ronin-vulns 0.1.5 → 0.2.0.rc1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/ChangeLog.md +43 -0
- data/Gemfile +14 -4
- data/README.md +7 -3
- data/Rakefile +9 -0
- data/data/completions/ronin-vulns +139 -0
- data/gemspec.yml +7 -1
- data/lib/ronin/vulns/cli/command.rb +1 -1
- data/lib/ronin/vulns/cli/commands/command_injection.rb +163 -0
- data/lib/ronin/vulns/cli/commands/completion.rb +63 -0
- data/lib/ronin/vulns/cli/commands/irb.rb +59 -0
- data/lib/ronin/vulns/cli/commands/lfi.rb +21 -9
- data/lib/ronin/vulns/cli/commands/open_redirect.rb +13 -1
- data/lib/ronin/vulns/cli/commands/reflected_xss.rb +13 -1
- data/lib/ronin/vulns/cli/commands/rfi.rb +13 -1
- data/lib/ronin/vulns/cli/commands/scan.rb +21 -9
- data/lib/ronin/vulns/cli/commands/sqli.rb +13 -1
- data/lib/ronin/vulns/cli/commands/ssti.rb +13 -1
- data/lib/ronin/vulns/cli/importable.rb +76 -0
- data/lib/ronin/vulns/cli/printing.rb +184 -0
- data/lib/ronin/vulns/cli/ruby_shell.rb +53 -0
- data/lib/ronin/vulns/cli/web_vuln_command.rb +216 -20
- data/lib/ronin/vulns/cli.rb +3 -2
- data/lib/ronin/vulns/command_injection.rb +267 -0
- data/lib/ronin/vulns/importer.rb +116 -0
- data/lib/ronin/vulns/lfi/test_file.rb +1 -1
- data/lib/ronin/vulns/lfi.rb +1 -1
- data/lib/ronin/vulns/open_redirect.rb +1 -1
- data/lib/ronin/vulns/reflected_xss/context.rb +1 -1
- data/lib/ronin/vulns/reflected_xss/test_string.rb +1 -1
- data/lib/ronin/vulns/reflected_xss.rb +1 -1
- data/lib/ronin/vulns/rfi.rb +64 -9
- data/lib/ronin/vulns/root.rb +1 -1
- data/lib/ronin/vulns/sqli/error_pattern.rb +1 -1
- data/lib/ronin/vulns/sqli.rb +36 -28
- data/lib/ronin/vulns/ssti/test_expression.rb +1 -1
- data/lib/ronin/vulns/ssti.rb +69 -53
- data/lib/ronin/vulns/url_scanner.rb +10 -1
- data/lib/ronin/vulns/version.rb +2 -2
- data/lib/ronin/vulns/vuln.rb +1 -1
- data/lib/ronin/vulns/web_vuln/http_request.rb +40 -1
- data/lib/ronin/vulns/web_vuln.rb +86 -16
- data/man/ronin-vulns-command-injection.1 +109 -0
- data/man/ronin-vulns-command-injection.1.md +112 -0
- data/man/ronin-vulns-completion.1 +76 -0
- data/man/ronin-vulns-completion.1.md +78 -0
- data/man/ronin-vulns-irb.1 +27 -0
- data/man/ronin-vulns-irb.1.md +26 -0
- data/man/ronin-vulns-lfi.1 +54 -51
- data/man/ronin-vulns-lfi.1.md +52 -20
- data/man/ronin-vulns-open-redirect.1 +51 -47
- data/man/ronin-vulns-open-redirect.1.md +50 -18
- data/man/ronin-vulns-reflected-xss.1 +50 -45
- data/man/ronin-vulns-reflected-xss.1.md +49 -17
- data/man/ronin-vulns-rfi.1 +54 -52
- data/man/ronin-vulns-rfi.1.md +52 -20
- data/man/ronin-vulns-scan.1 +68 -69
- data/man/ronin-vulns-scan.1.md +61 -29
- data/man/ronin-vulns-sqli.1 +54 -52
- data/man/ronin-vulns-sqli.1.md +52 -20
- data/man/ronin-vulns-ssti.1 +52 -48
- data/man/ronin-vulns-ssti.1.md +50 -18
- data/man/ronin-vulns.1 +73 -0
- data/man/ronin-vulns.1.md +69 -0
- data/scripts/setup +58 -0
- metadata +36 -5
- data/lib/ronin/vulns/cli/logging.rb +0 -81
@@ -0,0 +1,27 @@
|
|
1
|
+
.\" Generated by kramdown-man 1.0.1
|
2
|
+
.\" https://github.com/postmodern/kramdown-man#readme
|
3
|
+
.TH ronin-vulns-irb 1 "2023-02-01" Ronin Vulns "User Manuals"
|
4
|
+
.SH NAME
|
5
|
+
.PP
|
6
|
+
ronin\-vulns\-irb \- Starts an interactive Ruby shell with ronin\-vulns loaded
|
7
|
+
.SH SYNOPSIS
|
8
|
+
.PP
|
9
|
+
\fBronin\-vulns irb\fR \[lB]\fIoptions\fP\[rB]
|
10
|
+
.SH DESCRIPTION
|
11
|
+
.PP
|
12
|
+
Starts an interactive Ruby shell with \fBronin\[sl]vulns\fR loaded\.
