ronin-vulns 0.2.0.rc1 → 0.2.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/ruby.yml +1 -0
- data/.ruby-version +1 -1
- data/ChangeLog.md +13 -1
- data/README.md +7 -5
- data/data/completions/ronin-vulns +70 -38
- data/gemspec.yml +5 -3
- data/lib/ronin/vulns/cli/command.rb +3 -2
- data/lib/ronin/vulns/cli/commands/command_injection.rb +3 -3
- data/lib/ronin/vulns/cli/commands/completion.rb +3 -2
- data/lib/ronin/vulns/cli/commands/irb.rb +3 -3
- data/lib/ronin/vulns/cli/commands/lfi.rb +3 -3
- data/lib/ronin/vulns/cli/commands/open_redirect.rb +3 -3
- data/lib/ronin/vulns/cli/commands/reflected_xss.rb +3 -3
- data/lib/ronin/vulns/cli/commands/rfi.rb +3 -3
- data/lib/ronin/vulns/cli/commands/scan.rb +3 -3
- data/lib/ronin/vulns/cli/commands/sqli.rb +3 -3
- data/lib/ronin/vulns/cli/commands/ssti.rb +3 -3
- data/lib/ronin/vulns/cli/importable.rb +4 -3
- data/lib/ronin/vulns/cli/printing.rb +1 -1
- data/lib/ronin/vulns/cli/ruby_shell.rb +1 -1
- data/lib/ronin/vulns/cli/web_vuln_command.rb +4 -4
- data/lib/ronin/vulns/cli.rb +5 -2
- data/lib/ronin/vulns/command_injection.rb +3 -3
- data/lib/ronin/vulns/importer.rb +1 -1
- data/lib/ronin/vulns/lfi/test_file.rb +2 -2
- data/lib/ronin/vulns/lfi.rb +4 -3
- data/lib/ronin/vulns/open_redirect.rb +2 -2
- data/lib/ronin/vulns/reflected_xss/context.rb +2 -2
- data/lib/ronin/vulns/reflected_xss/test_string.rb +2 -2
- data/lib/ronin/vulns/reflected_xss.rb +4 -4
- data/lib/ronin/vulns/rfi.rb +3 -3
- data/lib/ronin/vulns/root.rb +1 -1
- data/lib/ronin/vulns/sqli/error_pattern.rb +2 -2
- data/lib/ronin/vulns/sqli.rb +3 -3
- data/lib/ronin/vulns/ssti/test_expression.rb +2 -2
- data/lib/ronin/vulns/ssti.rb +3 -3
- data/lib/ronin/vulns/url_scanner.rb +8 -8
- data/lib/ronin/vulns/version.rb +2 -2
- data/lib/ronin/vulns/vuln.rb +1 -1
- data/lib/ronin/vulns/web_vuln/http_request.rb +3 -2
- data/lib/ronin/vulns/web_vuln.rb +4 -4
- data/lib/ronin/vulns.rb +32 -0
- metadata +23 -8
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 35653f9125d0af1492343dc82a17c6d7e645fa2649b75ee828647ea13e256676
|
4
|
+
data.tar.gz: dbe4ada050f9dbcedea4eb8197a59217affec0276205e49ec5708b4d73865e23
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 8573bc7cbb8f8da72c27d453bdd904457ad0076723700171f89aafa82ad499dd1d0a206426858e148261196e387eb3a8d18395cff9feebd65b0783320b38b760
|
7
|
+
data.tar.gz: e647b631bd189433fe527ac88f8411ed0f1a40690711449ebc8596c3e55a43671a05318f71f1166ed9071a7bfd2243dea2162fba772921b39b3ea0be92ef1da9
|
data/.github/workflows/ruby.yml
CHANGED
data/.ruby-version
CHANGED
@@ -1 +1 @@
|
|
1
|
-
ruby-3.
|
1
|
+
ruby-3.3
|
data/ChangeLog.md
CHANGED
@@ -1,4 +1,16 @@
|
|
1
|
-
### 0.2.
|
1
|
+
### 0.2.1 / 2025-02-14
|
2
|
+
|
3
|
+
* Added the `base64` gem as a dependency for Bundler and Ruby 3.4.0.
