Compare commits

..

148 Commits

Author SHA1 Message Date
jcrew99
15b6bf25a8 Revert "Revert "Add support for the SuSE family in the installer (#2590)" (#2594)"
This reverts commit dc9e41c55a.
2022-10-13 13:31:38 +10:00
dependabot[bot]
50c06a9a29 Bump sqlite3 from 1.5.2 to 1.5.3 (#2598)
Bumps [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) from 1.5.2 to 1.5.3.
- [Release notes](https://github.com/sparklemotion/sqlite3-ruby/releases)
- [Changelog](https://github.com/sparklemotion/sqlite3-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/sqlite3-ruby/compare/v1.5.2...v1.5.3)

---
updated-dependencies:
- dependency-name: sqlite3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:27:21 +10:00
dependabot[bot]
d188edf25b Bump sinatra from 2.2.2 to 3.0.2 (#2593)
Bumps [sinatra](https://github.com/sinatra/sinatra) from 2.2.2 to 3.0.2.
- [Release notes](https://github.com/sinatra/sinatra/releases)
- [Changelog](https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sinatra/sinatra/compare/v2.2.2...v3.0.2)

---
updated-dependencies:
- dependency-name: sinatra
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:07:56 +10:00
dependabot[bot]
ea86221710 Bump irb from 1.4.1 to 1.4.2 (#2592)
Bumps [irb](https://github.com/ruby/irb) from 1.4.1 to 1.4.2.
- [Release notes](https://github.com/ruby/irb/releases)
- [Commits](https://github.com/ruby/irb/compare/v1.4.1...v1.4.2)

---
updated-dependencies:
- dependency-name: irb
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:07:26 +10:00
dependabot[bot]
c302bf78f6 Bump test-unit from 3.5.3 to 3.5.5 (#2591)
Bumps [test-unit](https://github.com/test-unit/test-unit) from 3.5.3 to 3.5.5.
- [Release notes](https://github.com/test-unit/test-unit/releases)
- [Commits](https://github.com/test-unit/test-unit/compare/3.5.3...3.5.5)

---
updated-dependencies:
- dependency-name: test-unit
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:07:14 +10:00
dependabot[bot]
b993c55e9a Bump rack-protection from 2.2.2 to 3.0.2 (#2588)
Bumps [rack-protection](https://github.com/sinatra/sinatra) from 2.2.2 to 3.0.2.
- [Release notes](https://github.com/sinatra/sinatra/releases)
- [Changelog](https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sinatra/sinatra/compare/v2.2.2...v3.0.2)

---
updated-dependencies:
- dependency-name: rack-protection
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:07:00 +10:00
dependabot[bot]
71a678cf9a Bump selenium-webdriver from 4.4.0 to 4.5.0 (#2584)
Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.4.0...selenium-4.5.0)

---
updated-dependencies:
- dependency-name: selenium-webdriver
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:06:31 +10:00
dependabot[bot]
10e984c94b Bump net-smtp from 0.3.1 to 0.3.2 (#2583)
Bumps [net-smtp](https://github.com/ruby/net-smtp) from 0.3.1 to 0.3.2.
- [Release notes](https://github.com/ruby/net-smtp/releases)
- [Changelog](https://github.com/ruby/net-smtp/blob/master/NEWS.md)
- [Commits](https://github.com/ruby/net-smtp/compare/v0.3.1...v0.3.2)

---
updated-dependencies:
- dependency-name: net-smtp
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-07 15:01:59 +10:00
jcrew99
dc9e41c55a Revert "Add support for the SuSE family in the installer (#2590)" (#2594)
This reverts commit 03f70879f2.
2022-10-07 14:57:12 +10:00
Ben
03f70879f2 Add support for the SuSE family in the installer (#2590) 2022-10-07 14:56:29 +10:00
dependabot[bot]
1152715646 Bump espeak-ruby from 1.0.5 to 1.1.0 (#2580)
Bumps [espeak-ruby](https://github.com/dejan/espeak-ruby) from 1.0.5 to 1.1.0.
- [Release notes](https://github.com/dejan/espeak-ruby/releases)
- [Changelog](https://github.com/dejan/espeak-ruby/blob/master/CHANGELOG)
- [Commits](https://github.com/dejan/espeak-ruby/compare/v1.0.5...v1.1.0)

---
updated-dependencies:
- dependency-name: espeak-ruby
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-07 14:55:09 +10:00
dependabot[bot]
8abae7cc85 Bump sqlite3 from 1.5.0 to 1.5.2 (#2589)
Bumps [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) from 1.5.0 to 1.5.2.
- [Release notes](https://github.com/sparklemotion/sqlite3-ruby/releases)
- [Changelog](https://github.com/sparklemotion/sqlite3-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/sqlite3-ruby/compare/v1.5.0...v1.5.2)

---
updated-dependencies:
- dependency-name: sqlite3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-05 13:11:37 +10:00
dependabot[bot]
6041cbf595 Bump websocket-client-simple from 0.5.1 to 0.6.0 (#2573)
Bumps [websocket-client-simple](https://github.com/ruby-jp/websocket-client-simple) from 0.5.1 to 0.6.0.
- [Release notes](https://github.com/ruby-jp/websocket-client-simple/releases)
- [Changelog](https://github.com/ruby-jp/websocket-client-simple/blob/master/History.txt)
- [Commits](https://github.com/ruby-jp/websocket-client-simple/compare/v0.5.1...v0.6.0)

---
updated-dependencies:
- dependency-name: websocket-client-simple
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-29 10:06:38 +10:00
jcrew99
ed4c9169b3 Update ISSUE_TEMPLATE.md 2022-09-21 22:21:12 +10:00
jcrew99
d8b5331544 Update README.md (#2571)
Added discord link to readme.md
2022-09-19 14:01:01 +10:00
dependabot[bot]
a0b589ecd2 Bump sqlite3 from 1.4.4 to 1.5.0 (#2566)
Bumps [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) from 1.4.4 to 1.5.0.
- [Release notes](https://github.com/sparklemotion/sqlite3-ruby/releases)
- [Changelog](https://github.com/sparklemotion/sqlite3-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/sqlite3-ruby/compare/v1.4.4...v1.5.0)

---
updated-dependencies:
- dependency-name: sqlite3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-12 23:42:24 +10:00
dependabot[bot]
6f5f5e7493 Bump rubocop from 1.35.1 to 1.36.0 (#2557)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.35.1 to 1.36.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.35.1...v1.36.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-02 15:04:17 +10:00
dependabot[bot]
b3d2ee8016 Bump rubocop from 1.35.0 to 1.35.1 (#2552)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.35.0 to 1.35.1.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.35.0...v1.35.1)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-23 14:44:19 +10:00
dependabot[bot]
cbc5ce1601 Bump pry-byebug from 3.10.0 to 3.10.1 (#2548)
Bumps [pry-byebug](https://github.com/deivid-rodriguez/pry-byebug) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/deivid-rodriguez/pry-byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/pry-byebug/blob/master/CHANGELOG.md)
- [Commits](https://github.com/deivid-rodriguez/pry-byebug/compare/v3.10.0...v3.10.1)

---
updated-dependencies:
- dependency-name: pry-byebug
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-18 11:52:56 +10:00
dependabot[bot]
8a0e122dc9 Bump pry-byebug from 3.9.0 to 3.10.0 (#2547)
Bumps [pry-byebug](https://github.com/deivid-rodriguez/pry-byebug) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/deivid-rodriguez/pry-byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/pry-byebug/blob/master/CHANGELOG.md)
- [Commits](https://github.com/deivid-rodriguez/pry-byebug/compare/v3.9.0...v3.10.0)

---
updated-dependencies:
- dependency-name: pry-byebug
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-17 14:02:49 +10:00
dependabot[bot]
74325078cc Bump rubocop from 1.34.1 to 1.35.0 (#2539)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.34.1 to 1.35.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.34.1...v1.35.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-15 12:30:41 +10:00
dependabot[bot]
111a07c016 Bump rubocop from 1.33.0 to 1.34.1 (#2536)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.33.0 to 1.34.1.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.33.0...v1.34.1)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-10 23:43:22 +10:00
dependabot[bot]
c318b31fd7 Bump selenium-webdriver from 4.3.0 to 4.4.0 (#2535)
Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.3.0...selenium-4.4.0)

---
updated-dependencies:
- dependency-name: selenium-webdriver
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-10 23:36:40 +10:00
dependabot[bot]
72261c4fcd Bump rubocop from 1.32.0 to 1.33.0 (#2528)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.32.0 to 1.33.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.32.0...v1.33.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-08 12:39:19 +10:00
ThumusLive
92e5a50f9b fREADME: Update Ruby website link (#2512) 2022-08-05 10:22:58 +10:00
bcoles
9f99d65e39 WebRTC: Rename Rtc model classes to align with ActiveRecord syntax (#2524) 2022-08-01 17:55:19 +10:00
bcoles
8d98a8e205 Bump Ruby version to 3.0.3 (#2523)
* Bump Ruby version to 3.0.3

* Add net-smtp to Gemfile to support Ruby 3.0 < 3.1

* Update Gemfile.lock
2022-08-01 16:08:26 +10:00
bcoles
77983167db Update dependencies (#2522) 2022-08-01 14:34:31 +10:00
dependabot[bot]
d1df07f13d Bump rack-protection from 2.2.0 to 2.2.1 (#2507)
Bumps [rack-protection](https://github.com/sinatra/sinatra) from 2.2.0 to 2.2.1.
- [Release notes](https://github.com/sinatra/sinatra/releases)
- [Changelog](https://github.com/sinatra/sinatra/blob/v2.2.1/CHANGELOG.md)
- [Commits](https://github.com/sinatra/sinatra/compare/v2.2.0...v2.2.1)

---
updated-dependencies:
- dependency-name: rack-protection
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-31 21:25:22 +10:00
dependabot[bot]
70685c94a4 Bump browserstack-local from 1.3.0 to 1.4.0 (#2509)
Bumps [browserstack-local](https://github.com/browserstack/browserstack-local-ruby) from 1.3.0 to 1.4.0.
- [Release notes](https://github.com/browserstack/browserstack-local-ruby/releases)
- [Changelog](https://github.com/browserstack/browserstack-local-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/browserstack/browserstack-local-ruby/commits)

---
updated-dependencies:
- dependency-name: browserstack-local
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-31 18:17:44 +10:00
dependabot[bot]
d761611056 Bump rubocop from 1.31.2 to 1.32.0 (#2511)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.31.2 to 1.32.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.31.2...v1.32.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-31 18:16:56 +10:00
MyLoginOnGitHub
87318f5a14 Fixed bug when response_data is empty when http.response_data.length is <= 100K (#2510)
* Fixed bug when response_data is empty when http.response_data.length <= 100K

* Refactor: do not modify field. Modify local variable instead
2022-07-22 10:05:54 +10:00
dependabot[bot]
94063f2f33 Bump activerecord from 7.0.3 to 7.0.3.1 (#2499)
Bumps [activerecord](https://github.com/rails/rails) from 7.0.3 to 7.0.3.1.
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v7.0.3.1/activerecord/CHANGELOG.md)
- [Commits](https://github.com/rails/rails/compare/v7.0.3...v7.0.3.1)

---
updated-dependencies:
- dependency-name: activerecord
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-13 23:02:24 +10:00
dependabot[bot]
fc7df4748f Bump rubocop from 1.26.1 to 1.31.2 (#2488)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.26.1 to 1.31.2.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.26.1...v1.31.2)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-13 15:19:47 +10:00
Megan Howell
24dd89884b Install: Add support for ArcoLinux and BlackArch (#2487) 2022-07-07 12:00:25 +10:00
iWhacko
e69281e341 Bugfix/module html5 webcam (#2392)
* - Fix for offline browsers. Allowing you to view all executed commands in the past and details.
- fiexed a small mistake in a comment

* Revert "- Fix for offline browsers. Allowing you to view all executed commands in the past and details. - fiexed a small mistake in a comment"

This reverts commit fed79d71

* - Fixed deprecated call to "window.URL.createObjectURL" on newer browsers
- Fixed bug where no image would be shown even if the picture was taken. (image size too large)
- added option to module to choose image size.

* fixed config we default

* fix codeql

Co-authored-by: Whacko <not@gonna.tel>
Co-authored-by: wheatley <wheatand@gmail.com>
2022-07-02 18:28:08 +10:00
wheatley
ddc06f1d7e Update stale.yml 2022-07-02 18:09:31 +10:00
wheatley
8d23c0e482 updated to run debug mode every 5mins 2022-07-02 17:48:31 +10:00
wheatley
28618367ea Add bot to help keep the issue backlog clean. (#2447)
* Create stale.yml

* Updated with exemptions and days

* updated closed days and message

* Update stale.yml
2022-07-02 17:38:29 +10:00
jcrew99
b1382e0be3 removing spelling mistake in configuration_spec (#2483) 2022-06-30 15:59:40 +10:00
Isaac Powell
c1e63d2486 Update issue template (#2473)
* updated issue template

* added loggin info
2022-06-24 15:56:25 +10:00
iWhacko
b56345fcdf Bugfix/browse offline zombies (#2388)
* - Fix for offline browsers. Allowing you to view all executed commands in the past and details.
- fiexed a small mistake in a comment

(cherry picked from commit fed79d7142)

* Revert "- Fix for offline browsers. Allowing you to view all executed commands in the past and details. - fiexed a small mistake in a comment"

This reverts commit fed79d71

* - Fix for offline browsers. Allowing you to view all executed commands in the past and details.
- fiexed a small mistake in a comment

* - Fix for offline browsers. Allowing you to view all executed commands in the past and details.
- fixed a small mistake in a comment"

Co-authored-by: Whacko <not@gonna.tel>
2022-06-24 15:39:47 +10:00
Isaac Powell
0221a1c7da 2364 inotes modules defect and error handling (#2374)
* Fix spelling error, add try catch handling

* update error message
2022-06-24 15:22:36 +10:00
jcrew99
de60112928 Update thin gem (#2471)
* Updated Rack version

* Updated rack gem

* Updated to the latest version

* updating sinatra
2022-06-24 00:51:11 +10:00
jcrew99
7a1e500946 Update thin gem (#2470)
* Updated Rack version

* Updated rack gem
2022-06-24 00:30:34 +10:00
Isaac Powell
eea9740f4f Initial hook detection (#2440)
* initial multi-stage with basic switch on useragent

* added legacybrowseruseragents to core

* moved logic to a method and debugging

* array for holding legacy browsers

* added are.js back for parity to legacy hook.js

* removed byebug
2022-06-23 16:00:57 +10:00
slimwang
73a3d17f29 Fixed isDebug not work in beef.js (#2013)
* fixed isDebug not work

* fixed JQMIGRATE print extra message to console

* fix debug mode not work

* testing approval process

* Update github_actions.yml

Co-authored-by: kinovir <kinovir@gmail.com>
Co-authored-by: t3hp0rP <github@pr0ph3t.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2022-06-23 15:49:44 +10:00
Peter Mosmans
f68e420318 feat: optimize Docker image (#2398) 2022-06-09 23:01:49 +10:00
dependabot[bot]
b87463a60d Bump curb from 1.0.0 to 1.0.1 (#2410) 2022-06-09 16:00:45 +10:00
dependabot[bot]
107cdd3f54 Bump capybara from 3.36.0 to 3.37.1 (#2417)
Bumps [capybara](https://github.com/teamcapybara/capybara) from 3.36.0 to 3.37.1.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/3.36.0...3.37.1)

---
updated-dependencies:
- dependency-name: capybara
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-06 22:58:18 +10:00
dependabot[bot]
d9d2c9c64b Bump json from 2.6.1 to 2.6.2 (#2420)
Bumps [json](https://github.com/flori/json) from 2.6.1 to 2.6.2.
- [Release notes](https://github.com/flori/json/releases)
- [Changelog](https://github.com/flori/json/blob/master/CHANGES.md)
- [Commits](https://github.com/flori/json/compare/v2.6.1...v2.6.2)

---
updated-dependencies:
- dependency-name: json
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-06 22:58:03 +10:00
dependabot[bot]
b911c8df23 Bump nokogiri from 1.13.3 to 1.13.6 (#2423)
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.3 to 1.13.6.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.3...v1.13.6)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-06 22:55:48 +10:00
dependabot[bot]
9bc8d017e6 Bump selenium-webdriver from 4.1.0 to 4.2.1 (#2438)
Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 4.1.0 to 4.2.1.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/commits)

---
updated-dependencies:
- dependency-name: selenium-webdriver
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-06 22:55:34 +10:00
wheatley
a7a4c81468 adding GHAS scanning (#2429) 2022-05-30 09:53:24 +10:00
bcoles
cbe9f66990 Admin UI: Remove 'Submit Bug' link from admin panel (#2403) 2022-05-12 11:09:52 +10:00
Isaac Powell
1c395a3153 1612 update detect lastpass module (#2292)
* updated detection methods for LastPass module

* removed old detection of form tag

* refactor detection, updated module config.yaml

* comment removal

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

True!

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

not necessary to preface the text for this one?

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* Update modules/browser/detect_lastpass/command.js

Co-authored-by: bcoles <bcoles@gmail.com>

* removing redundant code

* implement field creation

* form field creation and sequential execution

* removing test beef.debug

Co-authored-by: bcoles <bcoles@gmail.com>
2022-03-30 13:44:36 +10:00
iWhacko
0636e815db Bugfix/browse offline zombies (#2371)
* - Fix for offline browsers. Allowing you to view all executed commands in the past and details.
- fiexed a small mistake in a comment

(cherry picked from commit fed79d7142)

* Revert "- Fix for offline browsers. Allowing you to view all executed commands in the past and details. - fiexed a small mistake in a comment"

This reverts commit fed79d71

* - Fix for offline browsers. Allowing you to view all executed commands in the past and details.
- fiexed a small mistake in a comment

Co-authored-by: Whacko <not@gonna.tel>
2022-03-30 11:20:09 +10:00
Abd El-Twab M. Fakhry
b46edb4d1a Add Arch based distro 'Artix' for linux installer (#2373)
Thanks @AbdeltwabMF for contributing!
2022-03-25 09:10:47 +10:00
dependabot[bot]
5fdd96f576 Bump rubocop from 1.25.1 to 1.26.0 (#2347)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.25.1 to 1.26.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.25.1...v1.26.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-17 13:33:40 +10:00
bcoles
033dbc1192 AdminUI: Fix admin UI generated combined JavaScript file name (#2358) 2022-03-16 11:35:53 +11:00
bcoles
67892d46a8 Admin UI: Treat URL route mount failures as fatal (#2349) 2022-03-15 14:30:01 +10:00
bcoles
d2f27e6f2e Exit upon database connection errors at startup (#2350) 2022-03-15 14:12:51 +10:00
bcoles
57ab7fda84 Detect OpenNIC DNS (#2341) 2022-03-13 02:11:17 +11:00
bcoles
139359a760 Treat core configuration file load failure as fatal (#2351) 2022-03-13 00:03:38 +10:00
bcoles
38b7ac7c23 Bump Platform.js to version 1.3.6 (#2343) 2022-03-09 19:56:33 +11:00
bcoles
52996d4fc5 Detect Ethereum ENS (#2342) 2022-03-09 15:48:40 +10:00
dependabot[bot]
4dbced4f55 Bump nokogiri from 1.12.5 to 1.13.3 (#2316)
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.5 to 1.13.3.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.5...v1.13.3)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-09 15:01:43 +10:00
Marc Partensky
c5e17be6db healthcheck (#2314)
@MarcPartensky  thanks, please check out the comment on your other PR. Cheers
2022-03-09 12:02:07 +10:00
dependabot[bot]
1c7a6e9fef Bump selenium-webdriver from 3.142.7 to 4.1.0 (#2260)
Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 3.142.7 to 4.1.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/commits/selenium-4.1.0)

---
updated-dependencies:
- dependency-name: selenium-webdriver
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-22 22:29:00 +10:00
karlmanait
f104a5daff Update ruby version in Dockerfile (#2305)
* Update ruby version in Dockerfile
2022-02-22 20:15:04 +10:00
dependabot[bot]
216d312ebe Bump sinatra from 2.1.0 to 2.2.0 (#2298)
Bumps [sinatra](https://github.com/sinatra/sinatra) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/sinatra/sinatra/releases)
- [Changelog](https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sinatra/sinatra/compare/v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: sinatra
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-22 11:33:02 +10:00
Molese
9b277a0276 Format scripts with shfmt and fix two issues identified by shellcheck (#2303)
* install: format script with `shfmt`

Signed-off-by: molese <molese@protonmail.com>

* install: double quote `GITACTIONS` variable to prevent word splitting (SC2086)

Signed-off-by: molese <molese@protonmail.com>

* install: replace `! -z` with `-n` (SC2236)

Signed-off-by: molese <molese@protonmail.com>

* update-beef: format script with `shfmt`

Signed-off-by: molese <molese@protonmail.com>

* scripts/bump-version.sh: format script with `shfmt`

Signed-off-by: molese <molese@protonmail.com>
2022-02-18 19:01:47 +11:00
dependabot[bot]
c7a3d4c032 Bump otr-activerecord from 2.0.4 to 2.1.1 (#2291)
Bumps [otr-activerecord](https://github.com/jhollinger/otr-activerecord) from 2.0.4 to 2.1.1.
- [Release notes](https://github.com/jhollinger/otr-activerecord/releases)
- [Changelog](https://github.com/jhollinger/otr-activerecord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jhollinger/otr-activerecord/compare/v2.0.4...v2.1.1)

---
updated-dependencies:
- dependency-name: otr-activerecord
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-16 15:21:51 +10:00
dependabot[bot]
1c4ffa33d3 Bump rubocop from 1.25.0 to 1.25.1 (#2293)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.25.0 to 1.25.1.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.25.0...v1.25.1)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-16 11:18:53 +10:00
dependabot[bot]
908b6a7a0c Bump rspec from 3.10.0 to 3.11.0 (#2294)
Bumps [rspec](https://github.com/rspec/rspec-metagem) from 3.10.0 to 3.11.0.
- [Release notes](https://github.com/rspec/rspec-metagem/releases)
- [Commits](https://github.com/rspec/rspec-metagem/compare/v3.10.0...v3.11.0)

---
updated-dependencies:
- dependency-name: rspec
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-16 10:11:19 +10:00
jcrew99
14d7975c7a Merge pull request #2290 from beefproject/removed_comment
Code Quality #2288 Removed a comment
2022-01-26 19:31:30 +10:00
jcrew99
f9f2121219 Code Quality #2288 Removed a comment 2022-01-26 19:05:00 +10:00
bcoles
e22d262bbf Core: Move web server imitation templates into Router class (#2289) 2022-01-26 13:41:18 +11:00
dependabot[bot]
ae9976b050 Bump websocket-client-simple from 0.3.0 to 0.5.1 (#2263)
Bumps [websocket-client-simple](https://github.com/ruby-jp/websocket-client-simple) from 0.3.0 to 0.5.1.
- [Release notes](https://github.com/ruby-jp/websocket-client-simple/releases)
- [Changelog](https://github.com/ruby-jp/websocket-client-simple/blob/master/History.txt)
- [Commits](https://github.com/ruby-jp/websocket-client-simple/compare/v0.3.0...v0.5.1)

---
updated-dependencies:
- dependency-name: websocket-client-simple
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-01-25 11:28:41 +10:00
bcoles
124c9d60b3 Core: Resolve many Rubocop violations (#2282) 2022-01-24 16:25:39 +11:00
dependabot[bot]
9f7e1ecfc1 Bump otr-activerecord from 2.0.3 to 2.0.4 (#2271)
Bumps [otr-activerecord](https://github.com/jhollinger/otr-activerecord) from 2.0.3 to 2.0.4.
- [Release notes](https://github.com/jhollinger/otr-activerecord/releases)
- [Changelog](https://github.com/jhollinger/otr-activerecord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jhollinger/otr-activerecord/compare/v2.0.3...v2.0.4)