|
13
|
+
.SH OPTIONS
|
14
|
+
.TP
|
15
|
+
\fB\-h\fR, \fB\-\-help\fR
|
16
|
+
Print help information
|
17
|
+
.SH AUTHOR
|
18
|
+
.PP
|
19
|
+
Postmodern
|
20
|
+
.MT postmodern\.mod3\[at]gmail\.com
|
21
|
+
.ME
|
22
|
+
.SH SEE ALSO
|
23
|
+
.PP
|
24
|
+
.BR ronin\-vulns\-workers (1)
|
25
|
+
.BR ronin\-vulns\-worker (1)
|
26
|
+
.BR ronin\-vulns\-run (1)
|
27
|
+
.BR ronin\-vulns\-test (1)
|
@@ -0,0 +1,26 @@
|
|
1
|
+
# ronin-vulns-irb 1 "2023-02-01" Ronin Vulns "User Manuals"
|
2
|
+
|
3
|
+
## NAME
|
4
|
+
|
5
|
+
ronin-vulns-irb - Starts an interactive Ruby shell with ronin-vulns loaded
|
6
|
+
|
7
|
+
## SYNOPSIS
|
8
|
+
|
9
|
+
`ronin-vulns irb` [*options*]
|
10
|
+
|
11
|
+
## DESCRIPTION
|
12
|
+
|
13
|
+
Starts an interactive Ruby shell with `ronin/vulns` loaded.
|
14
|
+
|
15
|
+
## OPTIONS
|
16
|
+
|
17
|
+
`-h`, `--help`
|
18
|
+
: Print help information
|
19
|
+
|
20
|
+
## AUTHOR
|
21
|
+
|
22
|
+
Postmodern <postmodern.mod3@gmail.com>
|
23
|
+
|
24
|
+
## SEE ALSO
|
25
|
+
|
26
|
+
[ronin-vulns-workers](ronin-vulns-workers.1.md) [ronin-vulns-worker](ronin-vulns-worker.1.md) [ronin-vulns-run](ronin-vulns-run.1.md) [ronin-vulns-test](ronin-vulns-test.1.md)
|
data/man/ronin-vulns-lfi.1
CHANGED
@@ -1,107 +1,110 @@
|
|
1
|
-
.\" Generated by kramdown-man 0.1
|
1
|
+
.\" Generated by kramdown-man 1.0.1
|
2
2
|
.\" https://github.com/postmodern/kramdown-man#readme
|
3
3
|
.TH ronin-vulns-lfi 1 "May 2022" Ronin "User Manuals"
|
4
|
-
.
|
4
|
+
.SH NAME
|
5
|
+
.PP
|
6
|
+
ronin\-vulns\-lfi \- Scans URL(s) for Local File Inclusion (LFI) vulnerabilities
|
5
7
|
.SH SYNOPSIS
|
6
|
-
.LP
|
7
8
|
.PP
|
8
|
-
\fBronin
|
9
|
-
.LP
|
9
|
+
\fBronin\-vulns lfi\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB\-\-input\fR \fIFILE\fP\[rC]
|
10
10
|
.SH DESCRIPTION
|
11
|
-
.LP
|
12
11
|
.PP
|
13
12
|
Scans URL(s) for Local File Inclusion (LFI) vulnerabilities\. The URLs to scan
|
14
|
-
can be given as additional arguments or read from a file using the \fB
|
13
|
+
can be given as additional arguments or read from a file using the \fB\-\-input\fR
|
15
14
|
option\.
|
16
|
-
.LP
|
17
15
|
.SH ARGUMENTS
|
18
|
-
.LP
|
19
16
|
.TP
|
20
17
|
\fIURL\fP
|
21
18
|
A URL to scan\.
|
22
|
-
.LP
|
23
19
|
.SH OPTIONS
|
24
|
-
.LP
|
25
20
|
.TP
|
26
|
-
\fB
|
21
|
+
\fB\-\-db\fR \fINAME\fP
|
22
|
+
The database name to connect to\. Defaults to \fBdefault\fR if not given\.
|
23
|
+
.TP
|
24
|
+
\fB\-\-db\-uri\fR \fIURI\fP
|
25
|
+
The database URI to connect to
|
26
|
+
(ex: \fBpostgres:\[sl]\[sl]user:password\[at]host\[sl]db\fR)\.
