ronin-vulns 0.1.3 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b260c485d9272af5724bed43fc2959995463f8b78e276bf669d1bb98740e917c
-  data.tar.gz: de99077b9d9fe73bd167309af9c7c6d7688bd03a02d2af9bd2fc8eae133aa43a
+  metadata.gz: 782fb72c980f9466dd49b736e941d1d4bf092066bdb2894c776f7610bb0ee049
+  data.tar.gz: 732c6cf18098e86aa1d600e7607fb8110a903ea76391901977574faff167b550
 SHA512:
-  metadata.gz: 1f4ce00d82035a11ade026eb6deee9be1244b499d692e47d4961be3cfc2a2dd9d8c609b6c11c5fab72e454f5ccc60adf9dd6ab7e4ceced5b0df9ea27fc18ec27
-  data.tar.gz: fb41c677b9eaf56c3cc3fabc028db365061ed98e745dfc3bf942238ebd6c2b642716a2e5dc7f010bb9fa2249112bf4ab66db715d35221783104a3702c694aeea
+  metadata.gz: a636b00ea3642dadf7ee2f1c1b4a498f5b8e107d46c7ed64aac115cb1788b395de343c5ac7683eef0b3556128e9466e8228782ae453d337cae46ef0c280369fa
+  data.tar.gz: e610ebe869ae47cc6ea5ab6c6cd548838da9873943f3d64317ff4682d36bfa172de79df5fff4a53a8d37936a83ada614d4fdc4c1d374eed08cb51a3f9ab421a0

data/.github/workflows/ruby.yml

@@ -12,11 +12,12 @@ jobs:
           - '3.0'
           - '3.1'
           - '3.2'
+          - '3.3'
           # - jruby
           - truffleruby
     name: Ruby ${{ matrix.ruby }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -35,7 +36,7 @@ jobs:
   rubocop:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

data/ChangeLog.md

@@ -1,3 +1,25 @@
+### 0.1.5 / 2024-06-19
+
+* Improve the accuracy of {Ronin::Vulns::OpenRedirect#vulnerable?} when
+  detecting open redirects in meta-refresh HTML tags.
+  * Match the test URL when it ends with `?...`, `&...`, or `&...`.
+  * Detect when the test URL has an additional string appended to it
+    (ex: `.html`). The appended string can easily be bypassed by adding a
+    `?`, `&`, or `#` character to the end of the test URL.
+
+### 0.1.4 / 2023-09-19
+
+#### CLI
+
+* Improved the performance of `ronin-vulns` commands when scanning multiple URLs
+  or a file of URLs by not rebuilding an identical
+  {Ronin::Vulns::CLI::WebVulnCommand#scan_kwargs} for each URL.
+* Allow the `--cookie "..."` option to be repeated multiple times and merge the
+  cookie strings together.
+* Allow the `--cookie-param NAME=VALUE` option to be used with the
+  `--cookie "..."` option and merge the cookie values together.
+* Print vulnerable param names in single quotes.
+
 ### 0.1.3 / 2023-07-07
 
 * Fixed a bug in {Ronin::Vulns::SSTI.scan} where when called without `escape:`

data/README.md

@@ -9,7 +9,6 @@
 * [Issues](https://github.com/ronin-rb/ronin-vulns/issues)
 * [Documentation](https://ronin-rb.dev/docs/ronin-vulns/frames)
 * [Discord](https://discord.gg/6WAb3PsVX9) |
-  [Twitter](https://twitter.com/ronin_rb) |
   [Mastodon](https://infosec.exchange/@ronin_rb)
 
 ## Description

data/lib/ronin/vulns/cli/commands/lfi.rb

@@ -66,14 +66,18 @@ module Ronin
                       value: {
                         type: [:unix, :windows]
                       },
-                      desc: 'Sets the OS to test for'
+                      desc: 'Sets the OS to test for' do |os|
+                        scan_kwargs[:os] = os
+                      end
 
           option :depth, short: '-D',
                          value: {
                            type:  Integer,
                            usage: 'COUNT'
                          },
-                         desc: 'Sets the directory depth to escape up'
+                         desc: 'Sets the directory depth to escape up' do |depth|
+                           scan_kwargs[:depth] = depth
+                         end
 
           option :filter_bypass, short: '-B',
                                  value: {
@@ -85,30 +89,14 @@ module Ronin
                                      :zlib
                                    ]
                                  },
-                                 desc: 'Sets the filter bypass strategy to use'
+                                 desc: 'Sets the filter bypass strategy to use' do |filter_bypass|
+                                   scan_kwargs[:filter_bypass] = filter_bypass
+                                 end
 
           description 'Scans URL(s) for Local File Inclusion (LFI) vulnerabilities'
 
           man_page 'ronin-vulns-lfi.1'
 