---
updated-dependencies:
- dependency-name: otr-activerecord
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-01-24 14:21:20 +10:00
bcoles
b68fcecd46 Bump Ruby version from 2.7.2 to 2.7.4 (#2281) 2022-01-24 00:41:56 +11:00
jcrew99
29e025bbfc spec: Fix some rubocop violations (#2011) 2022-01-23 23:49:44 +11:00
bcoles
01c3413687 Modules: Resolve many Rubocop violations (#2280)
Modules: Resolve many Rubocop violations
2022-01-23 00:01:44 +11:00
Brendan Coles
a64480dfab Modules: Resolve many Rubocop violations 2022-01-22 12:46:42 +00:00
bcoles
bbe805f017 Extensions: Resolve many Rubocop violations (#2279)
Extensions: Resolve many Rubocop violations
2022-01-22 22:37:50 +11:00
Brendan Coles
aa7a6f9e64 Extensions: Resolve many Rubocop violations 2022-01-22 11:16:12 +00:00
bcoles
43af6391f0 Rubocop: Disable Metrics/ModuleLength, Naming/ClassAndModuleCamelCase, Style/Documentation (#2278)
Rubocop: Disable Metrics/ModuleLength, Naming/ClassAndModuleCamelCase, Style/Documentation
2022-01-22 19:04:52 +11:00
Brendan Coles
5f143a8e41 Rubocop: Disable Metrics/ModuleLength, Naming/ClassAndModuleCamelCase, Style/Documentation 2022-01-22 08:03:53 +00:00
bcoles
bbe4fda350 Bump minimum required Ruby version from 2.5 to 2.7 (#2277)
Bump minimum required Ruby version from 2.5 to 2.7
2022-01-22 18:30:22 +11:00
Brendan Coles
afec9fbaa2 Bump minimum required Ruby version from 2.5 to 2.7 2022-01-22 07:09:51 +00:00
bcoles
20f9f2e530 Modules: Rename browser/webcam to browser/webcam_flash (#2276)
Modules: Rename browser/webcam to browser/webcam_flash
2022-01-22 18:00:49 +11:00
Brendan Coles
060a3bfae2 Modules: Rename browser/webcam to browser/webcam_flash 2022-01-22 06:58:18 +00:00
bcoles
e75f5a87c2 Rubocop: Update TargetRubyVersion to 2.7 and enable all NewCops (#2275)
Rubocop: Update TargetRubyVersion to 2.7 and enable all NewCops
2022-01-22 17:39:05 +11:00
Brendan Coles
d9cc5cb364 Rubocop: Update TargetRubyVersion to 2.7 and enable all NewCops 2022-01-22 06:37:13 +00:00
bcoles
dd82546998 core/api: Fix typo for undefined variable 'method' (#2273)
core/api: Fix typo for undefined variable 'method'
2022-01-22 16:56:58 +11:00
Brendan Coles
7c4a90c51a core/api: Fix typo for undefined variable 'method' 2022-01-22 05:55:39 +00:00
bcoles
fb622e8c4c Metasploit BeEF Bind: Update installation instructions for Metasploit v6 (#2272)
Metasploit BeEF Bind: Update installation instructions for Metasploit v6
2022-01-22 16:37:13 +11:00
Brendan Coles
d0e2894137 Metasploit BeEF Bind: Rename instructions.txt -> README.md 2022-01-22 05:30:33 +00:00
Brendan Coles
448c3e864b Metasploit BeEF Bind: Update installation instructions for Metasploit v6 2022-01-22 05:29:56 +00:00
bcoles
9770e09d96 Update Metasploit BeEF Bind payloads for Metasploit v6 (#2226)
Fix modules for Metasploit v6.1.10-dev
2022-01-22 16:10:07 +11:00
dependabot[bot]
8294784268 Bump rubocop from 1.24.0 to 1.25.0 (#2270)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.24.0 to 1.25.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.24.0...v1.25.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-01-21 10:59:35 +10:00
dependabot[bot]
fe7627e169 Bump curb from 0.9.11 to 1.0.0 (#2269)
Bumps [curb](https://github.com/taf2/curb) from 0.9.11 to 1.0.0.
- [Release notes](https://github.com/taf2/curb/releases)
- [Changelog](https://github.com/taf2/curb/blob/master/ChangeLog.md)
- [Commits](https://github.com/taf2/curb/commits)

---
updated-dependencies:
- dependency-name: curb
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-01-21 10:29:27 +10:00
bcoles
0d084f00c6 GeoIP: update geoip to use new Maxmind GeoIP database (#2268)
Nice
2022-01-17 09:29:41 +10:00
wheatley
5f4610a4cb Update github_actions.yml 2022-01-13 06:53:36 +10:00
wheatley
35e1f36f44 Update github_actions.yml 2022-01-13 06:53:19 +10:00
bcoles
c2a2ce4a4c Merge pull request #2264 from bcoles/qemu_monitor_migrate_cmd_exec
Modules: Add QEMU Monitor 'migrate' Command Execution module (#2264)
2022-01-07 13:19:31 +11:00
Brendan Coles
77a30ae720 Add QEMU Monitor 'migrate' Command Execution module 2022-01-06 03:05:43 +00:00
dependabot[bot]
3ed9e7ab2f Bump espeak-ruby from 1.0.4 to 1.0.5 (#2238)
Bumps [espeak-ruby](https://github.com/dejan/espeak-ruby) from 1.0.4 to 1.0.5.
- [Release notes](https://github.com/dejan/espeak-ruby/releases)
- [Changelog](https://github.com/dejan/espeak-ruby/blob/master/CHANGELOG)
- [Commits](https://github.com/dejan/espeak-ruby/compare/v1.0.4...v1.0.5)

---
updated-dependencies:
- dependency-name: espeak-ruby
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-31 10:20:46 +10:00
wheatley
f33e2698a0 MAINTAINABILITY: 2257 update copyright 2022 (#2259)
* 2257 updated copyright date
2021-12-31 09:48:08 +10:00
dependabot[bot]
a606a0bd77 Bump irb from 1.3.7 to 1.4.1 (#2255)
Bumps [irb](https://github.com/ruby/irb) from 1.3.7 to 1.4.1.
- [Release notes](https://github.com/ruby/irb/releases)
- [Commits](https://github.com/ruby/irb/compare/v1.3.7...v1.4.1)

---
updated-dependencies:
- dependency-name: irb
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-29 22:46:16 +10:00
dependabot[bot]
e3ec7708e3 Bump em-websocket from 0.5.2 to 0.5.3 (#2229)
Bumps [em-websocket](https://github.com/igrigorik/em-websocket) from 0.5.2 to 0.5.3.
- [Release notes](https://github.com/igrigorik/em-websocket/releases)
- [Changelog](https://github.com/igrigorik/em-websocket/blob/master/CHANGELOG.rdoc)
- [Commits](https://github.com/igrigorik/em-websocket/compare/v0.5.2...v0.5.3)

---
updated-dependencies:
- dependency-name: em-websocket
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-29 22:24:39 +10:00
dependabot[bot]
fe7a07d6c5 Bump rubocop from 1.22.3 to 1.24.0 (#2252)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.22.3 to 1.24.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.22.3...v1.24.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-29 22:22:25 +10:00
dependabot[bot]
260c3fc52a Bump rdoc from 6.3.2 to 6.4.0 (#2254)
Bumps [rdoc](https://github.com/ruby/rdoc) from 6.3.2 to 6.4.0.
- [Release notes](https://github.com/ruby/rdoc/releases)
- [Changelog](https://github.com/ruby/rdoc/blob/master/History.rdoc)
- [Commits](https://github.com/ruby/rdoc/compare/v6.3.2...v6.4.0)

---
updated-dependencies:
- dependency-name: rdoc
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-29 22:20:01 +10:00
dependabot[bot]
e0d208e508 Bump mime-types from 3.3.1 to 3.4.1 (#2232)
Bumps [mime-types](https://github.com/mime-types/ruby-mime-types) from 3.3.1 to 3.4.1.
- [Release notes](https://github.com/mime-types/ruby-mime-types/releases)
- [Changelog](https://github.com/mime-types/ruby-mime-types/blob/main/History.md)
- [Commits](https://github.com/mime-types/ruby-mime-types/compare/v3.3.1...v3.4.1)

---
updated-dependencies:
- dependency-name: mime-types
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-29 22:19:46 +10:00
dependabot[bot]
9e882cd9d5 Bump test-unit from 3.5.1 to 3.5.3 (#2248)
Bumps [test-unit](https://github.com/test-unit/test-unit) from 3.5.1 to 3.5.3.
- [Release notes](https://github.com/test-unit/test-unit/releases)
- [Commits](https://github.com/test-unit/test-unit/compare/3.5.1...3.5.3)

---
updated-dependencies:
- dependency-name: test-unit
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-12-29 22:12:41 +10:00
Isaac Powell
d96af71220 additional grep command to correctly identify arch (#2251) 2021-12-29 21:59:30 +10:00
Isaac Powell
2f08343015 removed gcc9 and libgcc 9 from install (#2250) 2021-12-29 21:59:09 +10:00
wheatley
113e6214f2 Removing accidental creation of workflow 2021-12-22 16:16:30 +10:00
wheatley
21fd7ca0c5 Create codacy-analysis.yml 2021-12-22 16:14:57 +10:00
wheatley
0b41775618 added script to bump versions for release (#2239)
So cool
2021-12-03 11:04:18 +11:00
Isaac Powell
9181c83a87 catch for nil (#2237) 2021-11-26 16:20:48 +11:00
Isaac Powell
66257f1cf3 Release/0.5.4.0 (#2234)
* version up to 0.5.4.0
2021-11-26 12:00:58 +11:00
Wanetty
b42aebd99f Fix files to msf6 2021-11-10 04:34:50 -05:00
Wanetty
77c9991a35 Fix files to msf6 2021-11-10 04:31:10 -05:00
wheatley
c6bb893c32 Travis cleanup (#2224)
Removed old travis-cli files as the project is now using gitHub-actions
2021-11-10 08:06:22 +10:00
dependabot[bot]
6f6124e40f Bump json from 2.5.1 to 2.6.1 (#2208)
* Bump json from 2.5.1 to 2.6.1

Bumps [json](https://github.com/flori/json) from 2.5.1 to 2.6.1.
- [Release notes](https://github.com/flori/json/releases)
- [Changelog](https://github.com/flori/json/blob/master/CHANGES.md)
- [Commits](https://github.com/flori/json/compare/v2.5.1...v2.6.1)

---
updated-dependencies:
- dependency-name: json
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
Co-authored-by: Isaac Powell <36595182+DeezyE@users.noreply.github.com>
2021-11-09 17:23:10 +11:00
bcoles
d7a3ffb2c3 Merge pull request #2205 from bcoles/apache_tomcat_examples_cookie_disclosure
Modules: Add apache_tomcat_examples_cookie_disclosure module (#2205)
2021-11-09 16:38:15 +11:00
Brendan Coles
c8595b09b7 Modules: Add apache_tomcat_examples_cookie_disclosure module 2021-11-09 05:36:33 +00:00
dependabot[bot]
e9b113226d Bump otr-activerecord from 2.0.1 to 2.0.3 (#2209)
* Bump otr-activerecord from 2.0.1 to 2.0.3

Bumps [otr-activerecord](https://github.com/jhollinger/otr-activerecord) from 2.0.1 to 2.0.3.
- [Release notes](https://github.com/jhollinger/otr-activerecord/releases)
- [Changelog](https://github.com/jhollinger/otr-activerecord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jhollinger/otr-activerecord/compare/v2.0.1...v2.0.3)

---
updated-dependencies:
- dependency-name: otr-activerecord
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2021-11-09 16:25:58 +11:00
dependabot[bot]
be9b7655fe Bump capybara from 3.35.3 to 3.36.0 (#2210)
* Bump capybara from 3.35.3 to 3.36.0

Bumps [capybara](https://github.com/teamcapybara/capybara) from 3.35.3 to 3.36.0.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/3.35.3...3.36.0)

---
updated-dependencies:
- dependency-name: capybara
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2021-11-09 16:23:05 +11:00
dependabot[bot]
a6fcb1a14f Bump rubocop from 1.20.0 to 1.22.3 (#2213)
* Bump rubocop from 1.20.0 to 1.22.3

Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.20.0 to 1.22.3.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.20.0...v1.22.3)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
Co-authored-by: Isaac Powell <36595182+DeezyE@users.noreply.github.com>
2021-11-09 16:22:15 +11:00
dependabot[bot]
784e6db9ce Bump test-unit from 3.5.0 to 3.5.1 (#2223)
Bumps [test-unit](https://github.com/test-unit/test-unit) from 3.5.0 to 3.5.1.
- [Release notes](https://github.com/test-unit/test-unit/releases)
- [Commits](https://github.com/test-unit/test-unit/compare/3.5.0...3.5.1)

---
updated-dependencies:
- dependency-name: test-unit
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Isaac Powell <36595182+DeezyE@users.noreply.github.com>
2021-11-09 16:13:40 +11:00
Isaac Powell
0d0e51452c Enhancement - Check for update on launch (#2199) 2021-11-09 14:40:51 +10:00
dependabot[bot]
08faef394b Bump test-unit from 3.4.6 to 3.5.0 (#2198)
* Bump test-unit from 3.4.6 to 3.5.0

Bumps [test-unit](https://github.com/test-unit/test-unit) from 3.4.6 to 3.5.0.
- [Release notes](https://github.com/test-unit/test-unit/releases)
- [Commits](https://github.com/test-unit/test-unit/compare/3.4.6...3.5.0)

---
updated-dependencies:
- dependency-name: test-unit
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2021-11-09 09:07:16 +10:00
dependabot[bot]
1aa86bd64a Bump nokogiri from 1.12.4 to 1.12.5 (#2197)
* Bump nokogiri from 1.12.4 to 1.12.5

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.4 to 1.12.5.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.4...v1.12.5)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

* removing explicit dependancy of nokogiri as it is only required as a dependancy

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2021-11-09 09:05:15 +10:00
dependabot[bot]
b7108bc069 Bump async-dns from 1.2.6 to 1.3.0 (#2194)
* Bump async-dns from 1.2.6 to 1.3.0

Bumps [async-dns](https://github.com/socketry/async-dns) from 1.2.6 to 1.3.0.
- [Release notes](https://github.com/socketry/async-dns/releases)
- [Commits](https://github.com/socketry/async-dns/compare/v1.2.6...v1.3.0)

---
updated-dependencies:
- dependency-name: async-dns
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2021-11-09 09:04:44 +10:00
dependabot[bot]
a674c9d25f Bump parseconfig from 1.1.0 to 1.1.2 (#2193)
* Bump parseconfig from 1.1.0 to 1.1.2

Bumps [parseconfig](https://github.com/datafolklabs/ruby-parseconfig) from 1.1.0 to 1.1.2.
- [Release notes](https://github.com/datafolklabs/ruby-parseconfig/releases)
- [Changelog](https://github.com/datafolklabs/ruby-parseconfig/blob/master/Changelog)
- [Commits](https://github.com/datafolklabs/ruby-parseconfig/commits)

---
updated-dependencies:
- dependency-name: parseconfig
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* testing approval process

* Update github_actions.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: wheatley <wheatand@gmail.com>
2021-11-09 09:03:36 +10:00
wheatley
99c6287a67 MAINTAINABILITY: Added approval before code execution. (#2218) 2021-11-08 09:32:12 +10:00
Isaac Powell
2794bc3cf4 INSTALL: Fixed GITACTIONS check for null (#2214) 2021-10-28 15:35:10 +10:00
Isaac Powell
541933a45f deleted github actions .yaml used for testing 2021-10-28 12:24:43 +11:00
Isaac Powell
9cef23be22 Update github_actions.yml
Changed the actions to run on master branch when pull request is triggered
2021-10-22 12:05:01 +11:00
Isaac Powell
7c3e342981 Feature/ci (#2190)
squash and merge
2021-10-15 14:22:56 +11:00
Isaac Powell
3b34e428cc version up (#2188) 2021-10-15 13:56:58 +11:00
Isaac Powell
ea65554a50 Rubocop api.rb fix (#2175) 2021-10-15 10:36:54 +10:00
wheatley
dc68ed9390 Added testing installation on ubuntu 2021-10-14 16:20:50 +10:00
Isaac Powell
1ae320c3bc Hotfix api.rb (#2173)
* testing api

* formatting
2021-09-24 11:36:16 +10:00
wheatley
43e3fa5432 Release: 0.5.3.0 (#2169)
* Fix #1851 - Command/request(s) sent to zombie 'undefined' bug (#1963)

* Provided correct context in locationHashChanged() to have data necessary for the nested function calls to act as intended.

* rubocop cleanup (#2170)

* version up (#2172)

Co-authored-by: Jack Walker <46417690+jackdwalker@users.noreply.github.com>
Co-authored-by: Isaac Powell <36595182+DeezyE@users.noreply.github.com>
2021-09-24 11:06:47 +10:00
1364 changed files with 15070 additions and 15264 deletions

9
.dockerignore Normal file
View File

@@ -0,0 +1,9 @@
# Don't copy over git files
.git
.github
.gitignore
doc
docs
scripts
test
update-beef

View File

@@ -1,66 +1,31 @@
# Submit Issue
Verify first that your issue/request has not been posted previously:
* https://github.com/beefproject/beef/issues
* https://github.com/beefproject/beef/wiki/FAQ
Ensure you're using the [latest version of BeEF](https://github.com/beefproject/beef/releases/tag/v0.5.2.0).
Please do your best to provide as much information as possible. It will help substantially if you can enable and provide debugging logs with your issue. Instructions for enabling debugging logs are below:
1. In the `config.yaml` file of your BeEF root folder set debug and client_debug (lines 11 & 13 respectively) to `true`
* If using a standard installation of `beef-xss` the root folder will typically be `/usr/share/beef-xss`
2. Reproduce your error
3. Retrieve your client-side logs from your browser's developer console (Ctrl + Shift + I)
4. Retrieve your server-side logs from `~/.beef/beef.log`
5. **If using `beef-xss`:** Retrieve your service logs using `journalctl -u beef-xss`
Thank you, this will greatly aid us in identifying the root cause of your issue :)
**If we request additional information and we don't hear back from you within a week, we will be closing the ticket off.**
Feel free to open it back up if you continue to have issues.
## Summary
**Q:** Please provide a brief summary of the issue that you experienced.
**A:**
## Environment
*Please identify the environment in which your issue occurred.*
1. **BeEF Version:**
2. **Ruby Version:**
3. **Browser Details (e.g. Chrome v81.0):**
4. **Operating System (e.g. OSX Catalina):**
## First Steps
1. Confirm that your issue has not been posted previously by searching here: https://github.com/beefproject/beef/issues
2. Confirm that the wiki does not contain the answers you seek: https://github.com/beefproject/beef/wiki
3. Check the FAQ: https://github.com/beefproject/beef/wiki/FAQ
4. BeEF Version:
5. Ruby Version:
6. Browser Details (e.g. Chrome v81.0):
7. Operating System (e.g. OSX Catalina):
## Configuration
**Q:** Have you made any changes to your BeEF configuration?
**A:**
**Q:** Have you enabled or disabled any BeEF extensions?
**A:**
## Expected vs. Actual Behaviour
**Expected Behaviour:**
<br />
**Actual Behaviour:**
<br />
1. Have you made any changes to your BeEF configuration? Yes/No
2. Have you enabled or disabled any BeEF extensions? Yes/No
## Steps to Reproduce
*Please provide steps to reproduce this issue.*
1. (eg. I ran install script, which ran fine)
2. (eg. when launching console with './beef' I get an error as follows: <error here>)
3. (eg. beef does not launch)
1.
## How to enable and capture detailed logging
1. Edit `config.yaml` in the root directory
* If using Kali **beef-xss** the root dir will be `/usr/share/beef-xss`
2. Update `client_debug` to `true`
3. Retrieve browser logs from your browser's developer console (Ctrl + Shift + I or F12 depending on browser)
4. Retrieve your server-side logs from `~/.beef/beef.log`
* If using **beef-xss** logs found with `journalctl -u beef-xss`
## Additional Information
Please provide any additional information which may be useful in resolving this issue, such as debugging output and relevant screen shots. Debug output can be retrieved by following the instructions towards the top of the issue template.
**If we request additional information and we don't hear back from you within a week, we will be closing the ticket off.**

72
.github/workflows/codeql.yml vendored Normal file
View File

@@ -0,0 +1,72 @@
# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"
on:
push:
branches: [ master ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ master ]
schedule:
- cron: '36 1 * * 0'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'javascript', 'ruby' ]
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
steps:
- name: Checkout repository
uses: actions/checkout@v3
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
queries: security-extended,security-and-quality
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
# - name: Autobuild
# uses: github/codeql-action/autobuild@v2
# Command-line programs to run using the OS shell.
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
# If the Autobuild fails above, remove it and uncomment the following three lines.
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
# - run: |
# echo "Run, Build Application using script"
# ./location_of_script_within_repo/buildscript.sh
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2

59
.github/workflows/github_actions.yml vendored Normal file
View File

@@ -0,0 +1,59 @@
name: 'BrowserStack Test'
on:
pull_request_target:
branches: [ master ]
jobs:
approve:
runs-on: ubuntu-latest
steps:
- name: Approve
run: echo For security reasons, all pull requests need to be approved first before running any automated CI.
ubuntu-job:
name: 'BrowserStack Test on Ubuntu'
runs-on: ubuntu-latest # Can be self-hosted runner also
environment:
name: Integrate Pull Request
env:
GITACTIONS: true
steps:
- name: 'BrowserStack Env Setup' # Invokes the setup-env action
uses: browserstack/github-actions/setup-env@master
with:
username: ${{ secrets.BROWSERSTACK_USERNAME }}
access-key: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
- name: 'BrowserStack Local Tunnel Setup' # Invokes the setup-local action
uses: browserstack/github-actions/setup-local@master
with:
local-testing: start
local-identifier: random
- name: 'Checkout the repository'
uses: actions/checkout@v2
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 2
- name: 'Setting up Ruby'
uses: ruby/setup-ruby@v1
with:
ruby-version: 3.0.3 # Not needed with a .ruby-version file
- name: 'Build and run tests'
run: |
sudo apt update
sudo apt install libcurl4 libcurl4-openssl-dev
bundle config unset --local without
bundle config set --local with 'test' 'development'
bundle install
bundle exec rake browserstack --trace
- name: 'BrowserStackLocal Stop' # Terminating the BrowserStackLocal tunnel connection
uses: browserstack/github-actions/setup-local@master
with:
local-testing: stop

35
.github/workflows/stale.yml vendored Normal file
View File

@@ -0,0 +1,35 @@
# This workflow warns and then closes issues and PRs that have had no activity for a specified amount of time.
#
# You can adjust the behavior by modifying this file.
# For more information, see:
# https://github.com/actions/stale
name: Mark stale issues and pull requests
on:
schedule:
- cron: '5 * * * *'
jobs:
stale:
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
steps:
- uses: actions/stale@v5
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
days-before-stale: 7
days-before-pr-stale: 14
days-before-close: 7
days-before-pr-close: 14
stale-issue-message: 'This issue as been marked as stale due to inactivity and will be closed in 7 days'
stale-pr-message: 'Stale pull request message'
stale-issue-label: 'Stale'
stale-pr-label: 'no-pr-activity'
exempt-issue-labels: 'Critical, High, Low, Medium, Review, Backlog'
exempt-milestones: true
exempt-draft-pr: true
start-date: '2022-06-15'

1
.gitignore vendored
View File

@@ -9,7 +9,6 @@ custom-config.yaml
.rvmrc
beef.log
*.lock
extensions/metasploit/msf-exploits.cache

