pwn 0.5.405 → 0.5.406

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4b31134e90c20f44f69f6b1fbf8b6e4c8e7911bbec857597c729c0801578d5f
-  data.tar.gz: 8774dc902ef4eadf6d32303cac8efe5fea2a909997a4d7d2c0fdb2e8c137e58a
+  metadata.gz: 3a4875ea87dd3f0605bc2ac889621fc124d43016086b2ef914a71dd8104879ff
+  data.tar.gz: 68addc891a15eea06b39b9e575fd98ce3b9e5a4d3e490c20bdfbe138699b8f2e
 SHA512:
-  metadata.gz: a583c93c1288496cb703e5b4e48a9a70f258c955b05d0dbbf9ffa27b1be25c0d1c2568537379ebe65ae63a423bf31cc022221074e3d8cdbfe100c59739d25099
-  data.tar.gz: b9b3af817aa7ccd08a05cbc6cbe1107c5760db93b6ec9343a01b74d3b7d992d6f72abe4c11ef5d156f96649268a51b3b1177daa97fff2b04d7c759c781a69884
+  metadata.gz: 6b9211d610152046dec2ddcb6c96687085ae3004d104713064831c511e7ce1aa490c5f4e69c12066bc6d11e4f81b47dd90e6b289d5df88a6a5d65abb67d24dd7
+  data.tar.gz: e43570d37f21c2a3dc4008da1b42ee0aa379f4aebe5880dd47bb1b4c881a767db74a85b4121a125fbcdb67a4fc7526e239dfb595fd2327dbc0742c67e76027c7

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.405]:001 >>> PWN.help
+pwn[v0.5.406]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.405]:001 >>> PWN.help
+pwn[v0.5.406]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.405]:001 >>> PWN.help
+pwn[v0.5.406]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/burp_suite.rb

@@ -450,7 +450,7 @@ module PWN
         raise 'ERROR: burp_obj parameter is required' unless burp_obj.is_a?(Hash)
 
         openapi_spec = opts[:openapi_spec]
-        raise 'ERROR: openapi_spec parameter not found' unless File.exist?(openapi_spec)
+        raise 'ERROR: openapi_spec parameter is required' if openapi_spec.nil?
 
         additional_http_headers = opts[:additional_http_headers] ||= {}
         raise 'ERROR: additional_http_headers must be a Hash' unless additional_http_headers.is_a?(Hash)
@@ -1013,6 +1013,31 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # repeater_id = PWN::Plugins::BurpSuite.find_sitemap_entries(
+      #   burp_obj: 'required - burp_obj returned by #start method',
+      #   search_string: 'required - string to search for in the sitemap entries'
+      # )
+
+      public_class_method def self.find_sitemap_entries(opts = {})
+        burp_obj = opts[:burp_obj]
+        raise 'ERROR: burp_obj parameter is required' unless burp_obj.is_a?(Hash)
+
+        search_string = opts[:search_string]
+        raise 'ERROR: search_string parameter is required' if search_string.nil?
+
+        rest_browser = burp_obj[:rest_browser]
+        mitm_rest_api = burp_obj[:mitm_rest_api]
+
+        json_sitemap = get_sitemap(burp_obj: burp_obj)
+        matching_entries = json_sitemap.select do |entry|
+          decoded_request = Base64.strict_decode64(entry[:request])
+          decoded_request.include?(search_string)
+        end
+      rescue StandardError => e
+        raise e
+      end
+
       # Supported Method Parameters::
       # repeater_id = PWN::Plugins::BurpSuite.add_repeater_tab(
       #   burp_obj: 'required - burp_obj returned by #start method',

