ronin-vulns 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b883fd15ba88606984046997827e571053dc77cc7309cb228746435706789fe
-  data.tar.gz: 1090624e7a3dbb9d1b212052a1f300f454620cdb5508f4605e3124b8432698b1
+  metadata.gz: b260c485d9272af5724bed43fc2959995463f8b78e276bf669d1bb98740e917c
+  data.tar.gz: de99077b9d9fe73bd167309af9c7c6d7688bd03a02d2af9bd2fc8eae133aa43a
 SHA512:
-  metadata.gz: ba3fecaec4b2dcba4043c8cd95d67b0443011c04f0f83296d86f2cbef4b364d30359093ebee289076a1cbf8e55b77e3a03ca9bcd8b6aea6a972390571ff14910
-  data.tar.gz: ffb84a729dbab47c6df0bde5f4a7df8f9c0e345de58bb9ddc36d6c6420c87b77f615b0b1d1d7caa5f8edfc456bcca909b3dbf28d32dab2ddde83bd3ec066adec
+  metadata.gz: 1f4ce00d82035a11ade026eb6deee9be1244b499d692e47d4961be3cfc2a2dd9d8c609b6c11c5fab72e454f5ccc60adf9dd6ab7e4ceced5b0df9ea27fc18ec27
+  data.tar.gz: fb41c677b9eaf56c3cc3fabc028db365061ed98e745dfc3bf942238ebd6c2b642716a2e5dc7f010bb9fa2249112bf4ab66db715d35221783104a3702c694aeea

data/.document

@@ -2,4 +2,3 @@ lib/**/*.rb
 - 
 ChangeLog.md
 COPYING.txt
-man/*.md

data/.github/workflows/ruby.yml

@@ -30,3 +30,17 @@ jobs:
         run: bundle install --jobs 4 --retry 3
       - name: Run tests
         run: bundle exec rake test
+
+  # rubocop linting
+  rubocop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.0
+      - name: Install dependencies
+        run: bundle install --jobs 4 --retry 3
+      - name: Run rubocop
+        run: bundle exec rubocop --parallel

data/.rubocop.yml

@@ -0,0 +1,28 @@
+AllCops:
+  NewCops: enable
+  SuggestExtensions: false
+  TargetRubyVersion: 3.1
+
+inherit_gem:
+  rubocop-ronin: rubocop.yml
+
+# we need to make the branching logic extremely explicit here
+Lint/DuplicateBranch:
+  Exclude:
+    - 'lib/ronin/vulns/lfi.rb'
+
+# we need to use eval() in the specs to test the SSTI test expression
+Security/Eval:
+  Exclude:
+    - 'spec/ssti_spec.rb'
+
+# we need to call URLScanner.scan with a block
+Lint/EmptyBlock:
+  Exclude:
+    - 'spec/reflected_xss_spec.rb'
+    - 'spec/url_scanner_spec.rb'
+
+# Ronin::Vulns::Vuln does not define an #initialize method
+Lint/MissingSuper:
+  Exclude:
+    - 'lib/ronin/vulns/web_vuln.rb'

data/ChangeLog.md

@@ -1,3 +1,24 @@
+### 0.1.3 / 2023-07-07
+
+* Fixed a bug in {Ronin::Vulns::SSTI.scan} where when called without `escape:`
+  it would not return all found vulnerabilities.
+* Fixed a bug in {Ronin::Vulns::SQLI.scan} where repeat requests would be sent
+  even if `escape_quote:`, `escape_parens:`, or `terminate:` keyword arguments
+  are given.
+* Improved {Ronin::Vulns::ReflectedXSS::Context} to detect when the XSS occurs
+  after or *inside of* an HTML comment.
+
+### 0.1.2 / 2023-03-01
+
+* Require `ronin-support` ~> 1.0, >= 1.0.1
+
+#### CLI
+
+* Validate that given URLs start with either `http://` or `https://`, and print
+  an error message otherwise.
+* Print a `No vulnerabilities found` message when no vulnerabilities were
+  discovered.
+
 ### 0.1.1 / 2023-02-02
 
 * Fixed typo in {Ronin::Vulns::CLI::WebVulnCommand#process_url} which effected

data/Gemfile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 
 gemspec
@@ -8,9 +10,9 @@ gem 'jruby-openssl',	'~> 0.7', platforms: :jruby
 #                              branch: '0.4.0'
 