View File

@@ -4,7 +4,8 @@ AllCops:
- 'tmp/**/*'
- 'tools/**/*'
- 'doc/**/*'
TargetRubyVersion: 2.6
TargetRubyVersion: 3.0
NewCops: enable
Layout/LineLength:
Enabled: true
@@ -22,57 +23,20 @@ Metrics/ClassLength:
Metrics/MethodLength:
Enabled: false
Metrics/ModuleLength:
Enabled: false
Metrics/PerceivedComplexity:
Enabled: false
Metrics/CyclomaticComplexity:
Enabled: false
Naming/ClassAndModuleCamelCase:
Enabled: false
Style/FrozenStringLiteralComment:
Enabled: false
# TODO: review these
Layout/SpaceBeforeBrackets:
Enabled: false
Lint/AmbiguousAssignment:
Enabled: false
Lint/DeprecatedConstants:
Enabled: false
Lint/DuplicateBranch:
Enabled: false
Lint/DuplicateRegexpCharacterClassElement:
Enabled: false
Lint/EmptyBlock:
Enabled: false
Lint/EmptyClass:
Enabled: false
Lint/LambdaWithoutLiteralBlock:
Enabled: false
Lint/NoReturnInBeginEndBlocks:
Enabled: false
Lint/RedundantDirGlobSort:
Enabled: false
Lint/ToEnumArguments:
Enabled: false
Lint/UnexpectedBlockArity:
Enabled: false
Lint/UnmodifiedReduceAccumulator:
Enabled: false
Style/ArgumentsForwarding:
Enabled: false
Style/CollectionCompact:
Enabled: false
Style/DocumentDynamicEvalDefinition:
Enabled: false
Style/EndlessMethod:
Enabled: false
Style/HashExcept:
Enabled: false
Style/NegatedIfElseCondition:
Enabled: false
Style/NilLambda:
Enabled: false
Style/RedundantArgument:
Enabled: false
Style/SwapValues:
Style/Documentation:
Enabled: false

View File

@@ -1 +1 @@
2.7.2
3.0.3

View File

@@ -1,99 +0,0 @@
language: ruby
rvm:
- 2.5.3
- 2.6.0
- 2.6.3
- 2.6.5
- 2.7.0
notifications:
email:
recipients:
- wade@bindshell.net
on_success: always
on_failure: always
branches:
only:
- master
- browserstack
before_script:
- RUBY_VERSION=/bin/bash rvm current
- sed -i -E 's/system\((.*?)\)/""/g' /home/travis/.rvm/gems/$RUBY_VERSION/gems/browserstack-local-1.3.0/lib/browserstack/local.rb
env:
- CONFIG_FILE=osx/catalina/catalina_chrome_41.config.yml
- CONFIG_FILE=osx/catalina/catalina_chrome_59.config.yml
- CONFIG_FILE=osx/catalina/catalina_chrome_81.config.yml
- CONFIG_FILE=osx/catalina/catalina_firefox_11.config.yml
- CONFIG_FILE=osx/catalina/catalina_firefox_68esr.config.yml
- CONFIG_FILE=osx/catalina/catalina_firefox_75.config.yml
- CONFIG_FILE=osx/catalina/catalina_safari_13.config.yml
- CONFIG_FILE=osx/elcapitan/elcapitan_chrome_14.config.yml
- CONFIG_FILE=osx/elcapitan/elcapitan_chrome_81.config.yml
- CONFIG_FILE=osx/elcapitan/elcapitan_firefox_7.config.yml
- CONFIG_FILE=osx/elcapitan/elcapitan_firefox_75.config.yml
- CONFIG_FILE=osx/elcapitan/elcapitan_safari_9-1.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_chrome_14.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_chrome_35.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_chrome_49.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_firefox_7.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_firefox_38esr.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_firefox_42.config.yml
- CONFIG_FILE=osx/snowleopard/snowleopard_safari_5-1.config.yml
- CONFIG_FILE=windows/win10/win10_chrome_37.config.yml
- CONFIG_FILE=windows/win10/win10_chrome_59.config.yml
- CONFIG_FILE=windows/win10/win10_firefox_32.config.yml
- CONFIG_FILE=windows/win10/win10_firefox_68esr.config.yml
- CONFIG_FILE=windows/win10/win10_firefox_75.config.yml
- CONFIG_FILE=windows/win10/win10_edge_81.config.yml
- CONFIG_FILE=windows/win10/win10_ie_11.config.yml
- CONFIG_FILE=windows/win8/win8_chrome_22.config.yml
- CONFIG_FILE=windows/win8/win8_chrome_81.config.yml
- CONFIG_FILE=windows/win8/win8_firefox_32.config.yml
- CONFIG_FILE=windows/win8/win8_firefox_75.config.yml
- CONFIG_FILE=windows/win8/win8_edge_81.config.yml
- CONFIG_FILE=windows/win8/win8_ie_10.config.yml
- CONFIG_FILE=windows/xp/xp_chrome_14.config.yml
- CONFIG_FILE=windows/xp/xp_chrome_28.config.yml
- CONFIG_FILE=windows/xp/xp_chrome_43.config.yml
- CONFIG_FILE=windows/xp/xp_firefox_16.config.yml
- CONFIG_FILE=windows/xp/xp_firefox_26.config.yml
- CONFIG_FILE=windows/xp/xp_firefox_45.config.yml
- CONFIG_FILE=windows/xp/xp_ie_7.config.yml
jobs:
include:
- name: "Full Test Suite 2.5.3"
rvm: 2.5.3
env: CONFIG_FILE=windows/win10/win10_chrome_81.config.yml
script: bundle exec rspec
- name: "Full Test Suite 2.6.0"
rvm: 2.6.0
env: CONFIG_FILE=windows/win10/win10_chrome_81.config.yml
script: bundle exec rspec
- name: "Full Test Suite 2.6.3"
rvm: 2.6.3
env: CONFIG_FILE=windows/win10/win10_chrome_81.config.yml
script: bundle exec rspec
- name: "Full Test Suite 2.6.5"
rvm: 2.6.5
env: CONFIG_FILE=windows/win10/win10_chrome_81.config.yml
script: bundle exec rspec
- name: "Full Test Suite 2.7.0"
rvm: 2.7.0
env: CONFIG_FILE=windows/win10/win10_chrome_81.config.yml
script: bundle exec rspec
script:
- bundle exec rspec --tag run_on_browserstack
addons:
apt:
packages:
- libsqlite3-dev
- build-essential
- patch
- ruby-dev
- zlib1g-dev
- liblzma-dev
- libcurl4-openssl-dev
browserstack:
username:
secure: "Yj+a2jY56dFqJwXdU6JdSXeKhhS01CiToBoB922SXVnA2D2WclGOFiTi0YrkAS9PuOJX5AjC9eUw7VFUcp8DiLmeDGLWo8klYrWQoJOH55FmSWKjdkqDopJFYr0ZXk/ZuXzzpuMvKkCT5MGFnySXyheTW8aUj33GetJ6/sNq5BoA36jH04OE3iPgdBaFPRNDVXEIWLaLUDQsAyZsHNNYC+/cj3cxjXLHu+mbNuXsXEHgrHJ2A94EWdrdGODWL8mRtlSDNkIaYHZKCBnUlHWwCwBitLsjhzdy0YFrIGVbX96FV+C41sjPWLFjZhjAaNDuJ3FoTplbzFNvrw5oxQAAI8ZZqUwF4MRIrQbN8BLFVISX7JooQjfyrNVWvhpZWGPB4GZTN4CThrlQ7G7CJRYDVyqZ7nen6y0+osBr9DRKN+EemlVG73aNP3mXaZr6BmS1BpQJ6tlqDdLCvC5j/PdguKwvt4EmgHA8Pzn20UElV+8BPblcYGjsWplk/cxW1adW0pu2vIxskKxDKJ/ReY3l5yUpiQPZHbuMidq2ffSX0B3yALe7vx+3AvMb2Fk9yWh52EVJXPkVlLvhP7wDd22MHCemvrC2nLhkVR4MglLWs7dZKHswExlKJdWK4OSXprOStjZSA47sjF2nPdztWTpdI77SKaBcoLGR5WOV+JtcQgk="
access_key:
secure: "KHlR8NHPnoF9U1CJKgUhS1YhPSeTILI2lIu+JilQ5Xeo7rcbWg9lT2xwQQNnLYrISG1vC6OzsbkcnC/3ZnAv7jYff4iUTc3Syszs5wIhhvnhBx4qCxM+/UD78TJNQ0AuY7NOIK6OXcmwbpZrOBUojZkooEkc8bpG56nb2v7dOIafFLV+tv9xcc5DtMSfh7FavhqRFRO+PCybqOW8yWMc2NiMYy3p9jKBC3qYRqme4hx1NRrLo5BZQ+UIcO3Rf+vAjUP+3gGuhWeu2kDCvZYDnI2GN1/WacRVY2cqDPGiYlD6pHNMqU0raYKyWdK0QD4KwYpfjxBGRmwBfz8xU8KWUEZ3P11mJn+BvIt0qe3VpomR0/60/fok1BEso3nea8oENXur5G/5SOfpkPLjzd4P4f7JYnST1PeeWwpzV305wktDv9aLc+Ne9cFCaxSaaCnOk82rKDhtnktwnK7krFj1lM6oygtOD+arAytPKaURRgV2izaoophiXuLFb+9XKSkMGtJ3e+rQATonnDPaFTzouKaXSEPxZQQ2bnsp9tETAReDrYIwPHuYL778UbbBICgNk54CZSfTeRFLroRGNPb/0gPXbu6SryPnknfCMNd7ksSndVoyKsDo1plTHQJGVweP2hxR3R/9syk9Z6DU6H5H3dc/RbkkmoRPVooUtR/mZ/c="

View File

@@ -10,20 +10,20 @@
###########################################################################################################
# ---------------------------- Start of Builder 0 - Gemset Build ------------------------------------------
FROM ruby:2.6.3-alpine AS builder
FROM ruby:2.7.5-alpine AS builder
LABEL maintainer="Beef Project: github.com/beefproject/beef"
# Install gems in parallel with 4 workers to expedite build process.=
ARG BUNDLER_ARGS="--jobs=4"
ARG BUNDLER_ARGS="--jobs=4"
# Set gemrc config to install gems without Ruby Index (ri) and Ruby Documentation (rdoc) files
RUN echo "gem: --no-ri --no-rdoc" > /etc/gemrc
COPY . /beef
# Add bundler/gem dependencies and then install
# Add bundler/gem dependencies and then install
RUN apk add --no-cache git curl libcurl curl-dev ruby-dev libffi-dev make g++ gcc musl-dev zlib-dev sqlite-dev && \
bundle install --system --clean --no-cache --gemfile=/beef/Gemfile $BUNDLER_ARGS && \
bundle install --gemfile=/beef/Gemfile $BUNDLER_ARGS && \
# Temp fix for https://github.com/bundler/bundler/issues/6680
rm -rf /usr/local/bundle/cache
@@ -35,22 +35,19 @@ RUN chmod -R a+r /usr/local/bundle
# ---------------------------- Start of Builder 1 - Final Build ------------------------------------------
FROM ruby:2.6.3-alpine
FROM ruby:2.7.5-alpine
LABEL maintainer="Beef Project: github.com/beefproject/beef"
# Create service account to run BeEF
RUN adduser -h /beef -g beef -D beef
COPY . /beef
COPY --chown=1000:1000 . /beef
# Use gemset created by the builder above
COPY --from=builder /usr/local/bundle /usr/local/bundle
# Grant beef service account owner and groups rights over our BeEF working directory.
RUN chown -R beef:beef /beef
# Install BeEF's runtime dependencies
RUN apk add --no-cache curl git build-base openssl readline-dev zlib zlib-dev libressl-dev yaml-dev sqlite-dev sqlite libxml2-dev libxslt-dev autoconf libc6-compat ncurses5 automake libtool bison nodejs
RUN apk add --no-cache curl git build-base openssl readline-dev zlib zlib-dev libressl-dev yaml-dev sqlite-dev sqlite libxml2-dev libxslt-dev autoconf libc6-compat ncurses automake libtool bison nodejs
WORKDIR /beef
@@ -60,5 +57,7 @@ USER beef
# Expose UI, Proxy, WebSocket server, and WebSocketSecure server
EXPOSE 3000 6789 61985 61986
HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 CMD [ "curl", "-fS", "localhost:3000" ]
ENTRYPOINT ["/beef/beef"]
# ------------------------------------- End of Builder 1 -------------------------------------------------
# ------------------------------------- End of Builder 1 -------------------------------------------------

35
Gemfile
View File

@@ -1,18 +1,19 @@
# BeEF's Gemfile
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
#gem 'simplecov', require: false, group: :test
gem 'net-smtp', require: false
gem 'eventmachine'
gem 'thin'
gem 'sinatra', '>= 2.0.2'
gem 'rack', '>= 2.2.3'
gem 'rack-protection', '>= 2.0.0'
gem 'sinatra', '>= 2.2.0'
gem 'rack', '>= 2.2.4'
gem 'rack-protection', '>= 2.2.0'
gem 'em-websocket' # WebSocket support
gem 'uglifier', '>= 2.7.2'
gem 'uglifier', '>= 4.2.0'
gem 'mime-types'
gem 'execjs'
gem 'ansi'
@@ -20,11 +21,10 @@ gem 'term-ansicolor', :require => 'term/ansicolor'
gem 'json'
gem 'rubyzip', '>= 1.2.2'
gem 'espeak-ruby', '>= 1.0.4' # Text-to-Voice
gem 'nokogiri', '>= 1.11.1'
gem 'rake', '>= 12.3.3'
gem 'rake', '>= 13.0'
gem 'otr-activerecord', '>= 1.4.2'
gem 'sqlite3'
gem 'rubocop', '~> 1.20.0', require: false
gem 'rubocop', '~> 1.36.0', require: false
# Geolocation support
group :geoip do
@@ -42,12 +42,14 @@ end
# Notifications extension
group :ext_notifications do
gem 'unf'
gem 'domain_name', '>= 0.5.20190701'
# Pushover
gem 'rushover'
# Slack
gem 'slack-notifier'
# Twitter
gem 'twitter', '>= 5.0.0'
gem 'twitter', '>= 7.0.0'
end
# DNS extension
@@ -78,16 +80,11 @@ group :test do
# sudo port install libxml2 libxslt
gem 'capybara'
# RESTful API tests/generic command module tests
gem 'rest-client', '>= 2.0.1'
gem 'rest-client', '>= 2.1.0'
gem 'irb'
gem 'pry-byebug'
gem "websocket-client-simple", "~> 0.3.0"
gem "browserstack-local", "~> 1.3"
gem "websocket-client-simple", "~> 0.6.0"
gem "browserstack-local", "~> 1.4"
end
source 'https://rubygems.org'

309
Gemfile.lock Normal file
View File

@@ -0,0 +1,309 @@
GEM
remote: https://rubygems.org/
specs:
activemodel (7.0.3.1)
activesupport (= 7.0.3.1)
activerecord (7.0.3.1)
activemodel (= 7.0.3.1)
activesupport (= 7.0.3.1)
activesupport (7.0.3.1)
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 1.6, < 2)
minitest (>= 5.1)
tzinfo (~> 2.0)
addressable (2.8.0)
public_suffix (>= 2.0.2, < 5.0)
ansi (1.5.0)
archive-zip (0.12.0)
io-like (~> 0.3.0)
ast (2.4.2)
async (1.30.3)
console (~> 1.10)
nio4r (~> 2.3)
timers (~> 4.1)
async-dns (1.3.0)
async-io (~> 1.15)
async-io (1.33.0)
async
browserstack-local (1.4.0)
buftok (0.2.0)
byebug (11.1.3)
capybara (3.37.1)
addressable
matrix
mini_mime (>= 0.1.3)
nokogiri (~> 1.8)
rack (>= 1.6.0)
rack-test (>= 0.6.3)
regexp_parser (>= 1.5, < 3.0)
xpath (~> 3.2)
childprocess (4.1.0)
coderay (1.1.3)
concurrent-ruby (1.1.10)
console (1.15.3)
fiber-local
curb (1.0.1)
daemons (1.4.1)
diff-lcs (1.5.0)
domain_name (0.5.20190701)
unf (>= 0.0.5, < 1.0.0)
em-websocket (0.5.3)
eventmachine (>= 0.12.9)
http_parser.rb (~> 0)
equalizer (0.0.11)
erubis (2.7.0)
espeak-ruby (1.1.0)
event_emitter (0.2.6)
eventmachine (1.2.7)
execjs (2.8.1)
ffi (1.15.5)
ffi-compiler (1.0.1)
ffi (>= 1.0.0)
rake
fiber-local (1.0.0)
geckodriver-helper (0.24.0)
archive-zip (~> 0.7)
hashie (5.0.0)
hashie-forbidden_attributes (0.1.1)
hashie (>= 3.0)
http (4.4.1)
addressable (~> 2.3)
http-cookie (~> 1.0)
http-form_data (~> 2.2)
http-parser (~> 1.2.0)
http-accept (1.7.0)
http-cookie (1.0.5)
domain_name (~> 0.5)
http-form_data (2.3.0)
http-parser (1.2.3)
ffi-compiler (>= 1.0, < 2.0)
http_parser.rb (0.6.0)
i18n (1.12.0)
concurrent-ruby (~> 1.0)
io-console (0.5.11)
io-like (0.3.1)
irb (1.4.2)
reline (>= 0.3.0)
json (2.6.2)
matrix (0.4.2)
maxmind-db (1.1.1)
memoizable (0.4.2)
thread_safe (~> 0.3, >= 0.3.1)
method_source (1.0.0)
mime-types (3.4.1)
mime-types-data (~> 3.2015)
mime-types-data (3.2022.0105)
mini_mime (1.1.2)
minitest (5.16.2)
mojo_magick (0.6.7)
msfrpc-client (1.1.2)
msgpack (~> 1)
msgpack (1.5.4)
multipart-post (2.2.3)
mustermann (3.0.0)
ruby2_keywords (~> 0.0.1)
naught (1.1.0)
net-protocol (0.1.3)
timeout
net-smtp (0.3.2)
net-protocol
netrc (0.11.0)
nio4r (2.5.8)
nokogiri (1.13.8-x86_64-linux)
racc (~> 1.4)
otr-activerecord (2.1.1)
activerecord (>= 4.0, < 7.1)
hashie-forbidden_attributes (~> 0.1)
parallel (1.22.1)
parseconfig (1.1.2)
parser (3.1.2.1)
ast (~> 2.4.1)
power_assert (2.0.1)
pry (0.14.1)
coderay (~> 1.1)
method_source (~> 1.0)
pry-byebug (3.10.1)
byebug (~> 11.0)
pry (>= 0.13, < 0.15)
psych (4.0.4)
stringio
public_suffix (4.0.7)
qr4r (0.6.1)
mojo_magick (~> 0.6.5)
rqrcode_core (~> 0.1)
racc (1.6.0)
rack (2.2.4)
rack-protection (3.0.2)
rack
rack-test (2.0.2)
rack (>= 1.3)
rainbow (3.1.1)
rake (13.0.6)
rdoc (6.4.0)
psych (>= 4.0.0)
regexp_parser (2.5.0)
reline (0.3.1)
io-console (~> 0.5)
rest-client (2.1.0)
http-accept (>= 1.7.0, < 2.0)
http-cookie (>= 1.0.2, < 2.0)
mime-types (>= 1.16, < 4.0)
netrc (~> 0.8)
rexml (3.2.5)
rqrcode_core (0.2.0)
rr (3.1.0)
rspec (3.11.0)
rspec-core (~> 3.11.0)
rspec-expectations (~> 3.11.0)
rspec-mocks (~> 3.11.0)
rspec-core (3.11.0)
rspec-support (~> 3.11.0)
rspec-expectations (3.11.0)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.11.0)
rspec-mocks (3.11.1)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.11.0)
rspec-support (3.11.0)
rubocop (1.36.0)
json (~> 2.3)
parallel (~> 1.10)
parser (>= 3.1.2.1)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.8, < 3.0)
rexml (>= 3.2.5, < 4.0)
rubocop-ast (>= 1.20.1, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 1.4.0, < 3.0)
rubocop-ast (1.21.0)
parser (>= 3.1.1.0)
ruby-progressbar (1.11.0)
ruby2_keywords (0.0.5)
rubyzip (2.3.2)
rushover (0.3.0)
json
rest-client
selenium-webdriver (4.5.0)
childprocess (>= 0.5, < 5.0)
rexml (~> 3.2, >= 3.2.5)
rubyzip (>= 1.2.2, < 3.0)
websocket (~> 1.0)
simple_oauth (0.3.1)
sinatra (3.0.2)
mustermann (~> 3.0)
rack (~> 2.2, >= 2.2.4)
rack-protection (= 3.0.2)
tilt (~> 2.0)
slack-notifier (2.4.0)
sqlite3 (1.5.3-x86_64-linux)
stringio (3.0.2)
sync (0.5.0)
term-ansicolor (1.7.1)
tins (~> 1.0)
test-unit (3.5.5)
power_assert
test-unit-context (0.5.1)
test-unit (>= 2.4.0)
test-unit-full (0.0.5)
test-unit
test-unit-context
test-unit-notify
test-unit-rr
test-unit-runner-tap
test-unit-notify (1.0.4)
test-unit (>= 2.4.9)
test-unit-rr (1.0.5)
rr (>= 1.1.1)
test-unit (>= 2.5.2)
test-unit-runner-tap (1.1.2)
test-unit
thin (1.8.1)
daemons (~> 1.0, >= 1.0.9)
eventmachine (~> 1.0, >= 1.0.4)
rack (>= 1, < 3)
thread_safe (0.3.6)
tilt (2.0.11)
timeout (0.3.0)
timers (4.3.3)
tins (1.31.1)
sync
twitter (7.0.0)
addressable (~> 2.3)
buftok (~> 0.2.0)
equalizer (~> 0.0.11)
http (~> 4.0)
http-form_data (~> 2.0)
http_parser.rb (~> 0.6.0)
memoizable (~> 0.4.0)
multipart-post (~> 2.0)
naught (~> 1.0)
simple_oauth (~> 0.3.0)
tzinfo (2.0.5)
concurrent-ruby (~> 1.0)
uglifier (4.2.0)
execjs (>= 0.3.0, < 3)
unf (0.1.4)
unf_ext
unf_ext (0.0.8.2)
unicode-display_width (2.2.0)
webrick (1.7.0)
websocket (1.2.9)
websocket-client-simple (0.6.0)
event_emitter
websocket
xmlrpc (0.3.2)
webrick
xpath (3.2.0)
nokogiri (~> 1.8)
PLATFORMS
x86_64-linux
DEPENDENCIES
ansi
async-dns
browserstack-local (~> 1.4)
capybara
curb
domain_name (>= 0.5.20190701)
em-websocket
erubis
espeak-ruby (>= 1.0.4)
eventmachine
execjs
geckodriver-helper
irb
json
maxmind-db
mime-types
msfrpc-client
net-smtp
otr-activerecord (>= 1.4.2)
parseconfig
pry-byebug
qr4r
rack (>= 2.2.4)
rack-protection (>= 2.2.0)
rake (>= 13.0)
rdoc
rest-client (>= 2.1.0)
rspec
rubocop (~> 1.36.0)
rubyzip (>= 1.2.2)
rushover
selenium-webdriver
sinatra (>= 2.2.0)
slack-notifier
sqlite3
term-ansicolor
test-unit
test-unit-full
thin
twitter (>= 7.0.0)
uglifier (>= 4.2.0)
unf
websocket-client-simple (~> 0.6.0)
xmlrpc
BUNDLED WITH
2.3.14

View File

@@ -1,6 +1,6 @@
===============================================================================
Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
Browser Exploitation Framework (BeEF) - http://beefproject.com
See the file 'doc/COPYING' for copying permission
@@ -21,9 +21,9 @@ Or cloning the Git repository from Github:
Prerequisites
--------------
BeEF requires Ruby 2.5+.
BeEF requires Ruby 2.7+.
If your operating system package manager does not support Ruby version 2.5,
If your operating system package manager does not support Ruby version 2.7,
you can add the brightbox ppa repository for the latest version of Ruby:
$ sudo apt-add-repository -y ppa:brightbox/ruby-ng

View File

@@ -1,6 +1,6 @@
===============================================================================
Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
Browser Exploitation Framework (BeEF) - http://beefproject.com
See the file 'doc/COPYING' for copying permission
@@ -30,12 +30,13 @@ __Security Bugs:__ security@beefproject.com
__Twitter:__ [@beefproject](https://twitter.com/beefproject)
__Discord:__ https://discord.gg/ugmKmHarKc
Requirements
------------
* Operating System: Mac OSX 10.5.0 or higher / modern Linux. Note: Windows is not supported.
* [Ruby](http://ruby-lang.org): 2.5 or newer
* [Ruby](https://www.ruby-lang.org): 2.7 or newer
* [SQLite](http://sqlite.org): 3.x
* [Node.js](https://nodejs.org): 10 or newer
* The gems listed in the Gemfile: https://github.com/beefproject/beef/blob/master/Gemfile