data/lib/pwn/plugins/zaproxy.rb

@@ -171,147 +171,16 @@ module PWN
         raise e
       end
 
-      # Supported Method Parameters::
-      # PWN::Plugins::Zaproxy.add_to_scope(
-      #   zap_obj: 'required - zap_obj returned from #open method',
-      #   target_regex: 'required - url regex to add to scope (e.g. https://test.domain.local.*)',
-      #   context_name: 'optional - context name to add target_regex to (defaults to Default Context)'
-      # )
-
-      public_class_method def self.add_to_scope(opts = {})
-        zap_obj = opts[:zap_obj]
-        api_key = zap_obj[:api_key].to_s.scrub
-        target_regex = opts[:target_regex]
-        raise 'ERROR: target_url must be provided' if target_regex.nil?
-
-        context_name = opts[:context_name] ||= 'Default Context'
-
-        params = {
-          apikey: api_key,
-          contextName: context_name,
-          regex: target_regex
-        }
-
-        response = zap_rest_call(
-          zap_obj: zap_obj,
-          rest_call: 'JSON/context/action/includeInContext/',
-          params: params
-        )
-
-        JSON.parse(response.body, symbolize_names: true)
-      rescue StandardError, SystemExit, Interrupt => e
-        stop(zap_obj: zap_obj) unless zap_obj.nil?
-        raise e
-      end
-
-      # Supported Method Parameters::
-      # PWN::Plugins::Zaproxy.add_requester_tab(
-      #   zap_obj: 'required - zap_obj returned from #open method',
-      #   request: 'required - base64 encoded HTTP request (e.g. from #get_sitemap method)'
-      # )
-
-      public_class_method def self.add_requester_tab(opts = {})
-        zap_obj = opts[:zap_obj]
-        api_key = zap_obj[:api_key].to_s.scrub
-        request = opts[:request]
-
-        dec_request = Base64.strict_decode64(request).force_encoding('ASCII-8BIT')
-
-        # Parse the full request string
-        parts = dec_request.split("\r\n\r\n", 2)
-        headers_part = parts[0]
-        body = parts[1] || ''
-
-        header_lines = headers_part.split("\r\n")
-        first_line = header_lines.shift
-        method, full_url, http_version = first_line.split
-
-        headers = []
-        header_lines.each do |line|
-          name, value = line.split(': ', 2)
-          headers << { name: name, value: value }
-        end
-
-        # Parse URL for queryString and adjust url
-        uri = URI.parse(full_url)
-        query_string = []
-        if uri.query
-          URI.decode_www_form(uri.query).each do |name, value|
-            query_string << { name: name, value: value }
-          end
-        end
-        url = "#{uri.scheme}://#{uri.host}"
-        url += ":#{uri.port}" if uri.port && uri.port != (uri.scheme == 'https' ? 443 : 80)
-        url += uri.path
-
-        # Determine content-type
-        content_type_header = headers.find { |h| h[:name].downcase == 'content-type' }
-        mime_type = content_type_header ? content_type_header[:value] : 'application/octet-stream'
-
-        # Handle postData
-        post_data = nil
-        methods_with_body = %w[POST PUT PATCH]
-        if methods_with_body.include?(method) && !body.empty?
-          post_data = {
-            mimeType: mime_type,
-            params: [],
-            text: body
-          }
-
-          temp_body = body.dup.force_encoding('UTF-8')
-          if temp_body.valid_encoding?
-            if mime_type.include?('application/x-www-form-urlencoded')
-              URI.decode_www_form(temp_body).each do |name, value|
-                post_data[:params] << { name: name, value: value }
-              end
-            end
-          else
-            post_data[:text] = Base64.encode64(body)
-            post_data[:encoding] = 'base64'
-          end
-        end
-
-        # Construct HAR request
-        har_request = {
-          method: method,
-          url: url,
-          httpVersion: http_version,
-          cookies: [],
-          headers: headers,
-          queryString: query_string,
-          headersSize: -1,
-          bodySize: -1
-        }
-        har_request[:postData] = post_data if post_data
-
-        har_json = JSON.generate(har_request)
-
-        params = {
-          apikey: api_key,
-          request: har_json,
-          followRedirects: 'true'
-        }
-
-        response = zap_rest_call(
-          zap_obj: zap_obj,
-          rest_call: 'OTHER/core/other/sendHarRequest/',
-          params: params
-        )
-
-        JSON.parse(response.body, symbolize_names: true)
-      rescue StandardError, SystemExit, Interrupt => e
-        stop(zap_obj: zap_obj) unless zap_obj.nil?
-        raise e
-      end
-
       # Supported Method Parameters::
       # json_sitemap = PWN::Plugins::Zaproxy.get_sitemap(
-      #   zap_obj: 'required - zap_obj returned from #open method'
+      #   zap_obj: 'required - zap_obj returned from #open method',
+      #   return_as: 'optional - :base64 or :har (defaults to :base64)'
       # )
 
       public_class_method def self.get_sitemap(opts = {})
         zap_obj = opts[:zap_obj]
         api_key = zap_obj[:api_key].to_s.scrub
+        return_as = opts[:return_as] ||= :base64
 
         entries = []
         start = 0
@@ -333,6 +202,7 @@ module PWN
           entries += new_entries
           start += count
         end
+        return entries if return_as == :har
 