|
4
|
+
* Added missing `ronin/vulns` Ruby file.
|
5
|
+
* Use `require_relative` to improve load times.
|
6
|
+
* Documentation fixes.
|
7
|
+
|
8
|
+
#### CLI
|
9
|
+
|
10
|
+
* Fixed a bug in the `ronin-vulns irb` command where the `ronin/vulns` Ruby file
|
11
|
+
was missing.
|
12
|
+
|
13
|
+
### 0.2.0 / 2024-07-22
|
2
14
|
|
3
15
|
* Require [ronin-db] ~> 0.2
|
4
16
|
* Added {Ronin::Vulns::Importer}.
|
data/README.md
CHANGED
@@ -89,7 +89,7 @@ $ ronin-vulns lfi "http://www.example.com/page.php?lang=en"
|
|
89
89
|
Test a URL for SQL injection (SQLi):
|
90
90
|
|
91
91
|
```shell
|
92
|
-
$ ronin-vulns sqli "http://
|
92
|
+
$ ronin-vulns sqli "http://testphp.vulnweb.com/listproducts.php?cat=1"
|
93
93
|
```
|
94
94
|
|
95
95
|
Test a URL for Server Side Template Injection (SSTI):
|
@@ -185,17 +185,17 @@ Test a URL for SQL Injection (SQLi):
|
|
185
185
|
```ruby
|
186
186
|
require 'ronin/vulns/sqli'
|
187
187
|
|
188
|
-
vuln = Ronin::Vulns::SQLI.test('http://
|
188
|
+
vuln = Ronin::Vulns::SQLI.test('http://testphp.vulnweb.com/listproducts.php?cat=1')
|
189
189
|
# => #<Ronin::Vulns::SQLI: ...>
|
190
190
|
```
|
191
191
|
|
192
192
|
Finds all Server Side Template Injection (SQLI) vulnerabilities for a given URL:
|
193
193
|
|
194
194
|
```ruby
|
195
|
-
vulns = Ronin::Vulns::SQLI.scan('http://
|
195
|
+
vulns = Ronin::Vulns::SQLI.scan('http://testphp.vulnweb.com/listproducts.php?cat=1')
|
196
196
|
# => [#<Ronin::Vulns::SQLI: ...>, ...]
|
197
197
|
|
198
|
-
vulns = Ronin::Vulns::SQLI.scan('http://
|
198
|
+
vulns = Ronin::Vulns::SQLI.scan('http://testphp.vulnweb.com/listproducts.php?cat=1') do |vuln|
|
199
199
|
puts "Found SQLi on #{vuln.url} query param #{vuln.query_param}"
|
200
200
|
end
|
201
201
|
# => [#<Ronin::Vulns::SQLI: ...>, ...]
|
@@ -274,6 +274,7 @@ end
|
|
274
274
|
## Requirements
|
275
275
|
|
276
276
|
* [Ruby] >= 3.0.0
|
277
|
+
* [base64] ~> 0.1
|
277
278
|
* [ronin-support] ~> 1.0
|
278
279
|
* [ronin-core] ~> 0.2
|
279
280
|
* [ronin-db] ~> 0.2
|
@@ -309,7 +310,7 @@ gem.add_dependency 'ronin-vulns', '~> 0.1'
|
|
309
310
|
|
310
311
|
## License
|
311
312
|
|
312
|
-
Copyright (c) 2022-
|
313
|
+
Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
313
314
|
|
314
315
|
ronin-vulns is free software: you can redistribute it and/or modify
|
315
316
|
it under the terms of the GNU Lesser General Public License as published
|
@@ -327,6 +328,7 @@ along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
|
327
328
|
[Ruby]: https://www.ruby-lang.org
|
328
329
|
[ronin-rb]: https://ronin-rb.dev
|
329
330
|
|
331
|
+
[base64]: https://github.com/ruby/base64#readme
|
330
332
|
[ronin-support]: https://github.com/ronin-rb/ronin-support#readme
|
331
333
|
[ronin-core]: https://github.com/ronin-rb/ronin-core#readme
|
332
334
|
[ronin-db]: https://github.com/ronin-rb/ronin-db#readme
|
@@ -11,7 +11,7 @@ _ronin-vulns_completions_filter() {
|
|
11
11
|
|
12
12
|
if [[ "${cur:0:1}" == "-" ]]; then
|
13
13
|
echo "$words"
|
14
|
-
|
14
|
+
|
15
15
|
else
|
16
16
|
for word in $words; do
|
17
17
|
[[ "${word:0:1}" != "-" ]] && result+=("$word")
|
@@ -28,112 +28,144 @@ _ronin-vulns_completions() {
|
|
28
28
|
local compline="${compwords[*]}"
|
29
29
|
|
30
30
|
case "$compline" in
|