|
27
|
+
.TP
|
28
|
+
\fB\-\-db\-file\fR \fIPATH\fP
|
29
|
+
The sqlite3 database file to use\.
|
30
|
+
.TP
|
31
|
+
\fB\-\-import\fR
|
32
|
+
Imports discovered vulnerabilities into the database\.
|
33
|
+
.TP
|
34
|
+
\fB\-\-first\fR
|
27
35
|
Only find the first vulnerability for each URL\.
|
28
|
-
.LP
|
29
36
|
.TP
|
30
|
-
\fB
|
37
|
+
\fB\-A\fR, \fB\-\-all\fR
|
31
38
|
Find all vulnerabilities for each URL\.
|
32
|
-
.LP
|
33
39
|
.TP
|
34
|
-
\fB
|
40
|
+
\fB\-\-print\-curl\fR
|
41
|
+
Also prints an example \fBcurl\fR command for each vulnerability\.
|
42
|
+
.TP
|
43
|
+
\fB\-\-print\-http\fR
|
44
|
+
Also prints an example HTTP request for each vulnerability\.
|
45
|
+
.TP
|
46
|
+
\fB\-M\fR, \fB\-\-request\-method\fR \fBCOPY\fR\[or]\fBDELETE\fR\[or]\fBGET\fR\[or]\fBHEAD\fR\[or]\fBLOCK\fR\[or]\fBMKCOL\fR\[or]\fBMOVE\fR\[or]\fBOPTIONS\fR\[or]\fBPATCH\fR\[or]\fBPOST\fR\[or]\fBPROPFIND\fR\[or]\fBPROPPATCH\fR\[or]\fBPUT\fR\[or]\fBTRACE\fR\[or]\fBUNLOCK\fR
|
47
|
+
Sets the HTTP request method to use\.
|
48
|
+
.TP
|
49
|
+
\fB\-H\fR, \fB\-\-header\fR \[lq]\fIName\fP: \fIvalue\fP\[rq]
|
35
50
|
Sets an additional header using the given \fIName\fP and \fIvalue\fP\.
|
36
|
-
.LP
|
37
51
|
.TP
|
38
|
-
\fB
|
52
|
+
\fB\-U\fR, \fB\-\-user\-agent\-string\fR \fISTRING\fP
|
53
|
+
Sets the \fBUser\-Agent\fR header string\.
|
54
|
+
.TP
|
55
|
+
\fB\-u\fR, \fB\-\-user\-agent\fR \fBchrome\-linux\fR\[or]\fBchrome\-macos\fR\[or]\fBchrome\-windows\fR\[or]\fBchrome\-iphone\fR\[or]\fBchrome\-ipad\fR\[or]\fBchrome\-android\fR\[or]\fBfirefox\-linux\fR\[or]\fBfirefox\-macos\fR\[or]\fBfirefox\-windows\fR\[or]\fBfirefox\-iphone\fR\[or]\fBfirefox\-ipad\fR\[or]\fBfirefox\-android\fR\[or]\fBsafari\-macos\fR\[or]\fBsafari\-iphone\fR\[or]\fBsafari\-ipad\fR\[or]\fBedge\fR
|
56
|
+
Sets the \fBUser\-Agent\fR header\.
|
57
|
+
.TP
|
58
|
+
\fB\-C\fR, \fB\-\-cookie\fR \fICOOKIE\fP
|
39
59
|
Sets the raw \fBCookie\fR header\.
|
40
|
-
.LP
|
41
60
|
.TP
|
42
|
-
\fB
|
61
|
+
\fB\-c\fR, \fB\-\-cookie\-param\fR \fINAME\fP\fB\[eq]\fR\fIVALUE\fP
|
43
62
|
Sets an additional \fBCookie\fR param using the given \fINAME\fP and \fIVALUE\fP\.
|
44
|
-
.LP
|
45
63
|
.TP
|
46
|
-
\fB
|
64
|
+
\fB\-R\fR, \fB\-\-referer\fR \fIURL\fP
|
47
65
|
Sets the \fBReferer\fR header\.
|
48
|
-
.LP
|
49
66
|
.TP
|
50
|
-
\fB
|
67
|
+
\fB\-F\fR, \fB\-\-form\-param\fR \fINAME\fP\fB\[eq]\fR\fIVALUE\fP
|
51
68
|
Sets an additional form param using the given \fINAME\fP and \fIVALUE\fP\.
|
52
|
-
.LP
|
53
69
|
.TP
|
54
|
-
\fB
|
70
|
+
\fB\-\-test\-query\-param\fR \fINAME\fP
|
55
71
|
Tests the URL query param name\.
|
56
|
-
.LP
|
57
72
|
.TP
|
58
|
-
\fB
|
73
|
+
\fB\-\-test\-all\-query\-params\fR
|
59
74
|
Test all URL query param names\.