 # Ronin dependencies
-# gem 'ronin-support',	'~> 1.0', github: "ronin-rb/ronin-support",
+# gem 'ronin-support',	'~> 1.0', github: 'ronin-rb/ronin-support',
 #                                 branch: 'main'
-# gem 'ronin-core',     '~> 0.1', github: "ronin-rb/ronin-core",
+# gem 'ronin-core',     '~> 0.1', github: 'ronin-rb/ronin-core',
 #                                 branch: 'main'
 
 group :development do
@@ -31,4 +33,6 @@ group :development do
   gem 'dead_end',        require: false
   gem 'sord',            require: false, platform: :mri
   gem 'stackprof',       require: false, platform: :mri
+  gem 'rubocop',         require: false, platform: :mri
+  gem 'rubocop-ronin',   require: false, platform: :mri
 end

data/Rakefile

@@ -1,11 +1,11 @@
-require 'rubygems'
+# frozen_string_literal: true
 
 begin
   require 'bundler'
 rescue LoadError => e
   warn e.message
   warn "Run `gem install bundler` to install Bundler"
-  exit -1
+  exit(-1)
 end
 
 begin

data/bin/ronin-vulns

@@ -1,17 +1,16 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'rubygems'
 
 root = File.expand_path(File.join(File.dirname(__FILE__),'..'))
 if File.file?(File.join(root,'Gemfile.lock'))
   Dir.chdir(root) do
-    begin
-      require 'bundler/setup'
-    rescue LoadError => e
-      warn e.message
-      warn "Run `gem install bundler` to install Bundler"
-      exit -1
-    end
+    require 'bundler/setup'
+  rescue LoadError => e
+    warn e.message
+    warn "Run `gem install bundler` to install Bundler"
+    exit(-1)
   end
 end
 

data/gemspec.yml

@@ -34,7 +34,7 @@ generated_files:
   - man/ronin-vulns-scan.1
 
 dependencies:
-  ronin-support: ~> 1.0
+  ronin-support: ~> 1.0, >= 1.0.1
   ronin-core: ~> 0.1
 
 development_dependencies:

data/lib/ronin/vulns/cli/commands/open_redirect.rb

@@ -78,6 +78,7 @@ module Ronin
           #
           def scan_kwargs
             kwargs = super()
+
             kwargs[:test_url] = options[:test_url] if options[:test_url]
             return kwargs
           end

data/lib/ronin/vulns/cli/commands/rfi.rb

@@ -69,7 +69,7 @@ module Ronin
                                      'double-encode' => :double_encode,
                                      'suffix-escape' => :suffix_escape,
                                      'null-byte'     => :null_byte
-                                   },
+                                   }
                                  },
                                  desc: 'Optional filter-bypass strategy to use'
 

data/lib/ronin/vulns/cli/commands/scan.rb

@@ -98,7 +98,7 @@ module Ronin
                                          'double-encode' => :double_encode,
                                          'suffix-escape' => :suffix_escape,
                                          'null-byte'     => :null_byte
-                                       },
+                                       }
                                      },
                                      desc: 'Optional filter-bypass strategy to use'
 
@@ -127,7 +127,7 @@ module Ronin
           option :sqli_terminate, desc: 'Terminates the SQL expression with a --'
 
           option :ssti_test_expr, value: {
-                                    type: /\A\d+\s*[\*\/\+\-]\s*\d+\z/,
+                                    type: %r{\A\d+\s*[\*/\+\-]\s*\d+\z},
                                     usage: '{X*Y | X/Z | X+Y | X-Y}'
                                   },
                                   desc: 'Optional numeric test to use' do |expr|
@@ -260,10 +260,10 @@ module Ronin
           def scan_kwargs
             kwargs = super()
 
-            kwargs[:lfi]  = lfi_kwargs
-            kwargs[:rfi]  = rfi_kwargs
-            kwargs[:sqli] = sqli_kwargs
-            kwargs[:ssti] = ssti_kwargs
+            kwargs[:lfi]           = lfi_kwargs
+            kwargs[:rfi]           = rfi_kwargs
+            kwargs[:sqli]          = sqli_kwargs
+            kwargs[:ssti]          = ssti_kwargs
             kwargs[:open_redirect] = open_redirect_kwargs
             kwargs[:reflected_xss] = reflected_xss_kwargs
 

