },
       hardware: {
-        desc: 'Serial · BusPirate · Android · BareSIP · extro_serial · extro_telecomm',
+        desc: 'Serial · BusPirate · Android · BareSIP · YubiKey · extro_serial · extro_telecomm',
         gems: %w[libusb],
-        bins: %w[adb baresip]
+        bins: %w[adb baresip],
+        libs: %w[hidapi pcsc]
       },
       re: {
         desc: 'Radare2 · GDB · ExploitDev · Frida · Android RE tier',
@@ -458,7 +493,8 @@ module PWN
       full: {
         desc: 'everything above',
         gems: NATIVE_GEMS.keys,
-        bins: TOOLCHAIN.keys
+        bins: TOOLCHAIN.keys,
+        libs: NATIVE_LIBRARIES.keys
       }
     }.freeze
 
@@ -572,15 +608,23 @@ module PWN
       io.puts
 
       # ~/.pwn -----------------------------------------------------------
-      pwn_root  = File.join(Dir.home, '.pwn')
-      pwn_yaml  = File.join(pwn_root, 'pwn.yaml')
-      pwn_dec   = File.join(pwn_root, 'pwn.yaml.decryptor')
+      pwn_root = File.join(Dir.home, '.pwn')
+      driver = defined?(PWN::Env) && PWN::Env.is_a?(Hash) ? PWN::Env[:driver_opts] : nil
+      driver = {} unless driver.is_a?(Hash)
+      pwn_yaml  = driver[:pwn_env_path] || File.join(pwn_root, 'pwn.yaml')
+      pwn_dec   = driver[:pwn_dec_path] || "#{pwn_yaml}.decryptor"
       root_ok   = File.directory?(pwn_root)
       root_note = root_ok ? "(#{Dir.children(pwn_root).length} entries)" : '(will be created on first `pwn` launch)'
       io.puts "#{'~/.pwn/'.ljust(26)} #{root_ok ? OK : MISS}   #{root_note}"
       yaml_ok   = File.file?(pwn_yaml)
       dec_state = File.file?(pwn_dec) ? 'present' : 'MISSING'
-      yaml_note = yaml_ok ? "(encrypted, decryptor #{dec_state})" : '(run `pwn` once, then `pwn-vault` to configure)'
+      yaml_note = if !yaml_ok
+                    '(run `pwn` once, then `pwn-vault` to configure)'
+                  elsif PWN::Plugins::Vault.hardware_encrypted?(file: pwn_yaml)
+                    '(YubiKey encrypted; no software decryptor required)'
+                  else
+                    "(encrypted, decryptor #{dec_state})"
+                  end
       io.puts "#{'~/.pwn/pwn.yaml'.ljust(26)} #{yaml_ok ? OK : MISS}   #{yaml_note}"
       engine = ai_active_engine
       key_ok = ai_key_configured?(engine: engine)
@@ -603,6 +647,20 @@ module PWN
       end
       io.puts
 
+      # Runtime libraries ------------------------------------------------
+      io.puts 'Native libraries (host loading only; no device discovery)'
+      lib_missing = []
+      NATIVE_LIBRARIES.each do |name, meta|
+        ok = native_library_available?(name: name, os: os)
+        lib_missing << name unless ok
+        packages = Array(meta[pm[:key]])
+        hint = packages.empty? ? 'native OS library; see hardware profile' : packages.join(' ')
+        need = ok ? '' : "(needs: #{hint})"
+        io.puts "  #{name.ljust(14)} #{ok ? OK : MISS}  #{need} → #{Array(meta[:plugins]).join(', ')}"
+      end
+      io.puts '  Library presence does not verify device permissions, PC/SC service, reader or token readiness.'
+      io.puts
+
       # Toolchain --------------------------------------------------------
       io.puts "#{'External toolchain'.ljust(46)} used by"
       bin_missing = []
@@ -621,36 +679,41 @@ module PWN
         io.puts
       end
 
-      total   = NATIVE_GEMS.size + TOOLCHAIN.size
-      missing = gem_missing.size + bin_missing.size
+      total   = NATIVE_GEMS.size + TOOLCHAIN.size + NATIVE_LIBRARIES.size
+      missing = gem_missing.size + bin_missing.size + lib_missing.size
       io.puts "#{total - missing} / #{total} capabilities usable · #{missing} degraded"
       io.puts
       unless missing.zero?
-        io.puts 'Run `pwn setup --deps` to install missing OS headers/tools, or'
+        io.puts 'Run `pwn setup --deps` to install missing OS headers/tools/libraries, or'
         io.puts '    `pwn setup --profile <name>` for a subset. See `pwn setup --list-profiles`.'
       end
 
