ronin-vulns 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c80dfbe1e5e0f67d7f6ae908b5514f937004354a809a4e408025ad47f96bf8e7
-  data.tar.gz: 7af7ed3b5e0abed7e2f0bdf0fc4b774ed568412369f4db44971fd2520d663bd5
+  metadata.gz: a034edd07851be44f796a03f47cc5583969734943d5ec23c0073e9dc92f62bd7
+  data.tar.gz: 223f844d4ead3779a13d981a6998c46a5cf7f445d5b95044ae30997f546642e5
 SHA512:
-  metadata.gz: b06b563a221760c4f58fb55394ccdf01b510ed240b78d51f12dfd7bf122513f42d512f17bf3d5eb0857f61eda1b3db981c2d4583d9bedbb186c108216eec709f
-  data.tar.gz: 905e0de6182206b232358dab499af99f7849513bb09585e9242445505791dcc8a6c23a381be314f9078cf20848f388ca0c277b6d1647c845c7a56a9c6e10fcec
+  metadata.gz: 0db7e162bc9e7294be2d5a89660c3fd3b5892d4e2595b56704bcd8725bccb3041b38a8621c1daab77471236d2a17c1075bdf8ce7f4f233afee43d7277b6afc94
+  data.tar.gz: 9a5e1f7513231f294ca5f328f79921dc66c1072b301ccfbf3ac72844b75b492a0ccd76a171d507d82b002824522f79cf6d9e08e7bf99c7624e47375993064176

data/.document

@@ -2,4 +2,3 @@ lib/**/*.rb
 - 
 ChangeLog.md
 COPYING.txt
-man/*.md

data/ChangeLog.md

@@ -1,3 +1,26 @@
+### 0.1.4 / 2023-09-19
+
+#### CLI
+
+* Improved the performance of `ronin-vulns` commands when scanning multiple URLs
+  or a file of URLs by not rebuilding an identical
+  {Ronin::Vulns::CLI::WebVulnCommand#scan_kwargs} for each URL.
+* Allow the `--cookie "..."` option to be repeated multiple times and merge the
+  cookie strings together.
+* Allow the `--cookie-param NAME=VALUE` option to be used with the
+  `--cookie "..."` option and merge the cookie values together.
+* Print vulnerable param names in single quotes.
+
+### 0.1.3 / 2023-07-07
+
+* Fixed a bug in {Ronin::Vulns::SSTI.scan} where when called without `escape:`
+  it would not return all found vulnerabilities.
+* Fixed a bug in {Ronin::Vulns::SQLI.scan} where repeat requests would be sent
+  even if `escape_quote:`, `escape_parens:`, or `terminate:` keyword arguments
+  are given.
+* Improved {Ronin::Vulns::ReflectedXSS::Context} to detect when the XSS occurs
+  after or *inside of* an HTML comment.
+
 ### 0.1.2 / 2023-03-01
 
 * Require `ronin-support` ~> 1.0, >= 1.0.1

data/Gemfile

@@ -10,9 +10,9 @@ gem 'jruby-openssl',	'~> 0.7', platforms: :jruby
 #                              branch: '0.4.0'
 
 # Ronin dependencies
-# gem 'ronin-support',	'~> 1.0', github: "ronin-rb/ronin-support",
+# gem 'ronin-support',	'~> 1.0', github: 'ronin-rb/ronin-support',
 #                                 branch: 'main'
-# gem 'ronin-core',     '~> 0.1', github: "ronin-rb/ronin-core",
+# gem 'ronin-core',     '~> 0.1', github: 'ronin-rb/ronin-core',
 #                                 branch: 'main'
 
 group :development do

data/README.md

@@ -9,7 +9,6 @@
 * [Issues](https://github.com/ronin-rb/ronin-vulns/issues)
 * [Documentation](https://ronin-rb.dev/docs/ronin-vulns/frames)
 * [Discord](https://discord.gg/6WAb3PsVX9) |
-  [Twitter](https://twitter.com/ronin_rb) |
   [Mastodon](https://infosec.exchange/@ronin_rb)
 