31
|
+
'command_injection'*'--db-file')
|
32
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
33
|
+
;;
|
34
|
+
|
31
35
|
'command_injection'*'--input')
|
32
|
-
while read -r; do COMPREPLY+=(
|
36
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
33
37
|
;;
|
34
38
|
|
35
|
-
'
|
36
|
-
while read -r; do COMPREPLY+=(
|
39
|
+
'reflected_xss'*'--db-file')
|
40
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
41
|
+
;;
|
42
|
+
|
43
|
+
'open_redirect'*'--db-file')
|
44
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
37
45
|
;;
|
38
46
|
|
39
47
|
'reflected_xss'*'--input')
|
40
|
-
while read -r; do COMPREPLY+=(
|
48
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
49
|
+
;;
|
50
|
+
|
51
|
+
'open_redirect'*'--input')
|
52
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
41
53
|
;;
|
42
54
|
|
43
55
|
'command_injection'*'-i')
|
44
|
-
while read -r; do COMPREPLY+=(
|
56
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
45
57
|
;;
|
46
58
|
|
47
59
|
'command_injection'*)
|
48
|
-
while read -r; do COMPREPLY+=(
|
60
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --escape-quote -Q --escape-operator -O --terminator -T")" -- "$cur")
|
61
|
+
;;
|
62
|
+
|
63
|
+
'reflected_xss'*'-i')
|
64
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
49
65
|
;;
|
50
66
|
|
51
67
|
'open_redirect'*'-i')
|
52
|
-
while read -r; do COMPREPLY+=(
|
68
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
53
69
|
;;
|
54
70
|
|
55
|
-
'
|
56
|
-
while read -r; do COMPREPLY+=(
|
71
|
+
'scan'*'--db-file')
|
72
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
73
|
+
;;
|
74
|
+
|
75
|
+
'sqli'*'--db-file')
|
76
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
77
|
+
;;
|
78
|
+
|
79
|
+
'ssti'*'--db-file')
|
80
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
57
81
|
;;
|
58
82
|
|
59
83
|
'open_redirect'*)
|
60
|
-
while read -r; do COMPREPLY+=(
|
84
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --test-url -T")" -- "$cur")
|
61
85
|
;;
|
62
86
|
|
63
87
|
'reflected_xss'*)
|
64
|
-
while read -r; do COMPREPLY+=(
|
88
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i")" -- "$cur")
|
65
89
|
;;
|
66
90
|
|
67
|
-
'
|
68
|
-
while read -r; do COMPREPLY+=(
|
91
|
+
'lfi'*'--db-file')
|
92
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
69
93
|
;;
|
70
94
|
|
71
|
-
'
|
72
|
-
while read -r; do COMPREPLY+=(
|
95
|
+
'rfi'*'--db-file')
|
96
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -A directory -- "$cur")
|
73
97
|
;;
|
74
98
|
|
75
99
|
'ssti'*'--input')
|
76
|
-
while read -r; do COMPREPLY+=(
|
100
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
101
|
+
;;
|
102
|
+
|
103
|
+
'scan'*'--input')
|
104
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
105
|
+
;;
|
106
|
+
|
107
|
+
'sqli'*'--input')
|
108
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
77
109
|
;;
|
78
110
|
|
79
111
|
'lfi'*'--input')
|
80
|
-
while read -r; do COMPREPLY+=(
|
112
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
81
113
|
;;
|
82
114
|
|
83
115
|
'rfi'*'--input')
|
84
|
-
while read -r; do COMPREPLY+=(
|
116
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
85
117
|
;;
|
86
118
|
|
87
119
|
'completion'*)
|
88
|
-
while read -r; do COMPREPLY+=(
