ronin-rb / ronin-app Goto Github PK

4.0 2.0 5.0 359 KB

[WIP] A local web interface for Ronin.

License: GNU Affero General Public License v3.0

Dockerfile 0.20% Ruby 46.74% Procfile 0.04% JavaScript 0.96% CSS 0.87% Shell 3.32% HTML 47.87%

local webapp roninrb wip masscan network-scanning nmap spider exploit-database payloads-database recon ruby hacktoberfest infosec security-tools dry-schema dry-types dry-validation

ronin-app's Introduction

ronin-app

ronin-app is a small web application that is meant to be ran locally by the user. It provides a web interface to ronin-support, ronin-repos, ronin-db, ronin-payloads, ronin-exploits, as well as automating ronin-nmap, ronin-masscan, and ronin-web-spider.

Features

Provides a web interface to explore and search the ronin database.
Allows managing ronin-repos from the web interface.
Allows listing and building the built-in or installed 3rd-party payloads.
Allows listing installed 3rd-party exploits.
Supports automating nmap and masscan scans and importing their results into the ronin database.
Supports automating spidering websites and importing all visited URLs into the ronin database.
Small memory footprint (~184K).
Fast (~1.251ms response time).

Synopsis

Usage: ronin-app [options]

Options:
    -V, --version                    Prints the version and exits
    -H, --host IP                    The host to listen on (Default: localhost)
    -p, --port PORT                  The port to listen on (Default: 1337)
        --db NAME                    The ronin-db database to connect to
        --db-uri URI                 The ronin-db database URI to connect to
    -h, --help                       Print help information

Starts the ronin web app

$ ronin-app

Note: the ronin-app command will automatically open a browser for http://localhost:1337, if ran in a real terminal.

Requirements

Security

This app is intended to be ran locally.
All HTML output is escaped with Rack::Utils.escape_html.
All HTTP params are validated using dry-validation.

Development

Fork It!
Clone It!
cd ronin-app
./scripts/setup
git checkout -b my_feature
Code It!
Test It - bundle exec rake spec
Try It - ./scripts/server then visit http://localhost:1337/
Push It - git push origin my_feature

docker-compose

You can also use docker-compose to build and run the app:

$ docker-compose build
$ docker-compose up

Directory Structure

Gemfile - defines all gem dependencies.
Procfile - defines the various services of the app that will be started.
Procfile.dev - defines the various services of the app that will be started in development mode.
config.ru - The main entry point for rackup/puma.
config/ - Contains all app configuration files.
lib/ronin/app/helpers/ - Contains all Sinatra helper modules which define methods that
app.rb - The main Rack app that contains HTTP routes.
app/ - Contains sub-App classes that contains grouped HTTP routes
workers.rb - The main entry point for Sidekiq which loads all worker classes from lib/workers/.
workers/ - Contains all Sidekiq worker classes. can be called within the views.
lib/ronin/app/types.rb - Defines custom dry-types.
lib/ronin/app/types/ - Contains additional custom types.
lib/ronin/app/validations/ - Contains dry-validations logic for validating submitted HTTP params.
views/ - Contains all ERB views that are rendered by app.rb.
views/layout.erb - The main page layout view.
public/ - Contains all static assets (images, CSS stylesheets, and JavaScript).
scripts/ - Contains scripts for setting up or starting the app.

License

ronin-app is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ronin-app is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with ronin-app. If not, see http://www.gnu.org/licenses/.

ronin-app's People

Contributors

Stargazers

Watchers

Forkers

ttilberg ai-mozi hardikbalwani sweetdevil144 ch1keen

ronin-app's Issues

Package as a gem

Package ronin-app as a gem. Add gemspec.yml and ronin-app.gemspec files. This will allow easily installing ronin-app as a gem, or being added as a dependency.

Add a `/nmap/import` route

Add a route for importing nmap XML files. Also add a Sidekiq worker for importing nmap XML files. The "upload" form should use a <input type="filePath"> input to only upload the file path, which will then be passed to the Sidekiq worker.