data/lib/ronin/vulns/cli/commands/ssti.rb

@@ -63,7 +63,7 @@ module Ronin
 
           option :test_expr, short: '-T',
                              value: {
-                               type: /\A\d+\s*[\*\/\+\-]\s*\d+\z/,
+                               type: %r{\A\d+\s*[\*/\+\-]\s*\d+\z},
                                usage: '{X*Y | X/Z | X+Y | X-Y}'
                              },
                              desc: 'Optional numeric test to use' do |expr|
@@ -86,6 +86,7 @@ module Ronin
           #
           def scan_kwargs
             kwargs = super()
+
             kwargs[:test_expr] = @test_expr if @test_expr
             return kwargs
           end

data/lib/ronin/vulns/cli/logging.rb

@@ -23,6 +23,9 @@ require 'ronin/core/cli/logging'
 module Ronin
   module Vulns
     class CLI
+      #
+      # Mixin that adds methods for logging discovered web vulnerabilities.
+      #
       module Logging
         include Core::CLI::Logging
 

data/lib/ronin/vulns/cli/web_vuln_command.rb

@@ -53,7 +53,9 @@ module Ronin
                         desc: 'Sets an additional header' do |header|
                           name, value = header.split(/:\s*/,2)
 
+                          # lazy initialize the headers
                           @headers ||= {}
+
                           @headers[name] = value
                         end
 
@@ -74,14 +76,16 @@ module Ronin
                               desc: 'Sets an additional cookie param' do |param|
                                 name, value = param.split('=',2)
 
+                                # lazy initialize the cookie
                                 @cookie ||= Support::Network::HTTP::Cookie.new
+
                                 @cookie[name] = value
                               end
 
         option :referer, short: '-R',
                          value: {
                            type: String,
-                           usage: 'URL',
+                           usage: 'URL'
                          },
                          desc: 'Sets the Referer header' do |referer|
                            @referer = referer
@@ -95,7 +99,9 @@ module Ronin
                             desc: 'Sets an additional form param' do |param|
                               name, value = param.split('=',2)
 
+                              # lazy initialize the form data
                               @form_data ||= {}
+
                               @form_data[name] = value
                             end
 
@@ -104,7 +110,9 @@ module Ronin
                                     usage: 'NAME'
                                   },
                                   desc: 'Tests the URL query param name' do |name|
+                                    # lazy initialize the test query params
                                     @test_query_params ||= Set.new
+
                                     @test_query_params << name
                                   end
 
@@ -117,7 +125,9 @@ module Ronin
                                     usage: 'NAME'
                                   },
                                   desc: 'Tests the HTTP Header name' do |name|
+                                    # lazy initialize the test heade rnames
                                     @test_header_names ||= Set.new
+
                                     @test_header_names << name
                                   end
 
@@ -126,7 +136,9 @@ module Ronin
                                      usage: 'NAME'
                                    },
                                    desc: 'Tests the HTTP Cookie name' do |name|
+                                     # lazy initialize the test cookie params
                                      @test_cookie_params ||= Set.new
+
                                      @test_cookie_params << name
                                    end
 
@@ -135,11 +147,13 @@ module Ronin
         end
 
         option :test_form_param, value: {
-                                     type: String,
+                                   type: String,
                                      usage: 'NAME'
-                                   },
+                                 },
                                    desc: 'Tests the form param name' do |name|
+                                     # lazy initialize the test form params
                                      @test_form_params ||= Set.new
+
                                      @test_form_params << name
                                    end
 
@@ -235,19 +249,27 @@ module Ronin
         #   The URL(s) to scan.
         #
         def run(*urls)
+          unless (options[:input] || !urls.empty?)
+            print_error "must specify URL(s) or --input"
+            exit(-1)
+          end
+
+          vulns_discovered = false
+
           if options[:input]
             File.open(options[:input]) do |file|
               file.each_line(chomp: true) do |url|
-                process_url(url)
+                vulns_discovered ||= process_url(url)
               end
             end
           elsif !urls.empty?
             urls.each do |url|
-              process_url(url)
+              vulns_discovered ||= process_url(url)
             end
-          else
-            print_error "must specify URL(s) or --input"
-            exit(-1)
+          end
+
+          unless vulns_discovered
+            puts colors.green("No vulnerabilities found")
           end
         end
 
