pwn 0.4.886 → 0.4.887

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a85fbb128c8c5ba0dafc425373d33839998f866ccc0982b9d0f596ce7ee2411
-  data.tar.gz: ab8a86d182d5cc69e7509596bd38a0515b2c8c0b532ca61b59675558fb5df554
+  metadata.gz: eba0652465ac3cb7e848a84e78412952875ab79a2c47dbcda39068a65e9f5c5b
+  data.tar.gz: 2c03fbba16c08c1820d483e744e5e1dd70812081aff632a9f71f0227f582d2a7
 SHA512:
-  metadata.gz: d3ef35410455de329014f16c01c6498ce9e7540a1edbf2028b3c181297e47084a4439e7e6344892ce33685868599cd44f3ffb21008bfcd83695f6b1931067a95
-  data.tar.gz: 0e3155be591274c629fc0dd73a45d94b830261af83bf4a074d05c4579d0eea110815f5efb6ef5adf439c16e171da51f7287f44e032f29ec29b719c8a4c163a9d
+  metadata.gz: c9912c9c682b57c711c1a57e09e7ffad70c7018cf8e2689ecf7ff3a0f8fe3e5de9638588fd85c3475f58aaeb51a4892061e9cd4ceca6d1d3a40e5a2be8e88d31
+  data.tar.gz: c26189e41c966c8d3ca0e3988d9d901461b420a85e6d49123814b7e9331e8bcb6a7fe2dd2b3fa0d058f8b2b4f3948e3b5131a4ecb21854dc0a018e03f42d9b58