-          #
-          # Keyword arguments for `Vulns::LFI.scan` and `Vulns::LFI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:os]    = options[:os]    if options[:os]
-            kwargs[:depth] = options[:depth] if options[:depth]
-
-            if options[:filter_bypass]
-              kwargs[:filter_bypass] = options[:filter_bypass]
-            end
-
-            return kwargs
-          end
-
           #
           # Scans a URL for LFI vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/open_redirect.rb

@@ -64,25 +64,14 @@ module Ronin
                               type:  String,
                               usage: 'URL'
                             },
-                            desc: 'Optional test URL to try to redirect to'
+                            desc: 'Optional test URL to try to redirect to' do |test_url|
+                              scan_kwargs[:test_url] = test_url
+                            end
 
           description 'Scans URL(s) for Open Redirect vulnerabilities'
 
           man_page 'ronin-vulns-open-redirect.1'
 
-          #
-          # Keyword arguments for `Vulns::OpenRedirect.scan` and
-          # `Vulns::OpenRedirect.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:test_url] = options[:test_url] if options[:test_url]
-            return kwargs
-          end
-
           #
           # Scans a URL for Open Redirect vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/rfi.rb

@@ -71,7 +71,9 @@ module Ronin
                                      'null-byte'     => :null_byte
                                    }
                                  },
-                                 desc: 'Optional filter-bypass strategy to use'
+                                 desc: 'Optional filter-bypass strategy to use' do |filter_bypass|
+                                   scan_kwargs[:filter_bypass] = filter_bypass
+                                 end
 
           option :script_lang, short: '-S',
                                value: {
@@ -84,42 +86,23 @@ module Ronin
                                    'perl'       => :perl
                                  }
                                },
-                               desc: 'Explicitly specify the scripting language to test for'
+                               desc: 'Explicitly specify the scripting language to test for' do |script_lang|
+                                 scan_kwargs[:script_lang] = script_lang
+                               end
 
           option :test_script_url, short: '-T',
                                    value: {
                                      type:  String,
                                      usage: 'URL'
                                    },
-                                   desc: 'Use an alternative test script URL'
+                                   desc: 'Use an alternative test script URL' do |test_script_url|
+                                     scan_kwargs[:test_script_url] = test_script_url
+                                   end
 
           description 'Scans URL(s) for Remote File Inclusion (RFI) vulnerabilities'
 
           man_page 'ronin-vulns-rfi.1'
 
-          #
-          # Keyword arguments for `Vulns::RFI.scan` and `Vulns::RFI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            if options[:filter_bypass]
-              kwargs[:filter_bypass] = options[:filter_bypass]
-            end
-
-            if options[:script_lang]
-              kwargs[:script_lang] = options[:script_lang]
-            end
-
-            if options[:test_script_url]
-              kwargs[:test_script_url] = options[:test_script_url]
-            end
-
-            return kwargs
-          end
-
           #
           # Scans a URL for RFI vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/scan.rb

@@ -74,13 +74,17 @@ module Ronin
           option :lfi_os, value: {
                             type: [:unix, :windows]
                           },
-                          desc: 'Sets the OS to test for'
+                          desc: 'Sets the OS to test for' do |os|
+                            lfi_kwargs[:os] = os
+                          end
 
           option :lfi_depth, value: {
                                type:  Integer,
                                usage: 'COUNT'
                              },
-                             desc: 'Sets the directory depth to escape up'
+                             desc: 'Sets the directory depth to escape up' do |depth|
+                               lfi_kwargs[:depth] = depth
+                             end
 
