ronin-exploits 0.3.0 → 1.0.0.beta1

data/spec/sqli_spec.rb

@@ -0,0 +1,306 @@
+require 'spec_helper'
+require 'ronin/exploits/sqli'
+
+describe Ronin::Exploits::SQLI do
+  module TestSQLI
+    class TestExploit < Ronin::Exploits::SQLI
+      base_path   '/showthread.asp'
+      query_param 'id'
+    end
+  end
+
+  let(:exploit_class) { TestSQLI::TestExploit }
+  let(:base_url)      { 'http://testasp.vulnweb.com' }
+
+  subject do
+    exploit_class.new(
+      params: {
+        base_url: base_url
+      }
+    )
+  end
+
+  describe ".exploit_type" do
+    subject { described_class }
+
+    it { expect(subject.exploit_type).to eq(:sqli) }
+  end
+
+  describe ".escape_quote" do
+    subject { exploit_class }
+
+    context "and when escape_quote is not set in the class" do
+      module TestSQLI
+        class WithNoEscapeQuoteSet < Ronin::Exploits::SQLI
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::WithNoEscapeQuoteSet }
+
+      it "must default to false" do
+        expect(subject.escape_quote).to be(false)
+      end
+    end
+
+    context "and when escape_quote is set in the class" do
+      module TestSQLI
+        class WithEscapeQuoteSet < Ronin::Exploits::SQLI
+          escape_quote true
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::WithEscapeQuoteSet }
+
+      it "must return the set escape_quote" do
+        expect(subject.escape_quote).to eq(true)
+      end
+    end
+
+    context "but when the escape_quote was set in the superclass" do
+      module TestSQLI
+        class InheritsItsEscapeQuote < WithEscapeQuoteSet
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::InheritsItsEscapeQuote }
+
+      it "must return the escape_quote set in the superclass" do
+        expect(subject.escape_quote).to eq(true)
+      end
+
+      context "but the escape_quote is overridden in the sub-class" do
+        module TestSQLI
+          class OverridesItsInheritedEscapeQuote < WithEscapeQuoteSet
+            escape_quote false
+          end
+        end
+
+        let(:exploit_class) do
+          TestSQLI::OverridesItsInheritedEscapeQuote
+        end
+
+        it "must return the escape_quote set in the sub-class" do
+          expect(subject.escape_quote).to eq(false)
+        end
+      end
+    end
+  end
+
+  describe ".escape_parens" do
+    subject { exploit_class }
+
+    context "and when escape_parens is not set in the class" do
+      module TestSQLI
+        class WithNoEscapeParensSet < Ronin::Exploits::SQLI
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::WithNoEscapeParensSet }
+
+      it "must default to false" do
+        expect(subject.escape_parens).to be(false)
+      end
+    end
+
+    context "and when escape_parens is set in the class" do
+      module TestSQLI
+        class WithEscapeParensSet < Ronin::Exploits::SQLI
+          escape_parens true
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::WithEscapeParensSet }
+
+      it "must return the set escape_parens" do
+        expect(subject.escape_parens).to eq(true)
+      end
+    end
+
+    context "but when the escape_parens was set in the superclass" do
+      module TestSQLI
+        class InheritsItsEscapeParens < WithEscapeParensSet
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::InheritsItsEscapeParens }
+
+      it "must return the escape_parens set in the superclass" do
+        expect(subject.escape_parens).to eq(true)
+      end
+
+      context "but the escape_parens is overridden in the sub-class" do
+        module TestSQLI
+          class OverridesItsInheritedEscapeParens < WithEscapeParensSet
+            escape_parens false
+          end
+        end
+
+        let(:exploit_class) do
+          TestSQLI::OverridesItsInheritedEscapeParens
+        end
+
+        it "must return the escape_parens set in the sub-class" do
+          expect(subject.escape_parens).to eq(false)
+        end
+      end
+    end
+  end
+
+  describe ".terminate" do
+    subject { exploit_class }
+
+    context "and when terminate is not set in the class" do
+      module TestSQLI
+        class WithNoTerminateSet < Ronin::Exploits::SQLI
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::WithNoTerminateSet }
+
+      it "must default to false" do