View File

@@ -1,5 +1,5 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
@@ -23,6 +23,22 @@ RSpec::Core::RakeTask.new(:spec) do |task|
task.rspec_opts = ['--tag ~run_on_browserstack']
end
RSpec::Core::RakeTask.new(:browserstack) do |task|
task.rspec_opts = ['--tag run_on_browserstack']
end
RSpec::Core::RakeTask.new(:bs) do |task|
configs = Dir["spec/support/browserstack/**/*.yml"]
configs.each do |config|
config = config.split('spec/support/browserstack')[1]
ENV['CONFIG_FILE'] = config
puts "\e[45m#{config.upcase}\e[0m"
task.rspec_opts = ['--tag run_on_browserstack']
Rake::Task['browserstack'].invoke
Rake::Task['browserstack'].reenable
end
end
################################
# SSL/TLS certificate
@@ -244,4 +260,4 @@ namespace :db do
task :environment do
require_relative "beef"
end
end
end

View File

@@ -1,7 +1,7 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
0.5.2.0
0.5.4.0

54
beef
View File

@@ -1,7 +1,7 @@
#!/usr/bin/env ruby
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
@@ -12,11 +12,12 @@
$VERBOSE = nil
#
# @note Version check to ensure BeEF is running Ruby 2.5+
# @note Version check to ensure BeEF is running Ruby 2.7+
#
if RUBY_VERSION < '2.5'
min_ruby_version = '2.7'
if RUBY_VERSION < min_ruby_version
puts
puts "Ruby version #{RUBY_VERSION} is no longer supported. Please upgrade to Ruby version 2.5 or later."
puts "Ruby version #{RUBY_VERSION} is no longer supported. Please upgrade to Ruby version #{min_ruby_version} or later."
puts
exit 1
end
@@ -47,21 +48,21 @@ require 'timeout'
#
# @note Ask user if they would like to update beef
#
if BeEF::Core::Console::CommandLine.parse[:update_disabled] == false
if File.exist?("#{$root_dir}git") && BeEF::Core::Console::CommandLine.parse[:update_disabled] == false
if BeEF::Core::Console::CommandLine.parse[:update_auto] == true
print "Pulling latest BeEF repository and updating"
`git pull && bundle`
else
print 'Checking latest BeEF repository and updating'
`git pull && bundle`
elsif `git rev-parse master` != `git rev-parse origin/master`
begin
answer = Timeout::timeout(5) do
print "Would you like to check and download the latest BeEF update? y/n: "
Timeout.timeout(5) do
puts '-- BeEF Update Available --'
print 'Would you like to update to lastest version? y/n: '
response = gets
`git pull && bundle` if response.strip == 'y'
end
rescue Timeout::Error
puts "\nUpdate Skipped with input timeout"
`git pull && bundle` if response&.strip == 'y'
end
rescue Timeout::Error
puts "\nUpdate Skipped with input timeout"
end
end
end
@@ -183,8 +184,14 @@ db_file = config.get('beef.database.file')
# @note Resets the database if the -x flag was passed
if BeEF::Core::Console::CommandLine.parse[:resetdb]
print_info 'Resetting the database for BeEF.'
File.delete(db_file) if File.exists?(db_file)
begin
File.delete(db_file) if File.exists?(db_file)
rescue => e
print_error("Could not remove '#{db_file}' database file: #{e.message}")
exit(1)
end
end
# Connect to DB
ActiveRecord::Base.logger = nil
OTR::ActiveRecord.migrations_paths = [File.join('core', 'main', 'ar-migrations')]
@@ -194,6 +201,7 @@ OTR::ActiveRecord.configure_from_hash!(adapter:'sqlite3', database:db_file)
if Gem.loaded_specs['otr-activerecord'].version > Gem::Version.create('1.4.2')
OTR::ActiveRecord.establish_connection!
end
# Migrate (if required)
context = ActiveRecord::Migration.new.migration_context
if context.needs_migration?
@@ -207,7 +215,12 @@ print_info 'BeEF is loading. Wait a few seconds...'
#
# @note Execute migration procedure, checks for new modules
#
BeEF::Core::Migration.instance.update_db!
begin
BeEF::Core::Migration.instance.update_db!
rescue => e
print_error("Could not update '#{db_file}' database file: #{e.message}")
exit(1)
end
#
# @note Create HTTP Server and prepare it to run
@@ -215,6 +228,13 @@ BeEF::Core::Migration.instance.update_db!
http_hook_server = BeEF::Core::Server.instance
http_hook_server.prepare
begin
BeEF::Core::Logger.instance.register('System', 'BeEF server started')
rescue => e
print_error("Database connection failed: #{e.message}")
exit(1)
end
#
# @note Prints information back to the user before running the server
#

View File

@@ -1,12 +1,12 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
# BeEF Configuration file
beef:
version: '0.5.2.0'
version: '0.5.4.0'
# More verbose messages (server-side)
debug: false
# More verbose messages (client-side)
@@ -32,7 +32,7 @@ beef:
# slow API calls to 1 every api_attempt_delay seconds
api_attempt_delay: "0.05"
# HTTP server
# HTTP server
http:
debug: false #Thin::Logging.debug, very verbose. Prints also full exception stack trace.
host: "0.0.0.0"
@@ -120,10 +120,10 @@ beef:
dns_hostname_lookup: false
# IP Geolocation
# NOTE: requires MaxMind database. Run ./updated-geoipdb to install.
geoip:
enable: true
database: '/opt/GeoIP/GeoLite2-City.mmdb'
# GeoLite2 City database created by MaxMind, available from https://www.maxmind.com
database: '/usr/share/GeoIP/GeoLite2-City.mmdb'
# Integration with PhishingFrenzy
# If enabled BeEF will try to get the UID parameter value from the hooked URI, as this is used by PhishingFrenzy

View File

@@ -1,12 +1,11 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
#
# Registrar class to handle all registered timed API calls
#
@@ -24,26 +23,26 @@ module BeEF
# Register timed API calls to an owner
#
# @param [Class] owner the owner of the API hook
# @param [Class] c the API class the owner would like to hook into
# @param [Class] clss the API class the owner would like to hook into
# @param [String] method the method of the class the owner would like to execute
# @param [Array] params an array of parameters that need to be matched before the owner will be called
#
def register(owner, c, method, params = [])
unless verify_api_path(c, method)
print_error "API Registrar: Attempted to register non-existant API method #{c} :#{method}"
def register(owner, clss, method, params = [])
unless verify_api_path(clss, method)
print_error "API Registrar: Attempted to register non-existant API method #{clss} :#{method}"
return
end
if registered?(owner, c, method, params)
print_debug "API Registrar: Attempting to re-register API call #{c} :#{method}"
if registered?(owner, clss, method, params)
print_debug "API Registrar: Attempting to re-register API call #{clss} :#{method}"
return
end
id = @count
@registry << {
'id' => id,
'owner' => owner,
'class' => c,
'id' => id,
'owner' => owner,
'class' => clss,
'method' => method,
'params' => params
}
@@ -56,18 +55,19 @@ module BeEF
# Tests whether the owner is registered for an API hook
#
# @param [Class] owner the owner of the API hook
# @param [Class] c the API class
# @param [Class] clss the API class
# @param [String] method the method of the class
# @param [Array] params an array of parameters that need to be matched
#
# @return [Boolean] whether or not the owner is registered
#
def registered?(owner, c, method, params = [])
def registered?(owner, clss, method, params = [])
@registry.each do |r|
next unless r['owner'] == owner
next unless r['class'] == c
next unless r['class'] == clss
next unless r['method'] == method
next unless is_matched_params? r, params
return true
end
false
@@ -76,17 +76,18 @@ module BeEF
#
# Match a timed API call to determine if an API.fire() is required
#
# @param [Class] c the target API class
# @param [Class] clss the target API class
# @param [String] method the method of the target API class
# @param [Array] params an array of parameters that need to be matched
#
# @return [Boolean] whether or not the arguments match an entry in the API registry
#
def matched?(c, method, params = [])
def matched?(clss, method, params = [])
@registry.each do |r|
next unless r['class'] == c
next unless r['class'] == clss
next unless r['method'] == method
next unless is_matched_params? r, params
return true
end
false
@@ -98,24 +99,25 @@ module BeEF
# @param [Integer] id the ID of the API hook
#
def unregister(id)
@registry.delete_if {|r| r['id'] == id }
@registry.delete_if { |r| r['id'] == id }
end
#
# Retrieves all the owners and ID's of an API hook
# @param [Class] c the target API class
# @param [Class] clss the target API class
# @param [String] method the method of the target API class
# @param [Array] params an array of parameters that need to be matched
#
# @return [Array] an array of hashes consisting of two keys :owner and :id
#
def get_owners(c, method, params = [])
def get_owners(clss, method, params = [])
owners = []
@registry.each do |r|
next unless r['class'] == c
next unless r['class'] == clss
next unless r['method'] == method
next unless is_matched_params? r, params
owners << { :owner => r['owner'], :id => r['id'] }
owners << { owner: r['owner'], id: r['id'] }
end
owners
end
@@ -126,23 +128,23 @@ module BeEF
#
# @note This is a security precaution
#
# @param [Class] c the target API class to verify
# @param [String] m the target method to verify
# @param [Class] clss the target API class to verify
# @param [String] mthd the target method to verify
#
def verify_api_path(c, m)
(c.const_defined?('API_PATHS') && c.const_get('API_PATHS').key?(m))
def verify_api_path(clss, mthd)
(clss.const_defined?('API_PATHS') && clss.const_get('API_PATHS').key?(mthd))
end
#
# Retrieves the registered symbol reference for an API hook
#
# @param [Class] c the target API class to verify
# @param [String] m the target method to verify
# @param [Class] clss the target API class to verify
# @param [String] mthd the target method to verify
#
# @return [Symbol] the API path
#
def get_api_path(c, m)
verify_api_path(c, m) ? c.const_get('API_PATHS')[m] : nil
def get_api_path(clss, mthd)
verify_api_path(clss, mthd) ? clss.const_get('API_PATHS')[mthd] : nil
end
#
@@ -171,36 +173,32 @@ module BeEF
#
# Fires all owners registered to this API hook
#
# @param [Class] c the target API class
# @param [String] m the target API method
# @param [Class] clss the target API class
# @param [String] mthd the target API method
# @param [Array] *args parameters passed for the API call
#
# @return [Hash, NilClass] returns either a Hash of :api_id and :data
# if the owners return data, otherwise NilClass
#
def fire(c, m, *args)
mods = get_owners(c, m, args)
def fire(clss, mthd, *args)
mods = get_owners(clss, mthd, args)
return nil unless mods.length.positive?
unless verify_api_path(c, m) && c.ancestors[0].to_s > 'BeEF::API'
print_error "API Path not defined for Class: #{c} method:#{method}"
unless verify_api_path(clss, mthd) && clss.ancestors[0].to_s > 'BeEF::API'
print_error "API Path not defined for Class: #{clss} method: #{mthd}"
return []
end
data = []
method = get_api_path(c, m)
method = get_api_path(clss, mthd)
mods.each do |mod|
begin
# Only used for API Development (very verbose)
# print_info "API: #{mod} fired #{method}"
# Only used for API Development (very verbose)
# print_info "API: #{mod} fired #{method}"
result = mod[:owner].method(method).call(*args)
unless result.nil?
data << { :api_id => mod[:id], :data => result }
end
rescue => e
print_error "API Fire Error: #{e.message} in #{mod}.#{method}()"
end
result = mod[:owner].method(method).call(*args)
data << { api_id: mod[:id], data: result } unless result.nil?
rescue StandardError => e
print_error "API Fire Error: #{e.message} in #{mod}.#{method}()"
end
data
@@ -214,8 +212,7 @@ require 'core/api/modules'
require 'core/api/extension'
require 'core/api/extensions'
require 'core/api/main/migration'
require 'core/api/main/network_stack/assethandler.rb'
require 'core/api/main/network_stack/assethandler'
require 'core/api/main/server'
require 'core/api/main/server/hook'
require 'core/api/main/configuration'

View File

@@ -1,5 +1,5 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
@@ -7,14 +7,11 @@
module BeEF
module API
module Extension
attr_reader :full_name, :short_name, :description
@full_name = ''
@short_name = ''
@description = ''
end
end
end

View File

@@ -1,21 +1,18 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Extensions
# @note Defined API Paths
API_PATHS = {
'post_load' => :post_load
}
'post_load' => :post_load
}.freeze
# API hook fired after all extensions have been loaded
def post_load;
end
def post_load; end
end
end
end

View File

@@ -1,22 +1,19 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Configuration
# @note Defined API Paths
API_PATHS = {
module API
module Configuration
# @note Defined API Paths
API_PATHS = {
'module_configuration_load' => :module_configuration_load
}
# Fires just after module configuration is loaded and merged
# @param [String] mod module key
def module_configuration_load(mod); end
}.freeze
# Fires just after module configuration is loaded and merged
# @param [String] mod module key
def module_configuration_load(mod); end
end
end
end
end

View File

@@ -1,21 +1,18 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Migration
# @note Defined API Paths
API_PATHS = {
module API
module Migration
# @note Defined API Paths
API_PATHS = {
'migrate_commands' => :migrate_commands
}
}.freeze
# Fired just after the migration process
def migrate_commands; end
# Fired just after the migration process
def migrate_commands; end
end
end
end
end

View File

@@ -1,36 +1,34 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module NetworkStack
module Handlers
module AssetHandler
module API
module NetworkStack
module Handlers
module AssetHandler
# Binds a file to be accessible by the hooked browser
# @param [String] file file to be served
# @param [String] path URL path to be bound, if no path is specified a randomly generated one will be used
# @param [String] extension to be used in the URL
# @param [Integer] count amount of times the file can be accessed before being automatically unbound. (-1 = no limit)
# @return [String] URL bound to the specified file
# @todo Add hooked browser parameter to only allow specified hooked browsers access to the bound URL. Waiting on Issue #336
# @note This is a direct API call and does not have to be registered to be used
def self.bind(file, path = nil, extension = nil, count = -1)
BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind(file, path, extension, count)
end
# Binds a file to be accessible by the hooked browser
# @param [String] file file to be served
# @param [String] path URL path to be bound, if no path is specified a randomly generated one will be used
# @param [String] extension to be used in the URL
# @param [Integer] count amount of times the file can be accessed before being automatically unbound. (-1 = no limit)
# @return [String] URL bound to the specified file
# @todo Add hooked browser parameter to only allow specified hooked browsers access to the bound URL. Waiting on Issue #336
# @note This is a direct API call and does not have to be registered to be used
def self.bind(file, path=nil, extension=nil, count=-1)
return BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind(file, path, extension, count)
# Unbinds a file made accessible to hooked browsers
# @param [String] url the bound URL
# @todo Add hooked browser parameter to only unbind specified hooked browsers binds. Waiting on Issue #336
# @note This is a direct API call and does not have to be registered to be used
def self.unbind(url)
BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.unbind(url)
end
end
end
end
# Unbinds a file made accessible to hooked browsers
# @param [String] url the bound URL
# @todo Add hooked browser parameter to only unbind specified hooked browsers binds. Waiting on Issue #336
# @note This is a direct API call and does not have to be registered to be used
def self.unbind(url)
BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.unbind(url)
end
end
end
end
end
end
end

View File

@@ -1,43 +1,40 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Server
# @note Defined API Paths
API_PATHS = {
module API
module Server
# @note Defined API Paths
API_PATHS = {
'mount_handler' => :mount_handler,
'pre_http_start' => :pre_http_start
}
# Fires just before the HTTP Server is started
# @param [Object] http_hook_server HTTP Server object
def pre_http_start(http_hook_server); end
# Fires just after handlers have been mounted
# @param [Object] server HTTP Server object
def mount_handler(server); end
# Mounts a handler
# @param [String] url URL to be mounted
# @param [Class] http_handler_class the handler Class
# @param [Array] args an array of arguments
# @note This is a direct API call and does not have to be registered to be used
def self.mount(url, http_handler_class, args = nil)
BeEF::Core::Server.instance.mount(url, http_handler_class, *args)
end
}.freeze
# Unmounts a handler
# @param [String] url URL to be unmounted
# @note This is a direct API call and does not have to be registered to be used
def self.unmount(url)
# Fires just before the HTTP Server is started
# @param [Object] http_hook_server HTTP Server object
def pre_http_start(http_hook_server); end
# Fires just after handlers have been mounted
# @param [Object] server HTTP Server object
def mount_handler(server); end
# Mounts a handler
# @param [String] url URL to be mounted
# @param [Class] http_handler_class the handler Class
# @param [Array] args an array of arguments
# @note This is a direct API call and does not have to be registered to be used
def self.mount(url, http_handler_class, args = nil)
BeEF::Core::Server.instance.mount(url, http_handler_class, *args)
end
# Unmounts a handler
# @param [String] url URL to be unmounted
# @note This is a direct API call and does not have to be registered to be used
def self.unmount(url)
BeEF::Core::Server.instance.unmount(url)
end
end
end
end
end
end

View File

@@ -1,24 +1,21 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Server
module Hook
module API
module Server
module Hook
# @note Defined API Paths
API_PATHS = {
'pre_hook_send' => :pre_hook_send
}.freeze
# @note Defined API Paths
API_PATHS = {
'pre_hook_send' => :pre_hook_send
}
# Fires just before the hook is sent to the hooked browser
# @param [Class] handler the associated handler Class
def pre_hook_send(handler); end
# Fires just before the hook is sent to the hooked browser
# @param [Class] handler the associated handler Class
def pre_hook_send(handler); end
end
end
end
end
end
end

View File

@@ -1,26 +1,24 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Command
end
module Module
# @note Defined API Paths
API_PATHS = {
'pre_soft_load' => :pre_soft_load,
'post_soft_load' => :post_soft_load,
'pre_hard_load' => :pre_hard_load,
'post_hard_load' => :post_hard_load,
'get_options' => :get_options,
'get_payload_options' => :get_payload_options,
'override_execute' => :override_execute
}
'pre_soft_load' => :pre_soft_load,
'post_soft_load' => :post_soft_load,
'pre_hard_load' => :pre_hard_load,
'post_hard_load' => :post_hard_load,
'get_options' => :get_options,
'get_payload_options' => :get_payload_options,
'override_execute' => :override_execute
}.freeze
# Fired before a module soft load
# @param [String] mod module key of module about to be soft loaded
@@ -54,8 +52,6 @@ module BeEF
# @return [Hash] a hash of options
# @note the option hash is merged with all other API hook's returned hash. Hooking this API method prevents the default options being returned.
def get_payload_options; end
end
end
end

View File

@@ -1,22 +1,18 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module API
module Modules
# @note Defined API Paths
API_PATHS = {
'post_soft_load' => :post_soft_load
}
'post_soft_load' => :post_soft_load
}.freeze
# Fires just after all modules are soft loaded
def post_soft_load; end
end
end
end

View File

@@ -1,24 +1,22 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Core
end
end
## @note Include the BeEF router
require 'core/main/router/router'
require 'core/main/router/api'
require 'core/main/router/error_responses'
## @note Include http server functions for beef
require 'core/main/server'
require 'core/main/handlers/modules/beefjs'
require 'core/main/handlers/modules/legacybeefjs'
require 'core/main/handlers/modules/multistagebeefjs'
require 'core/main/handlers/modules/command'
require 'core/main/handlers/commands'
require 'core/main/handlers/hookedbrowsers'

View File

@@ -1,12 +1,11 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Core
end
module Core
end
end
# @note Includes database models - the order must be consistent otherwise DataMapper goes crazy
@@ -20,6 +19,7 @@ require 'core/main/models/optioncache'
require 'core/main/models/browserdetails'
require 'core/main/models/rule'
require 'core/main/models/execution'
require 'core/main/models/legacybrowseruseragents'
# @note Include the constants
require 'core/main/constants/browsers'
@@ -38,4 +38,3 @@ require 'core/main/geoip'
# @note Include the command line parser and the banner printer
require 'core/main/console/commandline'
require 'core/main/console/banners'

View File

@@ -1,11 +1,10 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Extension
# Checks to see if extension is set inside the configuration
# @param [String] ext the extension key
# @return [Boolean] whether or not the extension exists in BeEF's configuration
@@ -15,9 +14,10 @@ module BeEF
# Checks to see if extension is enabled in configuration
# @param [String] ext the extension key
# @return [Boolean] whether or not the extension is enabled
# @return [Boolean] whether or not the extension is enabled
def self.is_enabled(ext)
return false unless is_present(ext)
BeEF::Core::Configuration.instance.get("beef.extension.#{ext}.enable") == true
end
@@ -26,10 +26,11 @@ module BeEF
# @return [Boolean] whether or not the extension is loaded
def self.is_loaded(ext)
return false unless is_enabled(ext)
BeEF::Core::Configuration.instance.get("beef.extension.#{ext}.loaded") == true
end
# Loads an extension
# Loads an extension
# @param [String] ext the extension key
# @return [Boolean] whether or not the extension loaded successfully
def self.load(ext)
@@ -41,7 +42,7 @@ module BeEF
end
print_error "Unable to load extension '#{ext}'"
false
rescue => e
rescue StandardError => e
print_error "Unable to load extension '#{ext}':"
print_more e.message
end

View File

@@ -1,16 +1,15 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Extensions
# Returns configuration of all enabled extensions
# @return [Array] an array of extension configuration hashes that are enabled
def self.get_enabled
BeEF::Core::Configuration.instance.get('beef.extension').select { |k,v| v['enable'] == true }
rescue => e
BeEF::Core::Configuration.instance.get('beef.extension').select { |_k, v| v['enable'] == true }
rescue StandardError => e
print_error "Failed to get enabled extensions: #{e.message}"
print_error e.backtrace
end
@@ -18,8 +17,8 @@ module BeEF
# Returns configuration of all loaded extensions
# @return [Array] an array of extension configuration hashes that are loaded
def self.get_loaded
BeEF::Core::Configuration.instance.get('beef.extension').select {|k,v| v['loaded'] == true }
rescue => e
BeEF::Core::Configuration.instance.get('beef.extension').select { |_k, v| v['loaded'] == true }
rescue StandardError => e
print_error "Failed to get loaded extensions: #{e.message}"
print_error e.backtrace
end
@@ -28,12 +27,12 @@ module BeEF
# @note API fire for post_load
def self.load
BeEF::Core::Configuration.instance.load_extensions_config
self.get_enabled.each { |k,v|
get_enabled.each do |k, _v|
BeEF::Extension.load k
}
end
# API post extension load
BeEF::API::Registrar.instance.fire BeEF::API::Extensions, 'post_load'
rescue => e
rescue StandardError => e
print_error "Failed to load extensions: #{e.message}"
print_error e.backtrace
end

View File

@@ -1,11 +1,10 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Filters
end
end