         # Deduplicate entries based on method + url
         seen = Set.new
@@ -390,6 +260,119 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # PWN::Plugins::Zaproxy.add_to_scope(
+      #   zap_obj: 'required - zap_obj returned from #open method',
+      #   target_regex: 'required - url regex to add to scope (e.g. https://test.domain.local.*)',
+      #   context_name: 'optional - context name to add target_regex to (defaults to Default Context)'
+      # )
+
+      public_class_method def self.add_to_scope(opts = {})
+        zap_obj = opts[:zap_obj]
+        api_key = zap_obj[:api_key].to_s.scrub
+        target_regex = opts[:target_regex]
+        raise 'ERROR: target_url must be provided' if target_regex.nil?
+
+        context_name = opts[:context_name] ||= 'Default Context'
+
+        params = {
+          apikey: api_key,
+          contextName: context_name,
+          regex: target_regex
+        }
+
+        response = zap_rest_call(
+          zap_obj: zap_obj,
+          rest_call: 'JSON/context/action/includeInContext/',
+          params: params
+        )
+
+        JSON.parse(response.body, symbolize_names: true)
+      rescue StandardError, SystemExit, Interrupt => e
+        stop(zap_obj: zap_obj) unless zap_obj.nil?
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Zaproxy.find_har_entries(
+      #   zap_obj: 'required - zap_obj returned from #open method',
+      #   request: 'required - base64 encoded request or HAR entry :request (e.g. from #get_sitemap method)'
+      # )
+
+      public_class_method def self.find_har_entries(opts = {})
+        zap_obj = opts[:zap_obj]
+        api_key = zap_obj[:api_key].to_s.scrub
+        request = opts[:request]
+        raise 'ERROR: request must be provided' if request.nil?
+
+        har_sitemap = get_sitemap(
+          zap_obj: zap_obj,
+          return_as: :har
+        )
+
+        # HAR entry
+        if request.is_a?(Hash) && request.key?(:method) && request.key?(:url) && request.key?(:httpVersion)
+          har_entries = har_sitemap.select { |entry| entry[:request] == request }
+        else
+          # Base64 encoded string
+          dec_request = Base64.strict_decode64(request).force_encoding('ASCII-8BIT') unless dec_request.is_a?(Hash)
+
+          # Find the har request for the given base64 decoded dec_request value
+          har_entries = har_sitemap.select do |entry|
+            req = entry[:request]
+            req_line = "#{req[:method]} #{req[:url]} #{req[:httpVersion]}\r\n"
+            req_headers = req[:headers].map { |h| "#{h[:name]}: #{h[:value]}\r\n" }.join
+            req_body = ''
+            if req[:postData] && req[:postData][:text]
+              req_body = req[:postData][:text]
+              req_body = Base64.decode64(req_body) if req[:postData][:encoding] == 'base64'
+            end
+            full_req = "#{req_line}#{req_headers}\r\n#{req_body}".force_encoding('ASCII-8BIT')
+            full_req == dec_request
+          end
+        end
+
+        har_entries
+      rescue StandardError, SystemExit, Interrupt => e
+        stop(zap_obj: zap_obj) unless zap_obj.nil?
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Zaproxy.requester(
+      #   zap_obj: 'required - zap_obj returned from #open method',
+      #   har_entry: 'required - har entry (e.g. from #get_sitemap method or #find_har_entries method)',
+      #   redirect: 'optional - follow redirects if set to true (defaults to false)'
+      # )
+
+      public_class_method def self.requester(opts = {})
+        zap_obj = opts[:zap_obj]
+        api_key = zap_obj[:api_key].to_s.scrub
+        har_entry = opts[:har_entry]
+        raise 'ERROR: har_entry must be provided and be a valid HAR entry' unless har_entry.is_a?(Hash) && har_entry.key?(:request) && har_entry.key?(:response)
+
+        redirect = opts[:redirect] || false
+        raise 'ERROR: redirect must be a boolean' unless redirect.is_a?(TrueClass) || redirect.is_a?(FalseClass)
+
+        har_json = har_entry.to_json
+        params = {
+          apikey: api_key,
+          request: har_json,
+          followRedirects: redirect.to_s
+        }
+
+        response = zap_rest_call(
+          zap_obj: zap_obj,
+          rest_call: 'OTHER/exim/other/sendHarRequest/',
+          params: params
+        )
+
+        JSON.parse(response.body, symbolize_names: true)
+      rescue StandardError, SystemExit, Interrupt => e
+        stop(zap_obj: zap_obj) unless zap_obj.nil?
+        raise e
+      end
+
       # Supported Method Parameters::
       # PWN::Plugins::Zaproxy.spider(
       #   zap_obj: 'required - zap_obj returned from #open method',
@@ -785,19 +768,26 @@ module PWN
             openapi_spec: 'required - path to OpenAPI JSON or YAML spec file'
           )
 
+          #{self}.get_sitemap(
+            zap_obj: 'required - zap_obj returned from #open method',
+            return_as: 'optional - :base64 or :har (defaults to :base64)'
+          )
+
           #{self}.add_to_scope(
             zap_obj: 'required - zap_obj returned from #open method',
             target_regex: 'required - url regex to add to scope (e.g. https://test.domain.local.*)',
             context_name: 'optional - context name to add target_regex to (defaults to Default Context)'
           )
 
-          #{self}.add_requester_tab(
+          #{self}.find_har_entries(
             zap_obj: 'required - zap_obj returned from #open method',
-            request: 'required - base64 encoded HTTP request (e.g. from #get_sitemap method)'
+            request: 'required - base64 encoded request or HAR entry :request (e.g. from #get_sitemap method)'
           )
 
-          #{self}.get_sitemap(
-            zap_obj: 'required - zap_obj returned from #open method'
+          #{self}.requester(
+            zap_obj: 'required - zap_obj returned from #open method',
+            har_entry: 'required - har entry (e.g. from #get_sitemap method or #find_har_entries method)',
+            redirect: 'optional - follow redirects if set to true (defaults to true)'
           )
 
           json_sitemap = #{self}.spider(

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.405'
+  VERSION = '0.5.406'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.405
+  version: 0.5.406
 platform: ruby
 authors:
 - 0day Inc.