+        expect(subject.terminate).to be(false)
+      end
+    end
+
+    context "and when terminate is set in the class" do
+      module TestSQLI
+        class WithTerminateSet < Ronin::Exploits::SQLI
+          terminate true
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::WithTerminateSet }
+
+      it "must return the set terminate" do
+        expect(subject.terminate).to eq(true)
+      end
+    end
+
+    context "but when the terminate was set in the superclass" do
+      module TestSQLI
+        class InheritsItsTerminate < WithTerminateSet
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::InheritsItsTerminate }
+
+      it "must return the terminate set in the superclass" do
+        expect(subject.terminate).to eq(true)
+      end
+
+      context "but the terminate is overridden in the sub-class" do
+        module TestSQLI
+          class OverridesItsInheritedTerminate < WithTerminateSet
+            terminate false
+          end
+        end
+
+        let(:exploit_class) do
+          TestSQLI::OverridesItsInheritedTerminate
+        end
+
+        it "must return the terminate set in the sub-class" do
+          expect(subject.terminate).to eq(false)
+        end
+      end
+    end
+  end
+
+  describe "#vuln" do
+    it "must return a Ronin::Vulns::SQLI object" do
+      expect(subject.vuln).to be_kind_of(Ronin::Vulns::SQLI)
+    end
+
+    it "must set the #url attribute of the SQLI vuln object" do
+      expect(subject.vuln.url).to eq(subject.url)
+    end
+
+    it "must default the #escape_quote attribute of the SQLI vuln object to false" do
+      expect(subject.vuln.escape_quote).to be(false)
+    end
+
+    context "when the exploit class sets escape_quote" do
+      module TestSQLI
+        class TestExploitWithEscapeQuote < Ronin::Exploits::SQLI
+          base_path    '/showthread.asp'
+          query_param  'id'
+          escape_quote true
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::TestExploitWithEscapeQuote }
+
+      it "must set the #escape_quote attribute of the SQLI vuln object to the exploit class'es escape_quote" do
+        expect(subject.vuln.escape_quote).to eq(exploit_class.escape_quote)
+      end
+    end
+
+    it "must default the #escape_parens attribute of the SQLI vuln object to false" do
+      expect(subject.vuln.escape_parens).to be(false)
+    end
+
+    context "when the exploit class sets escape_parens" do
+      module TestSQLI
+        class TestExploitWithEscapeParens < Ronin::Exploits::SQLI
+          base_path    '/showthread.asp'
+          query_param  'id'
+          escape_parens true
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::TestExploitWithEscapeParens }
+
+      it "must set the #escape_parens attribute of the SQLI vuln object to the exploit class'es escape_parens" do
+        expect(subject.vuln.escape_parens).to eq(exploit_class.escape_parens)
+      end
+    end
+
+    it "must default the #terminate attribute of the SQLI vuln object to false" do
+      expect(subject.vuln.terminate).to be(false)
+    end
+
+    context "when the exploit class sets terminate" do
+      module TestSQLI
+        class TestExploitWithTerminate < Ronin::Exploits::SQLI
+          base_path    '/showthread.asp'
+          query_param  'id'
+          terminate    true
+        end
+      end
+
+      let(:exploit_class) { TestSQLI::TestExploitWithTerminate }
+
+      it "must set the #terminate attribute of the SQLI vuln object to the exploit class'es terminate" do
+        expect(subject.vuln.terminate).to eq(exploit_class.terminate)
+      end
+    end
+  end
+
+  describe "#launch" do
+    module TestSQLI
+      class SQLPayload < Ronin::Payloads::SQLPayload
+        def build
+          @payload = 'SQL PAYLOAD HERE();'
+        end
+      end
+    end
+
+    let(:payload_class) { TestSQLI::SQLPayload }
+    let(:payload)       { payload_class.new   }
+
+    subject do
+      exploit_class.new(
+        payload: payload,
+        params: {
+          base_url: base_url
+        }
+      )
+    end
+
+    it "must call #exploit on the #vuln object with the #payload" do
+      expect(subject.vuln).to receive(:exploit).with(payload)
+
+      subject.launch
+    end
+  end
+end