@@ -257,16 +279,32 @@ module Ronin
         # @param [String] url
         #   A URL to scan.
         #
+        # @return [Boolean]
+        #   Indicates whether a vulnerability was discovered in the URL.
+        #
         def process_url(url)
+          unless url.start_with?('http://') || url.start_with?('https://')
+            print_error("URL must start with http:// or https://: #{url.inspect}")
+            exit(-1)
+          end
+
+          vuln_discovered = false
+
           if @scan_mode == :first
             if (first_vuln = test_url(url))
               log_vuln(first_vuln)
+
+              vuln_discovered = true
             end
           else
             scan_url(url) do |vuln|
               log_vuln(vuln)
+
+              vuln_discovered = true
             end
           end
+
+          return vuln_discovered
         end
 
         #
@@ -295,7 +333,7 @@ module Ronin
             kwargs[:query_params]  = true
           end
 
-          kwargs[:header_names]  = @test_header_names  if @test_header_names
+          kwargs[:header_names] = @test_header_names if @test_header_names
 
           if @test_cookie_params
             kwargs[:cookie_params] = @test_cookie_params
@@ -303,7 +341,7 @@ module Ronin
             kwargs[:cookie_params] = true
           end
 
-          kwargs[:form_params]   = @test_form_params   if @test_form_params
+          kwargs[:form_params] = @test_form_params if @test_form_params
 
           return kwargs
         end

data/lib/ronin/vulns/lfi.rb

@@ -57,7 +57,7 @@ module Ronin
       attr_reader :os
 
       # Optional filter bypass technique to use.
-      # 
+      #
       # @return [:null_byte, :base64, :rot13, :zlib, nil]
       attr_reader :filter_bypass
 
@@ -176,7 +176,7 @@ module Ronin
           "#{@escape_path}#{path[3..]}"
         elsif @os == :windows && path =~ /\A[A-Z]:/
           # pass through absolute Windows paths to other drives
-            path
+          path
         elsif path.start_with?(@separator)
           # escape absolute paths
           "#{@escape_path}#{path[1..]}"
@@ -234,10 +234,9 @@ module Ronin
           Crypto.rot(body,-13) =~ @test_file
         when :zlib
           body.scan(Text::Patterns::BASE64).any? do |string|
-            begin
-              Compression.zlib_inflate(Base64.decode64(string)) =~ @test_file
-            rescue Zlib::DataError
-            end
+            Compression.zlib_inflate(Base64.decode64(string)) =~ @test_file
+          rescue Zlib::DataError
+            # not zlib compressed Base64, ignore
           end
         else
           body =~ @test_file

data/lib/ronin/vulns/open_redirect.rb

@@ -80,7 +80,7 @@ module Ronin
         when '301', '302', '303', '307', '308'
           if (locations = response.get_fields('Location'))
             escaped_test_url = Regexp.escape(@test_url)
-            regexp = %r{\A#{escaped_test_url}(?:[\?&].+)?\z}
+            regexp           = /\A#{escaped_test_url}(?:[\?&].+)?\z/
 
             locations.last =~ regexp
           end
@@ -89,7 +89,18 @@ module Ronin
 
           if content_type && content_type.include?('text/html')
             escaped_test_url = Regexp.escape(CGI.escapeHTML(@test_url))
-            regexp = %r{<meta\s+http-equiv\s*=\s*(?:"refresh"|'refresh'|refresh)\s+content\s*=\s*(?:"\s*\d+\s*;\s*url\s*=\s*'\s*#{escaped_test_url}\s*'\s*"|'\s*\d+\s*;\s*url\s*=\s*"\s*#{escaped_test_url}\s*"\s*'|\s*\d+;url=(?:"#{escaped_test_url}"|'#{escaped_test_url}'))\s*(?:/\s*)?>}i
+
+            regexp = %r{
+              <meta\s+
+                http-equiv\s*=\s*(?: "refresh" | 'refresh' | refresh )\s+
+                content\s*=\s*
+                (?:
+                 "\s*\d+\s*;\s*url\s*=\s*'\s*#{escaped_test_url}\s*'\s*"|
+                 '\s*\d+\s*;\s*url\s*=\s*"\s*#{escaped_test_url}\s*"\s*'|
+                 \s*\d+;url=(?: "#{escaped_test_url}" | '#{escaped_test_url}' )
+                )\s*
+                (?:/\s*)?>
+            }xi
 
             response.body =~ regexp
           end

data/lib/ronin/vulns/reflected_xss/context.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# frozen_string_literal: true
 #
 # ronin-vulns - A Ruby library for blind vulnerability testing.
 #
@@ -31,7 +30,7 @@ module Ronin
 