|
60
|
-
.LP
|
61
75
|
.TP
|
62
|
-
\fB
|
76
|
+
\fB\-\-test\-header\-name\fR \fINAME\fP
|
63
77
|
Tests the HTTP Header name\.
|
64
|
-
.LP
|
65
78
|
.TP
|
66
|
-
\fB
|
79
|
+
\fB\-\-test\-cookie\-param\fR \fINAME\fP
|
67
80
|
Tests the HTTP Cookie name\.
|
68
|
-
.LP
|
69
81
|
.TP
|
70
|
-
\fB
|
82
|
+
\fB\-\-test\-all\-cookie\-params\fR
|
71
83
|
Test all Cookie param names\.
|
72
|
-
.LP
|
73
84
|
.TP
|
74
|
-
\fB
|
85
|
+
\fB\-\-test\-form\-param\fR \fINAME\fP
|
75
86
|
Tests the form param name\.
|
76
|
-
.LP
|
77
87
|
.TP
|
78
|
-
\fB
|
88
|
+
\fB\-i\fR, \fB\-\-input\fR \fIFILE\fP
|
79
89
|
Reads URLs from the given \fIFILE\fP\.
|
80
|
-
.LP
|
81
90
|
.TP
|
82
|
-
\fB
|
91
|
+
\fB\-O\fR, \fB\-\-os\fR \fBunix\fR\[or]\fBwindows\fR
|
83
92
|
Sets the OS to test for\.
|
84
|
-
.LP
|
85
93
|
.TP
|
86
|
-
\fB
|
94
|
+
\fB\-D\fR, \fB\-\-depth\fR \fICOUNT\fP
|
87
95
|
Sets the directory depth to escape up\.
|
88
|
-
.LP
|
89
96
|
.TP
|
90
|
-
\fB
|
97
|
+
\fB\-B\fR, \fB\-\-filter\-bypass\fR \fBnull\[ru]byte\fR\[or]\fBdouble\[ru]escape\fR\[or]\fBbase64\fR\[or]\fBrot13\fR\[or]\fBzlib\fR
|
91
98
|
Sets the filter bypass strategy to use\.
|
92
|
-
.LP
|
93
99
|
.TP
|
94
|
-
\fB
|
100
|
+
\fB\-h\fR, \fB\-\-help\fR
|
95
101
|
Print help information\.
|
96
|
-
.LP
|
97
102
|
.SH AUTHOR
|
98
|
-
.LP
|
99
103
|
.PP
|
100
104
|
Postmodern
|
101
105
|
.MT postmodern\.mod3\[at]gmail\.com
|
102
106
|
.ME
|
103
|
-
.LP
|
104
107
|
.SH SEE ALSO
|
105
|
-
.LP
|
106
108
|
.PP
|
107
|
-
ronin\-vulns\-rfi
|
109
|
+
.BR ronin\-vulns\-rfi (1)
|
110
|
+
.BR ronin\-vulns\-scan (1)
|
data/man/ronin-vulns-lfi.1.md
CHANGED
@@ -1,5 +1,9 @@
|
|
1
1
|
# ronin-vulns-lfi 1 "May 2022" Ronin "User Manuals"
|
2
2
|
|
3
|
+
## NAME
|
4
|
+
|
5
|
+
ronin-vulns-lfi - Scans URL(s) for Local File Inclusion (LFI) vulnerabilities
|
6
|
+
|
3
7
|
## SYNOPSIS
|
4
8
|
|
5
9
|
`ronin-vulns lfi` [*options*] {*URL* ... \| `--input` *FILE*}
|
@@ -13,63 +17,91 @@ option.
|
|
13
17
|
## ARGUMENTS
|
14
18
|
|
15
19
|
*URL*
|
16
|
-
|
20
|
+
: A URL to scan.
|
17
21
|
|
18
22
|
## OPTIONS
|
19
23
|
|
24
|
+
`--db` *NAME*
|
25
|
+
: The database name to connect to. Defaults to `default` if not given.
|
26
|
+
|
27
|
+
`--db-uri` *URI*
|
28
|
+
: The database URI to connect to
|
29
|
+
(ex: `postgres://user:password@host/db`).
|
30
|
+
|
31
|
+
`--db-file` *PATH*
|
32
|
+
: The sqlite3 database file to use.
|
33
|
+
|
34
|
+
`--import`
|
35
|
+
: Imports discovered vulnerabilities into the database.
|
36
|
+
|
20
37
|
`--first`
|
21
|
-
|
38
|
+
: Only find the first vulnerability for each URL.
|
22
39
|
|
23
40
|
`-A`, `--all`
|
24
|
-
|
41
|
+
: Find all vulnerabilities for each URL.
|
42
|
+
|
43
|
+
`--print-curl`
|
44
|
+
: Also prints an example `curl` command for each vulnerability.