       # When a profile is given (`pwn setup --check --profile core`), :ok is
-      # gated ONLY on that profile's gems/bins so a partially-provisioned host
+      # gated ONLY on that profile's gems/bins/libs so a partially-provisioned host
       # can still pass its own doctor gate. `packer/provisioners/pwn.sh` and
       # spec/integration/fresh_install_spec.rb rely on this — a `core` leg of
       # install-matrix must not fail because gqrx/burpsuite/etc. are absent.
       gate_gems = gem_missing
       gate_bins = bin_missing
+      gate_libs = lib_missing
       if profile && PROFILES.key?(profile)
         prof      = PROFILES[profile]
         gate_gems = gem_missing & Array(prof[:gems])
         gate_bins = bin_missing & Array(prof[:bins])
+        gate_libs = lib_missing & Array(prof[:libs])
         io.puts
+        library_note = ", libs: #{gate_libs.empty? ? '—' : gate_libs.join(' ')}" unless Array(prof[:libs]).empty?
         io.puts "Profile '#{profile}' gate: " \
-                "#{gate_gems.empty? && gate_bins.empty? ? OK : MISS} " \
+                "#{gate_gems.empty? && gate_bins.empty? && gate_libs.empty? ? OK : MISS} " \
                 "(gems: #{gate_gems.empty? ? '—' : gate_gems.join(' ')}, " \
-                "bins: #{gate_bins.empty? ? '—' : gate_bins.join(' ')})"
+                "bins: #{gate_bins.empty? ? '—' : gate_bins.join(' ')}" \
+                "#{library_note})"
       end
 
-      { ok: gate_gems.empty? && gate_bins.empty? && Array(migrate && migrate[:incompatible]).empty?,
+      { ok: gate_gems.empty? && gate_bins.empty? && gate_libs.empty? && Array(migrate && migrate[:incompatible]).empty?,
         native_gems_missing: gem_missing, toolchain_missing: bin_missing,
-        state: migrate, pkg_manager: pm[:key], os: os, arch: arch }
+        state: migrate, pkg_manager: pm[:key], os: os, arch: arch,
+        native_libraries_missing: lib_missing }
     rescue StandardError => e
       raise e
     end
@@ -690,6 +753,7 @@ module PWN
       bins     = Array(prof[:bins])
       os_pkgs  = []
       gems.each { |g| os_pkgs.concat(Array(NATIVE_GEMS.dig(g, pm[:key]))) }
+      Array(prof[:libs]).each { |lib| os_pkgs.concat(Array(NATIVE_LIBRARIES.dig(lib, pm[:key]))) }
       bins.each { |b| os_pkgs.concat(packages_for(bin: b, distro: distro, version: version, pm_key: pm[:key])) }
       os_pkgs = os_pkgs.reject(&:empty?).uniq
       alts = alt_install_cmds(bins: bins, pm_key: pm[:key], distro: distro, version: version)
@@ -765,7 +829,7 @@ module PWN
     #      third_party/terminator/pwn_shift_enter.py to
     #      ~/.config/terminator/plugins/ and enables the PWNShiftEnter
     #      plugin in ~/.config/terminator/config — WITH confirmation and
-    #      a .pwnbak backup. This is the only VTE emulator we can fix at
+    #      a shared recovery backup. This is the only VTE emulator we can fix at
     #      the GTK layer without patching libvte itself.
     #
     # Everything here is host-config mutation, which is why it lives in
@@ -831,7 +895,7 @@ module PWN
       io.puts
       io.puts "    write   #{plugin_dst}"
       io.puts "    edit    #{cfg_path}   (add PWNShiftEnter to enabled_plugins)"
-      io.puts "    backup  #{cfg_path}.pwnbak"
+      io.puts '    backup  ~/.pwn/backup (shared seven-generation store)'
       io.puts
 
