ronin-vulns 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c80dfbe1e5e0f67d7f6ae908b5514f937004354a809a4e408025ad47f96bf8e7
-  data.tar.gz: 7af7ed3b5e0abed7e2f0bdf0fc4b774ed568412369f4db44971fd2520d663bd5
+  metadata.gz: b260c485d9272af5724bed43fc2959995463f8b78e276bf669d1bb98740e917c
+  data.tar.gz: de99077b9d9fe73bd167309af9c7c6d7688bd03a02d2af9bd2fc8eae133aa43a
 SHA512:
-  metadata.gz: b06b563a221760c4f58fb55394ccdf01b510ed240b78d51f12dfd7bf122513f42d512f17bf3d5eb0857f61eda1b3db981c2d4583d9bedbb186c108216eec709f
-  data.tar.gz: 905e0de6182206b232358dab499af99f7849513bb09585e9242445505791dcc8a6c23a381be314f9078cf20848f388ca0c277b6d1647c845c7a56a9c6e10fcec
+  metadata.gz: 1f4ce00d82035a11ade026eb6deee9be1244b499d692e47d4961be3cfc2a2dd9d8c609b6c11c5fab72e454f5ccc60adf9dd6ab7e4ceced5b0df9ea27fc18ec27
+  data.tar.gz: fb41c677b9eaf56c3cc3fabc028db365061ed98e745dfc3bf942238ebd6c2b642716a2e5dc7f010bb9fa2249112bf4ab66db715d35221783104a3702c694aeea

data/.document

@@ -2,4 +2,3 @@ lib/**/*.rb
 - 
 ChangeLog.md
 COPYING.txt
-man/*.md

data/ChangeLog.md

@@ -1,3 +1,13 @@
+### 0.1.3 / 2023-07-07
+
+* Fixed a bug in {Ronin::Vulns::SSTI.scan} where when called without `escape:`
+  it would not return all found vulnerabilities.
+* Fixed a bug in {Ronin::Vulns::SQLI.scan} where repeat requests would be sent
+  even if `escape_quote:`, `escape_parens:`, or `terminate:` keyword arguments
+  are given.
+* Improved {Ronin::Vulns::ReflectedXSS::Context} to detect when the XSS occurs
+  after or *inside of* an HTML comment.
+
 ### 0.1.2 / 2023-03-01
 
 * Require `ronin-support` ~> 1.0, >= 1.0.1

data/Gemfile

@@ -10,9 +10,9 @@ gem 'jruby-openssl',	'~> 0.7', platforms: :jruby
 #                              branch: '0.4.0'
 
 # Ronin dependencies
-# gem 'ronin-support',	'~> 1.0', github: "ronin-rb/ronin-support",
+# gem 'ronin-support',	'~> 1.0', github: 'ronin-rb/ronin-support',
 #                                 branch: 'main'
-# gem 'ronin-core',     '~> 0.1', github: "ronin-rb/ronin-core",
+# gem 'ronin-core',     '~> 0.1', github: 'ronin-rb/ronin-core',
 #                                 branch: 'main'
 
 group :development do

data/lib/ronin/vulns/reflected_xss/context.rb

@@ -30,7 +30,7 @@ module Ronin
 
         # Where in the HTML the XSS occurs.
         #
-        # @return [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body]
+        # @return [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body, :comment]
         #   The context which the XSS occurs in.
         #   * `:tag_body` occurred within a tag's body (ex: `<tag>XSS...</tag>`)
         #   * `:double_quoted_attr_value` - occurred in a double quoted
@@ -44,13 +44,14 @@ module Ronin
         #   * `:attr_list` - occurred in the attribute list
         #     (ex: `<tag XSS>...</tag>`)
         #   * `:tag_name` - occurred in the tag name (ex: `<tagXSS>...</tag>`)
+        #   * `:comment` - occurred in a comment (ex: `<!-- XSS -->`)
         #
         # @api public
         attr_reader :location
 
         # The name of the parent tag which the XSS occurs in.
         #
-        # @return [String]
+        # @return [String, nil]
         #
         # @api public
         attr_reader :tag
@@ -65,9 +66,9 @@ module Ronin
         #
         # Initializes the context.
         #
-        # @param [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body] location
+        # @param [:double_quoted_attr_value, :single_quoted_attr_value, :unquoted_attr_value, :attr_name, :attr_list, :tag_name, :tag_body, :comment] location
         #
-        # @param [String] tag
+        # @param [String, nil] tag
         #
         # @param [String, nil] attr
         #
@@ -100,6 +101,11 @@ module Ronin
         # @api private
         ATTR_LIST = /(?:\s+#{ATTR})*/
 
+        # HTML comment regexp.
+        #
+        # @api private
+        COMMENT = /<![^>]*>/
+
         # HTML tag name regexp.
         #
         # @api private
@@ -108,7 +114,7 @@ module Ronin
         # Regexp matching when an XSS occurs within a tag's inner HTML.
         #
         # @api private
-        IN_TAG_BODY = %r{<(#{TAG_NAME})#{ATTR_LIST}\s*(?:>|/>)[^<>]*\z}
+        IN_TAG_BODY = %r{<(#{TAG_NAME})#{ATTR_LIST}\s*(?:>|/>)([^<>]|#{COMMENT})*\z}
 
         # Regexp matching when an XSS occurs within a double-quoted attribute
         # value.
@@ -142,6 +148,11 @@ module Ronin
         # @api private
         IN_TAG_NAME = /<(#{TAG_NAME})\z/
 