           option :lfi_filter_bypass, value: {
                                        type: [
@@ -91,7 +95,9 @@ module Ronin
                                          :zlib
                                        ]
                                      },
-                                     desc: 'Sets the filter bypass strategy to use'
+                                     desc: 'Sets the filter bypass strategy to use' do |filter_bypass|
+                                       lfi_kwargs[:filter_bypass] = filter_bypass
+                                     end
 
           option :rfi_filter_bypass, value: {
                                        type: {
@@ -100,7 +106,9 @@ module Ronin
                                          'null-byte'     => :null_byte
                                        }
                                      },
-                                     desc: 'Optional filter-bypass strategy to use'
+                                     desc: 'Optional filter-bypass strategy to use' do |filter_bypass|
+                                       rfi_kwargs[:filter_bypass] = filter_bypass
+                                     end
 
           option :rfi_script_lang, value: {
                                      type:  {
@@ -112,33 +120,45 @@ module Ronin
                                        'perl'       => :perl
                                      }
                                    },
-                                   desc: 'Explicitly specify the scripting language to test for'
+                                   desc: 'Explicitly specify the scripting language to test for' do |script_lang|
+                                     rfi_kwargs[:script_lang] = script_lang
+                                   end
 
           option :rfi_test_script_url, value: {
                                          type:  String,
                                          usage: 'URL'
                                        },
-                                       desc: 'Use an alternative test script URL'
+                                       desc: 'Use an alternative test script URL' do |test_script_url|
+                                         rfi_kwargs[:test_script_url] = test_script_url
+                                       end
 
-          option :sqli_escape_quote, desc: 'Escapes quotation marks'
+          option :sqli_escape_quote, desc: 'Escapes quotation marks' do
+            sqli_kwargs[:escape_quote] = true
+          end
 
-          option :sqli_escape_parens, desc: 'Escapes parenthesis'
+          option :sqli_escape_parens, desc: 'Escapes parenthesis' do
+            sqli_kwargs[:escape_parens] = true
+          end
 
-          option :sqli_terminate, desc: 'Terminates the SQL expression with a --'
+          option :sqli_terminate, desc: 'Terminates the SQL expression with a --' do
+            sqli_kwargs[:terminate] = true
+          end
 
           option :ssti_test_expr, value: {
                                     type: %r{\A\d+\s*[\*/\+\-]\s*\d+\z},
                                     usage: '{X*Y | X/Z | X+Y | X-Y}'
                                   },
                                   desc: 'Optional numeric test to use' do |expr|
-                                    @ssti_test_expr = Vulns::SSTI::TestExpression.parse(expr)
+                                    ssti_kwargs[:test_expr] = Vulns::SSTI::TestExpression.parse(expr)
                                   end
 
           option :open_redirect_url, value: {
                                        type:  String,
                                        usage: 'URL'
                                      },
-                                     desc: 'Optional test URL to try to redirect to'
+                                     desc: 'Optional test URL to try to redirect to' do |test_url|
+                                       open_redirect_kwargs[:test_url] = test_url
+                                     end
 
           description 'Scans URL(s) for web vulnerabilities'
 
@@ -151,16 +171,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def lfi_kwargs
-            kwargs = {}
-
-            kwargs[:os]    = options[:lfi_os]    if options[:lfi_os]
-            kwargs[:depth] = options[:lfi_depth] if options[:lfi_depth]
-
-            if options[:lfi_filter_bypass]
-              kwargs[:filter_bypass] = options[:lfi_filter_bypass]
-            end
-
-            return kwargs
+            scan_kwargs[:lfi] ||= {}
           end
 
           #
@@ -170,21 +181,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def rfi_kwargs
-            kwargs = {}
-
-            if options[:rfi_filter_bypass]
-              kwargs[:filter_bypass] = options[:rfi_filter_bypass]
-            end
-
-            if options[:rfi_script_lang]
-              kwargs[:script_lang] = options[:rfi_script_lang]
-            end
-
-            if options[:rfi_test_script_url]
-              kwargs[:test_script_url] = options[:rfi_test_script_url]
-            end
-
-            return kwargs
+            scan_kwargs[:rfi] ||= {}
           end
 
