" . strrev("!detceteD )IFR( noisulcnI eliF etomeR :trelA ytiruceS") . "
" . PHP_EOL; 23 | echo "
20 |
21 |
", $security_alert, "
\n"; 25 | print "" + new StringBuffer("!detceteD )IFR( noisulcnI eliF etomeR :trelA ytiruceS").reverse() + "
" %> 19 | <%= "@security_alert
25 |bla bla bla
28 | #{file} 29 |bla bla bla
30 | 31 | 32 | HTML 33 | end 34 | 35 | it "must return MatchData" do 36 | expect(subject.match(response_body)).to be_kind_of(MatchData) 37 | end 38 | 39 | it "must match the given response body against #regexp" do 40 | expect(subject.match(response_body)[0]).to eq(file) 41 | end 42 | end 43 | 44 | context "when the #regexp does not match the response body" do 45 | let(:response_body) do 46 | <<~HTML 47 | 48 | 49 |bla bla bla
50 |bla bla bla
51 |bla bla bla
52 | 53 | 54 | HTML 55 | end 56 | 57 | it "must return nil" do 58 | expect(subject.match(response_body)).to be(nil) 59 | end 60 | end 61 | end 62 | 63 | describe "#=~" do 64 | context "when the #regexp matches the response body" do 65 | let(:file) { "foo\nbar\nbaz\n" } 66 | let(:response_body) do 67 | <<~HTML 68 | 69 | 70 |bla bla bla
71 | #{file} 72 |bla bla bla
73 | 74 | 75 | HTML 76 | end 77 | 78 | it "must return the index of the match" do 79 | expect(subject =~ response_body).to eq(response_body.index(regexp)) 80 | end 81 | end 82 | 83 | context "when the #regexp does not match the response body" do 84 | let(:response_body) do 85 | <<~HTML 86 | 87 | 88 |bla bla bla
89 |bla bla bla
90 |bla bla bla
91 | 92 | 93 | HTML 94 | end 95 | 96 | it "must return nil" do 97 | expect(subject =~ response_body).to be(nil) 98 | end 99 | end 100 | end 101 | end 102 | -------------------------------------------------------------------------------- /lib/ronin/vulns/lfi/test_file.rb: -------------------------------------------------------------------------------- 1 | # frozen_string_literal: true 2 | # 3 | # ronin-vulns - A Ruby library to blind vulnerability testing. 4 | # 5 | # Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com) 6 | # 7 | # ronin-vulns is free software: you can redistribute it and/or modify 8 | # it under the terms of the GNU Lesser General Public License as published 9 | # by the Free Software Foundation, either version 3 of the License, or 10 | # (at your option) any later version. 11 | # 12 | # ronin-vulns is distributed in the hope that it will be useful, 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 | # GNU Lesser General Public License for more details. 16 | # 17 | # You should have received a copy of the GNU Lesser General Public License 18 | # along with ronin-vulns. If not, seebla bla bla
51 | #{error} bla bla bla 52 |bla bla bla
53 | 54 | 55 | HTML 56 | end 57 | 58 | it "must return MatchData" do 59 | expect(subject.match(response_body)).to be_kind_of(MatchData) 60 | end 61 | 62 | it "must match the given response body against #regexp" do 63 | expect(subject.match(response_body)[0]).to eq(error) 64 | end 65 | end 66 | 67 | context "when the #regexp does not match the response body" do 68 | let(:response_body) do 69 | <<~HTML 70 | 71 | 72 |bla bla bla
73 |bla bla bla
74 |bla bla bla
75 | 76 | 77 | HTML 78 | end 79 | 80 | it "must return nil" do 81 | expect(subject.match(response_body)).to be(nil) 82 | end 83 | end 84 | end 85 | 86 | describe "#=~" do 87 | context "when the #regexp matches the response body" do 88 | let(:error) { "PostgreSQL bla bla bla ERROR" } 89 | let(:response_body) do 90 | <<~HTML 91 | 92 | 93 |bla bla bla
94 | #{error} bla bla bla 95 |bla bla bla
96 | 97 | 98 | HTML 99 | end 100 | 101 | it "must return the index of the match" do 102 | expect(subject =~ response_body).to eq(response_body.index(regexp)) 103 | end 104 | end 105 | 106 | context "when the #regexp does not match the response body" do 107 | let(:response_body) do 108 | <<~HTML 109 | 110 | 111 |bla bla bla
112 |bla bla bla
113 |bla bla bla