         # Where in the HTML the XSS occurs.
         #
-        # @return [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body]
+        # @return [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body, :comment]
         #   The context which the XSS occurs in.
         #   * `:tag_body` occurred within a tag's body (ex: `<tag>XSS...</tag>`)
         #   * `:double_quoted_attr_value` - occurred in a double quoted
@@ -45,13 +44,14 @@ module Ronin
         #   * `:attr_list` - occurred in the attribute list
         #     (ex: `<tag XSS>...</tag>`)
         #   * `:tag_name` - occurred in the tag name (ex: `<tagXSS>...</tag>`)
+        #   * `:comment` - occurred in a comment (ex: `<!-- XSS -->`)
         #
         # @api public
         attr_reader :location
 
         # The name of the parent tag which the XSS occurs in.
         #
-        # @return [String]
+        # @return [String, nil]
         #
         # @api public
         attr_reader :tag
@@ -66,9 +66,9 @@ module Ronin
         #
         # Initializes the context.
         #
-        # @param [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body] location
+        # @param [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body, :comment] location
         #
-        # @param [String] tag
+        # @param [String, nil] tag
         #
         # @param [String, nil] attr
         #
@@ -101,6 +101,11 @@ module Ronin
         # @api private
         ATTR_LIST = /(?:\s+#{ATTR})*/
 
+        # HTML comment regexp.
+        #
+        # @api private
+        COMMENT = /<![^>]*>/
+
         # HTML tag name regexp.
         #
         # @api private
@@ -109,39 +114,44 @@ module Ronin
         # Regexp matching when an XSS occurs within a tag's inner HTML.
         #
         # @api private
-        IN_TAG_BODY = %r{<(#{TAG_NAME})#{ATTR_LIST}\s*(?:>|/>)[^<>]*\z}
+        IN_TAG_BODY = %r{<(#{TAG_NAME})#{ATTR_LIST}\s*(?:>|/>)([^<>]|#{COMMENT})*\z}
 
         # Regexp matching when an XSS occurs within a double-quoted attribute
         # value.
         #
         # @api private
-        IN_DOUBLE_QUOTED_ATTR_VALUE = %r{<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})\s*=\s*"[^"]+\z}
+        IN_DOUBLE_QUOTED_ATTR_VALUE = /<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})\s*=\s*"[^"]+\z/
 
         # Regexp matching when an XSS occurs within a single-quoted attribute
         # value.
         #
         # @api private
-        IN_SINGLE_QUOTED_ATTR_VALUE = %r{<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})\s*=\s*'[^']+\z}
+        IN_SINGLE_QUOTED_ATTR_VALUE = /<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})\s*=\s*'[^']+\z/
 
         # Regexp matching when an XSS occurs within an unquoted attribute value.
         #
         # @api private
-        IN_UNQUOTED_ATTR_VALUE = %r{<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})=[^"'\s]+\z}
+        IN_UNQUOTED_ATTR_VALUE = /<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})=[^"'\s]+\z/
 
         # Regexp matching when an XSS occurs within an attribute's name.
         #
         # @api private
-        IN_ATTR_NAME = %r{<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})\z}
+        IN_ATTR_NAME = /<(#{TAG_NAME})#{ATTR_LIST}\s+(#{ATTR_NAME})\z/
 
         # Regexp matching when an XSS occurs within a tag's attribute list.
         #
         # @api private
-        IN_ATTR_LIST = %r{<(#{TAG_NAME})#{ATTR_LIST}\s+\z}
+        IN_ATTR_LIST = /<(#{TAG_NAME})#{ATTR_LIST}\s+\z/
 
         # Regexp matching when an XSS occurs within a tag's name.
         #
         # @api private
-        IN_TAG_NAME = %r{<(#{TAG_NAME})\z}
+        IN_TAG_NAME = /<(#{TAG_NAME})\z/
+
+        # Regexp matching when an XSS occurs within a comment.
+        #
+        # @api private
+        IN_COMMENT = /<![^>]*\z/
 
         #
         # Determine the context of the XSS by checking the characters that come
@@ -161,7 +171,7 @@ module Ronin
         def self.identify(body,index)
           prefix = body[0,index]
 