           #
@@ -194,21 +191,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def sqli_kwargs
-            kwargs = {}
-
-            if options[:sqli_escape_quote]
-              kwargs[:escape_quote] = options[:sqli_escape_quote]
-            end
-
-            if options[:sqli_escape_parens]
-              kwargs[:escape_parens] = options[:sqli_escape_parens]
-            end
-
-            if options[:sqli_terminate]
-              kwargs[:terminate] = options[:sqli_terminate]
-            end
-
-            return kwargs
+            scan_kwargs[:sqli] ||= {}
           end
 
           #
@@ -218,11 +201,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def ssti_kwargs
-            kwargs = {}
-
-            kwargs[:test_expr] = @ssti_test_expr if @ssti_test_expr
-
-            return kwargs
+            scan_kwargs[:ssti] ||= {}
           end
 
           #
@@ -232,13 +211,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def open_redirect_kwargs
-            kwargs = {}
-
-            if options[:open_redirect_url]
-              kwargs[:test_url] = options[:open_redirect_url]
-            end
-
-            return kwargs
+            scan_kwargs[:open_redirect] ||= {}
           end
 
           #
@@ -248,26 +221,7 @@ module Ronin
           # @return [Hash{Symbol => Object}]
           #
           def reflected_xss_kwargs
-            {}
-          end
-
-          #
-          # Keyword arguments for `Vulns::URLScanner.scan` and
-          # `Vulns::URLScanner.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:lfi]           = lfi_kwargs
-            kwargs[:rfi]           = rfi_kwargs
-            kwargs[:sqli]          = sqli_kwargs
-            kwargs[:ssti]          = ssti_kwargs
-            kwargs[:open_redirect] = open_redirect_kwargs
-            kwargs[:reflected_xss] = reflected_xss_kwargs
-
-            return kwargs
+            scan_kwargs[:reflected_xss] ||= {}
           end
 
           #

data/lib/ronin/vulns/cli/commands/sqli.rb

@@ -61,42 +61,22 @@ module Ronin
 
           usage '[options] {URL ... | --input FILE}'
 
-          option :escape_quote, short: '-Q',
-                                desc: 'Escapes quotation marks'
+          option :escape_quote, short: '-Q', desc: 'Escapes quotation marks' do
+            scan_kwargs[:escape_quote] = true
+          end
 
-          option :escape_parens, short: '-P',
-                                 desc: 'Escapes parenthesis'
+          option :escape_parens, short: '-P', desc: 'Escapes parenthesis' do
+            scan_kwargs[:escape_parens] = true
+          end
 
-          option :terminate, short: '-T',
-                             desc: 'Terminates the SQL expression with a --'
+          option :terminate, short: '-T', desc: 'Terminates the SQL expression with a --' do
+            scan_kwargs[:terminate] = true
+          end
 
           description 'Scans URL(s) for SQL injection (SQLi) vulnerabilities'
 
           man_page 'ronin-vulns-sqli.1'
 
-          #
-          # Keyword arguments for `Vulns::SQLI.scan` and `Vulns::SQLI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            if options[:escape_quote]
-              kwargs[:escape_quote] = options[:escape_quote]
-            end
-
-            if options[:escape_parens]
-              kwargs[:escape_parens] = options[:escape_parens]
-            end
-
-            if options[:terminate]
-              kwargs[:terminate] = options[:terminate]
-            end
-
-            return kwargs
-          end
-
           #
           # Scans a URL for SQLi vulnerabilities.
           #

data/lib/ronin/vulns/cli/commands/ssti.rb

@@ -67,30 +67,13 @@ module Ronin
                                usage: '{X*Y | X/Z | X+Y | X-Y}'
                              },
                              desc: 'Optional numeric test to use' do |expr|
-                               @test_expr = Vulns::SSTI::TestExpression.parse(expr)
+                               scan_kwargs[:test_expr] = Vulns::SSTI::TestExpression.parse(expr)
                              end
 
           description 'Scans URL(s) for Server Side Template Injection (SSTI) vulnerabilities'
 
           man_page 'ronin-vulns-ssti.1'
 