data/spec/ssti_spec.rb

@@ -0,0 +1,121 @@
+require 'spec_helper'
+require 'ronin/exploits/ssti'
+
+describe Ronin::Exploits::SSTI do
+  module TestSSTI
+    class TestExploit < Ronin::Exploits::SSTI
+      base_path   '/Templatize.asp'
+      query_param 'item'
+    end
+
+    class TestExploitWithEscapeExpr < Ronin::Exploits::SSTI
+      base_path   '/Templatize.asp'
+      query_param 'item'
+      escape_expr ->(expr) { "${{#{expr}}}" }
+    end
+  end
+
+  let(:exploit_class) { TestSSTI::TestExploit }
+  let(:base_url)      { 'http://testasp.vulnweb.com/' }
+  let(:query)         { 'item=html/about.html' }
+  let(:query_param)   { 'item' }
+
+  subject do
+    exploit_class.new(
+      params: {
+        base_url: base_url
+      }
+    )
+  end
+
+  describe ".escape_expr" do
+    subject { exploit_class }
+
+    context "and when escape_expr is not set in the class" do
+      module TestSSTI
+        class WithNoEscapeExprSet < Ronin::Exploits::SSTI
+        end
+      end
+
+      let(:exploit_class) { TestSSTI::WithNoEscapeExprSet }
+
+      it "must default to nil" do
+        expect(subject.escape_expr).to be(nil)
+      end
+    end
+
+    context "and when escape_expr is set in the class" do
+      module TestSSTI
+        class WithEscapeExprSet < Ronin::Exploits::SSTI
+          escape_expr ->(expr) { "{{#{expr}}}" }
+        end
+      end
+
+      let(:exploit_class) { TestSSTI::WithEscapeExprSet }
+
+      it "must return the set escape_expr" do
+        expect(subject.escape_expr).to be_kind_of(Proc)
+        expect(subject.escape_expr.call('test')).to eq('{{test}}')
+      end
+    end
+
+    context "but when the escape_expr was set in the superclass" do
+      module TestSSTI
+        class InheritsItsEscapeExpr < WithEscapeExprSet
+        end
+      end
+
+      let(:exploit_class) { TestSSTI::InheritsItsEscapeExpr }
+
+      it "must return the escape_expr set in the superclass" do
+        expect(subject.escape_expr).to be_kind_of(Proc)
+        expect(subject.escape_expr.call('test')).to eq('{{test}}')
+      end
+
+      context "but the escape_expr is overridden in the sub-class" do
+        module TestSSTI
+          class OverridesItsInheritedEscapeExpr < WithEscapeExprSet
+            escape_expr ->(expr) { "${#{expr}}" }
+          end
+        end
+
+        let(:exploit_class) do
+          TestSSTI::OverridesItsInheritedEscapeExpr
+        end
+
+        it "must return the escape_expr set in the sub-class" do
+          expect(subject.escape_expr).to be_kind_of(Proc)
+          expect(subject.escape_expr.call('test')).to eq('${test}')
+        end
+      end
+    end
+  end
+
+  describe ".exploit_type" do
+    subject { described_class }
+
+    it { expect(subject.exploit_type).to eq(:ssti) }
+  end
+
+  describe "#vuln" do
+    it "must return a Ronin::Vulns::SSTI object" do
+      expect(subject.vuln).to be_kind_of(Ronin::Vulns::SSTI)
+    end
+
+    it "must set the #url attribute of the SSTI vuln object" do
+      expect(subject.vuln.url).to eq(subject.url)
+    end
+
+    it "must defalt the #escape attribute of the SSTI vuln object to nil" do
+      expect(subject.vuln.escape).to be(nil)
+    end
+
+    context "when the exploit's escape_expr has been set" do
+      let(:exploit_class) { TestSSTI::TestExploitWithEscapeExpr }
+
+      it "must set the #escape attribute of the SSTI vuln object" do
+        expect(subject.vuln.escape).to be(exploit_class.escape_expr)
+      end
+    end
+  end
+end

data/spec/stack_overflow_spec.rb

@@ -0,0 +1,18 @@
+require 'spec_helper'
+require 'ronin/exploits/stack_overflow'
+
+describe Ronin::Exploits::StackOverflow do
+  it "must inherit from Ronin::Exploits::MemoryCorruption" do
+    expect(described_class).to be < Ronin::Exploits::MemoryCorruption
+  end
+
+  it "must include Ronin::Exploits::Mixins::StackOverflow" do
+    expect(described_class).to include(Ronin::Exploits::Mixins::StackOverflow)
+  end
+
+  describe ".exploit_type" do
+    subject { described_class }
+
+    it { expect(subject.exploit_type).to eq(:stack_overflow) }
+  end
+end

