Project

ronin-vulns

0.04
The project is in a healthy, maintained state
ronin-vulnsronin-rb/ronin-vulnsHomepageDocumentationSource CodeBug Tracker
ronin-vulns is a Ruby library for blind vulnerability testing. It currently supports testing for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), reflective Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects.
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Popularity
Downloads
8,791
Stars
72
Forks
16
Watchers
3
 Releases
Current version
0.2.0
Total releases
9
First release
2023-01-01
Latest release
2024-07-22
 Issues
Open Issues
12
Closed Issues
71
Total Issues
83
Issue Closure Rate
85%
 Pull Requests
Open Pull Requests
0
Closed Pull Requests
1
Merged Pull Requests
4
Pull Request Acceptance Rate
80%
 Development
Primary Language
Ruby
Licenses
LGPL-3.0
Average date of last 50 commits
2024-03-26
Reverse Dependencies
4

 Dependencies

Development

bundler
~> 2.0

Runtime

ronin-db
~> 0.2
ronin-core
~> 0.2
ronin-support
~> 1.0, >= 1.0.1
 Project Readme

ronin-vulns

CI Code Climate Gem Version

Description

ronin-vulns is a Ruby library for blind vulnerability testing. It currently supports testing for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), reflective Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects.

ronin-vulns is part of the ronin-rb project, a Ruby toolkit for security research and development.

Features

  • Supports testing for:
    • Local File Inclusion (LFI)
    • Remote File Inclusion (RFI)
      • PHP
      • ASP Class / ASP.NET
      • JSP
      • ColdFusion
      • Perl
    • SQL Injection (SQLi)
    • Reflected Cross Site Scripting (XSS)
    • Server Side Template Injection (SSTI)
    • Open Redirects
  • Supports testing:
    • URL query parameters.
    • HTTP Headers.
    • HTTP Cookie parameters.
    • Form parameters.
  • Has 96% documentation coverage.
  • Has 99% test coverage.

Synopsis

Usage: ronin-vulns [options] [COMMAND [ARGS...]]

Options:
    -h, --help                       Print help information

Arguments:
    [COMMAND]                        The command name to run
    [ARGS ...]                       Additional arguments for the command

Commands:
    completion
    help
    irb
    lfi
    open-redirect
    reflected-xss, xss
    rfi
    scan
    sqli
    ssti

Test a URL for any web vulnerabilities:

$ ronin-vulns scan "http://www.example.com/page.php?lang=en"

Test a URL for Remote File Inclusion (RFI):

$ ronin-vulns rfi "http://www.example.com/page.php?lang=en"

Test a URL for Local File Inclusion (LFI):

$ ronin-vulns lfi "http://www.example.com/page.php?lang=en"

Test a URL for SQL injection (SQLi):

$ ronin-vulns sqli "http://testphp.vulnweb.com/listproducts.php?cat=1"

Test a URL for Server Side Template Injection (SSTI):

$ ronin-vulns sqli "http://www.example.com/page.php?lang=en"

Test a URL for Open Redirects:

$ ronin-vulns open-redirect "http://www.example.com/page.php?lang=en"

Test a URL for reflected Cross Site Scripting (XSS):

$ ronin-vulns reflected-xss "http://www.example.com/page.php?lang=en"

Examples

Test a URL for any web vulnerability:

require 'ronin/vulns/url_scanner'

vuln = Ronin::Vulns::URLScanner.test('http://www.example.com/page.php?lang=en')
# => #<Ronin::Vulns::SQLI: ...>

Scan a URL for all web vulnerabilities:

require 'ronin/vulns/url_scanner'

vulns = Ronin::Vulns::URLScanner.scan('http://www.example.com/page.php?lang=en')
do |vuln|
  puts "Found #{vuln.class} on #{vuln.url} query param #{vuln.query_param}"
end
# => [#<Ronin::Vulns::SQLI: ...>, #<Ronin::Vulns::ReflectedXSS: ...>, ...]

Remote File Inclusion (RFI)

Test a URL for Remote File Inclusion (RFI):

require 'ronin/vulns/rfi'

vuln = Ronin::Vulns::RFI.test('http://www.example.com/page.php?lang=en')
# => #<Ronin::Vulns::RFI: ...>

Finds all Remote File Inclusion (RFI) vulnerabilities for a given URL:

vulns = Ronin::Vulns::RFI.scan('http://www.example.com/page.php?lang=en')
# => [#<Ronin::Vulns::RFI: ...>, ...]

vulns = Ronin::Vulns::RFI.scan('http://www.example.com/page.php?lang=en') do |vuln|
  puts "Found RFI on #{vuln.url} query param #{vuln.query_param}"
end
# => [#<Ronin::Vulns::RFI: ...>, ...]