-          # The expression to use to test for SSTI.
-          #
-          # @return [Vulns::SSTI::TestExpression, nil]
-          attr_reader :test_expr
-
-          #
-          # Keyword arguments for `Vulns::SSTI.scan` and `Vulns::SSTI.test`.
-          #
-          # @return [Hash{Symbol => Object}]
-          #
-          def scan_kwargs
-            kwargs = super()
-
-            kwargs[:test_expr] = @test_expr if @test_expr
-            return kwargs
-          end
-
           #
           # Scans a URL for SSTI vulnerabilities.
           #

data/lib/ronin/vulns/cli/logging.rb

@@ -60,13 +60,13 @@ module Ronin
         def log_vuln(vuln)
           vuln_name = vuln_type(vuln)
           location  = if vuln.query_param
-                        "query param #{vuln.query_param}"
+                        "query param '#{vuln.query_param}'"
                       elsif vuln.header_name
-                        "Header #{vuln.header_name}"
+                        "Header '#{vuln.header_name}'"
                       elsif vuln.cookie_param
-                        "Cookie param #{vuln.cookie_param}"
+                        "Cookie param '#{vuln.cookie_param}'"
                       elsif vuln.form_param
-                        "form param #{vuln.form_param}"
+                        "form param '#{vuln.form_param}'"
                       end
 
           if location

data/lib/ronin/vulns/cli/web_vuln_command.rb

@@ -53,10 +53,7 @@ module Ronin
                         desc: 'Sets an additional header' do |header|
                           name, value = header.split(/:\s*/,2)
 
-                          # lazy initialize the headers
-                          @headers ||= {}
-
-                          @headers[name] = value
+                          self.headers[name] = value
                         end
 
         option :cookie, short: '-C',
@@ -65,7 +62,9 @@ module Ronin
                           usage: 'COOKIE'
                         },
                         desc: 'Sets the raw Cookie header' do |cookie|
-                          @raw_cookie = cookie
+                          cookie = Support::Network::HTTP::Cookie.parse(cookie)
+
+                          self.cookie.merge!(cookie)
                         end
 
         option :cookie_param, short: '-c',
@@ -76,10 +75,7 @@ module Ronin
                               desc: 'Sets an additional cookie param' do |param|
                                 name, value = param.split('=',2)
 
-                                # lazy initialize the cookie
-                                @cookie ||= Support::Network::HTTP::Cookie.new
-
-                                @cookie[name] = value
+                                self.cookie[name] = value
                               end
 
         option :referer, short: '-R',
@@ -88,7 +84,7 @@ module Ronin
                            usage: 'URL'
                          },
                          desc: 'Sets the Referer header' do |referer|
-                           @referer = referer
+                           self.referer = referer
                          end
 
         option :form_param, short: '-F',
@@ -99,10 +95,7 @@ module Ronin
                             desc: 'Sets an additional form param' do |param|
                               name, value = param.split('=',2)
 
-                              # lazy initialize the form data
-                              @form_data ||= {}
-
-                              @form_data[name] = value
+                              self.form_data[name] = value
                             end
 
         option :test_query_param, value: {
@@ -110,14 +103,16 @@ module Ronin
                                     usage: 'NAME'
                                   },
                                   desc: 'Tests the URL query param name' do |name|
-                                    # lazy initialize the test query params
-                                    @test_query_params ||= Set.new
-
-                                    @test_query_params << name
+                                    case (test_query_params = self.test_query_params)
+                                    when true
+                                      # no-op, test all query params
+                                    when Set
+                                      test_query_params << name
+                                    end
                                   end
 
         option :test_all_query_params, desc: 'Test all URL query param names' do
-          @test_all_query_params = true
+          self.test_query_params = true
         end
 
         option :test_header_name, value: {
@@ -125,10 +120,7 @@ module Ronin
                                     usage: 'NAME'
                                   },
                                   desc: 'Tests the HTTP Header name' do |name|
-                                    # lazy initialize the test heade rnames
-                                    @test_header_names ||= Set.new
-
-                                    @test_header_names << name
+                                    self.test_header_names << name
                                   end
 