|
120
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--print --install --uninstall")" -- "$cur")
|
89
121
|
;;
|
90
122
|
|
91
123
|
'scan'*'-i')
|
92
|
-
while read -r; do COMPREPLY+=(
|
124
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
93
125
|
;;
|
94
126
|
|
95
127
|
'sqli'*'-i')
|
96
|
-
while read -r; do COMPREPLY+=(
|
128
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
97
129
|
;;
|
98
130
|
|
99
131
|
'ssti'*'-i')
|
100
|
-
while read -r; do COMPREPLY+=(
|
101
|
-
;;
|
102
|
-
|
103
|
-
'lfi'*'-i')
|
104
|
-
while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
|
132
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
105
133
|
;;
|
106
134
|
|
107
135
|
'rfi'*'-i')
|
108
|
-
while read -r; do COMPREPLY+=(
|
136
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
109
137
|
;;
|
110
138
|
|
111
|
-
'
|
112
|
-
while read -r; do COMPREPLY+=(
|
139
|
+
'lfi'*'-i')
|
140
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -A file -- "$cur")
|
113
141
|
;;
|
114
142
|
|
115
143
|
'sqli'*)
|
116
|
-
while read -r; do COMPREPLY+=(
|
144
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --escape-quote -Q --escape-parens -P --terminate -T")" -- "$cur")
|
117
145
|
;;
|
118
146
|
|
119
|
-
'
|
120
|
-
while read -r; do COMPREPLY+=(
|
147
|
+
'scan'*)
|
148
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --lfi-os --lfi-depth --lfi-filter-bypass --rfi-filter-bypass --rfi-script-lang --rfi-test-script-url --sqli-escape-quote --sqli-escape-parens --sqli-terminate --ssti-test-expr --open-redirect-url")" -- "$cur")
|
121
149
|
;;
|
122
150
|
|
123
|
-
'
|
124
|
-
while read -r; do COMPREPLY+=(
|
151
|
+
'ssti'*)
|
152
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --test-expr -T")" -- "$cur")
|
125
153
|
;;
|
126
154
|
|
127
155
|
'rfi'*)
|
128
|
-
while read -r; do COMPREPLY+=(
|
156
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --filter-bypass -B --script-lang -S --test-script-url -T")" -- "$cur")
|
157
|
+
;;
|
158
|
+
|
159
|
+
'lfi'*)
|
160
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--db --db-uri --db-file --import --first -F --all -A --print-curl --print-http --request-method -M --header -H --user-agent-string -U --user-agent -u --cookie -C --cookie-param -c --referer -R --form-param -F --test-query-param --test-all-query-params --test-header-name --test-cookie-param --test-all-cookie-params --test-form-param --test-all-form-params --input -i --os -O --depth -D --filter-bypass -B")" -- "$cur")
|
129
161
|
;;
|
130
162
|
|
131
163
|
*)
|
132
|
-
while read -r; do COMPREPLY+=(
|
164
|
+
while read -r; do COMPREPLY+=("$REPLY"); done < <(compgen -W "$(_ronin-vulns_completions_filter "--version -V help command-injection completion irb lfi open-redirect reflected-xss rfi scan sqli ssti xss cmdi")" -- "$cur")
|
133
165
|
;;
|
134
166
|
|
135
167
|
esac
|
136
168
|
} &&
|
137
|
-
complete -F _ronin-vulns_completions ronin-vulns
|
169
|
+
complete -F _ronin-vulns_completions ronin-vulns
|
138
170
|
|
139
171
|
# ex: filetype=sh
|
data/gemspec.yml
CHANGED
@@ -9,7 +9,7 @@ description: |
|
|
9
9
|
Remote File Inclusion (RFI), SQL injection (SQLi), reflective Cross Site
|
10
10
|
Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects.