|
45
|
+
|
46
|
+
`--print-http`
|
47
|
+
: Also prints an example HTTP request for each vulnerability.
|
48
|
+
|
49
|
+
`-M`, `--request-method` `COPY`|`DELETE`|`GET`|`HEAD`|`LOCK`|`MKCOL`|`MOVE`|`OPTIONS`|`PATCH`|`POST`|`PROPFIND`|`PROPPATCH`|`PUT`|`TRACE`|`UNLOCK`
|
50
|
+
: Sets the HTTP request method to use.
|
25
51
|
|
26
52
|
`-H`, `--header` "*Name*: *value*"
|
27
|
-
|
53
|
+
: Sets an additional header using the given *Name* and *value*.
|
54
|
+
|
55
|
+
`-U`, `--user-agent-string` *STRING*
|
56
|
+
: Sets the `User-Agent` header string.
|
57
|
+
|
58
|
+
`-u`, `--user-agent` `chrome-linux`\|`chrome-macos`\|`chrome-windows`\|`chrome-iphone`\|`chrome-ipad`\|`chrome-android`\|`firefox-linux`\|`firefox-macos`\|`firefox-windows`\|`firefox-iphone`\|`firefox-ipad`\|`firefox-android`\|`safari-macos`\|`safari-iphone`\|`safari-ipad`\|`edge`
|
59
|
+
: Sets the `User-Agent` header.
|
28
60
|
|
29
61
|
`-C`, `--cookie` *COOKIE*
|
30
|
-
|
62
|
+
: Sets the raw `Cookie` header.
|
31
63
|
|
32
64
|
`-c`, `--cookie-param` *NAME*`=`*VALUE*
|
33
|
-
|
65
|
+
: Sets an additional `Cookie` param using the given *NAME* and *VALUE*.
|
34
66
|
|
35
67
|
`-R`, `--referer` *URL*
|
36
|
-
|
68
|
+
: Sets the `Referer` header.
|
37
69
|
|
38
70
|
`-F`, `--form-param` *NAME*`=`*VALUE*
|
39
|
-
|
71
|
+
: Sets an additional form param using the given *NAME* and *VALUE*.
|
40
72
|
|
41
73
|
`--test-query-param` *NAME*
|
42
|
-
|
74
|
+
: Tests the URL query param name.
|
43
75
|
|
44
76
|
`--test-all-query-params`
|
45
|
-
|
77
|
+
: Test all URL query param names.
|
46
78
|
|
47
79
|
`--test-header-name` *NAME*
|
48
|
-
|
80
|
+
: Tests the HTTP Header name.
|
49
81
|
|
50
82
|
`--test-cookie-param` *NAME*
|
51
|
-
|
83
|
+
: Tests the HTTP Cookie name.
|
52
84
|
|
53
85
|
`--test-all-cookie-params`
|
54
|
-
|
86
|
+
: Test all Cookie param names.
|
55
87
|
|
56
88
|
`--test-form-param` *NAME*
|
57
|
-
|
89
|
+
: Tests the form param name.
|
58
90
|
|
59
91
|
`-i`, `--input` *FILE*
|
60
|
-
|
92
|
+
: Reads URLs from the given *FILE*.
|
61
93
|
|
62
94
|
`-O`, `--os` `unix`|`windows`
|
63
|
-
|
95
|
+
: Sets the OS to test for.
|
64
96
|
|
65
97
|
`-D`, `--depth` *COUNT*
|
66
|
-
|
98
|
+
: Sets the directory depth to escape up.
|
67
99
|
|
68
100
|
`-B`, `--filter-bypass` `null_byte`\|`double_escape`\|`base64`\|`rot13`\|`zlib`
|
69
|
-
|
101
|
+
: Sets the filter bypass strategy to use.
|
70
102
|
|
71
103
|
`-h`, `--help`
|
72
|
-
|
104
|
+
: Print help information.
|
73
105
|
|
74
106
|
## AUTHOR
|
75
107
|
|
@@ -77,4 +109,4 @@ Postmodern <postmodern.mod3@gmail.com>
|
|
77
109
|
|
78
110
|
## SEE ALSO
|
79
111
|
|
80
|
-
ronin-vulns-rfi(1) ronin-vulns-scan(1)
|
112
|
+
[ronin-vulns-rfi](ronin-vulns-rfi.1.md) [ronin-vulns-scan](ronin-vulns-scan.1.md)
|
@@ -1,98 +1,102 @@
|
|
1
|
-
.\" Generated by kramdown-man 0.1
|
1
|
+
.\" Generated by kramdown-man 1.0.1
|
2
2
|
.\" https://github.com/postmodern/kramdown-man#readme
|
3
3
|
.TH ronin-vulns-open-redirect 1 "May 2022" Ronin "User Manuals"
|
4
|
-
.