       unless yes
@@ -858,7 +922,7 @@ module PWN
         if cfg.include?('PWNShiftEnter')
           io.puts "  #{OK} PWNShiftEnter already enabled in #{cfg_path}"
         else
-          FileUtils.cp(cfg_path, "#{cfg_path}.pwnbak") unless File.exist?("#{cfg_path}.pwnbak")
+
           new_cfg =
             if cfg =~ /^\s*enabled_plugins\s*=\s*(.*)$/
               cfg.sub(/^(\s*enabled_plugins\s*=\s*)(.*)$/) do
@@ -871,8 +935,11 @@ module PWN
             else
               "[global_config]\n  enabled_plugins = PWNShiftEnter\n#{cfg}"
             end
-          File.write(cfg_path, new_cfg)
-          io.puts "  #{OK} enabled PWNShiftEnter in #{cfg_path} (backup: config.pwnbak)"
+          PWN::Backups.transaction do
+            backup = PWN::Backups.capture(path: cfg_path, label: 'terminator')
+            File.write(cfg_path, new_cfg)
+            io.puts "  #{OK} enabled PWNShiftEnter in #{cfg_path} (backup: #{backup})"
+          end
         end
       else
         FileUtils.mkdir_p(File.dirname(cfg_path))
@@ -900,6 +967,7 @@ module PWN
         io.puts "  #{name.to_s.ljust(10)} #{meta[:desc]}"
         io.puts "  #{''.ljust(10)}   gems: #{meta[:gems].join(' ')}" unless meta[:gems].empty?
         io.puts "  #{''.ljust(10)}   bins: #{meta[:bins].join(' ')}" unless meta[:bins].empty?
+        io.puts "  #{''.ljust(10)}   libs: #{meta[:libs].join(' ')}" unless Array(meta[:libs]).empty?
         io.puts
       end
       PROFILES.keys
@@ -998,6 +1066,28 @@ module PWN
       ''
     end
 
+    private_class_method def self.native_library_available?(opts = {})
+      require 'ffi'
+      os = opts[:os].to_s
+      platform = if os.match?(/darwin|osx|macos/i)
+                   :macos
+                 elsif os.match?(/mswin|mingw|cygwin|windows/i)
+                   :windows
+                 else
+                   :unix
+                 end
+      libraries = NATIVE_LIBRARIES.fetch(opts[:name]).fetch(:libraries).fetch(platform)
+      flags = ::FFI::DynamicLibrary::RTLD_LAZY | ::FFI::DynamicLibrary::RTLD_LOCAL
+      libraries.any? do |library|
+        ::FFI::DynamicLibrary.open(library, flags)
+        true
+      rescue LoadError
+        false
+      end
+    rescue LoadError
+      false
+    end
+
     private_class_method def self.gem_loadable?(opts = {})
       name = opts[:name].to_s
       Gem::Specification.find_by_name(name)
@@ -1137,13 +1227,13 @@ module PWN
           pm_key: 'optional - package-manager family (:apt :dnf :pacman :brew :port :pkg)'
         )
 
-        # Run check and return its result
+        # Check gems, binaries and native host libraries; native_libraries_missing reports HIDAPI/PCSC without device discovery.
         #{self}.check(
           io: 'optional - IO to write the report to (default $stdout)',
-          profile: 'optional - profile value consumed by #check'
+          profile: 'optional - gate only this profile; core never requires hardware libraries'
         )
 
-        # Install OS packages + native gems for a capability profile.
+        # Install OS packages and gems; hardware/full add HIDAPI and PC/SC, not a Python or executable YubiKey backend.
         #{self}.deps(
           profile: 'optional - one of PROFILES.keys (default :full)',
           yes: 'optional - non-interactive; assume yes to prompts (default false)',

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.784'
+  VERSION = '0.5.787'
 end

data/lib/pwn/www/app_cobalt_io.rb

@@ -5,6 +5,8 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports app.cobalt.io actions.
+    # YubiKey OATH MFA requires explicit confirm: true because HOTP advances counters
+    # and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
     module AppCobaltIO
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::AppCobaltIO.open(
@@ -28,10 +30,13 @@ module PWN
       #   browser_obj: 'required - browser_obj returned from #open method',
       #   username: 'required - username',
       #   password: 'optional - passwd (will prompt if blank)',
-      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)',
+      #   yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
+        yubikey = opts[:yubikey]
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -54,9 +59,9 @@ module PWN
         # name: 'commit' doesn't work
         browser.button(index: 6).click! # no name or id in button element
 
-        if mfa
+        if mfa || !yubikey.nil?
           until browser.url == 'https://app.cobalt.io/dashboard'
-            browser.text_field(id: 'code').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser.text_field(id: 'code').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token', yubikey: yubikey))
             browser.button(name: 'commit').click!
             sleep 3
           end
@@ -117,12 +122,18 @@ module PWN
             proxy: 'optional - scheme://proxy_host:port || tor'
           )
 