data/spec/target_spec.rb

@@ -0,0 +1,92 @@
+require 'spec_helper'
+require 'ronin/exploits/target'
+
+describe Ronin::Exploits::Target do
+  it "must inherit from OpenStruct" do
+    expect(described_class).to be < OpenStruct
+  end
+
+  describe "#initialize" do
+    it "must default #arch to nil" do
+      expect(subject.arch).to be(nil)
+    end
+
+    it "must default #os to nil" do
+      expect(subject.os).to be(nil)
+    end
+
+    it "must default #os_version to nil" do
+      expect(subject.os_version).to be(nil)
+    end
+
+    it "must default #software to nil" do
+      expect(subject.software).to be(nil)
+    end
+
+    it "must default #versiong to nil" do
+      expect(subject.versiong).to be(nil)
+    end
+
+    context "when given the arch: keyword argument" do
+      let(:arch) { :x86_64 }
+
+      subject { described_class.new(arch: arch) }
+
+      it "must set #arch" do
+        expect(subject.arch).to be(arch)
+      end
+    end
+
+    context "when given the os: keyword argument" do
+      let(:os) { :linux }
+
+      subject { described_class.new(os: os) }
+
+      it "must set #os" do
+        expect(subject.os).to be(os)
+      end
+    end
+
+    context "when given the os_version: keyword argument" do
+      let(:os_version) { '5.17.0' }
+
+      subject { described_class.new(os_version: os_version) }
+
+      it "must set #os_version" do
+        expect(subject.os_version).to be(os_version)
+      end
+    end
+
+    context "when given the software: keyword argument" do
+      let(:software) { 'Apache' }
+
+      subject { described_class.new(software: software) }
+
+      it "must set #software" do
+        expect(subject.software).to be(software)
+      end
+    end
+
+    context "when given the versiong: keyword argument" do
+      let(:versiong) { '1.2.3' }
+
+      subject { described_class.new(versiong: versiong) }
+
+      it "must set #versiong" do
+        expect(subject.versiong).to be(versiong)
+      end
+    end
+
+    context "when given additional keyword arguments" do
+      let(:foo) { 42     }
+      let(:bar) { 'data' }
+
+      subject { described_class.new(foo: foo, bar: bar) }
+
+      it "must populate the OpenStruct with them" do
+        expect(subject.foo).to be(foo)
+        expect(subject.bar).to be(bar)
+      end
+    end
+  end
+end

data/spec/test_result_spec.rb

@@ -0,0 +1,32 @@
+require 'spec_helper'
+require 'ronin/exploits/test_result'
+
+describe Ronin::Exploits::TestResult do
+  let(:message) { 'example message' }
+
+  subject { described_class.new(message) }
+
+  describe "#initialize" do
+    it "must set #message" do
+      expect(subject.message).to eq(message)
+    end
+  end
+
+  describe "#to_s" do
+    it "must return #message" do
+      expect(subject.to_s).to eq(subject.message)
+    end
+  end
+
+  it "must define a Vulnerable sub-class" do
+    expect(described_class::Vulnerable).to be < described_class
+  end
+
+  it "must define a NotVulnerable sub-class" do
+    expect(described_class::NotVulnerable).to be < described_class
+  end
+
+  it "must define a Unknown sub-class" do
+    expect(described_class::Unknown).to be < described_class
+  end
+end

data/spec/use_after_free_spec.rb

@@ -0,0 +1,14 @@
+require 'spec_helper'
+require 'ronin/exploits/use_after_free'
+
+describe Ronin::Exploits::UseAfterFree do
+  it "must inherit from Ronin::Exploits::MemoryCorruption" do
+    expect(described_class).to be < Ronin::Exploits::MemoryCorruption
+  end
+
+  describe ".exploit_type" do
+    subject { described_class }
+
+    it { expect(subject.exploit_type).to eq(:use_after_free) }
+  end
+end

data/spec/web_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+require 'ronin/exploits/web'
+
+describe Ronin::Exploits::Web do
+  it "must inherit from Ronin::Exploits::Exploit" do
+    expect(described_class).to be < Ronin::Exploits::Exploit
+  end
+
+  it "must include Ronin::Exploits::Mixin::HTTP" do
+    expect(described_class).to include(Ronin::Exploits::Mixins::HTTP)
+  end
+end