ronin-app 0.1.0.rc1

data/ChangeLog.md

@@ -0,0 +1,38 @@
+### 0.1.0 / 2024-XX-XX
+
+* Initial release:
+  * Provides a web interface to explore and search the
+    [ronin database][ronin-db].
+  * Allows managing [ronin-repos] from the web interface.
+  * Allows listing and building the built-in or installed 3rd-party
+    [payloads][ronin-payloads].
+  * Allows listing installed 3rd-party [exploits][ronin-exploits].
+  * Supports automating [nmap] and [masscan] scans and importing their results
+    into the [ronin database][ronin-db].
+  * Supports automating [spidering websites][ronin-web-spider] and importing all
+    visited URLs into the [ronin database][ronin-db].
+  * Supports performing recon using [ronin-recon] and importing all discovered
+    hostnames, IPs, and URLs into [ronin database][ronin-db].
+  * Supports testing URLs for web vulnerabilities using [ronin-vulns].
+
+[sqlite]: https://sqlite.org/
+[redis]: https://redis.io/
+[nmap]: https://nmap.org/
+[masscan]: https://github.com/robertdavidgraham/masscan#readme
+
+[Ruby]: https://www.ruby-lang.org/
+[dry-types]: https://dry-rb.org/gems/dry-types/
+[dry-schema]: https://dry-rb.org/gems/dry-schema/
+[dry-validation]: https://dry-rb.org/gems/dry-validation/
+
+[ronin-support]: https://github.com/ronin-rb/ronin-support#readme
+[ronin-repos]: https://github.com/ronin-rb/ronin-repos#readme
+[ronin-db]: https://github.com/ronin-rb/ronin-db#readme
+[ronin-payloads]: https://github.com/ronin-rb/ronin-payloads#readme
+[ronin-vulns]: https://github.com/ronin-rb/ronin-vulns#readme
+[ronin-exploits]: https://github.com/ronin-rb/ronin-exploits#readme
+[ronin-nmap]: https://github.com/ronin-rb/ronin-nmap#readme
+[ronin-masscan]: https://github.com/ronin-rb/ronin-masscan#readme
+[ronin-web-spider]: https://github.com/ronin-rb/ronin-web-spider#readme
+[ronin-recon]: https://github.com/ronin-rb/ronin-recon#readme
+[ronin-vulns]: https://github.com/ronin-rb/ronin-vulns#readme

data/Dockerfile

@@ -0,0 +1,27 @@
+FROM ruby:3.1.0
+
+ARG RONIN_UID=1000
+ARG RONIN_GID=1000
+
+ENV LANG=en_US.UTF-8
+
+WORKDIR /app
+ADD Gemfile /app
+ADD gemspec.yml /app
+ADD lib/ronin/app/version.rb /app/lib/ronin/app/
+ADD ronin-app.gemspec /app
+
+ARG NMAP_CAPS=cap_net_raw,cap_net_admin,cap_net_bind_service
+ARG MASSCAN_CAPS=cap_net_raw,cap_net_admin,cap_net_bind_service
+
+RUN apt-get update &&\
+    apt-get install -qq -y libcap2-bin gcc g++ make libsqlite3-dev nmap masscan && \
+    setcap "${NMAP_CAPS}+eip" /usr/bin/nmap && \
+    setcap "${MASSCAN_CAPS}+eip" /usr/bin/masscan && \
+    bundle install --path /app/vendor/bundler
+
+ADD . /app
+
+RUN groupadd -g "${RONIN_GID}" ronin && \
+    useradd -u "${RONIN_UID}" -g ronin -ms /bin/bash ronin
+USER ronin