View File

@@ -1,199 +1,214 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Filters
module Filters
# Check if the string is not empty and not nil
# @param [String] str String for testing
# @return [Boolean] Whether the string is not empty
def self.is_non_empty_string?(str)
return false if str.nil?
return false unless str.is_a? String
return false if str.empty?
# Check if the string is not empty and not nil
# @param [String] str String for testing
# @return [Boolean] Whether the string is not empty
def self.is_non_empty_string?(str)
return false if str.nil?
return false unless str.is_a? String
return false if str.empty?
true
true
end
# Check if only the characters in 'chars' are in 'str'
# @param [String] chars List of characters to match
# @param [String] str String for testing
# @return [Boolean] Whether or not the only characters in str are specified in chars
def self.only?(chars, str)
regex = Regexp.new('[^' + chars + ']')
regex.match(str.encode('UTF-8', invalid: :replace, undef: :replace, replace: '')).nil?
end
# Check if one or more characters in 'chars' are in 'str'
# @param [String] chars List of characters to match
# @param [String] str String for testing
# @return [Boolean] Whether one of the characters exists in the string
def self.exists?(chars, str)
regex = Regexp.new(chars)
!regex.match(str.encode('UTF-8', invalid: :replace, undef: :replace, replace: '')).nil?
end
# Check for null char
# @param [String] str String for testing
# @return [Boolean] If the string has a null character
def self.has_null?(str)
return false unless is_non_empty_string?(str)
exists?('\x00', str)
end
# Check for non-printable char
# @param [String] str String for testing
# @return [Boolean] Whether or not the string has non-printable characters
def self.has_non_printable_char?(str)
return false unless is_non_empty_string?(str)
!only?('[:print:]', str)
end
# Check if num characters only
# @param [String] str String for testing
# @return [Boolean] If the string only contains numbers
def self.nums_only?(str)
return false unless is_non_empty_string?(str)
only?('0-9', str)
end
# Check if valid float
# @param [String] str String for float testing
# @return [Boolean] If the string is a valid float
def self.is_valid_float?(str)
return false unless is_non_empty_string?(str)
return false unless only?('0-9\.', str)
!(str =~ /^\d+\.\d+$/).nil?
end
# Check if hex characters only
# @param [String] str String for testing
# @return [Boolean] If the string only contains hex characters
def self.hexs_only?(str)
return false unless is_non_empty_string?(str)
only?('0123456789ABCDEFabcdef', str)
end
# Check if first character is a number
# @param [String] String for testing
# @return [Boolean] If the first character of the string is a number
def self.first_char_is_num?(str)
return false unless is_non_empty_string?(str)
!(str =~ /^\d.*/).nil?
end
# Check for space characters: \t\n\r\f
# @param [String] str String for testing
# @return [Boolean] If the string has a whitespace character
def self.has_whitespace_char?(str)
return false unless is_non_empty_string?(str)
exists?('\s', str)
end
# Check for non word characters: a-zA-Z0-9
# @param [String] str String for testing
# @return [Boolean] If the string only has alphanums
def self.alphanums_only?(str)
return false unless is_non_empty_string?(str)
only?('a-zA-Z0-9', str)
end
# @overload self.is_valid_ip?(ip, version)
# Checks if the given string is a valid IP address
# @param [String] ip string to be tested
# @param [Symbol] version IP version (either <code>:ipv4</code> or <code>:ipv6</code>)
# @return [Boolean] true if the string is a valid IP address, otherwise false
#
# @overload self.is_valid_ip?(ip)
# Checks if the given string is either a valid IPv4 or IPv6 address
# @param [String] ip string to be tested
# @return [Boolean] true if the string is a valid IPv4 or IPV6 address, otherwise false
def self.is_valid_ip?(ip, version = :both)
return false unless is_non_empty_string?(ip)
if case version.inspect.downcase
when /^:ipv4$/
ip =~ /^((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}
(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])$/x
when /^:ipv6$/
ip =~ /^(([0-9a-f]{1,4}:){7,7}[0-9a-f]{1,4}|
([0-9a-f]{1,4}:){1,7}:|
([0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|
([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}|
([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}|
([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}|
([0-9a-f]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}|
[0-9a-f]{1,4}:((:[0-9a-f]{1,4}){1,6})|
:((:[0-9a-f]{1,4}){1,7}|:)|
fe80:(:[0-9a-f]{0,4}){0,4}%[0-9a-z]{1,}|
::(ffff(:0{1,4}){0,1}:){0,1}
((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}
(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|
([0-9a-f]{1,4}:){1,4}:
((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}
(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/ix
when /^:both$/
is_valid_ip?(ip, :ipv4) || is_valid_ip?(ip, :ipv6)
end
true
else
false
end
end
# Checks if the given string is a valid private IP address
# @param [String] ip string for testing
# @return [Boolean] true if the string is a valid private IP address, otherwise false
# @note Includes RFC1918 private IPv4, private IPv6, and localhost 127.0.0.0/8, but does not include local-link addresses.
def self.is_valid_private_ip?(ip)
return false unless is_valid_ip?(ip)
ip =~ /\A(^127\.)|(^192\.168\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^::1$)|(^[fF][cCdD])\z/ ? true : false
end
# Checks if the given string is a valid TCP port
# @param [String] port string for testing
# @return [Boolean] true if the string is a valid TCP port, otherwise false
def self.is_valid_port?(port)
valid = false
valid = true if port.to_i > 0 && port.to_i < 2**16
valid
end
# Checks if string is a valid domain name
# @param [String] domain string for testing
# @return [Boolean] If the string is a valid domain name
# @note Only validates the string format. It does not check for a valid TLD since ICANN's list of TLD's is not static.
def self.is_valid_domain?(domain)
return false unless is_non_empty_string?(domain)
return true if domain =~ /^[0-9a-z-]+(\.[0-9a-z-]+)*(\.[a-z]{2,}).?$/i
false
end
# Check for valid browser details characters
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser details characters
# @note This function passes the \302\256 character which translates to the registered symbol (r)
def self.has_valid_browser_details_chars?(str)
return false unless is_non_empty_string?(str)
!(str =~ %r{[^\w\d\s()-.,;:_/!\302\256]}).nil?
end
# Check for valid base details characters
# @param [String] str String for testing
# @return [Boolean] If the string has only valid base characters
# @note This is for basic filtering where possible all specific filters must be implemented
# @note This function passes the \302\256 character which translates to the registered symbol (r)
def self.has_valid_base_chars?(str)
return false unless is_non_empty_string?(str)
(str =~ /[^\302\256[:print:]]/).nil?
end
# Verify the yes and no is valid
# @param [String] str String for testing
# @return [Boolean] If the string is either 'yes' or 'no'
def self.is_valid_yes_no?(str)
return false if has_non_printable_char?(str)
return false if str !~ /\A(Yes|No)\z/i
true
end
end
# Check if only the characters in 'chars' are in 'str'
# @param [String] chars List of characters to match
# @param [String] str String for testing
# @return [Boolean] Whether or not the only characters in str are specified in chars
def self.only?(chars, str)
regex = Regexp.new('[^' + chars + ']')
regex.match(str.encode('UTF-8', invalid: :replace, undef: :replace, replace: '')).nil?
end
# Check if one or more characters in 'chars' are in 'str'
# @param [String] chars List of characters to match
# @param [String] str String for testing
# @return [Boolean] Whether one of the characters exists in the string
def self.exists?(chars, str)
regex = Regexp.new(chars)
not regex.match(str.encode('UTF-8', invalid: :replace, undef: :replace, replace: '')).nil?
end
# Check for null char
# @param [String] str String for testing
# @return [Boolean] If the string has a null character
def self.has_null? (str)
return false unless is_non_empty_string?(str)
exists?('\x00', str)
end
# Check for non-printable char
# @param [String] str String for testing
# @return [Boolean] Whether or not the string has non-printable characters
def self.has_non_printable_char?(str)
return false unless is_non_empty_string?(str)
not only?('[:print:]', str)
end
# Check if num characters only
# @param [String] str String for testing
# @return [Boolean] If the string only contains numbers
def self.nums_only?(str)
return false unless is_non_empty_string?(str)
only?('0-9', str)
end
# Check if valid float
# @param [String] str String for float testing
# @return [Boolean] If the string is a valid float
def self.is_valid_float?(str)
return false unless is_non_empty_string?(str)
return false unless only?('0-9\.', str)
not (str =~ /^[\d]+\.[\d]+$/).nil?
end
# Check if hex characters only
# @param [String] str String for testing
# @return [Boolean] If the string only contains hex characters
def self.hexs_only?(str)
return false unless is_non_empty_string?(str)
only?('0123456789ABCDEFabcdef', str)
end
# Check if first character is a number
# @param [String] String for testing
# @return [Boolean] If the first character of the string is a number
def self.first_char_is_num?(str)
return false unless is_non_empty_string?(str)
not (str =~ /^\d.*/).nil?
end
# Check for space characters: \t\n\r\f
# @param [String] str String for testing
# @return [Boolean] If the string has a whitespace character
def self.has_whitespace_char?(str)
return false unless is_non_empty_string?(str)
exists?('\s', str)
end
# Check for non word characters: a-zA-Z0-9
# @param [String] str String for testing
# @return [Boolean] If the string only has alphanums
def self.alphanums_only?(str)
return false unless is_non_empty_string?(str)
only?("a-zA-Z0-9", str)
end
# @overload self.is_valid_ip?(ip, version)
# Checks if the given string is a valid IP address
# @param [String] ip string to be tested
# @param [Symbol] version IP version (either <code>:ipv4</code> or <code>:ipv6</code>)
# @return [Boolean] true if the string is a valid IP address, otherwise false
#
# @overload self.is_valid_ip?(ip)
# Checks if the given string is either a valid IPv4 or IPv6 address
# @param [String] ip string to be tested
# @return [Boolean] true if the string is a valid IPv4 or IPV6 address, otherwise false
def self.is_valid_ip?(ip, version = :both)
return false unless is_non_empty_string?(ip)
valid = case version.inspect.downcase
when /^:ipv4$/
ip =~ /^((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}
(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])$/x
when /^:ipv6$/
ip =~ /^(([0-9a-f]{1,4}:){7,7}[0-9a-f]{1,4}|
([0-9a-f]{1,4}:){1,7}:|
([0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|
([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}|
([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}|
([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}|
([0-9a-f]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}|
[0-9a-f]{1,4}:((:[0-9a-f]{1,4}){1,6})|
:((:[0-9a-f]{1,4}){1,7}|:)|
fe80:(:[0-9a-f]{0,4}){0,4}%[0-9a-z]{1,}|
::(ffff(:0{1,4}){0,1}:){0,1}
((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}
(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|
([0-9a-f]{1,4}:){1,4}:
((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}
(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/ix
when /^:both$/
is_valid_ip?(ip, :ipv4) || is_valid_ip?(ip, :ipv6)
end ? true : false
valid
end
# Checks if the given string is a valid private IP address
# @param [String] ip string for testing
# @return [Boolean] true if the string is a valid private IP address, otherwise false
# @note Includes RFC1918 private IPv4, private IPv6, and localhost 127.0.0.0/8, but does not include local-link addresses.
def self.is_valid_private_ip?(ip)
return false unless is_valid_ip?(ip)
return ip =~ /\A(^127\.)|(^192\.168\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^::1$)|(^[fF][cCdD])\z/ ? true : false
end
# Checks if the given string is a valid TCP port
# @param [String] port string for testing
# @return [Boolean] true if the string is a valid TCP port, otherwise false
def self.is_valid_port?(port)
valid = false
valid = true if port.to_i > 0 && port.to_i < 2**16
valid
end
# Checks if string is a valid domain name
# @param [String] domain string for testing
# @return [Boolean] If the string is a valid domain name
# @note Only validates the string format. It does not check for a valid TLD since ICANN's list of TLD's is not static.
def self.is_valid_domain?(domain)
return false unless is_non_empty_string?(domain)
return true if domain =~ /^[0-9a-z-]+(\.[0-9a-z-]+)*(\.[a-z]{2,}).?$/i
false
end
# Check for valid browser details characters
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser details characters
# @note This function passes the \302\256 character which translates to the registered symbol (r)
def self.has_valid_browser_details_chars?(str)
return false unless is_non_empty_string?(str)
not (str =~ /[^\w\d\s()-.,;:_\/!\302\256]/).nil?
end
# Check for valid base details characters
# @param [String] str String for testing
# @return [Boolean] If the string has only valid base characters
# @note This is for basic filtering where possible all specific filters must be implemented
# @note This function passes the \302\256 character which translates to the registered symbol (r)
def self.has_valid_base_chars?(str)
return false unless is_non_empty_string?(str)
(str =~ /[^\302\256[:print:]]/).nil?
end
# Verify the yes and no is valid
# @param [String] str String for testing
# @return [Boolean] If the string is either 'yes' or 'no'
def self.is_valid_yes_no?(str)
return false if has_non_printable_char?(str)
return false if str !~ /\A(Yes|No)\z/i
true
end
end
end

View File

@@ -1,151 +1,162 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Filters
module Filters
# Check the browser type value - for example, 'FF'
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser name characters
def self.is_valid_browsername?(str)
return false unless is_non_empty_string?(str)
return false if str.length > 2
return false if has_non_printable_char?(str)
# Check the browser type value - for example, 'FF'
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser name characters
def self.is_valid_browsername?(str)
return false unless is_non_empty_string?(str)
return false if str.length > 2
return false if has_non_printable_char?(str)
true
end
true
end
# Check the Operating System name value - for example, 'Windows XP'
# @param [String] str String for testing
# @return [Boolean] If the string has valid Operating System name characters
def self.is_valid_osname?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length < 2
true
end
# Check the Operating System name value - for example, 'Windows XP'
# @param [String] str String for testing
# @return [Boolean] If the string has valid Operating System name characters
def self.is_valid_osname?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length < 2
# Check the Hardware name value - for example, 'iPhone'
# @param [String] str String for testing
# @return [Boolean] If the string has valid Hardware name characters
def self.is_valid_hwname?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length < 2
true
end
true
end
# Verify the browser version string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser version characters
def self.is_valid_browserversion?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return true if str.eql? "UNKNOWN"
return true if str.eql? "ALL"
return false if not nums_only?(str) and not is_valid_float?(str)
return false if str.length > 20
true
end
# Check the Hardware name value - for example, 'iPhone'
# @param [String] str String for testing
# @return [Boolean] If the string has valid Hardware name characters
def self.is_valid_hwname?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length < 2
# Verify the os version string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid os version characters
def self.is_valid_osversion?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return true if str.eql? "UNKNOWN"
return true if str.eql? "ALL"
return false unless BeEF::Filters::only?("a-zA-Z0-9.<=> ", str)
return false if str.length > 20
true
end
true
end
# Verify the browser/UA string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser / ua string characters
def self.is_valid_browserstring?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 300
true
end
# Verify the cookies are valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid cookie characters
def self.is_valid_cookies?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 2000
true
end
# Verify the browser version string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser version characters
def self.is_valid_browserversion?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return true if str.eql? 'UNKNOWN'
return true if str.eql? 'ALL'
return false if !nums_only?(str) and !is_valid_float?(str)
return false if str.length > 20
# Verify the system platform is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid system platform characters
def self.is_valid_system_platform?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
true
end
# Verify the date stamp is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid date stamp characters
def self.is_valid_date_stamp?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the os version string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid os version characters
def self.is_valid_osversion?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return true if str.eql? 'UNKNOWN'
return true if str.eql? 'ALL'
return false unless BeEF::Filters.only?('a-zA-Z0-9.<=> ', str)
return false if str.length > 20
# Verify the CPU type string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid CPU type characters
def self.is_valid_cpu?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
true
end
# Verify the memory string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid memory type characters
def self.is_valid_memory?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the browser/UA string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser / ua string characters
def self.is_valid_browserstring?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 300
# Verify the GPU type string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid GPU type characters
def self.is_valid_gpu?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
true
end
# Verify the browser_plugins string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser plugin characters
# @note This string can be empty if there are no browser plugins
# @todo Verify if the ruby version statement is still necessary
def self.is_valid_browser_plugins?(str)
return false unless is_non_empty_string?(str)
return false if str.length > 1000
if str.encoding === Encoding.find('UTF-8')
return (str =~ /[^\w\d\s()-.,';_!\302\256]/u).nil?
else
return (str =~ /[^\w\d\s()-.,';_!\302\256]/n).nil?
# Verify the cookies are valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid cookie characters
def self.is_valid_cookies?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 2000
true
end
# Verify the system platform is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid system platform characters
def self.is_valid_system_platform?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the date stamp is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid date stamp characters
def self.is_valid_date_stamp?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the CPU type string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid CPU type characters
def self.is_valid_cpu?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the memory string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid memory type characters
def self.is_valid_memory?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the GPU type string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid GPU type characters
def self.is_valid_gpu?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 200
true
end
# Verify the browser_plugins string is valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid browser plugin characters
# @note This string can be empty if there are no browser plugins
# @todo Verify if the ruby version statement is still necessary
def self.is_valid_browser_plugins?(str)
return false unless is_non_empty_string?(str)
return false if str.length > 1000
if str.encoding === Encoding.find('UTF-8')
(str =~ /[^\w\d\s()-.,';_!\302\256]/u).nil?
else
(str =~ /[^\w\d\s()-.,';_!\302\256]/n).nil?
end
end
end
end
end

View File

@@ -1,67 +1,71 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Filters
# Check if the string is a valid path from a HTTP request
# @param [String] str String for testing
# @return [Boolean] If the string has valid path characters
def self.is_valid_path_info?(str)
return false if str.nil?
return false unless str.is_a? String
return false if has_non_printable_char?(str)
true
end
module Filters
# Check if the string is a valid path from a HTTP request
# @param [String] str String for testing
# @return [Boolean] If the string has valid path characters
def self.is_valid_path_info?(str)
return false if str.nil?
return false unless str.is_a? String
return false if has_non_printable_char?(str)
# Check if the session id valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid hook session id characters
def self.is_valid_hook_session_id?(str)
return false unless is_non_empty_string?(str)
return false unless has_valid_key_chars?(str)
true
end
true
end
# Check if valid command module datastore key
# @param [String] str String for testing
# @return [Boolean] If the string has valid command module datastore key characters
def self.is_valid_command_module_datastore_key?(str)
return false unless is_non_empty_string?(str)
return false unless has_valid_key_chars?(str)
true
end
# Check if the session id valid
# @param [String] str String for testing
# @return [Boolean] If the string has valid hook session id characters
def self.is_valid_hook_session_id?(str)
return false unless is_non_empty_string?(str)
return false unless has_valid_key_chars?(str)
# Check if valid command module datastore value
# @param [String] str String for testing
# @return [Boolean] If the string has valid command module datastore param characters
def self.is_valid_command_module_datastore_param?(str)
return false if has_null?(str)
return false unless has_valid_base_chars?(str)
true
end
true
end
# Check for word and some punc chars
# @param [String] str String for testing
# @return [Boolean] If the string has valid key characters
def self.has_valid_key_chars?(str)
return false unless is_non_empty_string?(str)
return false unless has_valid_base_chars?(str)
true
end
# Check if valid command module datastore key
# @param [String] str String for testing
# @return [Boolean] If the string has valid command module datastore key characters
def self.is_valid_command_module_datastore_key?(str)
return false unless is_non_empty_string?(str)
return false unless has_valid_key_chars?(str)
# Check for word and underscore chars
# @param [String] str String for testing
# @return [Boolean] If the sting has valid param characters
def self.has_valid_param_chars?(str)
return false if str.nil?
return false unless str.is_a? String
return false if str.empty?
return false unless (str =~ /[^\w_\:]/).nil?
true
end
true
end
end
# Check if valid command module datastore value
# @param [String] str String for testing
# @return [Boolean] If the string has valid command module datastore param characters
def self.is_valid_command_module_datastore_param?(str)
return false if has_null?(str)
return false unless has_valid_base_chars?(str)
true
end
# Check for word and some punc chars
# @param [String] str String for testing
# @return [Boolean] If the string has valid key characters
def self.has_valid_key_chars?(str)
return false unless is_non_empty_string?(str)
return false unless has_valid_base_chars?(str)
true
end
# Check for word and underscore chars
# @param [String] str String for testing
# @return [Boolean] If the sting has valid param characters
def self.has_valid_param_chars?(str)
return false if str.nil?
return false unless str.is_a? String
return false if str.empty?
return false unless (str =~ /[^\w_:]/).nil?
true
end
end
end

View File

@@ -1,61 +1,62 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Filters
# Verify the hostname string is valid
# @param [String] str String for testing
# @return [Boolean] If the string is a valid hostname
def self.is_valid_hostname?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 255
return false if (str =~ /^[a-zA-Z0-9][a-zA-Z0-9\-\.]*[a-zA-Z0-9]$/).nil?
true
module BeEF
module Filters
# Verify the hostname string is valid
# @param [String] str String for testing
# @return [Boolean] If the string is a valid hostname
def self.is_valid_hostname?(str)
return false unless is_non_empty_string?(str)
return false if has_non_printable_char?(str)
return false if str.length > 255
return false if (str =~ /^[a-zA-Z0-9][a-zA-Z0-9\-.]*[a-zA-Z0-9]$/).nil?
true
end
def self.is_valid_verb?(verb)
%w[HEAD GET POST OPTIONS PUT DELETE].each { |v| return true if verb.eql? v }
false
end
def self.is_valid_url?(uri)
return true unless uri.nil?
# OPTIONS * is not yet supported
# return true if uri.eql? "*"
# TODO : CHECK THE normalize_path method and include it somewhere (maybe here)
# return true if uri.eql? self.normalize_path(uri)
false
end
def self.is_valid_http_version?(version)
# from browsers the http version contains a space at the end ("HTTP/1.0\r")
version.gsub!(/\r+/, '')
['HTTP/1.0', 'HTTP/1.1'].each { |v| return true if version.eql? v }
false
end
def self.is_valid_host_str?(host_str)
# from browsers the host header contains a space at the end
host_str.gsub!(/\r+/, '')
return true if 'Host:'.eql?(host_str)
false
end
def normalize_path(path)
print_error "abnormal path `#{path}'" if path[0] != '/'
ret = path.dup
ret.gsub!(%r{/+}o, '/') # // => /
while ret.sub!(%r{/\.(?:/|\Z)}, '/'); end # /. => /
while ret.sub!(%r{/(?!\.\./)[^/]+/\.\.(?:/|\Z)}, '/'); end # /foo/.. => /foo
print_error "abnormal path `#{path}'" if %r{/\.\.(/|\Z)} =~ ret
ret
end
end
def self.is_valid_verb?(verb)
["HEAD", "GET", "POST", "OPTIONS", "PUT", "DELETE"].each {|v| return true if verb.eql? v }
false
end
def self.is_valid_url?(uri)
return true if !uri.nil?
# OPTIONS * is not yet supported
#return true if uri.eql? "*"
# TODO : CHECK THE normalize_path method and include it somewhere (maybe here)
#return true if uri.eql? self.normalize_path(uri)
false
end
def self.is_valid_http_version?(version)
# from browsers the http version contains a space at the end ("HTTP/1.0\r")
version.gsub!(/[\r]+/,"")
["HTTP/1.0", "HTTP/1.1"].each {|v| return true if version.eql? v }
false
end
def self.is_valid_host_str?(host_str)
# from browsers the host header contains a space at the end
host_str.gsub!(/[\r]+/,"")
return true if "Host:".eql?(host_str)
false
end
def normalize_path(path)
print_error "abnormal path `#{path}'" if path[0] != ?/
ret = path.dup
ret.gsub!(%r{/+}o, '/') # // => /
while ret.sub!(%r'/\.(?:/|\Z)', '/'); end # /. => /
while ret.sub!(%r'/(?!\.\./)[^/]+/\.\.(?:/|\Z)', '/'); end # /foo/.. => /foo
print_error "abnormal path `#{path}'" if %r{/\.\.(/|\Z)} =~ ret
ret
end
end
end

View File

@@ -1,30 +1,30 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Filters
# Verify the page title string is valid
# @param [String] str String for testing
# @return [Boolean] If the string is a valid page title
def self.is_valid_pagetitle?(str)
return false unless str.is_a? String
return false if has_non_printable_char?(str)
return false if str.length > 500 # CxF Increased this because some page titles are MUCH longer
true
end
module Filters
# Verify the page title string is valid
# @param [String] str String for testing
# @return [Boolean] If the string is a valid page title
def self.is_valid_pagetitle?(str)
return false unless str.is_a? String
return false if has_non_printable_char?(str)
return false if str.length > 500 # CxF Increased this because some page titles are MUCH longer
# Verify the page referrer string is valid
# @param [String] str String for testing
# @return [Boolean] If the string is a valid referrer
def self.is_valid_pagereferrer?(str)
return false unless str.is_a? String
return false if has_non_printable_char?(str)
return false if str.length > 350
true
true
end
# Verify the page referrer string is valid
# @param [String] str String for testing
# @return [Boolean] If the string is a valid referrer
def self.is_valid_pagereferrer?(str)
return false unless str.is_a? String
return false if has_non_printable_char?(str)
return false if str.length > 350
true
end
end
end
end