Add a `DELETE /repos/:name` route

Add a route for deleting a repo.

Add more options to the `/masscan` form

Add every Masscan::Command scan option to the /masscan form and Schemas::MasscanParams.

Change default port to 1337

Display `Notes` on all `/db/` `show.erb` views

ronin-db-activerecord 0.2.0 added an notes association to IPAddress, HostName, MACAddress, EmailAddress, URL, etc. All /db/ show.erb views should display notes as Notes. Also add a _notes.erb partial template for rendering a notes Array.

Add a `GET /payloads/encoders/.../encode` route

Add a route and a view for running a payload encoder with given input data and displaying the output.

Add a `/repos` section

Add routes for accessing Ronin::Repos::CacheDir. It should list installed repos, allow installing a repo from a git URI, updating repo(s), or uninstalling a repo.

Add a dark-mode switch

Add a dark-mode switch to change the --bg-color to a dark midnight blue color. See the minimal JavaScript on my blog as an example.

Eventually add Screenshots to the README

Once the app stabilizes take some screenshots of the various pages and add them to the README.

Listen on `localhost` by default

Listen on localhost by default. Only listen on 0.0.0.0 when within docker.

Add a `GET /recon` and `POST /recon` routes

Add a /recon route and Workers::Recon worker class that calls the ronin-recon library.

Add a `Workers::Vulns` sidekiq worker class

Add a Workers::Vulns sidekiq worker class that scans a URL for web vulnerabilities using Ronin::Vulns::URLScanner. It must create a report of found vulnerabilities that is somehow passed back to the frontend.

Cannot access `/sidekiq` due to CSRF protection

Sidekiq::Web is mounted on /sidekiq, separate from the App, but wants a rack.session cookie.

Add red asterisks to required form fields

Add the typical red asterisk to all required form fields.

Could add this as a CSS class.

.label.is-required::after {
  content: ' *';
  color: red;
}

Would also need to add the usual blurb text " means a required field" to the forms.

Add a fancy D3 network graph visualization

Add a fancy D3 network graph visualization that can visualize a single IP, Host, or URL, then show related database records as connected nodes. When the user clicks on another node, load that node's related database records and render them as additional connected nodes. This will allow the user to explore the database without loading ALL of the data into the browser at once.

Add pagination to `/db/*` views

As the number of IPAddresses, HostNames, and URLs increase in the database, there should be pagination on the views/db/*.erb views which list the records.

Available Options

Add more options to the `/spider` form

Add every Spidr::Agent#initialize option to the /spider form and Validations::SpiderParams.

Add basic "Advanced Options" display toggle to forms

Add an "Advanced Options" link which shows/hides the advanced options on forms.

Eventually add a NixOS build file for `nix shell`

Add a Nix build file so users can run nix shell and have all of the dependencies installed within a nix environment. I'm not a NixOS user and know little about it, so I'll need help on this one.

Add a `GET /payloads/encoders/...` route

Add a route and view for displaying metadata for a specific encoder.

Add a `/repos/:name` route

Add a route for displaying information about a specific repo.

Add support for switching the database

Since the app uses ronin-db and [roin-db] supports configuring multiple databases, it should be possible to switch to another database as the app is running. Possibly the current database name would be stored in the session cookie or sent to Sidekiq workers which import data into the database? I'm not sure how we would tell ActiveRecord to use another database, or whether we'd simply call ActiveRecord.establish_connection again to switch to another database?

Add more options to the `/nmap` form

Add every Nmap::Command scan option to the /nmap form and Schemas::NmapParams.

Add a `-p,--port` option to `scripts/server`

Add a `GET /payloads/.../build` route

Horizontally center the menu and logo

The menu and logo is currently left-justified and doesn't look correct. They should be horizontally centered.

Note: the app uses Bulma CSS's .hero and .container CSS helper classes for the logo and menu.

Add a `GET /payloads/encoders` route

Add a route for listing all payload encoders in Ronin::Payloads::Encoders.