-          # Run login and return its result
+          # Log in with manual MFA or explicitly selected YubiKey OATH.
+          # YubiKey enables MFA even when mfa is false; failures never fall back to a prompt.
+          # Configure the service for an authenticator challenge, not SMS.
+          # Example yubikey: { account: 'EXACT_OATH_NAME', confirm: true, serial: '123456', timeout: 30 }
+          # Explicit consent is required: HOTP advances counters and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
+          # Reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username value consumed by #login',
             password: 'optional - passwd (will prompt if blank)',
-            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+            mfa: 'optional - if true prompt for mfa token (defaults to false)',
+            yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
           )
 
           # Run logout and return its result

data/lib/pwn/www/bug_crowd.rb

@@ -5,6 +5,8 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports bugcrowd.com actions.
+    # YubiKey OATH MFA requires explicit confirm: true because HOTP advances counters
+    # and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
     module BugCrowd
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::BugCrowd.open(
@@ -28,10 +30,13 @@ module PWN
       #   browser_obj: 'required - browser_obj returned from #open method',
       #   username: 'required - username',
       #   password: 'optional - passwd (will prompt if blank)',
-      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)',
+      #   yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
+        yubikey = opts[:yubikey]
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -51,9 +56,9 @@ module PWN
         browser.text_field(id: 'user_password').wait_until(&:present?).set(password)
         browser.button(name: 'button').click!
 
-        if mfa
+        if mfa || !yubikey.nil?
           until browser.url == 'https://bugcrowd.com/programs'
-            browser.text_field(name: 'otp_attempt').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser.text_field(name: 'otp_attempt').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token', yubikey: yubikey))
             browser.button(name: 'commit').click!
             sleep 3
           end
@@ -114,12 +119,18 @@ module PWN
             proxy: 'optional - scheme://proxy_host:port || tor'
           )
 
-          # Run login and return its result
+          # Log in with manual MFA or explicitly selected YubiKey OATH.
+          # YubiKey enables MFA even when mfa is false; failures never fall back to a prompt.
+          # Configure the service for an authenticator challenge, not SMS.
+          # Example yubikey: { account: 'EXACT_OATH_NAME', confirm: true, serial: '123456', timeout: 30 }
+          # Explicit consent is required: HOTP advances counters and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
+          # Reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username value consumed by #login',
             password: 'optional - passwd (will prompt if blank)',
-            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+            mfa: 'optional - if true prompt for mfa token (defaults to false)',
+            yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
           )
 
           # Run logout and return its result

data/lib/pwn/www/coinbase_pro.rb

@@ -5,6 +5,8 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports tradingview.com actions.
+    # YubiKey OATH MFA requires explicit confirm: true because HOTP advances counters
+    # and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
     module CoinbasePro
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::CoinbasePro.open(
@@ -28,10 +30,13 @@ module PWN
       #   browser_obj: 'required - browser_obj returned from #open method',
       #   username: 'required - username',
       #   password: 'optional - passwd (will prompt if blank)',
-      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)',
+      #   yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
+        yubikey = opts[:yubikey]
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -52,9 +57,9 @@ module PWN
         browser.text_field(name: 'password').wait_until(&:present?).set(password)
         browser.button(text: 'Sign In').click!
 
-        if mfa
+        if mfa || !yubikey.nil?
           until browser.url.include?('https://pro.coinbase.com')
-            browser.text_field(name: 'token').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser.text_field(name: 'token').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token', yubikey: yubikey))
             browser.button(text: 'Verify').click!
             sleep 3
           end
@@ -114,12 +119,18 @@ module PWN
             proxy: 'optional - scheme://proxy_host:port || tor'
           )
 
-          # Run login and return its result
+          # Log in with manual MFA or explicitly selected YubiKey OATH.
+          # YubiKey enables MFA even when mfa is false; failures never fall back to a prompt.
+          # Configure the service for an authenticator challenge, not SMS.
+          # Example yubikey: { account: 'EXACT_OATH_NAME', confirm: true, serial: '123456', timeout: 30 }
+          # Explicit consent is required: HOTP advances counters and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
+          # Reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username value consumed by #login',
             password: 'optional - passwd (will prompt if blank)',
-            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+            mfa: 'optional - if true prompt for mfa token (defaults to false)',
+            yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
           )
 
           # Run logout and return its result