|
11
11
|
|
12
|
-
license: LGPL-3.0
|
12
|
+
license: LGPL-3.0-or-later
|
13
13
|
authors: Postmodern
|
14
14
|
email: postmodern.mod3@gmail.com
|
15
15
|
homepage: https://ronin-rb.dev/
|
@@ -39,9 +39,11 @@ generated_files:
|
|
39
39
|
- man/ronin-vulns-scan.1
|
40
40
|
|
41
41
|
dependencies:
|
42
|
+
base64: ~> 0.1
|
43
|
+
# Ronin dependencies:
|
42
44
|
ronin-support: ~> 1.0, >= 1.0.1
|
43
|
-
ronin-core: ~> 0.2
|
44
|
-
ronin-db: ~> 0.2
|
45
|
+
ronin-core: ~> 0.2
|
46
|
+
ronin-db: ~> 0.2
|
45
47
|
|
46
48
|
development_dependencies:
|
47
49
|
bundler: ~> 2.0
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,9 +18,10 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
require 'ronin/vulns/root'
|
22
21
|
require 'ronin/core/cli/command'
|
23
22
|
|
23
|
+
require_relative '../root'
|
24
|
+
|
24
25
|
module Ronin
|
25
26
|
module Vulns
|
26
27
|
class CLI
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../command_injection'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,9 +18,10 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
require 'ronin/vulns/root'
|
22
21
|
require 'ronin/core/cli/completion_command'
|
23
22
|
|
23
|
+
require_relative '../../root'
|
24
|
+
|
24
25
|
module Ronin
|
25
26
|
module Vulns
|
26
27
|
class CLI
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../command'
|
22
|
+
require_relative '../ruby_shell'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../lfi'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../open_redirect'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../reflected_xss'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../rfi'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../url_scanner'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../sqli'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative '../web_vuln_command'
|
22
|
+
require_relative '../../ssti'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,9 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative 'printing'
|
22
|
+
require_relative '../importer'
|
23
|
+
|
23
24
|
require 'ronin/db/cli/database_options'
|
24
25
|
require 'ronin/db/cli/printing'
|
25
26
|
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,9 +18,9 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
23
|
-
|
21
|
+
require_relative 'command'
|
22
|
+
require_relative 'importable'
|
23
|
+
require_relative 'printing'
|
24
24
|
|
25
25
|
require 'ronin/support/network/http/cookie'
|
26
26
|
require 'ronin/support/network/http/user_agents'
|
data/lib/ronin/vulns/cli.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,12 +18,14 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
require 'ronin/
|
21
|
+
require 'ronin/core/cli/help/banner'
|
22
22
|
|
23
23
|
require 'command_kit/commands'
|
24
24
|
require 'command_kit/commands/auto_load'
|
25
25
|
require 'command_kit/options/version'
|
26
26
|
|
27
|
+
require_relative 'version'
|
28
|
+
|
27
29
|
module Ronin
|
28
30
|
module Vulns
|
29
31
|
#
|
@@ -39,6 +41,7 @@ module Ronin
|
|
39
41
|
namespace: "#{self}::Commands"
|
40
42
|
)
|
41
43
|
include CommandKit::Options::Version
|
44
|
+
include Core::CLI::Help::Banner
|
42
45
|
|
43
46
|
command_name 'ronin-vulns'
|
44
47
|
version Ronin::Vulns::VERSION
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
22
|
|
23
23
|
require 'time'