data/Gemfile

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+source 'https://rubygems.org'
+
+gemspec
+
+# gem 'ruby-masscan', '~> 0.3', github: 'postmodern/ruby-masscan',
+#                               branch: 'main'
+
+# NOTE: do not auto-load gems which are meant to be executed at runtime
+gem 'puma',    require: false
+gem 'sidekiq', require: false
+
+#
+# Ronin dependencies
+#
+# gem 'ronin-support',    '~> 1.1', github: 'ronin-rb/ronin-support',
+#                                   branch: 'main'
+# gem 'ronin-core',       '~> 0.2', github: 'ronin-rb/ronin-core',
+#                                   branch: 'main'
+# gem 'ronin-db',         '~> 0.2', github: 'ronin-rb/ronin-db',
+#                                   branch: 'main'
+
+# gem 'ronin-db-activerecord', '~> 0.2', github: 'ronin-rb/ronin-db-activerecord',
+#                                        branch: 'main'
+
+# gem 'ronin-payloads',   '~> 0.2', github: 'ronin-rb/ronin-payloads'
+# gem 'ronin-exploits',   '~> 1.1', github: 'ronin-rb/ronin-exploits',
+#                                   branch: 'main'
+# gem 'ronin-vulns',      '~> 0.2', github: 'ronin-rb/ronin-vulns',
+#                                   branch: 'main'
+# gem 'ronin-web-spider', '~> 0.2', github: 'ronin-rb/ronin-web-spider',
+#                                   branch: 'main'
+# gem 'ronin-recon',      '~> 0.1', github: 'ronin-rb/ronin-recon'
+# gem 'ronin-nmap',       '~> 0.1', github: 'ronin-rb/ronin-nmap'
+# gem 'ronin-masscan',    '~> 0.1', github: 'ronin-rb/ronin-masscan'
+# gem 'ronin-repos',      '~> 0.2', github: 'ronin-rb/ronin-repos',
+#                                   branch: 'main'
+
+group :development do
+  gem 'rake', require: false
+
+  gem 'rubygems-tasks',   '~> 0.2'
+
+  gem 'rspec',            '~> 3.0', require: false
+  gem 'simplecov',        '~> 0.20', require: false
+
+  gem 'kramdown',         '~> 2.0', require: false
+  gem 'kramdown-man',     '~> 1.0', require: false
+
+  gem 'redcarpet',        require: false, platform: :mri
+  gem 'yard',             '~> 0.9', require: false
+  gem 'yard-spellcheck',  require: false
+
+  gem 'dead_end',         require: false
+  gem 'sord',             require: false, platform: :mri
+  gem 'stackprof',        require: false, platform: :mri
+  gem 'rubocop',          require: false, platform: :mri
+  gem 'rubocop-ronin',    require: false, platform: :mri
+
+  gem 'foreman',          '~> 0.80', require: false
+end

data/Procfile

@@ -0,0 +1,2 @@
+web: bundle exec puma -C ./config/puma.rb -e production
+sidekiq: bundle exec sidekiq -C ./config/sidekiq.yml -r ./config/sidekiq.rb -r ./workers.rb -e production

data/Procfile.dev

@@ -0,0 +1,2 @@
+web: bundle exec puma -C ./config/puma.rb -e development
+sidekiq: bundle exec sidekiq -C ./config/sidekiq.yml -r ./config/sidekiq.rb -r ./workers.rb -e development