 ## Description

data/lib/ronin/vulns/cli/commands/lfi.rb

@@ -66,14 +66,18 @@ module Ronin
                       value: {
                         type: [:unix, :windows]
                       },
-                      desc: 'Sets the OS to test for'
+                      desc: 'Sets the OS to test for' do |os|
+                        scan_kwargs[:os] = os
+                      end
 
           option :depth, short: '-D',
                          value: {
                            type:  Integer,
                            usage: 'COUNT'
                          },
-                         desc: 'Sets the directory depth to escape up'
+                         desc: 'Sets the directory depth to escape up' do |depth|
+                           scan_kwargs[:depth] = depth
+                         end
 
           option :filter_bypass, short: '-B',
                                  value: {
@@ -85,30 +89,14 @@ module Ronin
                                      :zlib
                                    ]
                                  },
-                                 desc: 'Sets the filter bypass strategy to use'
+                                 desc: 'Sets the filter bypass strategy to use' do |filter_bypass|
+                                   scan_kwargs[:filter_bypass] = filter_bypass
+                                 end
 
           description 'Scans URL(s) for Local File Inclusion (LFI) vulnerabilities'
 
           man_page 'ronin-vulns-lfi.1'
 
-          #
-          # Keyword arguments for `Vulns::LFI.scan` and `Vulns::LFI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:os]    = options[:os]    if options[:os]
-            kwargs[:depth] = options[:depth] if options[:depth]
-
-            if options[:filter_bypass]
-              kwargs[:filter_bypass] = options[:filter_bypass]
-            end
-
-            return kwargs
-          end
-
           #
           # Scans a URL for LFI vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/open_redirect.rb

@@ -64,25 +64,14 @@ module Ronin
                               type:  String,
                               usage: 'URL'
                             },
-                            desc: 'Optional test URL to try to redirect to'
+                            desc: 'Optional test URL to try to redirect to' do |test_url|
+                              scan_kwargs[:test_url] = test_url
+                            end
 
           description 'Scans URL(s) for Open Redirect vulnerabilities'
 
           man_page 'ronin-vulns-open-redirect.1'
 
-          #
-          # Keyword arguments for `Vulns::OpenRedirect.scan` and
-          # `Vulns::OpenRedirect.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:test_url] = options[:test_url] if options[:test_url]
-            return kwargs
-          end
-
           #
           # Scans a URL for Open Redirect vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/rfi.rb

@@ -71,7 +71,9 @@ module Ronin
                                      'null-byte'     => :null_byte
                                    }
                                  },
-                                 desc: 'Optional filter-bypass strategy to use'
+                                 desc: 'Optional filter-bypass strategy to use' do |filter_bypass|
+                                   scan_kwargs[:filter_bypass] = filter_bypass
+                                 end
 
           option :script_lang, short: '-S',
                                value: {
@@ -84,42 +86,23 @@ module Ronin
                                    'perl'       => :perl
                                  }
                                },
-                               desc: 'Explicitly specify the scripting language to test for'
+                               desc: 'Explicitly specify the scripting language to test for' do |script_lang|
+                                 scan_kwargs[:script_lang] = script_lang
+                               end
 
           option :test_script_url, short: '-T',
                                    value: {
                                      type:  String,
                                      usage: 'URL'
                                    },
-                                   desc: 'Use an alternative test script URL'
+                                   desc: 'Use an alternative test script URL' do |test_script_url|
+                                     scan_kwargs[:test_script_url] = test_script_url
+                                   end
 
           description 'Scans URL(s) for Remote File Inclusion (RFI) vulnerabilities'
 
           man_page 'ronin-vulns-rfi.1'
 
-          #
-          # Keyword arguments for `Vulns::RFI.scan` and `Vulns::RFI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            if options[:filter_bypass]
-              kwargs[:filter_bypass] = options[:filter_bypass]
-            end
-
-            if options[:script_lang]
-              kwargs[:script_lang] = options[:script_lang]
-            end
-
-            if options[:test_script_url]
-              kwargs[:test_script_url] = options[:test_script_url]
-            end
-
-            return kwargs
-          end
-
           #
           # Scans a URL for RFI vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/scan.rb