114 | 115 | 116 | HTML 117 | end 118 | 119 | it "must return nil" do 120 | expect(subject =~ response_body).to be(nil) 121 | end 122 | end 123 | end 124 | end 125 | -------------------------------------------------------------------------------- /spec/ssti/test_expression_spec.rb: -------------------------------------------------------------------------------- 1 | require 'spec_helper' 2 | require 'ronin/vulns/ssti/test_expression' 3 | 4 | describe Ronin::Vulns::SSTI::TestExpression do 5 | let(:string) { '7*7' } 6 | let(:result) { '49' } 7 | 8 | subject { described_class.new(string,result) } 9 | 10 | describe "#initialize" do 11 | it "must set #string" do 12 | expect(subject.string).to eq(string) 13 | end 14 | 15 | it "must set #result" do 16 | expect(subject.result).to eq(result) 17 | end 18 | end 19 | 20 | describe ".parse" do 21 | subject { described_class } 22 | 23 | context "when given 'X*Z'" do 24 | let(:string) { '7*7' } 25 | let(:result) { '49' } 26 | 27 | it "must parse the string and calculate the result" do 28 | expr = subject.parse(string) 29 | 30 | expect(expr).to be_kind_of(described_class) 31 | expect(expr.string).to eq(string) 32 | expect(expr.result).to eq(result) 33 | end 34 | end 35 | 36 | context "when given 'X * Z'" do 37 | let(:string) { '7 * 7' } 38 | let(:result) { '49' } 39 | 40 | it "must parse the string and calculate the result" do 41 | expr = subject.parse(string) 42 | 43 | expect(expr).to be_kind_of(described_class) 44 | expect(expr.string).to eq(string) 45 | expect(expr.result).to eq(result) 46 | end 47 | end 48 | 49 | context "when given 'X/Z'" do 50 | let(:string) { '100/50' } 51 | let(:result) { '2' } 52 | 53 | it "must parse the string and calculate the result" do 54 | expr = subject.parse(string) 55 | 56 | expect(expr).to be_kind_of(described_class) 57 | expect(expr.string).to eq(string) 58 | expect(expr.result).to eq(result) 59 | end 60 | end 61 | 62 | context "when given 'X / Z'" do 63 | let(:string) { '100 / 50' } 64 | let(:result) { '2' } 65 | 66 | it "must parse the string and calculate the result" do 67 | expr = subject.parse(string) 68 | 69 | expect(expr).to be_kind_of(described_class) 70 | expect(expr.string).to eq(string) 71 | expect(expr.result).to eq(result) 72 | end 73 | end 74 | 75 | context "when given 'X+Z'" do 76 | let(:string) { '7+7' } 77 | let(:result) { '14' } 78 | 79 | it "must parse the string and calculate the result" do 80 | expr = subject.parse(string) 81 | 82 | expect(expr).to be_kind_of(described_class) 83 | expect(expr.string).to eq(string) 84 | expect(expr.result).to eq(result) 85 | end 86 | end 87 | 88 | context "when given 'X + Z'" do 89 | let(:string) { '7 + 7' } 90 | let(:result) { '14' } 91 | 92 | it "must parse the string and calculate the result" do 93 | expr = subject.parse(string) 94 | 95 | expect(expr).to be_kind_of(described_class) 96 | expect(expr.string).to eq(string) 97 | expect(expr.result).to eq(result) 98 | end 99 | end 100 | 101 | context "when given 'X-Z'" do 102 | let(:string) { '7-1' } 103 | let(:result) { '6' } 104 | 105 | it "must parse the string and calculate the result" do 106 | expr = subject.parse(string) 107 | 108 | expect(expr).to be_kind_of(described_class) 109 | expect(expr.string).to eq(string) 110 | expect(expr.result).to eq(result) 111 | end 112 | end 113 | 114 | context "when given 'X - Z'" do 115 | let(:string) { '7 - 1' } 116 | let(:result) { '6' } 117 | 118 | it "must parse the string and calculate the result" do 119 | expr = subject.parse(string) 120 | 121 | expect(expr).to be_kind_of(described_class) 122 | expect(expr.string).to eq(string) 123 | expect(expr.result).to eq(result) 124 | end 125 | end 126 | end 127 | 128 | describe "#to_s" do 129 | it "must return #string" do 130 | expect(subject.to_s).to eq(string) 131 | end 132 | end 133 | end 134 | -------------------------------------------------------------------------------- /spec/reflected_xss/test_string_spec.rb: -------------------------------------------------------------------------------- 1 | require 'spec_helper' 2 | require 'ronin/vulns/reflected_xss/test_string' 3 | 4 | describe Ronin::Vulns::ReflectedXSS::TestString do 5 | let(:string) { "abc" } 6 | let(:regexp) { /(a)(b)(c)/ } 7 | 8 | subject { described_class.new(string,regexp) } 9 | 10 | describe "#initialize" do 11 | it "must set #string" do 