+        # Regexp matching when an XSS occurs within a comment.
+        #
+        # @api private
+        IN_COMMENT = /<![^>]*\z/
+
         #
         # Determine the context of the XSS by checking the characters that come
         # before the given index.
@@ -174,6 +185,8 @@ module Ronin
             new(:attr_list, tag: match[1])
           elsif (match = prefix.match(IN_TAG_NAME))
             new(:tag_name, tag: match[1])
+          elsif prefix.match?(IN_COMMENT)
+            new(:comment)
           end
         end
 
@@ -193,7 +206,8 @@ module Ronin
           attr_name: MINIMAL_REQUIRED_CHARS,
           attr_list: MINIMAL_REQUIRED_CHARS,
           tag_name:  MINIMAL_REQUIRED_CHARS,
-          tag_body:  MINIMAL_REQUIRED_CHARS
+          tag_body:  MINIMAL_REQUIRED_CHARS,
+          comment:   MINIMAL_REQUIRED_CHARS
         }
 
         #

data/lib/ronin/vulns/sqli.rb

@@ -105,6 +105,18 @@ module Ronin
       # @param [URI::HTTP, String] url
       #   The URL to test or exploit.
       #
+      # @param [Array<Boolean>, Boolean] escape_quote
+      #   Controls whether to escape a quoted string value. If not specified,
+      #   with and without quoted string escaping will be tested.
+      #
+      # @param [Array<Boolean>, Boolean] escape_parens
+      #   Controls whether to escape parenthesis. If not specified, with and
+      #   without parenthesis escaping will be tested.
+      #
+      # @param [Array<Boolean>, Boolean] terminate
+      #   Controls whether to terminate the SQL statement with `--`.
+      #   If not specified, with and without `--` terminate will be tested.
+      #
       # @param [Ronin::Support::Network::HTTP, nil] http
       #   An HTTP session to use for testing the URL.
       #
@@ -115,28 +127,28 @@ module Ronin
       #   If a block is given it will be yielded each discovered SQL injection
       #   vulnerability.
       #
-      # @yieldparam [SQLi] sqli
+      # @yieldparam [SQLI] sqli
       #   A discovered SQL injection vulnerability in the URL.
       #
-      # @return [Array<SQLi>]
+      # @return [Array<SQLI>]
       #   All discovered SQL injection vulnerabilities.
       #
-      def self.scan(url, http: nil, **kwargs, &block)
+      def self.scan(url, escape_quote:  [false, true],
+                         escape_parens: [false, true],
+                         terminate:     [false, true],
+                         # WebVuln.scan keyword arguments
+                         http: nil, **kwargs, &block)
         url    = URI(url)
         http ||= Support::Network::HTTP.connect_uri(url)
 
-        escape_quotes = [false, true]
-        escape_parens = [false, true]
-        terminations  = [false, true]
-
         vulns = []
 
-        escape_quotes.each do |escape_quote|
-          escape_parens.each do |escape_paren|
-            terminations.each do |terminate|
-              vulns.concat(super(url, escape_quote:    escape_quote,
-                                      escape_parens:   escape_paren,
-                                      terminate:       terminate,
+        Array(escape_quote).each do |escape_quote_value|
+          Array(escape_parens).each do |escape_parens_value|
+            Array(terminate).each do |terminate_value|
+              vulns.concat(super(url, escape_quote:    escape_quote_value,
+                                      escape_parens:   escape_parens_value,
+                                      terminate:       terminate_value,
                                       http:            http,
                                       **kwargs,
                                       &block))

data/lib/ronin/vulns/ssti.rb

@@ -102,13 +102,13 @@ module Ronin
       # @param [URI::HTTP, String] url
       #   The URL to scan.
       #
-      # @param [Hash{Symbol => Object}] kwargs
-      #   Additional keyword arguments for {#initialize}.
-      #
-      # @option kwargs [Proc, nil] :escape
+      # @param [Array<Proc>, Proc, nil] escape
       #   The escape method to use. If `escape:` is not given, then all escapes
       #   in {ESCAPES} will be tested..
       #
+      # @param [Hash{Symbol => Object}] kwargs
+      #   Additional keyword arguments for {#initialize}.
+      #
       # @option kwargs [Array<Symbol, String>, Symbol, String, true, nil] :query_params
       #   The query param name(s) to test.
       #
@@ -145,14 +145,14 @@ module Ronin
       # @return [Array<SSTI>]
       #   All discovered SSTI vulnerabilities.
       #
-      def self.scan(url, **kwargs,&block)
-        if kwargs.has_key?(:escape)
-          super(url, **kwargs, &block)
-        else
-          ESCAPES.each do |escape|
-            super(url, escape: escape, **kwargs, &block)
-          end
+      def self.scan(url, escape: ESCAPES, **kwargs,&block)
+        vulns = []
+
+        Array(escape).each do |escape_char|
+          vulns.concat(super(url, escape: escape_char, **kwargs, &block))
         end
+
+        return vulns
       end
 
       #

data/lib/ronin/vulns/version.rb

@@ -21,6 +21,6 @@
 module Ronin
   module Vulns
     # The ronin-vulns version
-    VERSION = '0.1.2'
+    VERSION = '0.1.3'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ronin-vulns
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Postmodern
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-02 00:00:00.000000000 Z
+date: 2023-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ronin-support