@@ -74,13 +74,17 @@ module Ronin
           option :lfi_os, value: {
                             type: [:unix, :windows]
                           },
-                          desc: 'Sets the OS to test for'
+                          desc: 'Sets the OS to test for' do |os|
+                            lfi_kwargs[:os] = os
+                          end
 
           option :lfi_depth, value: {
                                type:  Integer,
                                usage: 'COUNT'
                              },
-                             desc: 'Sets the directory depth to escape up'
+                             desc: 'Sets the directory depth to escape up' do |depth|
+                               lfi_kwargs[:depth] = depth
+                             end
 
           option :lfi_filter_bypass, value: {
                                        type: [
@@ -91,7 +95,9 @@ module Ronin
                                          :zlib
                                        ]
                                      },
-                                     desc: 'Sets the filter bypass strategy to use'
+                                     desc: 'Sets the filter bypass strategy to use' do |filter_bypass|
+                                       lfi_kwargs[:filter_bypass] = filter_bypass
+                                     end
 
           option :rfi_filter_bypass, value: {
                                        type: {
@@ -100,7 +106,9 @@ module Ronin
                                          'null-byte'     => :null_byte
                                        }
                                      },
-                                     desc: 'Optional filter-bypass strategy to use'
+                                     desc: 'Optional filter-bypass strategy to use' do |filter_bypass|
+                                       rfi_kwargs[:filter_bypass] = filter_bypass
+                                     end
 
           option :rfi_script_lang, value: {
                                      type:  {
@@ -112,33 +120,45 @@ module Ronin
                                        'perl'       => :perl
                                      }
                                    },
-                                   desc: 'Explicitly specify the scripting language to test for'
+                                   desc: 'Explicitly specify the scripting language to test for' do |script_lang|
+                                     rfi_kwargs[:script_lang] = script_lang
+                                   end
 
           option :rfi_test_script_url, value: {
                                          type:  String,
                                          usage: 'URL'
                                        },
-                                       desc: 'Use an alternative test script URL'
+                                       desc: 'Use an alternative test script URL' do |test_script_url|
+                                         rfi_kwargs[:test_script_url] = test_script_url
+                                       end
 
-          option :sqli_escape_quote, desc: 'Escapes quotation marks'
+          option :sqli_escape_quote, desc: 'Escapes quotation marks' do
+            sqli_kwargs[:escape_quote] = true
+          end
 
-          option :sqli_escape_parens, desc: 'Escapes parenthesis'
+          option :sqli_escape_parens, desc: 'Escapes parenthesis' do
+            sqli_kwargs[:escape_parens] = true
+          end
 
-          option :sqli_terminate, desc: 'Terminates the SQL expression with a --'
+          option :sqli_terminate, desc: 'Terminates the SQL expression with a --' do
+            sqli_kwargs[:terminate] = true
+          end
 
           option :ssti_test_expr, value: {
                                     type: %r{\A\d+\s*[\*/\+\-]\s*\d+\z},
                                     usage: '{X*Y | X/Z | X+Y | X-Y}'
                                   },
                                   desc: 'Optional numeric test to use' do |expr|
-                                    @ssti_test_expr = Vulns::SSTI::TestExpression.parse(expr)
+                                    ssti_kwargs[:test_expr] = Vulns::SSTI::TestExpression.parse(expr)
                                   end
 
           option :open_redirect_url, value: {
                                        type:  String,
                                        usage: 'URL'
                                      },
-                                     desc: 'Optional test URL to try to redirect to'
+                                     desc: 'Optional test URL to try to redirect to' do |test_url|
+                                       open_redirect_kwargs[:test_url] = test_url
+                                     end
 
           description 'Scans URL(s) for web vulnerabilities'
 
@@ -151,16 +171,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def lfi_kwargs
-            kwargs = {}
-
-            kwargs[:os]    = options[:lfi_os]    if options[:lfi_os]
-            kwargs[:depth] = options[:lfi_depth] if options[:lfi_depth]
-
-            if options[:lfi_filter_bypass]
-              kwargs[:filter_bypass] = options[:lfi_filter_bypass]
-            end
-
-            return kwargs
+            scan_kwargs[:lfi] ||= {}
           end
 
           #
@@ -170,21 +181,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def rfi_kwargs
-            kwargs = {}
-
-            if options[:rfi_filter_bypass]
-              kwargs[:filter_bypass] = options[:rfi_filter_bypass]
-            end
-
-            if options[:rfi_script_lang]
-              kwargs[:script_lang] = options[:rfi_script_lang]
-            end
-
-            if options[:rfi_test_script_url]
-              kwargs[:test_script_url] = options[:rfi_test_script_url]
-            end
-
-            return kwargs
+            scan_kwargs[:rfi] ||= {}
           end
 