         option :test_cookie_param, value: {
@@ -136,26 +128,25 @@ module Ronin
                                      usage: 'NAME'
                                    },
                                    desc: 'Tests the HTTP Cookie name' do |name|
-                                     # lazy initialize the test cookie params
-                                     @test_cookie_params ||= Set.new
-
-                                     @test_cookie_params << name
+                                     case (test_cookie_params = self.test_cookie_params)
+                                     when true
+                                       # no-op, test all query params
+                                     when Set
+                                       test_cookie_params << name
+                                     end
                                    end
 
         option :test_all_cookie_params, desc: 'Test all Cookie param names' do
-          @test_all_cookie_params = true
+          self.test_cookie_params = true
         end
 
         option :test_form_param, value: {
                                    type: String,
-                                     usage: 'NAME'
+                                   usage: 'NAME'
                                  },
-                                   desc: 'Tests the form param name' do |name|
-                                     # lazy initialize the test form params
-                                     @test_form_params ||= Set.new
-
-                                     @test_form_params << name
-                                   end
+                                 desc: 'Tests the form param name' do |name|
+                                   self.test_form_params << name
+                                 end
 
         option :input, short: '-i',
                        value: {
@@ -175,60 +166,11 @@ module Ronin
         #   * `:all` - Find all vulnerabilities for each URL.
         attr_reader :scan_mode
 
-        # Additional headers.
-        #
-        # @return [Hash{String => String}, nil]
-        attr_reader :headers
-
-        # The raw `Cookie` header to send.
-        #
-        # @return [String, nil]
-        attr_reader :raw_cookie
-
-        # The optional `Cookie` header to send.
-        #
-        # @return [Ronin::Support::Network::HTTP::Cookie, nil]
-        attr_reader :cookie
-
-        # The optional `Referer` header to send.
-        #
-        # @return [String, nil]
-        attr_reader :referer
-
-        # Additional form params.
-        #
-        # @return [Hash{String => String}, nil]
-        attr_reader :form_data
-
-        # The URL query params to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_query_params
-
-        # Indicates whether to test all of the query params of the URL.
-        #
-        # @return [Boolean, nil]
-        attr_reader :test_all_query_params
-
-        # The HTTP Header names to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_header_names
-
-        # The HTTP Cookie to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_cookie_params
-
-        # Indicates whether to test all `Cookie` params for the URL.
+        # Keywrod arguments that will be used in {#scan_url} and {#test_url} to
+        # call {WebVuln.scan} or {WebVuln.test}.
         #
-        # @return [Boolean, nil]
-        attr_reader :test_all_cookie_params
-
-        # The form params to test.
-        #
-        # @return [Set<String>, nil]
-        attr_reader :test_form_params
+        # @return [Hash{Symbol => Object}]
+        attr_reader :scan_kwargs
 
         #
         # Initializes the command.
@@ -239,7 +181,8 @@ module Ronin
         def initialize(**kwargs)
           super(**kwargs)
 
-          @scan_mode = :first
+          @scan_mode   = :first
+          @scan_kwargs = {}
         end
 
         #
@@ -308,42 +251,111 @@ module Ronin
         end
 
         #
-        # The keyword arguments for {WebVuln.scan}.
+        # Additional headers.
         #
         # @return [Hash{String => String}]
-        #   The keyword arguments.
         #
-        def scan_kwargs
-          kwargs = {}
+        def headers
+          @scan_kwargs[:headers] ||= {}
+        end
+
+        #
+        # The optional `Cookie` header to send.
+        #
+        # @return [Ronin::Support::Network::HTTP::Cookie]
+        #
+        def cookie
+          @scan_kwargs[:cookie] ||= Support::Network::HTTP::Cookie.new
+        end
 
-          kwargs[:headers] = @headers if @headers
+        #
+        # The optional HTTP `Referer` header to send.
+        #
+        # @return [String, nil]
+        #
+        def referer
+          @scan_kwargs[:referer]
+        end
 
-          if @raw_cookie
-            kwargs[:cookie] = @raw_cookie
-          elsif @cookie
-            kwargs[:cookie] = @cookie
-          end
+        #
+        # Sets the HTTP `Referer` header to send.
+        #
+        # @param [String, nil] new_referer
+        #   The new `Referer` header to send.
+        #
+        # @return [String, nil]
+        #
+        def referer=(new_referer)
+          @scan_kwargs[:referer] = new_referer
+        end
 