-          if (match = prefix.match(IN_TAG_BODY))
+          if    (match = prefix.match(IN_TAG_BODY))
             new(:tag_body, tag: match[1])
           elsif (match = prefix.match(IN_DOUBLE_QUOTED_ATTR_VALUE))
             new(:double_quoted_attr_value, tag: match[1], attr: match[2])
@@ -175,6 +185,8 @@ module Ronin
             new(:attr_list, tag: match[1])
           elsif (match = prefix.match(IN_TAG_NAME))
             new(:tag_name, tag: match[1])
+          elsif prefix.match?(IN_COMMENT)
+            new(:comment)
           end
         end
 
@@ -194,7 +206,8 @@ module Ronin
           attr_name: MINIMAL_REQUIRED_CHARS,
           attr_list: MINIMAL_REQUIRED_CHARS,
           tag_name:  MINIMAL_REQUIRED_CHARS,
-          tag_body:  MINIMAL_REQUIRED_CHARS
+          tag_body:  MINIMAL_REQUIRED_CHARS,
+          comment:   MINIMAL_REQUIRED_CHARS
         }
 
         #

data/lib/ronin/vulns/reflected_xss/test_string.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# frozen_string_literal: true
 #
 # ronin-vulns - A Ruby library for blind vulnerability testing.
 #
@@ -67,7 +66,7 @@ module Ronin
           '/' => ['%2F'],
           '<' => ['%3C', '&lt;'],
           '>' => ['%3E', '&gt;'],
-          '&' => ['%26', '&amp;'],
+          '&' => ['%26', '&amp;']
         }
 
         #

data/lib/ronin/vulns/reflected_xss.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# frozen_string_literal: true
 #
 # ronin-vulns - A Ruby library for blind vulnerability testing.
 #
@@ -91,7 +90,7 @@ module Ronin
       #   The test string to send.
       #
       # @yield [body, match]
-      #   If a block is given, it will be passed the response body and the 
+      #   If a block is given, it will be passed the response body and the
       #   regular expression match data, if the response contains the test
       #   string.
       #
@@ -119,7 +118,7 @@ module Ronin
       # Tests which HTML characters are accepted or escaped/filtered.
       #
       # @yield [body, match]
-      #   If a block is given, it will be passed the response body and the 
+      #   If a block is given, it will be passed the response body and the
       #   regular expression match data, if the response contains the test
       #   string.
       #

data/lib/ronin/vulns/rfi.rb

@@ -65,7 +65,7 @@ module Ronin
       attr_reader :filter_bypass
 
       # URL of the Remote File Inclusion (RFI) Test script
-      # 
+      #
       # @return [URI::HTTP, String]
       attr_reader :test_script_url
 

data/lib/ronin/vulns/sqli.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# frozen_string_literal: true
 #
 # ronin-vulns - A Ruby library for blind vulnerability testing.
 #
@@ -42,7 +41,7 @@ module Ronin
       attr_reader :escape_quote
 
       # Specifies whether to escape parenthesis.
-      # 
+      #
       # @return [Boolean]
       attr_reader :escape_parens
 
@@ -106,6 +105,18 @@ module Ronin
       # @param [URI::HTTP, String] url
       #   The URL to test or exploit.
       #
+      # @param [Array<Boolean>, Boolean] escape_quote
+      #   Controls whether to escape a quoted string value. If not specified,
+      #   with and without quoted string escaping will be tested.
+      #
+      # @param [Array<Boolean>, Boolean] escape_parens
+      #   Controls whether to escape parenthesis. If not specified, with and
+      #   without parenthesis escaping will be tested.
+      #
+      # @param [Array<Boolean>, Boolean] terminate
+      #   Controls whether to terminate the SQL statement with `--`.
+      #   If not specified, with and without `--` terminate will be tested.
+      #
       # @param [Ronin::Support::Network::HTTP, nil] http
       #   An HTTP session to use for testing the URL.
       #
@@ -116,28 +127,28 @@ module Ronin
       #   If a block is given it will be yielded each discovered SQL injection
       #   vulnerability.
       #
-      # @yieldparam [SQLi] sqli
+      # @yieldparam [SQLI] sqli
       #   A discovered SQL injection vulnerability in the URL.
       #
-      # @return [Array<SQLi>]
+      # @return [Array<SQLI>]
       #   All discovered SQL injection vulnerabilities.
       #
-      def self.scan(url, http: nil, **kwargs, &block)
+      def self.scan(url, escape_quote:  [false, true],
+                         escape_parens: [false, true],
+                         terminate:     [false, true],
+                         # WebVuln.scan keyword arguments
+                         http: nil, **kwargs, &block)
         url    = URI(url)
         http ||= Support::Network::HTTP.connect_uri(url)
 