|
24
24
|
|
@@ -114,7 +114,7 @@ module Ronin
|
|
114
114
|
# @param [Array<String, nil>, String, nil] escape_operator
|
115
115
|
# The optional escape operator character(s) to test.
|
116
116
|
#
|
117
|
-
# @param [Array<String, nil>,
|
117
|
+
# @param [Array<String, nil>, String, nil] terminator
|
118
118
|
# The optional command termination character(s) to test.
|
119
119
|
#
|
120
120
|
# @param [Ronin::Support::Network::HTTP, nil] http
|
data/lib/ronin/vulns/importer.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library to blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative '../web_vuln'
|
22
22
|
|
23
23
|
module Ronin
|
24
24
|
module Vulns
|
data/lib/ronin/vulns/lfi.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,12 +18,13 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
|
+
require_relative 'lfi/test_file'
|
23
23
|
|
24
24
|
require 'ronin/support/text/patterns'
|
25
25
|
require 'ronin/support/crypto'
|
26
26
|
require 'ronin/support/compression'
|
27
|
+
|
27
28
|
require 'uri/query_params'
|
28
29
|
require 'base64'
|
29
30
|
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
22
|
|
23
23
|
require 'chars'
|
24
24
|
require 'cgi'
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative '../web_vuln'
|
22
22
|
|
23
23
|
module Ronin
|
24
24
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative '../web_vuln'
|
22
22
|
|
23
23
|
module Ronin
|
24
24
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,9 +18,9 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
23
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
|
+
require_relative 'reflected_xss/test_string'
|
23
|
+
require_relative 'reflected_xss/context'
|
24
24
|
|
25
25
|
require 'set'
|
26
26
|
|
data/lib/ronin/vulns/rfi.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
|
+
require_relative 'version'
|
23
23
|
|
24
24
|
require 'ronin/support/network/http'
|
25
25
|
require 'uri/query_params'
|
data/lib/ronin/vulns/root.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative '../web_vuln'
|
22
22
|
|
23
23
|
module Ronin
|
24
24
|
module Vulns
|
data/lib/ronin/vulns/sqli.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
|
+
require_relative 'sqli/error_pattern'
|
23
23
|
|
24
24
|
require 'time'
|
25
25
|
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,7 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative '../web_vuln'
|
22
22
|
|
23
23
|
module Ronin
|
24
24
|
module Vulns
|
data/lib/ronin/vulns/ssti.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,8 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
21
|
+
require_relative 'web_vuln'
|
22
|
+
require_relative 'ssti/test_expression'
|
23
23
|
|
24
24
|
module Ronin
|
25
25
|
module Vulns
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,13 +18,13 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
21
|
+
require_relative 'lfi'
|
22
|
+
require_relative 'rfi'
|
23
|
+
require_relative 'sqli'
|
24
|
+
require_relative 'ssti'
|
25
|
+
require_relative 'reflected_xss'
|
26
|
+
require_relative 'open_redirect'
|
27
|
+
require_relative 'command_injection'
|
28
28
|
|
29
29
|
module Ronin
|
30
30
|
module Vulns
|
data/lib/ronin/vulns/version.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -21,6 +21,6 @@
|
|
21
21
|
module Ronin
|
22
22
|
module Vulns
|
23
23
|
# The ronin-vulns version
|
24
|
-
VERSION = '0.2.
|
24
|
+
VERSION = '0.2.1'
|
25
25
|
end
|
26
26
|
end
|
data/lib/ronin/vulns/vuln.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,7 +18,8 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
21
|
+
require_relative '../vuln'
|
22
|
+
|
22
23
|
require 'ronin/support/network/http/cookie'
|
23
24
|
require 'ronin/support/network/http/user_agents'
|
24
25
|
|
data/lib/ronin/vulns/web_vuln.rb
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
#
|
3
3
|
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
4
|
#
|
5
|
-
# Copyright (c) 2022-
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
6
|
#
|
7
7
|
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
8
|
# it under the terms of the GNU Lesser General Public License as published
|
@@ -18,10 +18,10 @@
|
|
18
18
|
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
19
|
#
|
20
20
|
|
21
|
-
|
22
|
-
|
23
|
-
require 'ronin/support/network/http'
|
21
|
+
require_relative 'vuln'
|
22
|
+
require_relative 'web_vuln/http_request'
|
24
23
|
|
24
|
+
require 'ronin/support/network/http'
|
25
25
|
require 'chars'
|
26
26
|
|
27
27
|
module Ronin
|
data/lib/ronin/vulns.rb
ADDED
@@ -0,0 +1,32 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
#
|
3
|
+
# ronin-vulns - A Ruby library for blind vulnerability testing.
|
4
|
+
#
|
5
|
+
# Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com)