           #
@@ -194,21 +191,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def sqli_kwargs
-            kwargs = {}
-
-            if options[:sqli_escape_quote]
-              kwargs[:escape_quote] = options[:sqli_escape_quote]
-            end
-
-            if options[:sqli_escape_parens]
-              kwargs[:escape_parens] = options[:sqli_escape_parens]
-            end
-
-            if options[:sqli_terminate]
-              kwargs[:terminate] = options[:sqli_terminate]
-            end
-
-            return kwargs
+            scan_kwargs[:sqli] ||= {}
           end
 
           #
@@ -218,11 +201,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def ssti_kwargs
-            kwargs = {}
-
-            kwargs[:test_expr] = @ssti_test_expr if @ssti_test_expr
-
-            return kwargs
+            scan_kwargs[:ssti] ||= {}
           end
 
           #
@@ -232,13 +211,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def open_redirect_kwargs
-            kwargs = {}
-
-            if options[:open_redirect_url]
-              kwargs[:test_url] = options[:open_redirect_url]
-            end
-
-            return kwargs
+            scan_kwargs[:open_redirect] ||= {}
           end
 
           #
@@ -248,26 +221,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def reflected_xss_kwargs
-            {}
-          end
-
-          #
-          # Keyword arguments for `Vulns::URLScanner.scan` and
-          # `Vulns::URLScanner.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:lfi]           = lfi_kwargs
-            kwargs[:rfi]           = rfi_kwargs
-            kwargs[:sqli]          = sqli_kwargs
-            kwargs[:ssti]          = ssti_kwargs
-            kwargs[:open_redirect] = open_redirect_kwargs
-            kwargs[:reflected_xss] = reflected_xss_kwargs
-
-            return kwargs
+            scan_kwargs[:reflected_xss] ||= {}
           end
 
           #

data/lib/ronin/vulns/cli/commands/sqli.rb

@@ -61,42 +61,22 @@ module Ronin
 
           usage '[options] {URL ... | --input FILE}'
 
-          option :escape_quote, short: '-Q',
-                                desc: 'Escapes quotation marks'
+          option :escape_quote, short: '-Q', desc: 'Escapes quotation marks' do
+            scan_kwargs[:escape_quote] = true
+          end
 
-          option :escape_parens, short: '-P',
-                                 desc: 'Escapes parenthesis'
+          option :escape_parens, short: '-P', desc: 'Escapes parenthesis' do
+            scan_kwargs[:escape_parens] = true
+          end
 
-          option :terminate, short: '-T',
-                             desc: 'Terminates the SQL expression with a --'
+          option :terminate, short: '-T', desc: 'Terminates the SQL expression with a --' do
+            scan_kwargs[:terminate] = true
+          end
 
           description 'Scans URL(s) for SQL injection (SQLi) vulnerabilities'
 
           man_page 'ronin-vulns-sqli.1'
 
-          #
-          # Keyword arguments for `Vulns::SQLI.scan` and `Vulns::SQLI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            if options[:escape_quote]
-              kwargs[:escape_quote] = options[:escape_quote]
-            end
-
-            if options[:escape_parens]
-              kwargs[:escape_parens] = options[:escape_parens]
-            end
-
-            if options[:terminate]
-              kwargs[:terminate] = options[:terminate]
-            end
-
-            return kwargs
-          end
-
           #
           # Scans a URL for SQLi vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/ssti.rb

@@ -67,30 +67,13 @@ module Ronin
                                usage: '{X*Y | X/Z | X+Y | X-Y}'
                              },
                              desc: 'Optional numeric test to use' do |expr|
-                               @test_expr = Vulns::SSTI::TestExpression.parse(expr)
+                               scan_kwargs[:test_expr] = Vulns::SSTI::TestExpression.parse(expr)
                              end
 
           description 'Scans URL(s) for Server Side Template Injection (SSTI) vulnerabilities'
 
           man_page 'ronin-vulns-ssti.1'
 