12 | expect(subject.string).to eq(string) 13 | end 14 | 15 | it "must set #regexp" do 16 | expect(subject.regexp).to eq(regexp) 17 | end 18 | end 19 | 20 | describe ".build" do 21 | let(:string) { "'\" /><&" } 22 | 23 | subject { described_class.build(string) } 24 | 25 | it "must return a new #{described_class}" do 26 | expect(subject).to be_kind_of(described_class) 27 | end 28 | 29 | it "must set #string" do 30 | expect(subject.string).to eq(string) 31 | end 32 | 33 | it "must build a Regexp that captures the characters but ignores their HTML/URI escaped versions" do 34 | expect(subject.regexp).to eq( 35 | %r{(?:(')|%27|&\#39;|\\')?(?:(")|%22|"|\\")?(?:(\ )|\+|%20| )?(?:(/)|%2F)?(?:(>)|%3E|>)?(?:(<)|%3C|<)?(?:(&)|%26|&)?} 36 | ) 37 | end 38 | end 39 | 40 | describe "#wrap" do 41 | let(:prefix) { 'ABC' } 42 | let(:suffix) { 'XYZ' } 43 | 44 | subject { super().wrap(prefix,suffix) } 45 | 46 | it "must return a new #{described_class}" do 47 | expect(subject).to be_kind_of(described_class) 48 | end 49 | 50 | it "must prepend the prefix and append the suffix to the #string" do 51 | expect(subject.string).to eq("#{prefix}#{string}#{suffix}") 52 | end 53 | 54 | it "must prepend the prefix and append the suffix to the #regexp" do 55 | expect(subject.regexp).to eq(/#{prefix}#{regexp}#{suffix}/) 56 | end 57 | 58 | context "when the prefix contains Regexp special characters" do 59 | let(:prefix) { "ABC*CDE" } 60 | let(:escaped) { 'ABC\*CDE' } 61 | 62 | it "must escape the prefix before prepending it to the #regexp" do 63 | expect(subject.regexp).to eq(/#{escaped}#{regexp}#{suffix}/) 64 | end 65 | end 66 | 67 | context "when the suffix contains Regexp special characters" do 68 | let(:suffix) { "ABC*CDE" } 69 | let(:escaped) { 'ABC\*CDE' } 70 | 71 | it "must escape the prefix before prepending it to the #regexp" do 72 | expect(subject.regexp).to eq(/#{prefix}#{regexp}#{escaped}/) 73 | end 74 | end 75 | end 76 | 77 | describe "#match" do 78 | let(:prefix) { 'ABC' } 79 | let(:suffix) { 'XYZ' } 80 | 81 | subject { super().wrap(prefix,suffix) } 82 | 83 | context "when the #regexp matches the response body" do 84 | let(:response_body) do 85 | <<~HTML 86 | 87 | 88 |bla bla bla
89 | ABCabcXYZ 90 |bla bla bla
91 | 92 | 93 | HTML 94 | end 95 | 96 | it "must return MatchData" do 97 | expect(subject.match(response_body)).to be_kind_of(MatchData) 98 | end 99 | 100 | it "must match the given response body against #regexp" do 101 | match = subject.match(response_body) 102 | 103 | expect(match[0]).to eq('ABCabcXYZ') 104 | expect(match[1]).to eq('a') 105 | expect(match[2]).to eq('b') 106 | expect(match[3]).to eq('c') 107 | end 108 | end 109 | 110 | context "when the #regexp does not match the response body" do 111 | let(:response_body) do 112 | <<~HTML 113 | 114 | 115 |bla bla bla
116 |bla bla bla
117 |bla bla bla
118 | 119 | 120 | HTML 121 | end 122 | 123 | it "must return nil" do 124 | expect(subject.match(response_body)).to be(nil) 125 | end 126 | end 127 | end 128 | 129 | describe "#to_s" do 130 | it "must return the string" do 131 | expect(subject.to_s).to eq(string) 132 | end 133 | end 134 | end 135 | -------------------------------------------------------------------------------- /lib/ronin/vulns/importer.rb: -------------------------------------------------------------------------------- 1 | # frozen_string_literal: true 2 | # 3 | # ronin-vulns - A Ruby library for blind vulnerability testing. 4 | # 5 | # Copyright (c) 2022-2025 Hal Brodigan (postmodern.mod3 at gmail.com) 6 | # 7 | # ronin-vulns is free software: you can redistribute it and/or modify 8 | # it under the terms of the GNU Lesser General Public License as published 9 | # by the Free Software Foundation, either version 3 of the License, or 10 | # (at your option) any later version. 11 | # 12 | # ronin-vulns is distributed in the hope that it will be useful, 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 | # GNU Lesser General Public License for more details. 16 | # 17 | # You should have received a copy of the GNU Lesser General Public License 18 | # along with ronin-vulns. If not, see