pwn 0.5.545 → 0.5.546

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 717d110605939553b86667e954a7b91318e7e838493501df5313061024864a90
-  data.tar.gz: 199ab9d59ebce1331ca2bb31fd32dc0914eb7ff230a7c13e62d896d75730a569
+  metadata.gz: 34ca1351b29912cd044d8e4292edf889671ff7d85c3a9182a490d01d76b2f090
+  data.tar.gz: 2c3b2a78840db9a71157bfb3b12989f265c704c5974b7743351981e5a4d51dad
 SHA512:
-  metadata.gz: d2e6523acc202365dc8fbb2de66872c7abe1e024cdb6b58ede8acdf3357d9e3b745dfc46611a574527c01b528b6550fa7ddb84fbe16589bd0ba53c51114b623e
-  data.tar.gz: dee031cfc85494743679645d87ec37c34ca9c1b24f5c3f0d83b22dcd9e5d38f1a5c06e56cedee122225e9dee11ab7a33aa70c776ddf116908a9d0b76da8edd40
+  metadata.gz: a7d5fb3fa68334caa81ba313e923e6f3acdade24ad4261d30a02bab95b753d8def34ebb4624b6243181d7aa3e7a1140f6ec7d619ef7a4506f56f03cddedad630
+  data.tar.gz: fb111ab08c77c8b1c60a62d834b8df6275a825542163361a9f9b04acbaab817426075d24913bc2cde8828bd41266af20ee598973ab69e75a71cd4d5ecf7f0efa

data/Gemfile

@@ -74,7 +74,6 @@ gem 'pry-doc', '1.7.0'
 gem 'rake', '13.3.1'
 gem 'rb-readline', '0.5.5'
 gem 'rbvmomi2', '3.8.0'
-# gem 'rdoc', '7.2.0'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
 gem 'rmagick', '6.2.0'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.545]:001 >>> PWN.help
+pwn[v0.5.546]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-4.0.1@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.545]:001 >>> PWN.help
+pwn[v0.5.546]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-4.0.1@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.545]:001 >>> PWN.help
+pwn[v0.5.546]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/Rakefile

@@ -2,7 +2,7 @@
 
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
-require 'rdoc/task'
+require 'rdoc'
 require 'rubocop/rake_task'
 
 RSpec::Core::RakeTask.new(:spec)

data/lib/pwn/ai/agent/vuln_gen.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module PWN
+  module AI
+    module Agent
+      # This module is an AI agent designed to analyze generic vulnerability descriptions and generate detailed security findings, including business impact, remediation recommendations, CVSS scoring, CWE categorization, and relevant NIST 800-53 controls. It leverages the PWN::AI::Introspection.reflect_on method to process the input request and produce comprehensive markdown-formatted findings.
+      module VulnGen
+        # Supported Method Parameters::
+        # ai_analysis = PWN::AI::Agent::VulnGen.analyze(
+        #   request: 'required - high level description of vulnerability discovered (e.g. "Discovered a SQLi vulnerability in /login"'
+        # )
+
+        public_class_method def self.analyze(opts = {})
+          request = opts[:request]
+          raise 'ERROR: request parameter is required' if request.nil? || request.empty?
+
+          system_role_content = '
+          _ALWAYS_ Generate markdown security findings for the message provided with the following content:
+
+          1. Detailed Finding Description: This should be a deep, detailed technical description that should include exploit proof-of-concepts when possible.
+
+          2. Business Impact: This should describe, in business terms, the importance of fixing the issue.  Reputational and/or financial impact should be considered for this section.
+
+          3. Remediation Recommendations:  Targeted towards technical engineers that can ascertain a reasonable approach to fix the vulnerability based upon common security remediation patterns.  Be sure to consider compensating controls / stop gaps that can be implemented (e.g. WAF, additional logging, etc.) until such time the vulnerability can be fixed.  Provide examples in cases where code fixes may be required.
+
+          4. CVSS Score (Severity), Base CVSS Vector string as /AV:`N|L|A|P`/AC:`L|H`/PR:`N|L|H`/UI:`N|R`/S:`U|C`/C:`N|L|H`/I:`N|L|H`/A:`N|L|H`, and first.org CVSS calculator URI as https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:`N|L|A|P`/AC:`L|H`/PR:`N|L|H`/UI:`N|R`/S:`U|C`/C:`N|L|H`/I:`N|L|H`/A:`N|L|H`.  The Vector string must be formatted like: `/AV:%s/AC:%s/PR:%s/UI:%s/S:%s/C:%s/I:%s/A:%s`.  Ensure the score and severity aligns with the vector string calculation.
+
+          5. CWE Category, Brief CWE description, and CWE URI
+
+          6. NIST 800-53 Security Control that is impacted by this vulnerability.
+          '
+
+          PWN::AI::Introspection.reflect_on(
+            system_role_content: system_role_content,
+            request: request,
+            suppress_pii_warning: true
+          )
+        rescue StandardError => e
+          raise e.backtrace
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):
+            0day Inc. <support@0dayinc.com>
+          "
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.545'
+  VERSION = '0.5.546'
 end

data/spec/lib/pwn/ai/agent/vuln_gen_spec.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::AI::Agent::VulnGen do
+  it 'analyze method should exist' do
+    analyze_response = PWN::AI::Agent::VulnGen
+    expect(analyze_response).to respond_to :analyze
+  end
+
+  it 'should display information for authors' do
+    authors_response = PWN::AI::Agent::VulnGen
+    expect(authors_response).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    help_response = PWN::AI::Agent::VulnGen
+    expect(help_response).to respond_to :help
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.545
+  version: 0.5.546
 platform: ruby
 authors:
 - 0day Inc.
@@ -1766,6 +1766,7 @@ files:
 - lib/pwn/ai/agent/hacker_one.rb
 - lib/pwn/ai/agent/sast.rb
 - lib/pwn/ai/agent/transparent_browser.rb
+- lib/pwn/ai/agent/vuln_gen.rb
 - lib/pwn/ai/grok.rb
 - lib/pwn/ai/introspection.rb
 - lib/pwn/ai/ollama.rb
@@ -2133,6 +2134,7 @@ files:
 - spec/lib/pwn/ai/agent/hacker_one_spec.rb
 - spec/lib/pwn/ai/agent/sast_spec.rb
 - spec/lib/pwn/ai/agent/transparent_browser_spec.rb
+- spec/lib/pwn/ai/agent/vuln_gen_spec.rb
 - spec/lib/pwn/ai/agent_spec.rb
 - spec/lib/pwn/ai/grok_spec.rb
 - spec/lib/pwn/ai/introspection_spec.rb