-          # The expression to use to test for SSTI.
-          #
-          # @return [Vulns::SSTI::TestExpression, nil]
-          attr_reader :test_expr
-
-          #
-          # Keyword arguments for `Vulns::SSTI.scan` and `Vulns::SSTI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:test_expr] = @test_expr if @test_expr
-            return kwargs
-          end
-
           #
           # Scans a URL for SSTI vulnerabilities.
           #

data/lib/ronin/vulns/cli/logging.rb

@@ -60,13 +60,13 @@ module Ronin
         def log_vuln(vuln)
           vuln_name = vuln_type(vuln)
           location  = if vuln.query_param
-                        "query param #{vuln.query_param}"
+                        "query param '#{vuln.query_param}'"
                       elsif vuln.header_name
-                        "Header #{vuln.header_name}"
+                        "Header '#{vuln.header_name}'"
                       elsif vuln.cookie_param
-                        "Cookie param #{vuln.cookie_param}"
+                        "Cookie param '#{vuln.cookie_param}'"
                       elsif vuln.form_param
-                        "form param #{vuln.form_param}"
+                        "form param '#{vuln.form_param}'"
                       end
 
           if location

data/lib/ronin/vulns/cli/web_vuln_command.rb

@@ -53,10 +53,7 @@ module Ronin
                         desc: 'Sets an additional header' do |header|
                           name, value = header.split(/:\s*/,2)
 
-                          # lazy initialize the headers
-                          @headers ||= {}
-
-                          @headers[name] = value
+                          self.headers[name] = value
                         end
 
         option :cookie, short: '-C',
@@ -65,7 +62,9 @@ module Ronin
                           usage: 'COOKIE'
                         },
                         desc: 'Sets the raw Cookie header' do |cookie|
-                          @raw_cookie = cookie
+                          cookie = Support::Network::HTTP::Cookie.parse(cookie)
+
+                          self.cookie.merge!(cookie)
                         end
 
         option :cookie_param, short: '-c',
@@ -76,10 +75,7 @@ module Ronin
                               desc: 'Sets an additional cookie param' do |param|
                                 name, value = param.split('=',2)
 
-                                # lazy initialize the cookie
-                                @cookie ||= Support::Network::HTTP::Cookie.new
-
-                                @cookie[name] = value
+                                self.cookie[name] = value
                               end
 
         option :referer, short: '-R',
@@ -88,7 +84,7 @@ module Ronin
                            usage: 'URL'
                          },
                          desc: 'Sets the Referer header' do |referer|
-                           @referer = referer
+                           self.referer = referer
                          end
 
         option :form_param, short: '-F',
@@ -99,10 +95,7 @@ module Ronin
                             desc: 'Sets an additional form param' do |param|
                               name, value = param.split('=',2)
 
-                              # lazy initialize the form data
-                              @form_data ||= {}
-
-                              @form_data[name] = value
+                              self.form_data[name] = value
                             end
 
         option :test_query_param, value: {
@@ -110,14 +103,16 @@ module Ronin
                                     usage: 'NAME'
                                   },
                                   desc: 'Tests the URL query param name' do |name|
-                                    # lazy initialize the test query params
-                                    @test_query_params ||= Set.new
-
-                                    @test_query_params << name
+                                    case (test_query_params = self.test_query_params)
+                                    when true
+                                      # no-op, test all query params
+                                    when Set
+                                      test_query_params << name
+                                    end
                                   end
 
         option :test_all_query_params, desc: 'Test all URL query param names' do
-          @test_all_query_params = true
+          self.test_query_params = true
         end
 
         option :test_header_name, value: {
@@ -125,10 +120,7 @@ module Ronin
                                     usage: 'NAME'
                                   },
                                   desc: 'Tests the HTTP Header name' do |name|
-                                    # lazy initialize the test heade rnames
-                                    @test_header_names ||= Set.new
-
-                                    @test_header_names << name
+                                    self.test_header_names << name
                                   end
 
         option :test_cookie_param, value: {
@@ -136,26 +128,25 @@ module Ronin
                                      usage: 'NAME'
                                    },
                                    desc: 'Tests the HTTP Cookie name' do |name|
-                                     # lazy initialize the test cookie params
-                                     @test_cookie_params ||= Set.new
-
-                                     @test_cookie_params << name
+                                     case (test_cookie_params = self.test_cookie_params)
+                                     when true
+                                       # no-op, test all query params
+                                     when Set
+                                       test_cookie_params << name
+                                     end
                                    end
 
         option :test_all_cookie_params, desc: 'Test all Cookie param names' do
-          @test_all_cookie_params = true
+          self.test_cookie_params = true
         end
 
         option :test_form_param, value: {
                                    type: String,
-                                     usage: 'NAME'
+                                   usage: 'NAME'
                                  },
-                                   desc: 'Tests the form param name' do |name|
-                                     # lazy initialize the test form params
-                                     @test_form_params ||= Set.new
-
-                                     @test_form_params << name
-                                   end
+                                 desc: 'Tests the form param name' do |name|
+                                   self.test_form_params << name
+                                 end
 
         option :input, short: '-i',
                        value: {
@@ -175,60 +166,11 @@ module Ronin
         #   * `:all` - Find all vulnerabilities for each URL.
         attr_reader :scan_mode
 