-        escape_quotes = [false, true]
-        escape_parens = [false, true]
-        terminations  = [false, true]
-
         vulns = []
 
-        escape_quotes.each do |escape_quote|
-          escape_parens.each do |escape_paren|
-            terminations.each do |terminate|
-              vulns.concat(super(url, escape_quote:    escape_quote,
-                                      escape_parens:   escape_paren,
-                                      terminate:       terminate,
+        Array(escape_quote).each do |escape_quote_value|
+          Array(escape_parens).each do |escape_parens_value|
+            Array(terminate).each do |terminate_value|
+              vulns.concat(super(url, escape_quote:    escape_quote_value,
+                                      escape_parens:   escape_parens_value,
+                                      terminate:       terminate_value,
                                       http:            http,
                                       **kwargs,
                                       &block))
@@ -205,7 +216,7 @@ module Ronin
           /ERROR: parser: parse error at or near/,
           /PostgreSQL query failed/,
           /org\.postgresql\.jdbc/,
-          /Pdo[.\/_\\]Pgsql/,
+          %r{Pdo[\./_\\]Pgsql},
           /PSQLException/
         ],
 
@@ -219,12 +230,12 @@ module Ronin
           /MySqlClient\./,
           /com\.mysql\.jdbc/,
           /Zend_Db_(?:Adapter|Statement)_Mysqli_Exception/,
-          /Pdo[.\/_\\]Mysql/,
+          %r{Pdo[\./_\\]Mysql},
           /MySqlException/
         ],
 
         sqlite: ErrorPattern[
-          /SQLite\/JDBCDriver/,
+          %r{SQLite/JDBCDriver},
           /SQLite\.Exception/,
           /(Microsoft|System)\.Data\.SQLite\.SQLiteException/,
           /Warning.*\W(?:sqlite_|SQLite3::)/,
@@ -233,7 +244,7 @@ module Ronin
           /sqlite3\.OperationalError:/,
           /SQLite3::SQLException/,
           /org\.sqlite\.JDBC/,
-          /Pdo[.\/_\\]Sqlite/,
+          %r{Pdo[\./_\\]Sqlite},
           /SQLiteException/
         ],
 
@@ -254,7 +265,7 @@ module Ronin
           /macromedia\.jdbc\.sqlserver/,
           /Zend_Db_(?:Adapter|Statement)_Sqlsrv_Exception/,
           /com\.microsoft\.sqlserver\.jdbc/,
-          /Pdo[.\/_\\](?:Mssql|SqlSrv)/,
+          %r{Pdo[\./_\\](?:Mssql|SqlSrv)},
           /SQL(?:Srv|Server)Exception/
         ],
 
@@ -268,7 +279,7 @@ module Ronin
           /macromedia\.jdbc\.oracle/,
           /oracle\.jdbc/,
           /Zend_Db_(?:Adapter|Statement)_Oracle_Exception/,
-          /Pdo[.\/_\\](?:Oracle|OCI)/,
+          %r{Pdo[\./_\\](?:Oracle|OCI)},
           /OracleException/
         ]
       }
@@ -304,7 +315,7 @@ module Ronin
       # @api private
       #
       def random_id
-        rand(8_999) + 1_000
+        rand(8_999..9999)
       end
 
       #
@@ -317,6 +328,7 @@ module Ronin
       #
       def test_or_true_and_false
         id = random_id
+
         response1 = exploit("OR #{id}=#{id}")
         response2 = exploit("AND #{random_id}=#{random_id}")
 

data/lib/ronin/vulns/ssti/test_expression.rb

@@ -68,7 +68,7 @@ module Ronin
         #   Could not parse the test expression.
         #
         def self.parse(string)
-          unless (match = string.match(/\A(\d+)\s*([\*\/\+\-])\s*(\d+)\z/))
+          unless (match = string.match(%r{\A(\d+)\s*([\*/\+\-])\s*(\d+)\z}))
             raise(ArgumentError,"could not parse the expression: #{string.inspect}")
           end
 

data/lib/ronin/vulns/ssti.rb

@@ -87,8 +87,8 @@ module Ronin
       #   A random test expression.
       #
       def self.random_test
-        int1 = rand(999) + 1_000
-        int2 = rand(999) + 1_000
+        int1 = rand(1_000..1_999)
+        int2 = rand(1_000..1_999)
 