-          kwargs[:referer]   = @referer   if @referer
-          kwargs[:form_data] = @form_data if @form_data
+        #
+        # Additional form params.
+        #
+        # @return [Hash{String => String}, nil]
+        #
+        def form_data
+          @scan_kwargs[:form_data] ||= {}
+        end
 
-          if @test_query_params
-            kwargs[:query_params]  = @test_query_params
-          elsif @test_all_query_params
-            kwargs[:query_params]  = true
-          end
+        #
+        # The URL query params to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_query_params
+          @scan_kwargs[:query_params] ||= Set.new
+        end
+
+        #
+        # Sets the URL query params to test.
+        #
+        # @param [Set<String>, true] new_query_params
+        #   The query params to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_query_params=(new_query_params)
+          @scan_kwargs[:query_params] = new_query_params
+        end
 
-          kwargs[:header_names] = @test_header_names if @test_header_names
+        #
+        # The HTTP Header names to test.
+        #
+        # @return [Set<String>]
+        #
+        def test_header_names
+          @scan_kwargs[:header_names] ||= Set.new
+        end
 
-          if @test_cookie_params
-            kwargs[:cookie_params] = @test_cookie_params
-          elsif @test_all_cookie_params
-            kwargs[:cookie_params] = true
-          end
+        #
+        # The HTTP Cookie to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_cookie_params
+          @scan_kwargs[:cookie_params] ||= Set.new
+        end
 
-          kwargs[:form_params] = @test_form_params if @test_form_params
+        #
+        # Sets the HTTP Cookie to test.
+        #
+        # @param [Set<String>, true] new_cookie_params
+        #   The new cookie param names to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_cookie_params=(new_cookie_params)
+          @scan_kwargs[:cookie_params] = new_cookie_params
+        end
 
-          return kwargs
+        #
+        # The form params to test.
+        #
+        # @return [Set<String>, nil]
+        #
+        def test_form_params
+          @scan_kwargs[:form_params] ||= Set.new
         end
 
         #

data/lib/ronin/vulns/open_redirect.rb

@@ -80,7 +80,7 @@ module Ronin
         when '301', '302', '303', '307', '308'
           if (locations = response.get_fields('Location'))
             escaped_test_url = Regexp.escape(@test_url)
-            regexp           = /\A#{escaped_test_url}(?:[\?&].+)?\z/
+            regexp           = /\A#{escaped_test_url}.*\z/
 
             locations.last =~ regexp
           end
@@ -95,10 +95,34 @@ module Ronin
                 http-equiv\s*=\s*(?: "refresh" | 'refresh' | refresh )\s+
                 content\s*=\s*
                 (?:
-                 "\s*\d+\s*;\s*url\s*=\s*'\s*#{escaped_test_url}\s*'\s*"|
-                 '\s*\d+\s*;\s*url\s*=\s*"\s*#{escaped_test_url}\s*"\s*'|
-                 \s*\d+;url=(?: "#{escaped_test_url}" | '#{escaped_test_url}' )
-                )\s*
+                  # content="..."
+                  "\s*\d+\s*;\s*url\s*=\s*
+                  (?:
+                    # content="0; url='...'"
+                    '\s*#{escaped_test_url}[^'"]*' |
+                    # content="0; url=..."
+                    #{escaped_test_url}[^"]*
+                  )\s*" |
+                  # content='...'
+                  '\s*\d+\s*;\s*url\s*=\s*
+                  (?:
+                    # content='0; url="..."'
+                    "\s*#{escaped_test_url}[^"']*" |
+                    # content='0; url=...'
+                    #{escaped_test_url}[^']*
+                  )\s*' |
+                  # content=...
+                  \s*\d+;url=(?:
+                    # content=0;url="..."
+                    "\s*#{escaped_test_url}[^\s"]*" |
+                    # content=0;url='...'
+                    '\s*#{escaped_test_url}[^\s']*' |
+                    # content=0;url=...
+                    #{escaped_test_url}[^\s/>]*
+                  )
+                )
+                \s*
+                # /> or / >
                 (?:/\s*)?>
             }xi
 