Local File Inclusion (LFI)

Test a URL for Local File Inclusion (LFI):

require 'ronin/vulns/lfi'

vuln = Ronin::Vulns::LFI.test('http://www.example.com/page.php?lang=en')
# => #<Ronin::Vulns::LFI: ...>

Finds all Local File Inclusion (LFI) vulnerabilities for a given URL:

vulns = Ronin::Vulns::LFI.scan('http://www.example.com/page.php?lang=en')
# => [#<Ronin::Vulns::LFI: ...>, ...]

vulns = Ronin::Vulns::LFI.scan('http://www.example.com/page.php?lang=en') do |vuln|
  puts "Found LFI on #{vuln.url} query param #{vuln.query_param}"
end

SQL Injection (SQLI)

Test a URL for SQL Injection (SQLi):

require 'ronin/vulns/sqli'

vuln = Ronin::Vulns::SQLI.test('http://testphp.vulnweb.com/listproducts.php?cat=1')
# => #<Ronin::Vulns::SQLI: ...>

Finds all Server Side Template Injection (SQLI) vulnerabilities for a given URL:

vulns = Ronin::Vulns::SQLI.scan('http://testphp.vulnweb.com/listproducts.php?cat=1')
# => [#<Ronin::Vulns::SQLI: ...>, ...]

vulns = Ronin::Vulns::SQLI.scan('http://testphp.vulnweb.com/listproducts.php?cat=1') do |vuln|
  puts "Found SQLi on #{vuln.url} query param #{vuln.query_param}"
end
# => [#<Ronin::Vulns::SQLI: ...>, ...]

Server Side Template Injection (SSTI)

Test a URL for Server Side Template Injection (SSTI):

require 'ronin/vulns/ssti'

vuln = Ronin::Vulns::SSTI.test('http://www.example.com/page.php?lang=en')
# => #<Ronin::Vulns::SSTI: ...>

Finds all Server Side Template Injection (SSTI) vulnerabilities for a given URL:

vulns = Ronin::Vulns::SSTI.scan('http://www.example.com/page.php?lang=en')
# => [#<Ronin::Vulns::SSTI: ...>, ...]

vulns = Ronin::Vulns::SSTI.scan('http://www.example.com/page.php?lang=en') do |vuln|
  puts "Found SSTI on #{vuln.url} query param #{vuln.query_param}"
end
# => [#<Ronin::Vulns::SSTI: ...>, ...]

Reflected Cross Site Scripting (XSS)

Test a URL for an (Reflected) Cross Site Scripting (XSS) vulnerability:

require 'ronin/vulns/reflected_xss'

vuln = Ronin::Vulns::ReflectedXSS.test('http://www.example.com/page.php?lang=en')
# => #<Ronin::Vulns::ReflectedXSS: ...>

Finds all (Reflected) Cross Site Scripting (XSS) vulnerabilities for a given URL:

vulns = Ronin::Vulns::ReflectedXSS.scan('http://www.example.com/page.php?lang=en')
# => [#<Ronin::Vulns::ReflectedXSS: ...>, ...]

vulns = Ronin::Vulns::ReflectedXSS.scan('http://www.example.com/page.php?lang=en') do |vuln|
  puts "Found ReflectedXSS on #{vuln.url} query param #{vuln.query_param}"
end
# => [#<Ronin::Vulns::ReflectedXSS: ...>, ...]

Open Redirect

Test a URL for an Open Redirect vulnerability:

require 'ronin/vulns/open_redirect'

vuln = Ronin::Vulns::OpenRedirect.test('http://www.example.com/page.php?lang=en')
# => #<Ronin::Vulns::OpenRedirect: ...>

Finds all Open Redirect vulnerabilities for a given URL:

vulns = Ronin::Vulns::OpenRedirect.scan('http://www.example.com/page.php?lang=en')
# => [#<Ronin::Vulns::OpenRedirect: ...>, ...]

vulns = Ronin::Vulns::OpenRedirect.scan('http://www.example.com/page.php?lang=en') do |vuln|
  puts "Found OpenRedirect on #{vuln.url} query param #{vuln.query_param}"
end
# => [#<Ronin::Vulns::OpenRedirect: ...>, ...]

Requirements

Install

$ gem install ronin-vulns

Gemfile

gem 'ronin-vulns', '~> 0.1'

gemspec

gem.add_dependency 'ronin-vulns', '~> 0.1'

Development

  1. Fork It!
  2. Clone It!
  3. cd ronin-vulns/
  4. ./scripts/setup
  5. git checkout -b my_feature
  6. Code It!
  7. bundle exec rake spec
  8. git push origin my_feature

License

Copyright (c) 2022-2024 Hal Brodigan (postmodern.mod3 at gmail.com)

ronin-vulns is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ronin-vulns is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with ronin-vulns. If not, see https://www.gnu.org/licenses/.