|
6
|
+
#
|
7
|
+
# ronin-vulns is free software: you can redistribute it and/or modify
|
8
|
+
# it under the terms of the GNU Lesser General Public License as published
|
9
|
+
# by the Free Software Foundation, either version 3 of the License, or
|
10
|
+
# (at your option) any later version.
|
11
|
+
#
|
12
|
+
# ronin-vulns is distributed in the hope that it will be useful,
|
13
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
14
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
15
|
+
# GNU Lesser General Public License for more details.
|
16
|
+
#
|
17
|
+
# You should have received a copy of the GNU Lesser General Public License
|
18
|
+
# along with ronin-vulns. If not, see <https://www.gnu.org/licenses/>.
|
19
|
+
#
|
20
|
+
|
21
|
+
require_relative 'vulns/vuln'
|
22
|
+
require_relative 'vulns/web_vuln'
|
23
|
+
require_relative 'vulns/lfi'
|
24
|
+
require_relative 'vulns/rfi'
|
25
|
+
require_relative 'vulns/sqli'
|
26
|
+
require_relative 'vulns/ssti'
|
27
|
+
require_relative 'vulns/command_injection'
|
28
|
+
require_relative 'vulns/open_redirect'
|
29
|
+
require_relative 'vulns/reflected_xss'
|
30
|
+
require_relative 'vulns/url_scanner'
|
31
|
+
require_relative 'vulns/importer'
|
32
|
+
require_relative 'vulns/version'
|
metadata
CHANGED
@@ -1,15 +1,29 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: ronin-vulns
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.2.
|
4
|
+
version: 0.2.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Postmodern
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2025-02-15 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: base64
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - "~>"
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '0.1'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - "~>"
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '0.1'
|
13
27
|
- !ruby/object:Gem::Dependency
|
14
28
|
name: ronin-support
|
15
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -36,28 +50,28 @@ dependencies:
|
|
36
50
|
requirements:
|
37
51
|
- - "~>"
|
38
52
|
- !ruby/object:Gem::Version
|
39
|
-
version: 0.2
|
53
|
+
version: '0.2'
|
40
54
|
type: :runtime
|
41
55
|
prerelease: false
|
42
56
|
version_requirements: !ruby/object:Gem::Requirement
|
43
57
|
requirements:
|
44
58
|
- - "~>"
|
45
59
|
- !ruby/object:Gem::Version
|
46
|
-
version: 0.2
|
60
|
+
version: '0.2'
|
47
61
|
- !ruby/object:Gem::Dependency
|
48
62
|
name: ronin-db
|
49
63
|
requirement: !ruby/object:Gem::Requirement
|
50
64
|
requirements:
|
51
65
|
- - "~>"
|
52
66
|
- !ruby/object:Gem::Version
|
53
|
-
version: 0.2
|
67
|
+
version: '0.2'
|
54
68
|
type: :runtime
|
55
69
|
prerelease: false
|
56
70
|
version_requirements: !ruby/object:Gem::Requirement
|
57
71
|
requirements:
|
58
72
|
- - "~>"
|
59
73
|
- !ruby/object:Gem::Version
|
60
|
-
version: 0.2
|
74
|
+
version: '0.2'
|
61
75
|
- !ruby/object:Gem::Dependency
|
62
76
|
name: bundler
|
63
77
|
requirement: !ruby/object:Gem::Requirement
|
@@ -107,6 +121,7 @@ files:
|
|
107
121
|
- data/rfi_test.php
|
108
122
|
- data/rfi_test.pl
|
109
123
|
- gemspec.yml
|
124
|
+
- lib/ronin/vulns.rb
|
110
125
|
- lib/ronin/vulns/cli.rb
|
111
126
|
- lib/ronin/vulns/cli/command.rb
|
112
127
|
- lib/ronin/vulns/cli/commands/command_injection.rb
|
@@ -168,7 +183,7 @@ files:
|
|
168
183
|
- scripts/setup
|
169
184
|
homepage: https://ronin-rb.dev/
|
170
185
|
licenses:
|
171
|
-
- LGPL-3.0
|
186
|
+
- LGPL-3.0-or-later
|
172
187
|
metadata:
|
173
188
|
documentation_uri: https://ronin-rb.dev/docs/ronin-vulns
|
174
189
|
source_code_uri: https://github.com/ronin-rb/ronin-vulns
|
@@ -190,7 +205,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
190
205
|
- !ruby/object:Gem::Version
|
191
206
|
version: '0'
|
192
207
|
requirements: []
|
193
|
-
rubygems_version: 3.
|
208
|
+
rubygems_version: 3.5.22
|
194
209
|
signing_key:
|
195
210
|
specification_version: 4
|
196
211
|
summary: Tests URLs for Local File Inclusion (LFI), Remove File Inclusion (RFI), SQL
|