Random ActiveRecord timeouts

For some reason ActiveRecord randomly times out when accessing the sqlite3 database. Not sure if we need to configure ActiveRecord to somehow avoid this?

ActiveRecord::ConnectionTimeoutError - could not obtain a connection from the pool within 5.000 seconds (waited 5.003 seconds); all pooled connections were in use:

We need to clear the ActiveRecord connection pool or obtain/release an individual connection for the app routes and the SideKiq workers.

App
SideKiq workers

Add JavaScript auto-complete for local file paths

Implement a vanilla JavaScript component for auto-completing local paths using a Bulma dropdown menu. The JavaScript should make background requests to the server, which would then attempt to lookup the path and return possible matches.

Example Bulma CSS + JavaScript auto-complete code: https://github.com/mattmezza/bulmahead

Note that all JavaScript must be vanilla ES6+ JavaScript. JavaScript frameworks or React are not allowed.

Add a `/exploits` section

Add routes for listing Ronin::Exploits, loading and displaying an exploit's metadata. Will need to figure out how to execute an exploit from the backend and provide a shell-like interface on the frontend similar to ronin-exploits run's post-exploitation shell.

Add a `ronin-app` command

Add a ronin-app command which can start the app.

Honor the `DATABASE_NAME` env variable

Use the DATABASE_NAME env variable to select the database to connect to by name in config/database.rb.

Add a `POST /payloads/.../build` route

Add a `POST /repos/:name/update` route

Add a route for updating a repo.

Add validations to `Validations::SpiderParams` to validate the host and domain

Add validations to Validations::SpiderParams to validate that the host is roughly a host-name and that the domain is roughly a domain-name, and not say a URI.

Add a `POST /vulns` route

Add a POST /vulns route which will enqueue a job for scanning a URL for web vulnerabilities using ronin-vulns.

Add a `/payloads` section

Add routes for listing Ronin::Payloads, loading and viewing metadata about a specific payload, or building a payload.

Add a `/jobs` or `/queue` route

Add a /jobs or /queue route which inspects Sidekiq::API and shows current running jobs.

Publish a `ronin-app` docker image

Publish a pre-built ronin-app docker image that uses it's own database on a separate volume (see #40).

Add a "Add Note" form to all `/db/` `show.erb` views

Add a "Add Note" text area and form to all /db/``show.erb views to allow adding a new comment to the notes association of the record. This may also require adding a _add_note.erb partial template.

Add systemd service files

Add systemd service files for running ronin-app. foreman export systemd can export the files. They must also depend on the redis.service service.

Add a `CONTRIBUTING.md` file

Change the Docker config/image to use it's own DB?

Change the Docker config/image to mount ~/.local/share/ronin-db/ as a volume. This can be done using the VOLUME keyword. This should allow users to pull down the ronin-app docker image and quickly run it with docker, and not have to use docker-compose or pass in complex options to docker run.

Add support for a `DATABASE_URL` env variable

Honor the DATABASE_URL env variable when connecting to the database.

Improve the layout of the `/nmap` Advanced Options

The Advanced Options section on the /nmap form is very long and needs better grouping/organization.

Add more `/db/` routes and views

Flush out the /db/ routes and views. Must provide access to all other database models (ex: OpenPort, Port, ASN, Credential, etc) with links to other routes.

Add a `/masscan/import` route

Add a route for importing masscan scan files. Also add a Sidekiq worker for importing masscan scan files. The "upload" form should use a <input type="filePath"> input to only upload the file path, which will then be passed to the Sidekiq worker.

Add a `/network/dns` route

Add a /network/dns route and form for performing arbitrary DNS queries. It should use JavaScript to send another HTTP request to another route (ex: /network/dns/query), which would send the DNS query using Ronin::Support::Network::DNS::Resolver and return the response object as JSON, which would then be parsed and rendered by the JavaScript.

There should also be an Import checkbox that causes both the DNS query and response as Ronin::DB::DNSQuery and Ronin::DB::DNSRecord records.

Add a `GET /vulns` route

Add a GET /vulns route and form for scanning a URL for web vulnerabilities using ronin-vulns.