data/lib/ronin/vulns/sqli.rb

@@ -296,7 +296,7 @@ module Ronin
       #
       def check_for_sql_errors(response)
         if response.code == '500'
-          ERROR_PATTERNS.each do |database,error_pattern|
+          ERROR_PATTERNS.each_value do |error_pattern|
             if error_pattern =~ response.body
               return true
             end

data/lib/ronin/vulns/url_scanner.rb

@@ -30,6 +30,16 @@ module Ronin
     #
     # Top-level module which scans a URL for all web vulnerabilities.
     #
+    # ## Examples
+    #
+    #     require 'ronin/vulns/url_scanner'
+    #
+    #     Ronin::Vulns::URLScanner.scan(url) do |vuln|
+    #       # ...
+    #     end
+    #
+    #     vuln = Ronin::Vulns::URLScanner.test(url)
+    #
     module URLScanner
       #
       # Scans a URL for web vulnerabilities.

data/lib/ronin/vulns/version.rb

@@ -21,6 +21,6 @@
 module Ronin
   module Vulns
     # The ronin-vulns version
-    VERSION = '0.1.3'
+    VERSION = '0.1.5'
   end
 end

data/man/ronin-vulns-lfi.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-lfi 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns lfi\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION

data/man/ronin-vulns-open-redirect.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-open-redirect 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns open-redirect\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION

data/man/ronin-vulns-reflected-xss.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-reflected-xss 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns reflected-xss\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION

data/man/ronin-vulns-rfi.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-rfi 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns rfi\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION
@@ -82,7 +82,7 @@ Reads URLs from the given \fIFILE\fP\.
 \fB-B\fR, \fB--filter-bypass\fR \fBdouble-encode\fR\[or]\fBsuffix-escape\fR\[or]\fBnull-byte\fR
 Optional filter\-bypass strategy to use\.
 .LP
-.HP
+.PP
 \fB-S\fR, \fB--script-lang\fR \fBasp\|\fRasp\.net\fB\|\fRcoldfusion\fB\|\fRjsp\fB\|\fRphp\fB\|\fRperl\`
 Explicitly specify the scripting language to test for\.
 .LP

data/man/ronin-vulns-scan.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-scan 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns scan\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION
@@ -113,7 +113,7 @@ Escapes parenthesis\.
 \fB--sqli-terminate\fR
 Terminates the SQL expression with a \fB--\fR\.
 .LP
-.HP
+.PP
 \fB--ssti-test-expr\fR \[lC]\fIX\fP*\fIY\fP \[or] \fIX\fP\[sl]\fIZ\fP \[or] \fIX\fP\[pl]\fIY\fP \[or] \fIX\fP\-\fIY\fP\[rC]
 Optional numeric test to use\.
 .LP

data/man/ronin-vulns-sqli.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-sqli 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns sqli\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION

data/man/ronin-vulns-ssti.1

@@ -1,10 +1,10 @@
-.\" Generated by kramdown-man 0.1.8
+.\" Generated by kramdown-man 0.1.9
 .\" https://github.com/postmodern/kramdown-man#readme
 .TH ronin-vulns-lfi 1 "May 2022" Ronin "User Manuals"
 .LP
 .SH SYNOPSIS
 .LP
-.HP
+.PP
 \fBronin-vulns lfi\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB--input\fR \fIFILE\fP\[rC]
 .LP
 .SH DESCRIPTION
@@ -78,7 +78,7 @@ Tests the form param name\.
 \fB-i\fR, \fB--input\fR \fIFILE\fP
 Reads URLs from the given \fIFILE\fP\.
 .LP
-.HP
+.PP
 \fB-T\fR, \fB--test-expr\fR \[lC]\fIX*Y\fP \[or] \fIX\[sl]Z\fP \[or] \fIX\[pl]Y\fP \[or] \fIX\-Y\fP\[rC]
 Optional numeric test to use\.
 .LP

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ronin-vulns
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.5
 platform: ruby
 authors:
 - Postmodern
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-07-08 00:00:00.000000000 Z
+date: 2024-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ronin-support
@@ -159,7 +159,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
+rubygems_version: 3.3.27
 signing_key:
 specification_version: 4
 summary: Tests URLs for Local File Inclusion (LFI), Remove File Inclusion (RFI), SQL