         string  = "#{int1}*#{int2}"
         result  = (int1 * int2).to_s
@@ -102,13 +102,13 @@ module Ronin
       # @param [URI::HTTP, String] url
       #   The URL to scan.
       #
+      # @param [Array<Proc>, Proc, nil] escape
+      #   The escape method to use. If `escape:` is not given, then all escapes
+      #   in {ESCAPES} will be tested..
+      #
       # @param [Hash{Symbol => Object}] kwargs
       #   Additional keyword arguments for {#initialize}.
       #
-      # @option kwargs [Proc, nil] :escape
-      #   The escape method to use. If `escape:` is not given, then all escapes
-      #   in {ESCAPES} will be tested..
-      #   
       # @option kwargs [Array<Symbol, String>, Symbol, String, true, nil] :query_params
       #   The query param name(s) to test.
       #
@@ -145,14 +145,14 @@ module Ronin
       # @return [Array<SSTI>]
       #   All discovered SSTI vulnerabilities.
       #
-      def self.scan(url, **kwargs,&block)
-        if kwargs.has_key?(:escape)
-          super(url, **kwargs, &block)
-        else
-          ESCAPES.each do |escape|
-            super(url, escape: escape, **kwargs, &block)
-          end
+      def self.scan(url, escape: ESCAPES, **kwargs,&block)
+        vulns = []
+
+        Array(escape).each do |escape_char|
+          vulns.concat(super(url, escape: escape_char, **kwargs, &block))
         end
+
+        return vulns
       end
 
       #

data/lib/ronin/vulns/url_scanner.rb

@@ -27,6 +27,9 @@ require 'ronin/vulns/open_redirect'
 
 module Ronin
   module Vulns
+    #
+    # Top-level module which scans a URL for all web vulnerabilities.
+    #
     module URLScanner
       #
       # Scans a URL for web vulnerabilities.

data/lib/ronin/vulns/version.rb

@@ -21,6 +21,6 @@
 module Ronin
   module Vulns
     # The ronin-vulns version
-    VERSION = '0.1.1'
+    VERSION = '0.1.3'
   end
 end

data/lib/ronin/vulns/web_vuln/http_request.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# frozen_string_literal: true
 #
 # ronin-vulns - A Ruby library for blind vulnerability testing.
 #
@@ -119,9 +118,10 @@ module Ronin
                             cookie:         nil,
                             form_data:      nil)
           @url = url
-          
+
           if query_params && !query_params.empty?
             @url = url.dup
+
             @url.query_params = query_params
           end
 

data/lib/ronin/vulns/web_vuln.rb

@@ -292,7 +292,7 @@ module Ronin
         url    = URI(url)
         http ||= Support::Network::HTTP.connect_uri(url)
 
-        unless cookie_params 
+        unless cookie_params
           cookie_params = Set.new
 
           http.get_cookies(url.request_uri).each do |set_cookie|

data/ronin-vulns.gemspec

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'yaml'
 
 Gem::Specification.new do |gem|
@@ -20,7 +22,7 @@ Gem::Specification.new do |gem|
   gem.homepage    = gemspec['homepage']
   gem.metadata    = gemspec['metadata'] if gemspec['metadata']
 
-  glob = lambda { |patterns| gem.files & Dir[*patterns] }
+  glob = ->(patterns) { gem.files & Dir[*patterns] }
 
   gem.files  = `git ls-files`.split($/)
   gem.files  = glob[gemspec['files']] if gemspec['files']
@@ -44,7 +46,7 @@ Gem::Specification.new do |gem|
   gem.required_rubygems_version = gemspec['required_rubygems_version']
   gem.post_install_message      = gemspec['post_install_message']
 
-  split = lambda { |string| string.split(/,\s*/) }
+  split = ->(string) { string.split(/,\s*/) }
 
   if gemspec['dependencies']
     gemspec['dependencies'].each do |name,versions|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ronin-vulns
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Postmodern
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-02-02 00:00:00.000000000 Z
+date: 2023-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ronin-support
@@ -17,6 +17,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -24,6 +27,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.1
 - !ruby/object:Gem::Dependency
   name: ronin-core
   requirement: !ruby/object:Gem::Requirement
@@ -70,6 +76,7 @@ files:
 - ".github/workflows/ruby.yml"
 - ".gitignore"
 - ".rspec"
+- ".rubocop.yml"
 - ".ruby-version"
 - ".yardopts"
 - COPYING.txt