View File

@@ -1,16 +1,15 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module HBManager
# Get hooked browser by session id
# @param [String] sid hooked browser session id string
# @return [BeEF::Core::Models::HookedBrowser] returns the associated Hooked Browser
def self.get_by_session(sid)
BeEF::Core::Models::HookedBrowser.where(:session => sid).first
BeEF::Core::Models::HookedBrowser.where(session: sid).first
end
# Get hooked browser by id
@@ -19,6 +18,5 @@ module BeEF
def self.get_by_id(id)
BeEF::Core::Models::HookedBrowser.find(id)
end
end
end

View File

@@ -1,5 +1,5 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#

View File

@@ -1,5 +1,5 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
@@ -12,8 +12,8 @@ module BeEF
attr_writer :logger
def logger
@logger ||= Logger.new("#{$home_dir}/beef.log").tap do |log|
log.progname = self.name
@logger ||= Logger.new("#{$home_dir}/beef.log").tap do |log|
log.progname = name
log.level = Logger::WARN
end
end

View File

@@ -1,12 +1,8 @@
class CreateCommandModules < ActiveRecord::Migration[6.0]
def change
create_table :command_modules do |t|
t.text :name
t.text :path
end
end
def change
create_table :command_modules do |t|
t.text :name
t.text :path
end
end
end

View File

@@ -1,19 +1,15 @@
class CreateHookedBrowsers < ActiveRecord::Migration[6.0]
def change
create_table :hooked_browsers do |t|
t.text :session
t.text :ip
t.text :firstseen
t.text :lastseen
t.text :httpheaders
t.text :domain
t.integer :port
t.integer :count
t.boolean :is_proxy
end
end
def change
create_table :hooked_browsers do |t|
t.text :session
t.text :ip
t.text :firstseen
t.text :lastseen
t.text :httpheaders
t.text :domain
t.integer :port
t.integer :count
t.boolean :is_proxy
end
end
end

View File

@@ -1,14 +1,10 @@
class CreateLogs < ActiveRecord::Migration[6.0]
def change
create_table :logs do |t|
t.text :logtype
t.text :event
t.datetime :date
t.references :hooked_browser
end
end
def change
create_table :logs do |t|
t.text :logtype
t.text :event
t.datetime :date
t.references :hooked_browser
end
end
end

View File

@@ -1,16 +1,12 @@
class CreateCommands < ActiveRecord::Migration[6.0]
def change
create_table :commands do |t|
t.references :command_module
t.references :hooked_browser
t.text :data
t.datetime :creationdate
t.text :label
t.boolean :instructions_sent, default: false
end
end
def change
create_table :commands do |t|
t.references :command_module
t.references :hooked_browser
t.text :data
t.datetime :creationdate
t.text :label
t.boolean :instructions_sent, default: false
end
end
end

View File

@@ -1,15 +1,11 @@
class CreateResults < ActiveRecord::Migration[6.0]
def change
create_table :results do |t|
t.references :command
t.references :hooked_browser
t.datetime :date
t.integer :status
t.text :data
end
end
def change
create_table :results do |t|
t.references :command
t.references :hooked_browser
t.datetime :date
t.integer :status
t.text :data
end
end
end

View File

@@ -1,12 +1,8 @@
class CreateOptionCaches < ActiveRecord::Migration[6.0]
def change
create_table :option_caches do |t|
t.text :name
t.text :value
end
end
def change
create_table :option_caches do |t|
t.text :name
t.text :value
end
end
end

View File

@@ -1,13 +1,9 @@
class CreateBrowserDetails < ActiveRecord::Migration[6.0]
def change
create_table :browser_details do |t|
t.text :session_id
t.text :detail_key
t.text :detail_value
end
end
def change
create_table :browser_details do |t|
t.text :session_id
t.text :detail_key
t.text :detail_value
end
end
end

View File

@@ -1,18 +1,14 @@
class CreateExecutions < ActiveRecord::Migration[6.0]
def change
create_table :executions do |t|
t.text :session_id
t.integer :mod_count
t.integer :mod_successful
t.text :mod_body
t.text :exec_time
t.text :rule_token
t.boolean :is_sent
t.integer :rule_id
end
end
def change
create_table :executions do |t|
t.text :session_id
t.integer :mod_count
t.integer :mod_successful
t.text :mod_body
t.text :exec_time
t.text :rule_token
t.boolean :is_sent
t.integer :rule_id
end
end
end

View File

@@ -1,20 +1,16 @@
class CreateRules < ActiveRecord::Migration[6.0]
def change
create_table :rules do |t|
t.text :name
t.text :author
t.text :browser
t.text :browser_version
t.text :os
t.text :os_version
t.text :modules
t.text :execution_order
t.text :execution_delay
t.text :chain_mode
end
end
def change
create_table :rules do |t|
t.text :name
t.text :author
t.text :browser
t.text :browser_version
t.text :os
t.text :os_version
t.text :modules
t.text :execution_order
t.text :execution_delay
t.text :chain_mode
end
end
end

View File

@@ -1,12 +1,8 @@
class CreateInterceptor < ActiveRecord::Migration[6.0]
def change
create_table :interceptors do |t|
t.text :ip
t.text :post_data
end
end
def change
create_table :interceptors do |t|
t.text :ip
t.text :post_data
end
end
end

View File

@@ -1,12 +1,8 @@
class CreateWebCloner < ActiveRecord::Migration[6.0]
def change
create_table :web_cloners do |t|
t.text :uri
t.text :mount
end
end
def change
create_table :web_cloners do |t|
t.text :uri
t.text :mount
end
end
end

View File

@@ -1,11 +1,7 @@
class CreateMassMailer < ActiveRecord::Migration[6.0]
def change
create_table :mass_mailers do |t|
#todo fields
end
end
def change
create_table :mass_mailers do |t|
# TODO: fields
end
end
end

View File

@@ -1,17 +1,13 @@
class CreateNetworkHost < ActiveRecord::Migration[6.0]
def change
create_table :network_hosts do |t|
t.references :hooked_browser
t.text :ip
t.text :hostname
t.text :ntype
t.text :os
t.text :mac
t.text :lastseen
end
end
def change
create_table :network_hosts do |t|
t.references :hooked_browser
t.text :ip
t.text :hostname
t.text :ntype
t.text :os
t.text :mac
t.text :lastseen
end
end
end

View File

@@ -1,15 +1,11 @@
class CreateNetworkService < ActiveRecord::Migration[6.0]
def change
create_table :network_services do |t|
t.references :hooked_browser
t.text :proto
t.text :ip
t.text :port
t.text :ntype
end
end
def change
create_table :network_services do |t|
t.references :hooked_browser
t.text :proto
t.text :ip
t.text :port
t.text :ntype
end
end
end

View File

@@ -1,44 +1,40 @@
class CreateHttp < ActiveRecord::Migration[6.0]
def change
create_table :https do |t|
t.text :hooked_browser_id
# The http request to perform. In clear text.
t.text :request
# Boolean value as string to say whether cross-domain requests are allowed
t.boolean :allow_cross_domain, :default => true
# The http response body received. In clear text.
t.text :response_data
# The http response code. Useful to handle cases like 404, 500, 302, ...
t.integer :response_status_code
# The http response code. Human-readable code: success, error, ecc..
t.text :response_status_text
# The port status. closed, open or not http
t.text :response_port_status
# The XHR Http response raw headers
t.text :response_headers
# The http response method. GET or POST.
t.text :method
# The content length for the request.
t.text :content_length, :default => 0
# The request protocol/scheme (http/https)
t.text :proto
# The domain on which perform the request.
t.text :domain
# The port on which perform the request.
t.text :port
# Boolean value to say if the request was cross-domain
t.text :has_ran, :default => "waiting"
# The path of the request.
# Example: /secret.html
t.text :path
# The date at which the http response has been saved.
t.datetime :response_date
# The date at which the http request has been saved.
t.datetime :request_date
end
end
def change
create_table :https do |t|
t.text :hooked_browser_id
# The http request to perform. In clear text.
t.text :request
# Boolean value as string to say whether cross-domain requests are allowed
t.boolean :allow_cross_domain, default: true
# The http response body received. In clear text.
t.text :response_data
# The http response code. Useful to handle cases like 404, 500, 302, ...
t.integer :response_status_code
# The http response code. Human-readable code: success, error, ecc..
t.text :response_status_text
# The port status. closed, open or not http
t.text :response_port_status
# The XHR Http response raw headers
t.text :response_headers
# The http response method. GET or POST.
t.text :method
# The content length for the request.
t.text :content_length, default: 0
# The request protocol/scheme (http/https)
t.text :proto
# The domain on which perform the request.
t.text :domain
# The port on which perform the request.
t.text :port
# Boolean value to say if the request was cross-domain
t.text :has_ran, default: 'waiting'
# The path of the request.
# Example: /secret.html
t.text :path
# The date at which the http response has been saved.
t.datetime :response_date
# The date at which the http request has been saved.
t.datetime :request_date
end
end
end

View File

@@ -1,13 +1,9 @@
class CreateRtcStatus < ActiveRecord::Migration[6.0]
def change
create_table :rtc_statuss do |t|
t.references :hooked_browser
t.integer :target_hooked_browser_id
t.text :status
end
end
def change
create_table :rtc_statuss do |t|
t.references :hooked_browser
t.integer :target_hooked_browser_id
t.text :status
end
end
end

View File

@@ -1,13 +1,9 @@
class CreateRtcManage < ActiveRecord::Migration[6.0]
def change
create_table :rtc_manages do |t|
t.references :hooked_browser
t.text :message
t.text :has_sent, default: "waiting"
end
end
def change
create_table :rtc_manages do |t|
t.references :hooked_browser
t.text :message
t.text :has_sent, default: 'waiting'
end
end
end

View File

@@ -1,14 +1,10 @@
class CreateRtcSignal < ActiveRecord::Migration[6.0]
def change
create_table :rtc_signals do |t|
t.references :hooked_browser
t.integer :target_hooked_browser_id
t.text :signal
t.text :has_sent, default: "waiting"
end
end
def change
create_table :rtc_signals do |t|
t.references :hooked_browser
t.integer :target_hooked_browser_id
t.text :signal
t.text :has_sent, default: 'waiting'
end
end
end

View File

@@ -1,14 +1,10 @@
class CreateRtcModuleStatus < ActiveRecord::Migration[6.0]
def change
create_table :rtc_module_statuss do |t|
t.references :hooked_browser
t.references :command_module
t.integer :target_hooked_browser_id
t.text :status
end
end
def change
create_table :rtc_module_statuss do |t|
t.references :hooked_browser
t.references :command_module
t.integer :target_hooked_browser_id
t.text :status
end
end
end

View File

@@ -1,14 +1,10 @@
class CreateXssraysDetail < ActiveRecord::Migration[6.0]
def change
create_table :xssraysdetails do |t|
t.references :hooked_browser
t.text :vector_name
t.text :vector_method
t.text :vector_poc
end
end
def change
create_table :xssraysdetails do |t|
t.references :hooked_browser
t.text :vector_name
t.text :vector_method
t.text :vector_poc
end
end
end

View File

@@ -1,14 +1,10 @@
class CreateDnsRule < ActiveRecord::Migration[6.0]
def change
create_table :dns_rules do |t|
t.text :pattern
t.text :resource
t.text :response
t.text :callback
end
end
def change
create_table :dns_rules do |t|
t.text :pattern
t.text :resource
t.text :response
t.text :callback
end
end
end

View File

@@ -1,13 +1,9 @@
class CreateIpecExploit < ActiveRecord::Migration[6.0]
def change
create_table :ipec_exploits do |t|
t.text :name
t.text :protocol
t.text :os
end
end
def change
create_table :ipec_exploits do |t|
t.text :name
t.text :protocol
t.text :os
end
end
end

View File

@@ -1,13 +1,9 @@
class CreateIpecExploitRun < ActiveRecord::Migration[6.0]
def change
create_table :ipec_exploit_runs do |t|
t.boolean :launched
t.text :http_headers
t.text :junk_size
end
end
def change
create_table :ipec_exploit_runs do |t|
t.boolean :launched
t.text :http_headers
t.text :junk_size
end
end
end

View File

@@ -1,12 +1,8 @@
class CreateAutoloader < ActiveRecord::Migration[6.0]
def change
create_table :autoloaders do |t|
t.references :command
t.boolean :in_use
end
end
def change
create_table :autoloaders do |t|
t.references :command
t.boolean :in_use
end
end
end

View File

@@ -1,18 +1,14 @@
class CreateXssraysScan < ActiveRecord::Migration[6.0]
def change
create_table :xssraysscans do |t|
t.references :hooked_browser
t.datetime :scan_start
t.datetime :scan_finish
t.text :domain
t.text :cross_domain
t.integer :clean_timeout
t.boolean :is_started
t.boolean :is_finished
end
end
def change
create_table :xssraysscans do |t|
t.references :hooked_browser
t.datetime :scan_start
t.datetime :scan_finish
t.text :domain
t.text :cross_domain
t.integer :clean_timeout
t.boolean :is_started
t.boolean :is_finished
end
end
end