data/README.md

@@ -0,0 +1,215 @@
+# ronin-app
+
+* [Website](https://ronin-rb.dev)
+* [Issues](https://github.com/ronin-rb/docker/issues)
+* [DockerHub](https://hub.docker.com/r/roninrb/ronin)
+* [Discord](https://discord.gg/6WAb3PsVX9) |
+  [Mastodon](https://infosec.exchange/@ronin_rb)
+
+ronin-app is a small web application that is meant to be ran locally by the
+user. It provides a web interface to [ronin-support], [ronin-repos], [ronin-db],
+[ronin-payloads], [ronin-exploits], as well as automating
+[ronin-nmap], [ronin-masscan], [ronin-web-spider], [ronin-recon], and
+[ronin-vulns].
+
+## Features
+
+* Provides a web interface to explore and search the [ronin database][ronin-db].
+* Allows managing [ronin-repos] from the web interface.
+* Allows listing and building the built-in or installed 3rd-party
+  [payloads][ronin-payloads].
+* Allows listing installed 3rd-party [exploits][ronin-exploits].
+* Supports automating [nmap] and [masscan] scans and importing their results
+  into the [ronin database][ronin-db].
+* Supports automating [spidering websites][ronin-web-spider] and importing all
+  visited URLs into the [ronin database][ronin-db].
+* Supports performing recon using [ronin-recon] and importing all discovered
+  hostnames, IPs, and URLs into [ronin database][ronin-db].
+* Supports testing URLs for web vulnerabilities using [ronin-vulns].
+* Small memory footprint (~184K).
+* Fast (~1.251ms response time).
+
+## Screenshots
+
+<table>
+  <tbody>
+    <tr>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_scanning_nmap.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_scanning_masscan.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_scanning_recon.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_scanning_spider.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_scanning_vulns.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_db.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_db_ip_address.svg" />
+      </td>
+    </tr>
+    <tr>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_repos.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_repos_show.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_payloads.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_payloads_show.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_payloads_build.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_exploits.svg" />
+      </td>
+      <td>
+        <img src="https://raw.githubusercontent.com/ronin-rb/ronin-app/add_screenshots/screenshots/ronin_app_exploits_show.svg" />
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+## Synopsis
+
+```
+Usage: ronin-app [options]
+
+Options:
+    -V, --version                    Prints the version and exits
+    -H, --host IP                    The host to listen on (Default: localhost)
+    -p, --port PORT                  The port to listen on (Default: 1337)
+        --db NAME                    The ronin-db database to connect to
+        --db-uri URI                 The ronin-db database URI to connect to
+    -h, --help                       Print help information
+
+Starts the ronin web app
+```
+
+```shell
+$ ronin-app
+```
+
+**Note:** the `ronin-app` command will automatically open a browser for
+http://localhost:1337, if ran in a real terminal.
+
+## Requirements
+
+* [libsqlite3][sqlite]
+* [redis-server][redis] >= 6.2
+* [nmap]
+* [masscan]
+* [Ruby] >= 3.1.0
+
+**Note:** both `nmap` and `masscan` require additional Linux capabilities in
+order to be ran without `sudo` or `root` privileges.
+
+```shell
+sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip "$(which nmap)"
+sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip "$(which masscan)"
+```
+
+## Security
+
+* This app is intended to be ran locally.
+* All HTML output is escaped with `Rack::Utils.escape_html`.
+* All HTTP params are validated using [dry-validation].
+
+## Development
+
+1. [Fork It!](https://github.com/ronin-rb/ronin/fork)
+2. Clone It!
+3. `cd ronin-app`
+4. `./scripts/setup`
+5. `git checkout -b my_feature`
+6. Code It!
+7. Test It - `bundle exec rake spec`
+8. Try It - `./scripts/server` then visit http://localhost:1337/
+9. Push It - `git push origin my_feature`
+
+### docker-compose
+
+You can also use [docker-compose] to build and run the app:
+
+[docker-compose]: https://docs.docker.com/compose/install/
+
+```shell
+$ docker-compose build
+$ docker-compose up
+```
+
+### Directory Structure
+
+* `Gemfile` - defines all gem dependencies.
+* `Procfile` - defines the various services of the app that will be started.
+* `Procfile.dev` - defines the various services of the app that will be started
+  in development mode.
+* `config.ru` - The main entry point for `rackup`/`puma`.
+* `config/` - Contains all app configuration files.
+* `lib/ronin/app/helpers/` - Contains all Sinatra helper modules which define methods that
+* `app.rb` - The main Rack app that contains HTTP routes.
+* `app/` - Contains sub-App classes that contains grouped HTTP routes
+* `workers.rb` - The main entry point for Sidekiq which loads all worker classes
+  from `lib/workers/`.
+* `workers/` - Contains all Sidekiq worker classes.
+  can be called within the views.
+* `lib/ronin/app/types.rb` - Defines custom [dry-types].
+* `lib/ronin/app/types/` - Contains additional custom types.
+* `lib/ronin/app/validations/` - Contains [dry-validation]s logic for validating
+  submitted HTTP params.
+* `views/` - Contains all ERB views that are rendered by `app.rb`.
+* `views/layout.erb` - The main page layout view.
+* `public/` - Contains all static assets (images, CSS stylesheets, and
+  JavaScript).
+* `scripts/` - Contains scripts for setting up or starting the app.
+
+## License
+
+Copyright (C) 2023-2024 Hal Brodigan (postmodern.mod3@gmail.com)
+
+ronin-app is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+ronin-app is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with ronin-app.  If not, see <http://www.gnu.org/licenses/>.
+
+[sqlite]: https://sqlite.org/
+[redis]: https://redis.io/
+[nmap]: https://nmap.org/
+[masscan]: https://github.com/robertdavidgraham/masscan#readme
+
+[Ruby]: https://www.ruby-lang.org/
+[dry-types]: https://dry-rb.org/gems/dry-types/
+[dry-schema]: https://dry-rb.org/gems/dry-schema/
+[dry-validation]: https://dry-rb.org/gems/dry-validation/
+
+[ronin-support]: https://github.com/ronin-rb/ronin-support#readme
+[ronin-repos]: https://github.com/ronin-rb/ronin-repos#readme
+[ronin-db]: https://github.com/ronin-rb/ronin-db#readme
+[ronin-payloads]: https://github.com/ronin-rb/ronin-payloads#readme
+[ronin-vulns]: https://github.com/ronin-rb/ronin-vulns#readme
+[ronin-exploits]: https://github.com/ronin-rb/ronin-exploits#readme
+[ronin-nmap]: https://github.com/ronin-rb/ronin-nmap#readme
+[ronin-masscan]: https://github.com/ronin-rb/ronin-masscan#readme
+[ronin-web-spider]: https://github.com/ronin-rb/ronin-web-spider#readme
+[ronin-recon]: https://github.com/ronin-rb/ronin-recon#readme
+[ronin-vulns]: https://github.com/ronin-rb/ronin-vulns#readme

data/Rakefile

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+begin
+  require 'bundler'
+rescue LoadError => e
+  warn e.message
+  warn "Run `gem install bundler` to install Bundler"
+  exit(-1)
+end
+
+begin
+  Bundler.setup(:development)
+rescue Bundler::BundlerError => e
+  warn e.message
+  warn "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+
+require 'rake'
+
+require 'rubygems/tasks'
+Gem::Tasks.new(sign: {checksum: true, pgp: true})
+
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new
+task :test    => :spec
+task :default => :spec
+
+require 'yard'
+YARD::Rake::YardocTask.new
+task :docs => :yard
+
+require 'kramdown/man/task'
+Kramdown::Man::Task.new
+
+require 'ronin/db/tasks'
+Ronin::DB::Tasks.new(
+  database: {
+    adapter:  :sqlite3,
+    database: 'db/dev.sqlite3'
+  }
+)
+
+task :setup => %w[man db:migrate]