|
4
|
+
.SH NAME
|
5
|
+
.PP
|
6
|
+
ronin\-vulns\-open\-redirect \- Scans URL(s) for Open Redirect vulnerabilities
|
5
7
|
.SH SYNOPSIS
|
6
|
-
.LP
|
7
8
|
.PP
|
8
|
-
\fBronin
|
9
|
-
.LP
|
9
|
+
\fBronin\-vulns open\-redirect\fR \[lB]\fIoptions\fP\[rB] \[lC]\fIURL\fP \.\.\. \[or] \fB\-\-input\fR \fIFILE\fP\[rC]
|
10
10
|
.SH DESCRIPTION
|
11
|
-
.LP
|
12
11
|
.PP
|
13
12
|
Scans URL(s) for Open Redirect vulnerabilities\. The URLs to scan can be given
|
14
|
-
as additional arguments or read from a file using the \fB
|
15
|
-
.LP
|
13
|
+
as additional arguments or read from a file using the \fB\-\-input\fR option\.
|
16
14
|
.SH ARGUMENTS
|
17
|
-
.LP
|
18
15
|
.TP
|
19
16
|
\fIURL\fP
|
20
17
|
A URL to scan\.
|
21
|
-
.LP
|
22
18
|
.SH OPTIONS
|
23
|
-
.LP
|
24
19
|
.TP
|
25
|
-
\fB
|
20
|
+
\fB\-\-db\fR \fINAME\fP
|
21
|
+
The database name to connect to\. Defaults to \fBdefault\fR if not given\.
|
22
|
+
.TP
|
23
|
+
\fB\-\-db\-uri\fR \fIURI\fP
|
24
|
+
The database URI to connect to
|
25
|
+
(ex: \fBpostgres:\[sl]\[sl]user:password\[at]host\[sl]db\fR)\.
|
26
|
+
.TP
|
27
|
+
\fB\-\-db\-file\fR \fIPATH\fP
|
28
|
+
The sqlite3 database file to use\.
|
29
|
+
.TP
|
30
|
+
\fB\-\-import\fR
|
31
|
+
Imports discovered vulnerabilities into the database\.
|
32
|
+
.TP
|
33
|
+
\fB\-\-first\fR
|
26
34
|
Only find the first vulnerability for each URL\.
|
27
|
-
.LP
|
28
35
|
.TP
|
29
|
-
\fB
|
36
|
+
\fB\-A\fR, \fB\-\-all\fR
|
30
37
|
Find all vulnerabilities for each URL\.
|
31
|
-
.LP
|
32
38
|
.TP
|
33
|
-
\fB
|
39
|
+
\fB\-\-print\-curl\fR
|
40
|
+
Also prints an example \fBcurl\fR command for each vulnerability\.
|
41
|
+
.TP
|
42
|
+
\fB\-\-print\-http\fR
|
43
|
+
Also prints an example HTTP request for each vulnerability\.
|
44
|
+
.TP
|
45
|
+
\fB\-M\fR, \fB\-\-request\-method\fR \fBCOPY\fR\[or]\fBDELETE\fR\[or]\fBGET\fR\[or]\fBHEAD\fR\[or]\fBLOCK\fR\[or]\fBMKCOL\fR\[or]\fBMOVE\fR\[or]\fBOPTIONS\fR\[or]\fBPATCH\fR\[or]\fBPOST\fR\[or]\fBPROPFIND\fR\[or]\fBPROPPATCH\fR\[or]\fBPUT\fR\[or]\fBTRACE\fR\[or]\fBUNLOCK\fR
|
46
|
+
Sets the HTTP request method to use\.
|
47
|
+
.TP
|
48
|
+
\fB\-H\fR, \fB\-\-header\fR \[lq]\fIName\fP: \fIvalue\fP\[rq]
|
34
49
|
Sets an additional header using the given \fIName\fP and \fIvalue\fP\.
|
35
|
-
.LP
|
36
50
|
.TP
|
37
|
-
\fB
|
51
|
+
\fB\-U\fR, \fB\-\-user\-agent\-string\fR \fISTRING\fP
|
52
|
+
Sets the \fBUser\-Agent\fR header string\.
|
53
|
+
.TP
|
54
|
+
\fB\-u\fR, \fB\-\-user\-agent\fR \fBchrome\-linux\fR\[or]\fBchrome\-macos\fR\[or]\fBchrome\-windows\fR\[or]\fBchrome\-iphone\fR\[or]\fBchrome\-ipad\fR\[or]\fBchrome\-android\fR\[or]\fBfirefox\-linux\fR\[or]\fBfirefox\-macos\fR\[or]\fBfirefox\-windows\fR\[or]\fBfirefox\-iphone\fR\[or]\fBfirefox\-ipad\fR\[or]\fBfirefox\-android\fR\[or]\fBsafari\-macos\fR\[or]\fBsafari\-iphone\fR\[or]\fBsafari\-ipad\fR\[or]\fBedge\fR
|
55
|
+
Sets the \fBUser\-Agent\fR header\.