-        # Additional headers.
-        #
-        # @return [Hash{String => String}, nil]
-        attr_reader :headers
-
-        # The raw `Cookie` header to send.
-        #
-        # @return [String, nil]
-        attr_reader :raw_cookie
-
-        # The optional `Cookie` header to send.
-        #
-        # @return [Ronin::Support::Network::HTTP::Cookie, nil]
-        attr_reader :cookie
-
-        # The optional `Referer` header to send.
-        #
-        # @return [String, nil]
-        attr_reader :referer
-
-        # Additional form params.
-        #
-        # @return [Hash{String => String}, nil]
-        attr_reader :form_data
-
-        # The URL query params to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_query_params
-
-        # Indicates whether to test all of the query params of the URL.
-        #
-        # @return [Boolean, nil]
-        attr_reader :test_all_query_params
-
-        # The HTTP Header names to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_header_names
-
-        # The HTTP Cookie to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_cookie_params
-
-        # Indicates whether to test all `Cookie` params for the URL.
+        # Keywrod arguments that will be used in {#scan_url} and {#test_url} to
+        # call {WebVuln.scan} or {WebVuln.test}.
         #
-        # @return [Boolean, nil]
-        attr_reader :test_all_cookie_params
-
-        # The form params to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_form_params
+        # @return [Hash{Symbol => Object}]
+        attr_reader :scan_kwargs
 
         #
         # Initializes the command.
@@ -239,7 +181,8 @@ module Ronin
         def initialize(**kwargs)
           super(**kwargs)
 
-          @scan_mode = :first
+          @scan_mode   = :first
+          @scan_kwargs = {}
         end
 
         #
@@ -308,42 +251,111 @@ module Ronin
         end
 
         #
-        # The keyword arguments for {WebVuln.scan}.
+        # Additional headers.
         #
         # @return [Hash{String => String}]
-        #   The keyword arguments.
         #
-        def scan_kwargs
-          kwargs = {}
+        def headers
+          @scan_kwargs[:headers] ||= {}
+        end
+
+        #
+        # The optional `Cookie` header to send.
+        #
+        # @return [Ronin::Support::Network::HTTP::Cookie]
+        #
+        def cookie
+          @scan_kwargs[:cookie] ||= Support::Network::HTTP::Cookie.new
+        end
 
-          kwargs[:headers] = @headers if @headers
+        #
+        # The optional HTTP `Referer` header to send.
+        #
+        # @return [String, nil]
+        #
+        def referer
+          @scan_kwargs[:referer]
+        end
 
-          if @raw_cookie
-            kwargs[:cookie] = @raw_cookie
-          elsif @cookie
-            kwargs[:cookie] = @cookie
-          end
+        #
+        # Sets the HTTP `Referer` header to send.
+        #
+        # @param [String, nil] new_referer
+        #   The new `Referer` header to send.
+        #
+        # @return [String, nil]
+        #
+        def referer=(new_referer)
+          @scan_kwargs[:referer] = new_referer
+        end
 
-          kwargs[:referer]   = @referer   if @referer
-          kwargs[:form_data] = @form_data if @form_data
+        #
+        # Additional form params.
+        #
+        # @return [Hash{String => String}, nil]
+        #
+        def form_data
+          @scan_kwargs[:form_data] ||= {}
+        end
 
-          if @test_query_params
-            kwargs[:query_params]  = @test_query_params
-          elsif @test_all_query_params
-            kwargs[:query_params]  = true
-          end
+        #
+        # The URL query params to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_query_params
+          @scan_kwargs[:query_params] ||= Set.new
+        end
+
+        #
+        # Sets the URL query params to test.
+        #
+        # @param [Set<String>, true] new_query_params
+        #   The query params to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_query_params=(new_query_params)
+          @scan_kwargs[:query_params] = new_query_params
+        end
 