data/README.md

@@ -37,7 +37,7 @@ $ rvm use ruby-3.2.2@pwn
 $ rvm list gemsets
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.886]:001 >>> PWN.help
+pwn[v0.4.887]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.2.2@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.886]:001 >>> PWN.help
+pwn[v0.4.887]:001 >>> PWN.help
 ```
 
 

data/bin/pwn_graphql_introspection_detector

@@ -0,0 +1,311 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'faker'
+require 'json'
+require 'optparse'
+require 'pwn'
+
+opts = {}
+OptionParser.new do |options|
+  options.on('-jFILE', '--json-results=FILE', 'Required - JSON results file from pwn_shodan_search driver') do |j|
+    opts[:json_results] = j
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+json_results_path = opts[:json_results]
+raise "ERROR: Shodan JSON Results File #{json_results_path} Does Not Exist." unless File.exist?(json_results_path)
+
+search_results = JSON.parse(
+  File.read(json_results_path),
+  symbolize_names: true
+)
+
+print 'Extracting URIs from Shodan search results...'
+uri_arr = PWN::Plugins::Shodan.get_uris(search_results: search_results)
+puts 'complete.'
+
+print "Extracting GraphQL URIs from #{uri_arr.count} URIs..."
+graphql_uris = uri_arr.uniq.select do |uri|
+  uri if uri =~ %r{.+/graphql/?$} ||
+         uri =~ %r{.+/graphiql/?$} ||
+         uri =~ %r{.+/playground/?$} ||
+         uri =~ %r{.+/console/?$} ||
+         uri =~ %r{.+/query/?$} ||
+         uri =~ %r{.+/gql/?$} ||
+         uri =~ %r{.+/index.php?graphql$}
+end
+puts 'complete.'
+
+browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: :rest)
+rest_client = browser_obj[:browser]::Request
+
+graphql_payloads_arr = []
+
+graphql_schema_payload = '{ "query": "{ __schema { types { name } } }" }'
+graphql_payloads_arr.push(graphql_schema_payload)
+
+graphql_introspection_payload1 = <<-END_OF_PAYLOAD
+  {
+    query IntrospectionQuery {
+      __schema {
+
+        queryType { name }
+        mutationType { name }
+        subscriptionType { name }
+        types { ...FullType }
+        directives {
+          name
+          description
+          locations
+          args { ...InputValue }
+        }
+      }
+    }
+
+    fragment FullType on __Type {
+      kind
+      name
+      description
+      fields(includeDeprecated: true) {
+        name
+        description
+        args { ...InputValue }
+        type { ...TypeRef }
+        isDeprecated
+        deprecationReason
+      }
+      inputFields {
+        ...InputValue
+      }
+      interfaces {
+        ...TypeRef
+      }
+      enumValues(includeDeprecated: true) {
+        name
+        description
+        isDeprecated
+        deprecationReason
+      }
+      possibleTypes {
+        ...TypeRef
+      }
+    }
+
+    fragment InputValue on __InputValue {
+      name
+      description
+      type { ...TypeRef }
+      defaultValue
+    }
+
+    fragment TypeRef on __Type {
+      kind
+      name
+      ofType {
+        kind
+        name
+        ofType {
+          kind
+          name
+          ofType {
+            kind
+            name
+            ofType {
+              kind
+              name
+              ofType {
+                kind
+                name
+                ofType {
+                  kind
+                  name
+                  ofType {
+                    kind
+                    name
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+END_OF_PAYLOAD
+graphql_payloads_arr.push(graphql_introspection_payload1)
+
+graphql_introspection_payload2 = <<-END_OF_PAYLOAD
+    {
+      "operationName":"IntrospectionQuery",
+      "variables":{},
+      "query":"
+        fragment FullType on __Type {
+          kind
+          name
+          description
+          fields(includeDeprecated: true) {
+            name
+            description
+            args { ...InputValue }
+            type { ...TypeRef }
+            isDeprecated    deprecationReason
+          }
+          inputFields { ...InputValue  }
+          interfaces { ...TypeRef  }
+          enumValues(includeDeprecated: true) {
+            name
+            description
+            isDeprecated
+            deprecationReason
+          }
+          possibleTypes { ...TypeRef }
+      }
+
+      fragment InputValue on __InputValue {
+        name
+        description
+        type { ...TypeRef }
+        defaultValue
+      }
+
+      fragment TypeRef on __Type {
+        kind
+        name
+        ofType {
+          kind
+          name
+          ofType {
+            kind
+            name
+            ofType {
+              kind
+              name
+              ofType {
+                kind
+                name
+                ofType {
+                  kind
+                  name
+                  ofType {
+                    kind
+                    name
+                    ofType {
+                      kind
+                      name
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+
+      query IntrospectionQuery {
+        __schema {
+          queryType { name }
+          mutationType { name }
+          types { ...FullType }
+          directives {
+            name
+            description
+            locations
+            args { ...InputValue }
+          }
+        }
+      }"
+    }
+END_OF_PAYLOAD
+graphql_payloads_arr.push(graphql_introspection_payload2)
+
+# Math Part
+graphql_uri_tot = graphql_uris.length
+payload_tot = graphql_payloads_arr.length
+request_tot = payload_tot * graphql_uri_tot
+
+puts "Sending #{payload_tot} payloads to #{graphql_uris.count} GraphQL URIs..."
+puts "Total HTTP Requests: #{request_tot}"
+
+user_agent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36'
+introspection_arr_of_hashes = []
+graphql_uris.each do |this_uri|
+  puts "IN PROGRESS: #{this_uri}..."
+  graphql_payloads_arr.each_with_index do |this_payload, payload_index|
+    # user_agent = Faker::Internet.user_agent
+    timestamp = Time.now.strftime('%Y-%m-%d_%H:%M:%S')
+    introspection_hash = {
+      time: timestamp,
+      uri: this_uri,
+      payload_index: payload_index,
+      response_code: nil,
+      response_headers: nil,
+      response: nil
+    }
+    resp = rest_client.execute(
+      method: :post,
+      url: this_uri,
+      headers: {
+        content_type: 'application/json; charset=UTF-8',
+        user_agent: user_agent
+      },
+      payload: this_payload,
+      verify_ssl: false,
+      timeout: 3.0,
+      max_redirects: 3
+    )
+    introspection_hash[:response_code] = resp.code
+    introspection_hash[:response_headers] = resp.headers
+    json_resp = JSON.parse(
+      resp.body,
+      symbolize_names: true
+    )
+
+    introspection_hash[:response] = json_resp
+  rescue Errno::ECONNREFUSED,
+         Errno::ENETUNREACH,
+         JSON::ParserError,
+         OpenSSL::SSL::SSLError,
+         SocketError => e
+
+    introspection_hash[:response_code] = "#{e.class}: #{e.message}"
+
+    next
+  rescue RestClient::ExceptionWithResponse => e
+    introspection_hash[:response_code] = "#{e.class}: #{e.message}" if e.response.nil?
+
+    if e.response
+      introspection_hash[:response_code] = e.response.code
+      introspection_hash[:response_headers] = e.response.headers
+      introspection_hash[:response] = e.response.body
+    end
+
+    next
+  ensure
+    introspection_arr_of_hashes.push(introspection_hash)
+  end
+end
+puts 'complete.'
+
+timestamp = Time.now.strftime('%Y-%m-%d_%H:%M:%S')
+print 'Saving Introspection Results...'
+File.write(
+  "graphql_results-#{timestamp}-ALL.json",
+  JSON.pretty_generate(introspection_arr_of_hashes)
+)
+
+vulnerable_uris = introspection_arr_of_hashes.select do |h|
+  h if (h[:response].is_a?(Hash) && h[:response].keys.first.to_sym == :data) ||
+       (h[:response].is_a?(Integer) && h[:response_code] == 415) ||
+       (h[:response].is_a?(Integer) && h[:response_code] >= 500)
+end
+File.write(
+  "graphql_results-#{timestamp}-VULNERABLE.json",
+  JSON.pretty_generate(vulnerable_uris)
+)
+puts 'complete.'

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.4.886'
+  VERSION = '0.4.887'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.4.886
+  version: 0.4.887
 platform: ruby
 authors:
 - 0day Inc.
@@ -1167,6 +1167,7 @@ executables:
 - pwn_diff_csv_files_w_column_exclude
 - pwn_domain_reversewhois
 - pwn_fuzz_net_app_proto
+- pwn_graphql_introspection_detector
 - pwn_ibm_appscan_enterprise
 - pwn_jenkins_create_job
 - pwn_jenkins_create_view
@@ -1233,6 +1234,7 @@ files:
 - bin/pwn_diff_csv_files_w_column_exclude
 - bin/pwn_domain_reversewhois
 - bin/pwn_fuzz_net_app_proto
+- bin/pwn_graphql_introspection_detector
 - bin/pwn_ibm_appscan_enterprise
 - bin/pwn_jenkins_create_job
 - bin/pwn_jenkins_create_view