|
56
|
+
.TP
|
57
|
+
\fB\-C\fR, \fB\-\-cookie\fR \fICOOKIE\fP
|
38
58
|
Sets the raw \fBCookie\fR header\.
|
39
|
-
.LP
|
40
59
|
.TP
|
41
|
-
\fB
|
60
|
+
\fB\-c\fR, \fB\-\-cookie\-param\fR \fINAME\fP\fB\[eq]\fR\fIVALUE\fP
|
42
61
|
Sets an additional \fBCookie\fR param using the given \fINAME\fP and \fIVALUE\fP\.
|
43
|
-
.LP
|
44
62
|
.TP
|
45
|
-
\fB
|
63
|
+
\fB\-R\fR, \fB\-\-referer\fR \fIURL\fP
|
46
64
|
Sets the \fBReferer\fR header\.
|
47
|
-
.LP
|
48
65
|
.TP
|
49
|
-
\fB
|
66
|
+
\fB\-F\fR, \fB\-\-form\-param\fR \fINAME\fP\fB\[eq]\fR\fIVALUE\fP
|
50
67
|
Sets an additional form param using the given \fINAME\fP and \fIVALUE\fP\.
|
51
|
-
.LP
|
52
68
|
.TP
|
53
|
-
\fB
|
69
|
+
\fB\-\-test\-query\-param\fR \fINAME\fP
|
54
70
|
Tests the URL query param name\.
|
55
|
-
.LP
|
56
71
|
.TP
|
57
|
-
\fB
|
72
|
+
\fB\-\-test\-all\-query\-params\fR
|
58
73
|
Test all URL query param names\.
|
59
|
-
.LP
|
60
74
|
.TP
|
61
|
-
\fB
|
75
|
+
\fB\-\-test\-header\-name\fR \fINAME\fP
|
62
76
|
Tests the HTTP Header name\.
|
63
|
-
.LP
|
64
77
|
.TP
|
65
|
-
\fB
|
78
|
+
\fB\-\-test\-cookie\-param\fR \fINAME\fP
|
66
79
|
Tests the HTTP Cookie name\.
|
67
|
-
.LP
|
68
80
|
.TP
|
69
|
-
\fB
|
81
|
+
\fB\-\-test\-all\-cookie\-params\fR
|
70
82
|
Test all Cookie param names\.
|
71
|
-
.LP
|
72
83
|
.TP
|
73
|
-
\fB
|
84
|
+
\fB\-\-test\-form\-param\fR \fINAME\fP
|
74
85
|
Tests the form param name\.
|
75
|
-
.LP
|
76
86
|
.TP
|
77
|
-
\fB
|
87
|
+
\fB\-i\fR, \fB\-\-input\fR \fIFILE\fP
|
78
88
|
Reads URLs from the given \fIFILE\fP\.
|
79
|
-
.LP
|
80
89
|
.TP
|
81
|
-
\fB
|
90
|
+
\fB\-T\fR, \fB\-\-test\-url\fR \fIURL\fP
|
82
91
|
Optional test \fIURL\fP to try to redirect to\.
|
83
|
-
.LP
|
84
92
|
.TP
|
85
|
-
\fB
|
93
|
+
\fB\-h\fR, \fB\-\-help\fR
|
86
94
|
Print help information\.
|
87
|
-
.LP
|
88
95
|
.SH AUTHOR
|
89
|
-
.LP
|
90
96
|
.PP
|
91
97
|
Postmodern
|
92
98
|
.MT postmodern\.mod3\[at]gmail\.com
|
93
99
|
.ME
|
94
|
-
.LP
|
95
100
|
.SH SEE ALSO
|
96
|
-
.LP
|
97
101
|
.PP
|
98
|
-
ronin\-vulns\-scan(1)
|
102
|
+
.BR ronin\-vulns\-scan (1)
|
@@ -1,5 +1,9 @@
|
|
1
1
|
# ronin-vulns-open-redirect 1 "May 2022" Ronin "User Manuals"
|
2
2
|
|
3
|
+
## NAME
|
4
|
+
|
5
|
+
ronin-vulns-open-redirect - Scans URL(s) for Open Redirect vulnerabilities
|
6
|
+
|
3
7
|
## SYNOPSIS
|
4
8
|
|
5
9
|
`ronin-vulns open-redirect` [*options*] {*URL* ... \| `--input` *FILE*}
|
@@ -12,57 +16,85 @@ as additional arguments or read from a file using the `--input` option.
|
|
12
16
|
## ARGUMENTS
|
13
17
|
|
14
18
|
*URL*
|
15
|
-
|
19
|
+
: A URL to scan.
|
16
20
|
|
17
21
|
## OPTIONS
|
18
22
|
|
23
|
+
`--db` *NAME*
|
24
|
+
: The database name to connect to. Defaults to `default` if not given.