-          kwargs[:header_names] = @test_header_names if @test_header_names
+        #
+        # The HTTP Header names to test.
+        #
+        # @return [Set<String>]
+        #
+        def test_header_names
+          @scan_kwargs[:header_names] ||= Set.new
+        end
 
-          if @test_cookie_params
-            kwargs[:cookie_params] = @test_cookie_params
-          elsif @test_all_cookie_params
-            kwargs[:cookie_params] = true
-          end
+        #
+        # The HTTP Cookie to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_cookie_params
+          @scan_kwargs[:cookie_params] ||= Set.new
+        end
 
-          kwargs[:form_params] = @test_form_params if @test_form_params
+        #
+        # Sets the HTTP Cookie to test.
+        #
+        # @param [Set<String>, true] new_cookie_params
+        #   The new cookie param names to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_cookie_params=(new_cookie_params)
+          @scan_kwargs[:cookie_params] = new_cookie_params
+        end
 
-          return kwargs
+        #
+        # The form params to test.
+        #
+        # @return [Set<String>, nil]
+        #
+        def test_form_params
+          @scan_kwargs[:form_params] ||= Set.new
         end
 
         #

data/lib/ronin/vulns/reflected_xss/context.rb

@@ -30,7 +30,7 @@ module Ronin
 
         # Where in the HTML the XSS occurs.
         #
-        # @return [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body]
+        # @return [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body, :comment]
         #   The context which the XSS occurs in.
         #   * `:tag_body` occurred within a tag's body (ex: `<tag>XSS...</tag>`)
         #   * `:double_quoted_attr_value` - occurred in a double quoted
@@ -44,13 +44,14 @@ module Ronin
         #   * `:attr_list` - occurred in the attribute list
         #     (ex: `<tag XSS>...</tag>`)
         #   * `:tag_name` - occurred in the tag name (ex: `<tagXSS>...</tag>`)
+        #   * `:comment` - occurred in a comment (ex: `<!-- XSS -->`)
         #
         # @api public
         attr_reader :location
 
         # The name of the parent tag which the XSS occurs in.
         #
-        # @return [String]
+        # @return [String, nil]
         #
         # @api public
         attr_reader :tag
@@ -65,9 +66,9 @@ module Ronin
         #
         # Initializes the context.
         #
-        # @param [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body] location
+        # @param [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body, :comment] location
         #
-        # @param [String] tag
+        # @param [String, nil] tag
         #
         # @param [String, nil] attr
         #
@@ -100,6 +101,11 @@ module Ronin
         # @api private
         ATTR_LIST = /(?:\s+#{ATTR})*/
 
+        # HTML comment regexp.
+        #
+        # @api private
+        COMMENT = /<![^>]*>/
+
         # HTML tag name regexp.
         #
         # @api private
@@ -108,7 +114,7 @@ module Ronin
         # Regexp matching when an XSS occurs within a tag's inner HTML.
         #
         # @api private
-        IN_TAG_BODY = %r{<(#{TAG_NAME})#{ATTR_LIST}\s*(?:>|/>)[^<>]*\z}
+        IN_TAG_BODY = %r{<(#{TAG_NAME})#{ATTR_LIST}\s*(?:>|/>)([^<>]|#{COMMENT})*\z}
 
         # Regexp matching when an XSS occurs within a double-quoted attribute
         # value.
@@ -142,6 +148,11 @@ module Ronin
         # @api private
         IN_TAG_NAME = /<(#{TAG_NAME})\z/
 
+        # Regexp matching when an XSS occurs within a comment.
+        #
+        # @api private
+        IN_COMMENT = /<![^>]*\z/
+
         #
         # Determine the context of the XSS by checking the characters that come
         # before the given index.
@@ -174,6 +185,8 @@ module Ronin
             new(:attr_list, tag: match[1])
           elsif (match = prefix.match(IN_TAG_NAME))
             new(:tag_name, tag: match[1])
+          elsif prefix.match?(IN_COMMENT)
+            new(:comment)
           end
         end
 
@@ -193,7 +206,8 @@ module Ronin
           attr_name: MINIMAL_REQUIRED_CHARS,
           attr_list: MINIMAL_REQUIRED_CHARS,
           tag_name:  MINIMAL_REQUIRED_CHARS,
-          tag_body:  MINIMAL_REQUIRED_CHARS
+          tag_body:  MINIMAL_REQUIRED_CHARS,
+          comment:   MINIMAL_REQUIRED_CHARS
         }
 