View File

@@ -1,14 +1,12 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Core
module AutorunEngine
class Engine
include Singleton
def initialize
@@ -20,8 +18,8 @@ module BeEF
@debug_on = @config.get('beef.debug')
@VERSION = ['<','<=','==','>=','>','ALL']
@VERSION_STR = ['XP','Vista']
@VERSION = ['<', '<=', '==', '>=', '>', 'ALL']
@VERSION_STR = %w[XP Vista]
end
# Check if the hooked browser type/version and OS type/version match any Rule-sets
@@ -30,13 +28,12 @@ module BeEF
def run(hb_id, browser_name, browser_version, os_name, os_version)
are = BeEF::Core::AutorunEngine::Engine.instance
match_rules = are.match(browser_name, browser_version, os_name, os_version)
are.trigger(match_rules, hb_id) if match_rules !=nil && match_rules.length > 0
are.trigger(match_rules, hb_id) if !match_rules.nil? && match_rules.length > 0
end
# Prepare and return the JavaScript of the modules to be sent.
# It also updates the rules ARE execution table with timings
def trigger(rule_ids, hb_id)
hb = BeEF::HBManager.get_by_id(hb_id)
hb_session = hb.session
@@ -48,26 +45,25 @@ module BeEF
execution_delay = JSON.parse(rule.execution_delay)
chain_mode = rule.chain_mode
mods_bodies = Array.new
mods_codes = Array.new
mods_conditions = Array.new
mods_bodies = []
mods_codes = []
mods_conditions = []
# this ensures that if both rule A and rule B call the same module in sequential mode,
# execution will be correct preventing wrapper functions to be called with equal names.
rule_token = SecureRandom.hex(5)
modules.each do |cmd_mod|
mod = BeEF::Core::Models::CommandModule.where(:name => cmd_mod['name']).first
mod = BeEF::Core::Models::CommandModule.where(name: cmd_mod['name']).first
options = []
replace_input = false
cmd_mod['options'].each do|k,v|
options.push({'name' => k, 'value' => v})
cmd_mod['options'].each do |k, v|
options.push({ 'name' => k, 'value' => v })
replace_input = true if v == '<<mod_input>>'
end
command_body = prepare_command(mod, options, hb_id, replace_input, rule_token)
mods_bodies.push(command_body)
mods_codes.push(cmd_mod['code'])
mods_conditions.push(cmd_mod['condition'])
@@ -75,32 +71,31 @@ module BeEF
# Depending on the chosen chain mode (sequential or nested/forward), prepare the appropriate wrapper
case chain_mode
when 'nested-forward'
wrapper = prepare_nested_forward_wrapper(mods_bodies, mods_codes, mods_conditions, execution_order, rule_token)
when 'sequential'
wrapper = prepare_sequential_wrapper(mods_bodies, execution_order, execution_delay, rule_token)
else
wrapper = nil
print_error "Chain mode looks wrong!"
# TODO catch error, which should never happen as values are checked way before ;-)
when 'nested-forward'
wrapper = prepare_nested_forward_wrapper(mods_bodies, mods_codes, mods_conditions, execution_order, rule_token)
when 'sequential'
wrapper = prepare_sequential_wrapper(mods_bodies, execution_order, execution_delay, rule_token)
else
wrapper = nil
print_error 'Chain mode looks wrong!'
# TODO: catch error, which should never happen as values are checked way before ;-)
end
are_exec = BeEF::Core::Models::Execution.new(
:session_id => hb_session,
:mod_count => modules.length,
:mod_successful => 0,
:rule_token => rule_token,
:mod_body => wrapper,
:is_sent => false,
:id => rule_id
session_id: hb_session,
mod_count: modules.length,
mod_successful: 0,
rule_token: rule_token,
mod_body: wrapper,
is_sent: false,
id: rule_id
)
are_exec.save!
# Once Engine.check() verified that the hooked browser match a Rule, trigger the Rule ;-)
print_more "Triggering ruleset #{rule_ids.to_s} on HB #{hb_id}"
print_more "Triggering ruleset #{rule_ids} on HB #{hb_id}"
end
end
# Wraps module bodies in their own function, using setTimeout to trigger them with an eventual delay.
# Launch order is also taken care of.
# - sequential chain with delays (setTimeout stuff)
@@ -114,7 +109,7 @@ module BeEF
delayed_exec = ''
c = 0
while c < mods.length
delayed_exec += %Q| setTimeout(function(){#{mods[order[c]][:mod_name]}_#{rule_token}();}, #{delay[c]}); |
delayed_exec += %| setTimeout(function(){#{mods[order[c]][:mod_name]}_#{rule_token}();}, #{delay[c]}); |
mod_body = mods[order[c]][:mod_body].to_s.gsub("#{mods[order[c]][:mod_name]}_mod_output", "#{mods[order[c]][:mod_name]}_#{rule_token}_mod_output")
wrapped_mod = "#{mod_body}\n"
wrapper += wrapped_mod
@@ -141,16 +136,17 @@ module BeEF
# if the first once return with success. Also, the second module has the possibility of mangling first
# module output and use it as input for some of its module inputs.
def prepare_nested_forward_wrapper(mods, code, conditions, order, rule_token)
wrapper, delayed_exec = '',''
delayed_exec_footers = Array.new
wrapper = ''
delayed_exec = ''
delayed_exec_footers = []
c = 0
while c < mods.length
if mods.length == 1
i = c
else
i = c + 1
end
i = if mods.length == 1
c
else
c + 1
end
code_snippet = ''
mod_input = ''
@@ -159,11 +155,11 @@ module BeEF
mod_input = 'mod_input'
end
conditions[i] = true if conditions[i] == nil || conditions[i] == ''
conditions[i] = true if conditions[i].nil? || conditions[i] == ''
if c == 0
# this is the first wrapper to prepare
delayed_exec += %Q|
delayed_exec += %|
function #{mods[order[c]][:mod_name]}_#{rule_token}_f(){
#{mods[order[c]][:mod_name]}_#{rule_token}();
@@ -185,7 +181,7 @@ module BeEF
#{mods[order[c]][:mod_name]}_#{rule_token}_mod_output = mod_result[1];
|
delayed_exec_footer = %Q|
delayed_exec_footer = %|
}
}
}
@@ -198,10 +194,10 @@ module BeEF
delayed_exec_footers.push(delayed_exec_footer)
elsif c < mods.length - 1
code_snippet = code_snippet.to_s.gsub(mods[order[c-1]][:mod_name], "#{mods[order[c-1]][:mod_name]}_#{rule_token}")
code_snippet = code_snippet.to_s.gsub(mods[order[c - 1]][:mod_name], "#{mods[order[c - 1]][:mod_name]}_#{rule_token}")
# this is one of the wrappers in the middle of the chain
delayed_exec += %Q|
delayed_exec += %|
function #{mods[order[c]][:mod_name]}_#{rule_token}_f(){
if(#{mods[order[c]][:mod_name]}_#{rule_token}_can_exec){
#{code_snippet}
@@ -223,7 +219,7 @@ module BeEF
#{mods[order[c]][:mod_name]}_#{rule_token}_mod_output = mod_result[1];
|
delayed_exec_footer = %Q|
delayed_exec_footer = %|
}
}
}
@@ -236,9 +232,9 @@ module BeEF
delayed_exec_footers.push(delayed_exec_footer)
else
code_snippet = code_snippet.to_s.gsub(mods[order[c-1]][:mod_name], "#{mods[order[c-1]][:mod_name]}_#{rule_token}")
code_snippet = code_snippet.to_s.gsub(mods[order[c - 1]][:mod_name], "#{mods[order[c - 1]][:mod_name]}_#{rule_token}")
# this is the last wrapper to prepare
delayed_exec += %Q|
delayed_exec += %|
function #{mods[order[c]][:mod_name]}_#{rule_token}_f(){
if(#{mods[order[c]][:mod_name]}_#{rule_token}_can_exec){
#{code_snippet}
@@ -258,7 +254,6 @@ module BeEF
wrapper
end
# prepare the command module (compiling the Erubis templating stuff), eventually obfuscate it,
# and store it in the database.
# Returns the raw module body after template substitution.
@@ -266,16 +261,16 @@ module BeEF
config = BeEF::Core::Configuration.instance
begin
command = BeEF::Core::Models::Command.new(
:data => options.to_json,
:hooked_browser_id => hb_id,
:command_module_id => BeEF::Core::Configuration.instance.get("beef.module.#{mod.name}.db.id"),
:creationdate => Time.new.to_i,
:instructions_sent => true
data: options.to_json,
hooked_browser_id: hb_id,
command_module_id: BeEF::Core::Configuration.instance.get("beef.module.#{mod.name}.db.id"),
creationdate: Time.new.to_i,
instructions_sent: true
)
command.save!
command_module = BeEF::Core::Models::CommandModule.find(mod.id)
if (command_module.path.match(/^Dynamic/))
if command_module.path.match(/^Dynamic/)
# metasploit and similar integrations
command_module = BeEF::Modules::Commands.const_get(command_module.path.split('/').last.capitalize).new
else
@@ -293,18 +288,18 @@ module BeEF
build_missing_beefjs_components(command_module.beefjs_components) unless command_module.beefjs_components.empty?
if config.get("beef.extension.evasion.enable")
if config.get('beef.extension.evasion.enable')
evasion = BeEF::Extension::Evasion::Evasion.instance
command_body = evasion.obfuscate(command_module.output) + "\n\n"
else
command_body = command_module.output + "\n\n"
command_body = command_module.output + "\n\n"
end
# @note prints the event to the console
print_more "Preparing JS for command id [#{command.id}], module [#{mod.name}]"
replace_input ? mod_input = 'mod_input' : mod_input = ''
result = %Q|
mod_input = replace_input ? 'mod_input' : ''
result = %|
var #{mod.name}_#{rule_token} = function(#{mod_input}){
#{clean_command_body(command_body, replace_input)}
};
@@ -312,8 +307,8 @@ module BeEF
var #{mod.name}_#{rule_token}_mod_output = null;
|
return {:mod_name => mod.name, :mod_body => result}
rescue => e
{ mod_name: mod.name, mod_body: result }
rescue StandardError => e
print_error e.message
print_debug e.backtrace.join("\n")
end
@@ -324,56 +319,47 @@ module BeEF
#
# Also replace <<mod_input>> with mod_input variable if needed for chaining module output/input
def clean_command_body(command_body, replace_input)
begin
cmd_body = command_body.lines.map(&:chomp)
wrapper_start_index,wrapper_end_index = nil
cmd_body = command_body.lines.map(&:chomp)
wrapper_start_index, wrapper_end_index = nil
cmd_body.each_with_index do |line, index|
if line.to_s =~ /^(beef|[a-zA-Z]+)\.execute\(function\(\)/
wrapper_start_index = index
break
end
end
if wrapper_start_index.nil?
print_error "[ARE] Could not find module start index"
cmd_body.each_with_index do |line, index|
if line.to_s =~ /^(beef|[a-zA-Z]+)\.execute\(function\(\)/
wrapper_start_index = index
break
end
end
print_error '[ARE] Could not find module start index' if wrapper_start_index.nil?
cmd_body.reverse.each_with_index do |line, index|
if line.include?('});')
wrapper_end_index = index
break
end
end
if wrapper_end_index.nil?
print_error "[ARE] Could not find module end index"
cmd_body.reverse.each_with_index do |line, index|
if line.include?('});')
wrapper_end_index = index
break
end
end
print_error '[ARE] Could not find module end index' if wrapper_end_index.nil?
cleaned_cmd_body = cmd_body.slice(wrapper_start_index..-(wrapper_end_index+1)).join("\n")
if cleaned_cmd_body.eql?('')
print_error "[ARE] No command to send"
end
cleaned_cmd_body = cmd_body.slice(wrapper_start_index..-(wrapper_end_index + 1)).join("\n")
print_error '[ARE] No command to send' if cleaned_cmd_body.eql?('')
# check if <<mod_input>> should be replaced with a variable name (depending if the variable is a string or number)
if replace_input
if cleaned_cmd_body.include?('"<<mod_input>>"')
final_cmd_body = cleaned_cmd_body.gsub('"<<mod_input>>"','mod_input')
elsif cleaned_cmd_body.include?('\'<<mod_input>>\'')
final_cmd_body = cleaned_cmd_body.gsub('\'<<mod_input>>\'','mod_input')
elsif cleaned_cmd_body.include?('<<mod_input>>')
final_cmd_body = cleaned_cmd_body.gsub('\'<<mod_input>>\'','mod_input')
else
return cleaned_cmd_body
end
return final_cmd_body
# check if <<mod_input>> should be replaced with a variable name (depending if the variable is a string or number)
if replace_input
if cleaned_cmd_body.include?('"<<mod_input>>"')
final_cmd_body = cleaned_cmd_body.gsub('"<<mod_input>>"', 'mod_input')
elsif cleaned_cmd_body.include?('\'<<mod_input>>\'')
final_cmd_body = cleaned_cmd_body.gsub('\'<<mod_input>>\'', 'mod_input')
elsif cleaned_cmd_body.include?('<<mod_input>>')
final_cmd_body = cleaned_cmd_body.gsub('\'<<mod_input>>\'', 'mod_input')
else
return cleaned_cmd_body
end
rescue => e
print_error "[ARE] There is likely a problem with the module's command.js parsing. Check Engine.clean_command_body"
final_cmd_body
else
cleaned_cmd_body
end
rescue StandardError => e
print_error "[ARE] There is likely a problem with the module's command.js parsing. Check Engine.clean_command_body. #{e.message}"
end
# Checks if there are any ARE rules to be triggered for the specified hooked browser
#
# Note: browser version checks are supporting only major versions, ex: C 43, IE 11
@@ -382,105 +368,119 @@ module BeEF
# Returns an array with rule IDs that matched and should be triggered.
# if rule_id is specified, checks will be executed only against the specified rule (useful
# for dynamic triggering of new rulesets ar runtime)
def match(browser, browser_version, os, os_version, rule_id=nil)
def match(browser, browser_version, os, os_version, rule_id = nil)
match_rules = []
if rule_id != nil
rules = [BeEF::Core::Models::Rule.find(rule_id)]
else
rules = BeEF::Core::Models::Rule.all
end
return nil if rules == nil
rules = if rule_id.nil?
BeEF::Core::Models::Rule.all
else
[BeEF::Core::Models::Rule.find(rule_id)]
end
return nil if rules.nil?
return nil unless rules.length > 0
print_info "[ARE] Checking if any defined rules should be triggered on target."
# TODO handle cases where there are multiple ARE rules for the same hooked browser.
print_info '[ARE] Checking if any defined rules should be triggered on target.'
# TODO: handle cases where there are multiple ARE rules for the same hooked browser.
# TODO the above works well, but maybe rules need to have priority or something?
rules.each do |rule|
begin
browser_match, os_match = false, false
browser_match = false
os_match = false
b_ver_cond = rule.browser_version.split(' ').first
b_ver = rule.browser_version.split(' ').last
b_ver_cond = rule.browser_version.split(' ').first
b_ver = rule.browser_version.split(' ').last
os_ver_rule_cond = rule.os_version.split(' ').first
os_ver_rule_maj = rule.os_version.split(' ').last.split('.').first
os_ver_rule_min = rule.os_version.split(' ').last.split('.').last
os_ver_rule_cond = rule.os_version.split(' ').first
os_ver_rule_maj = rule.os_version.split(' ').last.split('.').first
os_ver_rule_min = rule.os_version.split(' ').last.split('.').last
# Most of the times Linux/*BSD OS doesn't return any version
# (TODO: improve OS detection on these operating systems)
if os_version != nil && !@VERSION_STR.include?(os_version)
os_ver_hook_maj = os_version.split('.').first
os_ver_hook_min = os_version.split('.').last
# Most of the times Linux/*BSD OS doesn't return any version
# (TODO: improve OS detection on these operating systems)
if !os_version.nil? && !@VERSION_STR.include?(os_version)
os_ver_hook_maj = os_version.split('.').first
os_ver_hook_min = os_version.split('.').last
# the following assignments to 0 are need for later checks like:
# 8.1 >= 7, because if the version doesn't have minor versions, maj/min are the same
os_ver_hook_min = 0 if os_version.split('.').length == 1
os_ver_rule_min = 0 if rule.os_version.split('.').length == 1
else
# most probably Windows XP or Vista. the following is a hack as Microsoft had the brilliant idea
# to switch from strings to numbers in OS versioning. To prevent rewriting code later on,
# we say that XP is Windows 5.0 and Vista is Windows 6.0. Easier for comparison later on.
os_ver_hook_maj, os_ver_hook_min = 5, 0 if os_version == 'XP'
os_ver_hook_maj, os_ver_hook_min = 6, 0 if os_version == 'Vista'
# the following assignments to 0 are need for later checks like:
# 8.1 >= 7, because if the version doesn't have minor versions, maj/min are the same
os_ver_hook_min = 0 if os_version.split('.').length == 1
os_ver_rule_min = 0 if rule.os_version.split('.').length == 1
else
# most probably Windows XP or Vista. the following is a hack as Microsoft had the brilliant idea
# to switch from strings to numbers in OS versioning. To prevent rewriting code later on,
# we say that XP is Windows 5.0 and Vista is Windows 6.0. Easier for comparison later on.
if os_version == 'XP'
os_ver_hook_maj = 5
os_ver_hook_min = 0
end
os_ver_rule_maj, os_ver_rule_min = 5, 0 if os_ver_rule_maj == 'XP'
os_ver_rule_maj, os_ver_rule_min = 6, 0 if os_ver_rule_maj == 'Vista'
next unless @VERSION.include?(b_ver_cond)
next unless BeEF::Filters::is_valid_browserversion?(b_ver)
next unless @VERSION.include?(os_ver_rule_cond) || @VERSION_STR.include?(os_ver_rule_cond)
# os_ver without checks as it can be very different or even empty, for instance on linux/bsd)
# skip rule unless the browser matches
browser_match = false
# check if rule specifies multiple browsers
if rule.browser !~ /\A[A-Z]+\Z/
rule.browser.gsub(/[^A-Z,]/i, '').split(',').each do |b|
browser_match = true if b == browser || b == 'ALL'
end
# else, only one browser
else
next unless rule.browser == 'ALL' || browser == rule.browser
# check if the browser version matches
browser_version_match = compare_versions(browser_version.to_s, b_ver_cond, b_ver.to_s)
if browser_version_match
browser_match = true
else
browser_match = false
end
print_more "Browser version check -> (hook) #{browser_version} #{rule.browser_version} (rule) : #{browser_version_match}"
if os_version == 'Vista'
os_ver_hook_maj = 6
os_ver_hook_min = 0
end
next unless browser_match
# skip rule unless the OS matches
next unless rule.os == 'ALL' || os == rule.os
# check if the OS versions match
if os_version != nil || rule.os_version != 'ALL'
os_major_version_match = compare_versions(os_ver_hook_maj.to_s, os_ver_rule_cond, os_ver_rule_maj.to_s)
os_minor_version_match = compare_versions(os_ver_hook_min.to_s, os_ver_rule_cond, os_ver_rule_min.to_s)
else
# os_version_match = true if (browser doesn't return an OS version || rule OS version is ALL )
os_major_version_match, os_minor_version_match = true, true
end
os_match = true if os_ver_rule_cond == 'ALL' || (os_major_version_match && os_minor_version_match)
print_more "OS version check -> (hook) #{os_version} #{rule.os_version} (rule): #{os_major_version_match && os_minor_version_match}"
if browser_match && os_match
print_more "Hooked browser and OS type/version MATCH rule: #{rule.name}."
match_rules.push(rule.id)
end
rescue => e
print_error e.message
print_debug e.backtrace.join("\n")
end
if os_ver_rule_maj == 'XP'
os_ver_rule_maj = 5
os_ver_rule_min = 0
end
if os_ver_rule_maj == 'Vista'
os_ver_rule_maj = 6
os_ver_rule_min = 0
end
next unless @VERSION.include?(b_ver_cond)
next unless BeEF::Filters.is_valid_browserversion?(b_ver)
next unless @VERSION.include?(os_ver_rule_cond) || @VERSION_STR.include?(os_ver_rule_cond)
# os_ver without checks as it can be very different or even empty, for instance on linux/bsd)
# skip rule unless the browser matches
browser_match = false
# check if rule specifies multiple browsers
if rule.browser =~ /\A[A-Z]+\Z/
next unless rule.browser == 'ALL' || browser == rule.browser
# check if the browser version matches
browser_version_match = compare_versions(browser_version.to_s, b_ver_cond, b_ver.to_s)
browser_match = if browser_version_match
true
else
false
end
print_more "Browser version check -> (hook) #{browser_version} #{rule.browser_version} (rule) : #{browser_version_match}"
else
rule.browser.gsub(/[^A-Z,]/i, '').split(',').each do |b|
browser_match = true if b == browser || b == 'ALL'
end
# else, only one browser
end
next unless browser_match
# skip rule unless the OS matches
next unless rule.os == 'ALL' || os == rule.os
# check if the OS versions match
if !os_version.nil? || rule.os_version != 'ALL'
os_major_version_match = compare_versions(os_ver_hook_maj.to_s, os_ver_rule_cond, os_ver_rule_maj.to_s)
os_minor_version_match = compare_versions(os_ver_hook_min.to_s, os_ver_rule_cond, os_ver_rule_min.to_s)
else
# os_version_match = true if (browser doesn't return an OS version || rule OS version is ALL )
os_major_version_match = true
os_minor_version_match = true
end
os_match = true if os_ver_rule_cond == 'ALL' || (os_major_version_match && os_minor_version_match)
print_more "OS version check -> (hook) #{os_version} #{rule.os_version} (rule): #{os_major_version_match && os_minor_version_match}"
if browser_match && os_match
print_more "Hooked browser and OS type/version MATCH rule: #{rule.name}."
match_rules.push(rule.id)
end
rescue StandardError => e
print_error e.message
print_debug e.backtrace.join("\n")
end
print_more "Found [#{match_rules.length}/#{rules.length}] ARE rules matching the hooked browser type/version."
return match_rules
match_rules
end
# compare versions
@@ -491,7 +491,8 @@ module BeEF
return true if cond == '<' && ver_a < ver_b
return true if cond == '>=' && ver_a >= ver_b
return true if cond == '>' && ver_a > ver_b
return false
false
end
end
end

View File

@@ -1,89 +1,85 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Core
module AutorunEngine
class Parser
include Singleton
def initialize
@config = BeEF::Core::Configuration.instance
end
BROWSER = ['FF','C','IE','S','O','ALL']
OS = ['Linux','Windows','OSX','Android','iOS','BlackBerry','ALL']
VERSION = ['<','<=','==','>=','>','ALL','Vista','XP']
CHAIN_MODE = ['sequential','nested-forward']
BROWSER = %w[FF C IE S O ALL]
OS = %w[Linux Windows OSX Android iOS BlackBerry ALL]
VERSION = ['<', '<=', '==', '>=', '>', 'ALL', 'Vista', 'XP']
CHAIN_MODE = %w[sequential nested-forward]
MAX_VER_LEN = 15
# Parse a JSON ARE file and returns an Hash with the value mappings
def parse(name,author,browser, browser_version, os, os_version, modules, exec_order, exec_delay, chain_mode)
begin
success = [true]
def parse(name, author, browser, browser_version, os, os_version, modules, exec_order, exec_delay, chain_mode)
success = [true]
return [false, 'Illegal chain_mode definition'] unless CHAIN_MODE.include?(chain_mode)
return [false, 'Illegal rule name'] unless BeEF::Filters.is_non_empty_string?(name)
return [false, 'Illegal author name'] unless BeEF::Filters.is_non_empty_string?(author)
# if multiple browsers were specified, check each browser
if browser.kind_of?(Array)
browser.each do |b|
return [false, 'Illegal browser definition'] unless BROWSER.include?(b)
end
# else, if only one browser was specified, check browser and browser version
else
return [false, 'Illegal browser definition'] unless BROWSER.include?(browser)
if browser_version != 'ALL'
return [false, 'Illegal browser_version definition'] unless
VERSION.include?(browser_version[0,2].gsub(/\s+/,'')) &&
BeEF::Filters::is_valid_browserversion?(browser_version[2..-1].gsub(/\s+/,'')) && browser_version.length < MAX_VER_LEN
end
return [false, 'Illegal chain_mode definition'] unless CHAIN_MODE.include?(chain_mode)
return [false, 'Illegal rule name'] unless BeEF::Filters.is_non_empty_string?(name)
return [false, 'Illegal author name'] unless BeEF::Filters.is_non_empty_string?(author)
# if multiple browsers were specified, check each browser
if browser.is_a?(Array)
browser.each do |b|
return [false, 'Illegal browser definition'] unless BROWSER.include?(b)
end
# else, if only one browser was specified, check browser and browser version
else
return [false, 'Illegal browser definition'] unless BROWSER.include?(browser)
if os_version != 'ALL'
return [false, 'Illegal os_version definition'] unless
VERSION.include?(os_version[0,2].gsub(/\s+/,'')) &&
BeEF::Filters::is_valid_osversion?(os_version[2..-1].gsub(/\s+/,'')) && os_version.length < MAX_VER_LEN
if browser_version != 'ALL' && !(VERSION.include?(browser_version[0, 2].gsub(/\s+/, '')) &&
BeEF::Filters.is_valid_browserversion?(browser_version[2..-1].gsub(/\s+/, '')) && browser_version.length < MAX_VER_LEN)
return [false, 'Illegal browser_version definition']
end
return [false, 'Illegal os definition'] unless OS.include?(os)
# check if module names, conditions and options are ok
modules.each do |cmd_mod|
mod = BeEF::Core::Models::CommandModule.where(:name => cmd_mod['name']).first
if mod != nil
modk = BeEF::Module.get_key_by_database_id(mod.id)
mod_options = BeEF::Module.get_options(modk)
opt_count = 0
mod_options.each do |opt|
if opt['name'] == cmd_mod['options'].keys[opt_count]
opt_count += 1
else
return [false, "The specified option (#{cmd_mod['options'].keys[opt_count]
}) for module (#{cmd_mod['name']}) does not exist"]
end
end
else
return [false, "The specified module name (#{cmd_mod['name']}) does not exist"]
end
end
exec_order.each{ |order| return [false, 'execution_order values must be Integers'] unless order.integer?}
exec_delay.each{ |delay| return [false, 'execution_delay values must be Integers'] unless delay.integer?}
return [false, 'execution_order and execution_delay values must be consistent with modules numbers'] unless
modules.size == exec_order.size && modules.size == exec_delay.size
success
rescue => e
print_error "#{e.message}"
print_debug "#{e.backtrace.join("\n")}"
return [false, 'Something went wrong.']
end
if os_version != 'ALL' && !(VERSION.include?(os_version[0, 2].gsub(/\s+/, '')) &&
BeEF::Filters.is_valid_osversion?(os_version[2..-1].gsub(/\s+/, '')) && os_version.length < MAX_VER_LEN)
return [false, 'Illegal os_version definition']
end
return [false, 'Illegal os definition'] unless OS.include?(os)
# check if module names, conditions and options are ok
modules.each do |cmd_mod|
mod = BeEF::Core::Models::CommandModule.where(name: cmd_mod['name']).first
if mod.nil?
return [false, "The specified module name (#{cmd_mod['name']}) does not exist"]
else
modk = BeEF::Module.get_key_by_database_id(mod.id)
mod_options = BeEF::Module.get_options(modk)
opt_count = 0
mod_options.each do |opt|
if opt['name'] == cmd_mod['options'].keys[opt_count]
opt_count += 1
else
return [false, "The specified option (#{cmd_mod['options'].keys[opt_count]
}) for module (#{cmd_mod['name']}) does not exist"]
end
end
end
end
exec_order.each { |order| return [false, 'execution_order values must be Integers'] unless order.integer? }
exec_delay.each { |delay| return [false, 'execution_delay values must be Integers'] unless delay.integer? }
return [false, 'execution_order and execution_delay values must be consistent with modules numbers'] unless
modules.size == exec_order.size && modules.size == exec_delay.size
success
rescue StandardError => e
print_error e.message.to_s
print_debug e.backtrace.join("\n").to_s
[false, 'Something went wrong.']
end
end
end

View File

@@ -1,14 +1,12 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Core
module AutorunEngine
class RuleLoader
include Singleton
def initialize
@@ -18,78 +16,74 @@ module BeEF
# this expects parsed JSON as input
def load(data)
begin
name = data['name']
author = data['author']
browser = data['browser'] || 'ALL'
browser_version = data['browser_version'] || 'ALL'
os = data['os'] || 'ALL'
os_version = data['os_version'] || 'ALL'
modules = data['modules']
exec_order = data['execution_order']
exec_delay = data['execution_delay']
chain_mode = data['chain_mode']
name = data['name']
author = data['author']
browser = data['browser']||'ALL'
browser_version = data['browser_version']||'ALL'
os = data['os']||'ALL'
os_version = data['os_version']||'ALL'
modules = data['modules']
exec_order = data['execution_order']
exec_delay = data['execution_delay']
chain_mode = data['chain_mode']
parser_result = BeEF::Core::AutorunEngine::Parser.instance.parse(
name, author, browser, browser_version, os, os_version, modules, exec_order, exec_delay, chain_mode
)
parser_result = BeEF::Core::AutorunEngine::Parser.instance.parse(
name,author,browser,browser_version,os,os_version,modules,exec_order,exec_delay,chain_mode)
if parser_result.length == 1 && parser_result.first
print_info "[ARE] Ruleset (#{name}) parsed and stored successfully."
if @debug_on
print_more "Target Browser: #{browser} (#{browser_version})"
print_more "Target OS: #{os} (#{os_version})"
print_more "Modules to Trigger:"
modules.each do |mod|
print_more "(*) Name: #{mod['name']}"
print_more "(*) Condition: #{mod['condition']}"
print_more "(*) Code: #{mod['code']}"
print_more "(*) Options:"
mod['options'].each do |key,value|
print_more "\t#{key}: (#{value})"
end
end
print_more "Exec order: #{exec_order}"
print_more "Exec delay: #{exec_delay}"
if parser_result.length == 1 && parser_result.first
print_info "[ARE] Ruleset (#{name}) parsed and stored successfully."
if @debug_on
print_more "Target Browser: #{browser} (#{browser_version})"
print_more "Target OS: #{os} (#{os_version})"
print_more 'Modules to Trigger:'
modules.each do |mod|
print_more "(*) Name: #{mod['name']}"
print_more "(*) Condition: #{mod['condition']}"
print_more "(*) Code: #{mod['code']}"
print_more '(*) Options:'
mod['options'].each do |key, value|
print_more "\t#{key}: (#{value})"
end
end
are_rule = BeEF::Core::Models::Rule.new(
:name => name,
:author => author,
:browser => browser,
:browser_version => browser_version,
:os => os,
:os_version => os_version,
:modules => modules.to_json,
:execution_order => exec_order,
:execution_delay => exec_delay,
:chain_mode => chain_mode)
are_rule.save
return { 'success' => true, 'rule_id' => are_rule.id}
else
print_error "[ARE] Ruleset (#{name}): ERROR. " + parser_result.last
return { 'success' => false, 'error' => parser_result.last }
print_more "Exec order: #{exec_order}"
print_more "Exec delay: #{exec_delay}"
end
rescue => e
err = 'Malformed JSON ruleset.'
print_error "[ARE] Ruleset (#{name}): ERROR. #{e} #{e.backtrace}"
return { 'success' => false, 'error' => err }
are_rule = BeEF::Core::Models::Rule.new(
name: name,
author: author,
browser: browser,
browser_version: browser_version,
os: os,
os_version: os_version,
modules: modules.to_json,
execution_order: exec_order,
execution_delay: exec_delay,
chain_mode: chain_mode
)
are_rule.save
{ 'success' => true, 'rule_id' => are_rule.id }
else
print_error "[ARE] Ruleset (#{name}): ERROR. " + parser_result.last
{ 'success' => false, 'error' => parser_result.last }
end
rescue StandardError => e
err = 'Malformed JSON ruleset.'
print_error "[ARE] Ruleset (#{name}): ERROR. #{e} #{e.backtrace}"
{ 'success' => false, 'error' => err }
end
def load_file(json_rule_path)
begin
rule_file = File.open(json_rule_path, 'r:UTF-8', &:read)
self.load JSON.parse(rule_file)
rescue => e
print_error "[ARE] Failed to load ruleset from #{json_rule_path}"
end
rule_file = File.open(json_rule_path, 'r:UTF-8', &:read)
self.load JSON.parse(rule_file)
rescue StandardError => e
print_error "[ARE] Failed to load ruleset from #{json_rule_path}: #{e.message}"
end
def load_directory
Dir.glob("#{$root_dir}/arerules/enabled/**/*.json") do |rule|
print_debug "[ARE] Processing rule: #{rule}"
self.load_file rule
load_file rule
end
end
end

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//
@@ -39,7 +39,7 @@ if(typeof beef === 'undefined' && typeof window.beef === 'undefined') {
*/
debug: function(msg) {
isDebug = '<%= @client_debug %>'
if (typeof console == "object" && typeof console.log == "function" && isDebug.localeCompare("true")) {
if (typeof console == "object" && typeof console.log == "function" && isDebug === 'true') {
var currentdate = new Date();
var pad = function(n){return ("0" + n).slice(-2);}
var datetime = currentdate.getFullYear() + "-"

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -16,10 +16,10 @@ var warnedAbout = {};
jQuery.migrateWarnings = [];
// Set to true to prevent console output; migrateWarnings still maintained
// jQuery.migrateMute = false;
jQuery.migrateMute = true;
// Show a message on the console so devs know we're active
if ( window.console && window.console.log ) {
if (window.console && window.console.log && !jQuery.migrateMute) {
window.console.log( "JQMIGRATE: Migrate is installed" +
( jQuery.migrateMute ? "" : " with logging active" ) +
", version " + jQuery.migrateVersion );
@@ -27,7 +27,7 @@ if ( window.console && window.console.log ) {
// Set to false to disable traces that appear with warnings
if ( jQuery.migrateTrace === undefined ) {
jQuery.migrateTrace = true;
jQuery.migrateTrace = false;
}
// Forget any warnings we've already given; public