|
25
|
+
|
26
|
+
`--db-uri` *URI*
|
27
|
+
: The database URI to connect to
|
28
|
+
(ex: `postgres://user:password@host/db`).
|
29
|
+
|
30
|
+
`--db-file` *PATH*
|
31
|
+
: The sqlite3 database file to use.
|
32
|
+
|
33
|
+
`--import`
|
34
|
+
: Imports discovered vulnerabilities into the database.
|
35
|
+
|
19
36
|
`--first`
|
20
|
-
|
37
|
+
: Only find the first vulnerability for each URL.
|
21
38
|
|
22
39
|
`-A`, `--all`
|
23
|
-
|
40
|
+
: Find all vulnerabilities for each URL.
|
41
|
+
|
42
|
+
`--print-curl`
|
43
|
+
: Also prints an example `curl` command for each vulnerability.
|
44
|
+
|
45
|
+
`--print-http`
|
46
|
+
: Also prints an example HTTP request for each vulnerability.
|
47
|
+
|
48
|
+
`-M`, `--request-method` `COPY`|`DELETE`|`GET`|`HEAD`|`LOCK`|`MKCOL`|`MOVE`|`OPTIONS`|`PATCH`|`POST`|`PROPFIND`|`PROPPATCH`|`PUT`|`TRACE`|`UNLOCK`
|
49
|
+
: Sets the HTTP request method to use.
|
24
50
|
|
25
51
|
`-H`, `--header` "*Name*: *value*"
|
26
|
-
|
52
|
+
: Sets an additional header using the given *Name* and *value*.
|
53
|
+
|
54
|
+
`-U`, `--user-agent-string` *STRING*
|
55
|
+
: Sets the `User-Agent` header string.
|
56
|
+
|
57
|
+
`-u`, `--user-agent` `chrome-linux`\|`chrome-macos`\|`chrome-windows`\|`chrome-iphone`\|`chrome-ipad`\|`chrome-android`\|`firefox-linux`\|`firefox-macos`\|`firefox-windows`\|`firefox-iphone`\|`firefox-ipad`\|`firefox-android`\|`safari-macos`\|`safari-iphone`\|`safari-ipad`\|`edge`
|
58
|
+
: Sets the `User-Agent` header.
|
27
59
|
|
28
60
|
`-C`, `--cookie` *COOKIE*
|
29
|
-
|
61
|
+
: Sets the raw `Cookie` header.
|
30
62
|
|
31
63
|
`-c`, `--cookie-param` *NAME*`=`*VALUE*
|
32
|
-
|
64
|
+
: Sets an additional `Cookie` param using the given *NAME* and *VALUE*.
|
33
65
|
|
34
66
|
`-R`, `--referer` *URL*
|
35
|
-
|
67
|
+
: Sets the `Referer` header.
|
36
68
|
|
37
69
|
`-F`, `--form-param` *NAME*`=`*VALUE*
|
38
|
-
|
70
|
+
: Sets an additional form param using the given *NAME* and *VALUE*.
|
39
71
|
|
40
72
|
`--test-query-param` *NAME*
|
41
|
-
|
73
|
+
: Tests the URL query param name.
|
42
74
|
|
43
75
|
`--test-all-query-params`
|
44
|
-
|
76
|
+
: Test all URL query param names.
|
45
77
|
|
46
78
|
`--test-header-name` *NAME*
|
47
|
-
|
79
|
+
: Tests the HTTP Header name.
|
48
80
|
|
49
81
|
`--test-cookie-param` *NAME*
|
50
|
-
|
82
|
+
: Tests the HTTP Cookie name.
|
51
83
|
|
52
84
|
`--test-all-cookie-params`
|
53
|
-
|
85
|
+
: Test all Cookie param names.
|
54
86
|
|
55
87
|
`--test-form-param` *NAME*
|
56
|
-
|
88
|
+
: Tests the form param name.
|
57
89
|
|
58
90
|
`-i`, `--input` *FILE*
|
59
|
-
|
91
|
+
: Reads URLs from the given *FILE*.
|
60
92
|
|
61
93
|
`-T`, `--test-url` *URL*
|
62
|
-
|
94
|
+
: Optional test *URL* to try to redirect to.
|
63
95
|
|
64
96
|
`-h`, `--help`
|
65
|
-
|
97
|
+
: Print help information.
|
66
98
|
|
67
99
|
## AUTHOR
|
68
100
|
|
@@ -70,4 +102,4 @@ Postmodern <postmodern.mod3@gmail.com>
|
|
70
102
|
|
71
103
|
## SEE ALSO
|
72
104
|
|
73
|
-
ronin-vulns-scan(1)
|
105
|
+
[ronin-vulns-scan](ronin-vulns-scan.1.md)
|