         #

data/lib/ronin/vulns/sqli.rb

@@ -105,6 +105,18 @@ module Ronin
       # @param [URI::HTTP, String] url
       #   The URL to test or exploit.
       #
+      # @param [Array<Boolean>, Boolean] escape_quote
+      #   Controls whether to escape a quoted string value. If not specified,
+      #   with and without quoted string escaping will be tested.
+      #
+      # @param [Array<Boolean>, Boolean] escape_parens
+      #   Controls whether to escape parenthesis. If not specified, with and
+      #   without parenthesis escaping will be tested.
+      #
+      # @param [Array<Boolean>, Boolean] terminate
+      #   Controls whether to terminate the SQL statement with `--`.
+      #   If not specified, with and without `--` terminate will be tested.
+      #
       # @param [Ronin::Support::Network::HTTP, nil] http
       #   An HTTP session to use for testing the URL.
       #
@@ -115,28 +127,28 @@ module Ronin
       #   If a block is given it will be yielded each discovered SQL injection
       #   vulnerability.
       #
-      # @yieldparam [SQLi] sqli
+      # @yieldparam [SQLI] sqli
       #   A discovered SQL injection vulnerability in the URL.
       #
-      # @return [Array<SQLi>]
+      # @return [Array<SQLI>]
       #   All discovered SQL injection vulnerabilities.
       #
-      def self.scan(url, http: nil, **kwargs, &block)
+      def self.scan(url, escape_quote:  [false, true],
+                         escape_parens: [false, true],
+                         terminate:     [false, true],
+                         # WebVuln.scan keyword arguments
+                         http: nil, **kwargs, &block)
         url    = URI(url)
         http ||= Support::Network::HTTP.connect_uri(url)
 
-        escape_quotes = [false, true]
-        escape_parens = [false, true]
-        terminations  = [false, true]
-
         vulns = []
 
-        escape_quotes.each do |escape_quote|
-          escape_parens.each do |escape_paren|
-            terminations.each do |terminate|
-              vulns.concat(super(url, escape_quote:    escape_quote,
-                                      escape_parens:   escape_paren,
-                                      terminate:       terminate,
+        Array(escape_quote).each do |escape_quote_value|
+          Array(escape_parens).each do |escape_parens_value|
+            Array(terminate).each do |terminate_value|
+              vulns.concat(super(url, escape_quote:    escape_quote_value,
+                                      escape_parens:   escape_parens_value,
+                                      terminate:       terminate_value,
                                       http:            http,
                                       **kwargs,
                                       &block))

data/lib/ronin/vulns/ssti.rb

@@ -102,13 +102,13 @@ module Ronin
       # @param [URI::HTTP, String] url
       #   The URL to scan.
       #
-      # @param [Hash{Symbol => Object}] kwargs
-      #   Additional keyword arguments for {#initialize}.
-      #
-      # @option kwargs [Proc, nil] :escape
+      # @param [Array<Proc>, Proc, nil] escape
       #   The escape method to use. If `escape:` is not given, then all escapes
       #   in {ESCAPES} will be tested..
       #
+      # @param [Hash{Symbol => Object}] kwargs
+      #   Additional keyword arguments for {#initialize}.
+      #
       # @option kwargs [Array<Symbol, String>, Symbol, String, true, nil] :query_params
       #   The query param name(s) to test.
       #
@@ -145,14 +145,14 @@ module Ronin
       # @return [Array<SSTI>]
       #   All discovered SSTI vulnerabilities.
       #
-      def self.scan(url, **kwargs,&block)
-        if kwargs.has_key?(:escape)
-          super(url, **kwargs, &block)
-        else
-          ESCAPES.each do |escape|
-            super(url, escape: escape, **kwargs, &block)
-          end
+      def self.scan(url, escape: ESCAPES, **kwargs,&block)
+        vulns = []
+
+        Array(escape).each do |escape_char|
+          vulns.concat(super(url, escape: escape_char, **kwargs, &block))
         end
+
+        return vulns
       end
 
       #

data/lib/ronin/vulns/version.rb

@@ -21,6 +21,6 @@
 module Ronin
   module Vulns
     # The ronin-vulns version
-    VERSION = '0.1.2'
+    VERSION = '0.1.4'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ronin-vulns
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - Postmodern
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-02 00:00:00.000000000 Z
+date: 2023-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ronin-support