View File

@@ -1,9 +1,8 @@
/**
/*!
* Platform.js
* Copyright 2014-2018 Benjamin Tan
* Copyright 2014-2020 Benjamin Tan
* Copyright 2011-2013 John-David Dalton
* Available under MIT license
* @namespace platform
*/
;(function() {
'use strict';
@@ -340,7 +339,7 @@
/* Detectable layout engines (order is important). */
var layout = getLayout([
{ 'label': 'EdgeHTML', 'pattern': '(?:Edge|EdgA|EdgiOS)' },
{ 'label': 'EdgeHTML', 'pattern': 'Edge' },
'Trident',
{ 'label': 'WebKit', 'pattern': 'AppleWebKit' },
'iCab',
@@ -370,7 +369,7 @@
'Konqueror',
'Lunascape',
'Maxthon',
{ 'label': 'Microsoft Edge', 'pattern': '(?:Edge|EdgA|EdgiOS)' },
{ 'label': 'Microsoft Edge', 'pattern': '(?:Edge|Edg|EdgA|EdgiOS)' },
'Midori',
'Nook Browser',
'PaleMoon',
@@ -386,13 +385,18 @@
{ 'label': 'SRWare Iron', 'pattern': 'Iron' },
'Sunrise',
'Swiftfox',
'Vivaldi',
'Waterfox',
'WebPositive',
{ 'label': 'Yandex Browser', 'pattern': 'YaBrowser' },
{ 'label': 'UC Browser', 'pattern': 'UCBrowser' },
'Opera Mini',
{ 'label': 'Opera Mini', 'pattern': 'OPiOS' },
'Opera',
{ 'label': 'Opera', 'pattern': 'OPR' },
'Chromium',
'Chrome',
{ 'label': 'Chrome', 'pattern': '(?:HeadlessChrome)' },
{ 'label': 'Chrome Mobile', 'pattern': '(?:CriOS|CrMo)' },
{ 'label': 'Firefox', 'pattern': '(?:Firefox|Minefield)' },
{ 'label': 'Firefox for iOS', 'pattern': 'FxiOS' },
@@ -438,6 +442,7 @@
/* Detectable manufacturers. */
var manufacturer = getManufacturer({
'Apple': { 'iPad': 1, 'iPhone': 1, 'iPod': 1 },
'Alcatel': {},
'Archos': {},
'Amazon': { 'Kindle': 1, 'Kindle Fire': 1 },
'Asus': { 'Transformer': 1 },
@@ -446,22 +451,28 @@
'Google': { 'Google TV': 1, 'Nexus': 1 },
'HP': { 'TouchPad': 1 },
'HTC': {},
'Huawei': {},
'Lenovo': {},
'LG': {},
'Microsoft': { 'Xbox': 1, 'Xbox One': 1 },
'Motorola': { 'Xoom': 1 },
'Nintendo': { 'Wii U': 1, 'Wii': 1 },
'Nokia': { 'Lumia': 1 },
'Oppo': {},
'Samsung': { 'Galaxy S': 1, 'Galaxy S2': 1, 'Galaxy S3': 1, 'Galaxy S4': 1 },
'Sony': { 'PlayStation': 1, 'PlayStation Vita': 1 }
'Sony': { 'PlayStation': 1, 'PlayStation Vita': 1 },
'Xiaomi': { 'Mi': 1, 'Redmi': 1 }
});
/* Detectable operating systems (order is important). */
var os = getOS([
'Windows Phone',
'KaiOS',
'Android',
'CentOS',
{ 'label': 'Chrome OS', 'pattern': 'CrOS' },
'Debian',
{ 'label': 'DragonFly BSD', 'pattern': 'DragonFly' },
'Fedora',
'FreeBSD',
'Gentoo',
@@ -617,9 +628,26 @@
// Convert layout to an array so we can add extra details.
layout && (layout = [layout]);
// Detect Android products.
// Browsers on Android devices typically provide their product IDS after "Android;"
// up to "Build" or ") AppleWebKit".
// Example:
// "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (5) Plus) AppleWebKit/537.36
// (KHTML, like Gecko) Chrome/70.0.3538.80 Mobile Safari/537.36"
if (/\bAndroid\b/.test(os) && !product &&
(data = /\bAndroid[^;]*;(.*?)(?:Build|\) AppleWebKit)\b/i.exec(ua))) {
product = trim(data[1])
// Replace any language codes (eg. "en-US").
.replace(/^[a-z]{2}-[a-z]{2};\s*/i, '')
|| null;
}
// Detect product names that contain their manufacturer's name.
if (manufacturer && !product) {
product = getProduct([manufacturer]);
} else if (manufacturer && product) {
product = product
.replace(RegExp('^(' + qualify(manufacturer) + ')[-_.\\s]', 'i'), manufacturer + ' ')
.replace(RegExp('^(' + qualify(manufacturer) + ')[-_.]?(\\w)', 'i'), manufacturer + ' $2');
}
// Clean up Google TV.
if ((data = /\bGoogle TV\b/.exec(product))) {
@@ -647,7 +675,7 @@
: '');
}
// Detect Kubuntu.
else if (name == 'Konqueror' && !/buntu/i.test(os)) {
else if (name == 'Konqueror' && /^Linux\b/i.test(os)) {
os = 'Kubuntu';
}
// Detect Android browsers.
@@ -667,6 +695,10 @@
description.unshift('accelerated');
}
}
// Detect UC Browser speed mode.
else if (name == 'UC Browser' && /\bUCWEB\b/.test(ua)) {
description.push('speed mode');
}
// Detect PaleMoon identifying as Firefox.
else if (name == 'PaleMoon' && (data = /\bFirefox\/([\d.]+)\b/.exec(ua))) {
description.push('identifying as Firefox ' + data[1]);
@@ -696,7 +728,7 @@
// Detect non-Opera (Presto-based) versions (order is important).
if (!version) {
version = getVersion([
'(?:Cloud9|CriOS|CrMo|Edge|EdgA|EdgiOS|FxiOS|IEMobile|Iron|Opera ?Mini|OPiOS|OPR|Raven|SamsungBrowser|Silk(?!/[\\d.]+$))',
'(?:Cloud9|CriOS|CrMo|Edge|Edg|EdgA|EdgiOS|FxiOS|HeadlessChrome|IEMobile|Iron|Opera ?Mini|OPiOS|OPR|Raven|SamsungBrowser|Silk(?!/[\\d.]+$)|UCBrowser|YaBrowser)',
'Version',
qualify(name),
'(?:Firefox|Minefield|NetFront)'
@@ -824,7 +856,7 @@
(prerelease == 'beta' ? beta : alpha) + (/\d+\+?/.exec(data) || '');
}
// Detect Firefox Mobile.
if (name == 'Fennec' || name == 'Firefox' && /\b(?:Android|Firefox OS)\b/.test(os)) {
if (name == 'Fennec' || name == 'Firefox' && /\b(?:Android|Firefox OS|KaiOS)\b/.test(os)) {
name = 'Firefox Mobile';
}
// Obscure Maxthon's unreliable version.
@@ -920,7 +952,7 @@
version = null;
}
// Use the full Chrome version when available.
data[1] = (/\bChrome\/([\d.]+)/i.exec(ua) || 0)[1];
data[1] = (/\b(?:Headless)?Chrome\/([\d.]+)/i.exec(ua) || 0)[1];
// Detect Blink layout engine.
if (data[0] == 537.36 && data[2] == 537.36 && parseFloat(data[1]) >= 28 && layout == 'WebKit') {
layout = ['Blink'];
@@ -929,7 +961,7 @@
// http://stackoverflow.com/questions/6768474/how-can-i-detect-which-javascript-engine-v8-or-jsc-is-used-at-runtime-in-androi
if (!useFeatures || (!likeChrome && !data[1])) {
layout && (layout[1] = 'like Safari');
data = (data = data[0], data < 400 ? 1 : data < 500 ? 2 : data < 526 ? 3 : data < 533 ? 4 : data < 534 ? '4+' : data < 535 ? 5 : data < 537 ? 6 : data < 538 ? 7 : data < 601 ? 8 : '8');
data = (data = data[0], data < 400 ? 1 : data < 500 ? 2 : data < 526 ? 3 : data < 533 ? 4 : data < 534 ? '4+' : data < 535 ? 5 : data < 537 ? 6 : data < 538 ? 7 : data < 601 ? 8 : data < 602 ? 9 : data < 604 ? 10 : data < 606 ? 11 : data < 608 ? 12 : '12');
} else {
layout && (layout[1] = 'like Chrome');
data = data[1] || (data = data[0], data < 530 ? 1 : data < 532 ? 2 : data < 532.05 ? 3 : data < 533 ? 4 : data < 534.03 ? 5 : data < 534.07 ? 6 : data < 534.10 ? 7 : data < 534.13 ? 8 : data < 534.16 ? 9 : data < 534.24 ? 10 : data < 534.30 ? 11 : data < 535.01 ? 12 : data < 535.02 ? '13+' : data < 535.07 ? 15 : data < 535.11 ? 16 : data < 535.19 ? 17 : data < 536.05 ? 18 : data < 536.10 ? 19 : data < 537.01 ? 20 : data < 537.11 ? '21+' : data < 537.13 ? 23 : data < 537.18 ? 24 : data < 537.24 ? 25 : data < 537.36 ? 26 : layout != 'Blink' ? '27' : '28');
@@ -939,6 +971,8 @@
// Obscure version for some Safari 1-2 releases.
if (name == 'Safari' && (!version || parseInt(version) > 45)) {
version = data;
} else if (name == 'Chrome' && /\bHeadlessChrome/i.test(ua)) {
description.unshift('headless');
}
}
// Detect Opera desktop modes.
@@ -966,16 +1000,24 @@
os = null;
}
}
// Newer versions of SRWare Iron uses the Chrome tag to indicate its version number.
else if (/\bSRWare Iron\b/.test(name) && !version) {
version = getVersion('Chrome');
}
// Strip incorrect OS versions.
if (version && version.indexOf((data = /[\d.]+$/.exec(os))) == 0 &&
ua.indexOf('/' + data + '-') > -1) {
os = trim(os.replace(data, ''));
}
// Ensure OS does not include the browser name.
if (os && os.indexOf(name) != -1 && !RegExp(name + ' OS').test(os)) {
os = os.replace(RegExp(' *' + qualify(name) + ' *'), '');
}
// Add layout engine.
if (layout && !/\b(?:Avant|Nook)\b/.test(name) && (
/Browser|Lunascape|Maxthon/.test(name) ||
name != 'Safari' && /^iOS/.test(os) && /\bSafari\b/.test(layout[1]) ||
/^(?:Adobe|Arora|Breach|Midori|Opera|Phantom|Rekonq|Rock|Samsung Internet|Sleipnir|Web)/.test(name) && layout[1])) {
/^(?:Adobe|Arora|Breach|Midori|Opera|Phantom|Rekonq|Rock|Samsung Internet|Sleipnir|SRWare Iron|Vivaldi|Web)/.test(name) && layout[1])) {
// Don't add layout details to description if they are falsey.
(data = layout[layout.length - 1]) && description.push(data);
}
@@ -1033,7 +1075,7 @@
/**
* The platform object.
*
* @memberof platform
* @name platform
* @type Object
*/
var platform = {};
@@ -1144,8 +1186,8 @@
*
* Common values include:
* "Windows", "Windows Server 2008 R2 / 7", "Windows Server 2008 / Vista",
* "Windows XP", "OS X", "Ubuntu", "Debian", "Fedora", "Red Hat", "SuSE",
* "Android", "iOS" and "Windows Phone"
* "Windows XP", "OS X", "Linux", "Ubuntu", "Debian", "Fedora", "Red Hat",
* "SuSE", "Android", "iOS" and "Windows Phone"
*
* @memberOf platform.os
* @type string|null

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
//
// Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
// Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//

View File

@@ -1,5 +1,5 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
@@ -43,7 +43,7 @@ module BeEF
#
class Command
attr_reader :datastore, :path, :default_command_url, :beefjs_components, :friendlyname,
:config
:config
attr_accessor :zombie, :command_id, :session_id
include BeEF::Core::CommandUtils
@@ -100,12 +100,12 @@ module BeEF
# Returns information about the command in a JSON format.
# @return [String] JSON formatted string
#
def to_json
def to_json(*_args)
{
'Name' => @friendlyname,
'Name' => @friendlyname,
'Description' => BeEF::Core::Configuration.instance.get("beef.module.#{@key}.description"),
'Category' => BeEF::Core::Configuration.instance.get("beef.module.#{@key}.category"),
'Data' => BeEF::Module.get_options(@key)
'Category' => BeEF::Core::Configuration.instance.get("beef.module.#{@key}.category"),
'Data' => BeEF::Module.get_options(@key)
}.to_json
end
@@ -116,7 +116,7 @@ module BeEF
#
def build_datastore(data)
@datastore = JSON.parse data
rescue => e
rescue StandardError => e
print_error "Could not build datastore: #{e.message}"
end
@@ -126,7 +126,7 @@ module BeEF
# @param [Hash] http_headers HTTP headers
#
def build_callback_datastore(result, command_id, beefhook, http_params, http_headers)
@datastore = {'http_headers' => {}} # init the datastore
@datastore = { 'http_headers' => {} } # init the datastore
if !http_params.nil? && !http_headers.nil?
# get, check and add the http_params to the datastore
@@ -166,7 +166,7 @@ module BeEF
@datastore['results'] = result
@datastore['cid'] = command_id
@datastore['beefhook'] = beefhook
@datastore['beefhook'] = beefhook
end
#
@@ -184,7 +184,7 @@ module BeEF
@eruby = Erubis::FastEruby.new(File.read(f))
#data = BeEF::Core::Configuration.instance.get "beef.module.#{@key}"
# data = BeEF::Core::Configuration.instance.get "beef.module.#{@key}"
cc = BeEF::Core::CommandContext.new
cc['command_url'] = @default_command_url
cc['command_id'] = @command_id
@@ -226,7 +226,7 @@ module BeEF
def use(component)
return if @beefjs_components.include? component
component_path = '/'+component
component_path = '/' + component
component_path.gsub!(/beef./, '')
component_path.gsub!(/\./, '/')
component_path.replace "#{$root_dir}/core/main/client/#{component_path}.js"
@@ -238,8 +238,9 @@ module BeEF
# @todo TODO Document
def oc_value(name)
option = BeEF::Core::Models::OptionCache.where(:name => name).first
option = BeEF::Core::Models::OptionCache.where(name: name).first
return nil unless option
option.value
end
@@ -250,8 +251,6 @@ module BeEF
end
end
private
@use_template
@eruby
@update_zombie

View File

@@ -1,5 +1,5 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
@@ -24,14 +24,15 @@ module BeEF
raise TypeError, "Configuration file '#{config}' cannot be found" unless File.exist? config
begin
#open base config
# open base config
@config = load(config)
# set default value if key? does not exist
@config.default = nil
@@config = config
rescue => e
rescue StandardError => e
print_error "Fatal Error: cannot load configuration file '#{config}' : #{e.message}"
print_error e.backtrace
print_more e.backtrace
exit(1)
end
@@instance = self
@@ -41,12 +42,8 @@ module BeEF
# @param [String] file YAML file to be loaded
# @return [Hash] YAML formatted hash
def load(file)
return nil unless File.exist? file
raw = File.read file
YAML.safe_load raw
rescue => e
print_debug "Unable to load configuration file '#{file}' : #{e.message}"
print_error e.backtrace
return nil unless File.exist?(file)
YAML.safe_load(File.binread(file))
end
#
@@ -56,7 +53,7 @@ module BeEF
if @config.empty?
print_error 'Configuration file is empty'
return
end
end
if @config['beef'].nil?
print_error "Configuration file is malformed: 'beef' is nil"
@@ -136,17 +133,17 @@ module BeEF
def public_enabled?
!get('beef.http.public.host').nil?
end
#
# Returns the beef protocol that is used by external resources
# e.g. hooked browsers
def beef_proto
if public_enabled? && public_https_enabled? then
return 'https'
if public_enabled? && public_https_enabled?
'https'
elsif public_enabled? && !public_https_enabled?
return 'http'
'http'
elsif !public_enabled?
return local_proto
local_proto
end
end
@@ -201,6 +198,7 @@ module BeEF
hash[k]
end
return nil if subhash.nil?
subhash.key?(lastkey) ? subhash[lastkey] : nil
end
@@ -215,7 +213,7 @@ module BeEF
return false if subkeys.empty?
hash = { subkeys.shift.to_s => value }
subkeys.each { |v| hash = {v.to_s => hash} }
subkeys.each { |v| hash = { v.to_s => hash } }
@config = @config.deep_merge hash
true
end
@@ -231,7 +229,7 @@ module BeEF
lastkey = subkeys.pop
hash = @config
subkeys.each {|v| hash = hash[v] }
subkeys.each { |v| hash = hash[v] }
hash.delete(lastkey).nil? ? false : true
end
@@ -258,7 +256,7 @@ module BeEF
def load_modules_config
set('beef.module', {})
# support nested sub-categories, like browser/hooked_domain/ajax_fingerprint
module_configs = File.join("#{$root_dir}/modules/**", "config.yaml")
module_configs = File.join("#{$root_dir}/modules/**", 'config.yaml')
Dir.glob(module_configs) do |cf|
y = load(cf)
if y.nil?
@@ -280,9 +278,8 @@ module BeEF
private
def validate_public_config_variable?(config)
return true if (config['beef']['http']['public'].is_a?(Hash) ||
config['beef']['http']['public'].is_a?(NilClass))
return true if config['beef']['http']['public'].is_a?(Hash) ||
config['beef']['http']['public'].is_a?(NilClass)
print_error 'Config path beef.http.public is deprecated.'
print_error 'Please use the new format for public variables found'

View File

@@ -1,143 +1,141 @@
#
# Copyright (c) 2006-2021 Wade Alcorn - wade@bindshell.net
# Copyright (c) 2006-2022 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
module BeEF
module Core
module Console
module Core
module Console
module Banners
class << self
attr_accessor :interfaces
module Banners
class << self
attr_accessor :interfaces
#
# Prints BeEF's ascii art
#
def print_ascii_art
if File.exists?('core/main/console/beef.ascii')
File.open('core/main/console/beef.ascii', 'r') do |f|
#
# Prints BeEF's ascii art
#
def print_ascii_art
if File.exist?('core/main/console/beef.ascii')
File.open('core/main/console/beef.ascii', 'r') do |f|
while line = f.gets
puts line
puts line
end
end
end
end
#
# Prints BeEF's welcome message
#
def print_welcome_msg
config = BeEF::Core::Configuration.instance
version = config.get('beef.version')
print_info "Browser Exploitation Framework (BeEF) #{version}"
data = "Twit: @beefproject\n"
data += "Site: https://beefproject.com\n"
data += "Blog: http://blog.beefproject.com\n"
data += "Wiki: https://github.com/beefproject/beef/wiki\n"
print_more data
print_info 'Project Creator: ' + 'Wade Alcorn'.red + ' (@WadeAlcorn)'
end
#
# Prints the number of network interfaces beef is operating on.
# Looks like that:
#
# [14:06:48][*] 5 network interfaces were detected.
#
def print_network_interfaces_count
# get the configuration information
configuration = BeEF::Core::Configuration.instance
# local host
beef_host = configuration.local_host
# create an array of the interfaces the framework is listening on
if beef_host == '0.0.0.0' # the framework will listen on all interfaces
interfaces = Socket.ip_address_list.map { |x| x.ip_address if x.ipv4? }
interfaces.delete_if { |x| x.nil? } # remove if the entry is nill
else # the framework will listen on only one interface
interfaces = [beef_host]
end
self.interfaces = interfaces
# output the banner to the console
print_info "#{interfaces.count} network interfaces were detected."
end
#
# Prints the route to the network interfaces beef has been deployed on.
# Looks like that:
#
# [14:06:48][+] running on network interface: 192.168.255.1
# [14:06:48] | Hook URL: http://192.168.255.1:3000/hook.js
# [14:06:48] | UI URL: http://192.168.255.1:3000/ui/panel
# [14:06:48][+] running on network interface: 127.0.0.1
# [14:06:48] | Hook URL: http://127.0.0.1:3000/hook.js
# [14:06:48] | UI URL: http://127.0.0.1:3000/ui/panel
#
def print_network_interfaces_routes
configuration = BeEF::Core::Configuration.instance
# local config settings
proto = configuration.local_proto
hook_file = configuration.hook_file_path
admin_ui = configuration.get('beef.extension.admin_ui.enable') ? true : false
admin_ui_path = configuration.get('beef.extension.admin_ui.base_path')
# display the hook URL and Admin UI URL on each interface from the interfaces array
interfaces.map do |host|
print_info "running on network interface: #{host}"
port = configuration.local_port
data = "Hook URL: #{proto}://#{host}:#{port}#{hook_file}\n"
data += "UI URL: #{proto}://#{host}:#{port}#{admin_ui_path}/panel\n" if admin_ui
print_more data
end
# display the public hook URL and Admin UI URL
if configuration.public_enabled?
print_info 'Public:'
data = "Hook URL: #{configuration.hook_url}\n"
data += "UI URL: #{configuration.beef_url_str}#{admin_ui_path}/panel\n" if admin_ui
print_more data
end
end
#
# Print loaded extensions
#
def print_loaded_extensions
extensions = BeEF::Extensions.get_loaded
print_info "#{extensions.size} extensions enabled:"
output = ''
extensions.each do |_key, ext|
output << "#{ext['name']}\n"
end
print_more output
end
#
# Print loaded modules
#
def print_loaded_modules
print_info "#{BeEF::Modules.get_enabled.count} modules enabled."
end
#
# Print WebSocket servers
#
def print_websocket_servers
config = BeEF::Core::Configuration.instance
ws_poll_timeout = config.get('beef.http.websocket.ws_poll_timeout')
print_info "Starting WebSocket server ws://#{config.beef_host}:#{config.get('beef.http.websocket.port').to_i} [timer: #{ws_poll_timeout}]"
if config.get('beef.http.websocket.secure')
print_info "Starting WebSocketSecure server on wss://[#{config.beef_host}:#{config.get('beef.http.websocket.secure_port').to_i} [timer: #{ws_poll_timeout}]"
end
end
end
end
#
# Prints BeEF's welcome message
#
def print_welcome_msg
config = BeEF::Core::Configuration.instance
version = config.get('beef.version')
print_info "Browser Exploitation Framework (BeEF) #{version}"
data = "Twit: @beefproject\n"
data += "Site: https://beefproject.com\n"
data += "Blog: http://blog.beefproject.com\n"
data += "Wiki: https://github.com/beefproject/beef/wiki\n"
print_more data
print_info "Project Creator: " + "Wade Alcorn".red + " (@WadeAlcorn)"
end
#
# Prints the number of network interfaces beef is operating on.
# Looks like that:
#
# [14:06:48][*] 5 network interfaces were detected.
#
def print_network_interfaces_count
# get the configuration information
configuration = BeEF::Core::Configuration.instance
# local host
beef_host = configuration.local_host
# create an array of the interfaces the framework is listening on
if beef_host == '0.0.0.0' # the framework will listen on all interfaces
interfaces = Socket.ip_address_list.map {|x| x.ip_address if x.ipv4?}
interfaces.delete_if {|x| x.nil?} # remove if the entry is nill
else # the framework will listen on only one interface
interfaces = [beef_host]
end
self.interfaces = interfaces
# output the banner to the console
print_info "#{interfaces.count} network interfaces were detected."
end
#
# Prints the route to the network interfaces beef has been deployed on.
# Looks like that:
#
# [14:06:48][+] running on network interface: 192.168.255.1
# [14:06:48] | Hook URL: http://192.168.255.1:3000/hook.js
# [14:06:48] | UI URL: http://192.168.255.1:3000/ui/panel
# [14:06:48][+] running on network interface: 127.0.0.1
# [14:06:48] | Hook URL: http://127.0.0.1:3000/hook.js
# [14:06:48] | UI URL: http://127.0.0.1:3000/ui/panel
#
def print_network_interfaces_routes
configuration = BeEF::Core::Configuration.instance
# local config settings
proto = configuration.local_proto
hook_file = configuration.hook_file_path
admin_ui = configuration.get("beef.extension.admin_ui.enable") ? true : false
admin_ui_path = configuration.get("beef.extension.admin_ui.base_path")
# display the hook URL and Admin UI URL on each interface from the interfaces array
self.interfaces.map do |host|
print_info "running on network interface: #{host}"
port = configuration.local_port
data = "Hook URL: #{proto}://#{host}:#{port}#{hook_file}\n"
data += "UI URL: #{proto}://#{host}:#{port}#{admin_ui_path}/panel\n" if admin_ui
print_more data
end
# display the public hook URL and Admin UI URL
if configuration.public_enabled?
print_info 'Public:'
data = "Hook URL: #{configuration.hook_url}\n"
data += "UI URL: #{configuration.beef_url_str}#{admin_ui_path}/panel\n" if admin_ui
print_more data
end
end
#
# Print loaded extensions
#
def print_loaded_extensions
extensions = BeEF::Extensions.get_loaded
print_info "#{extensions.size} extensions enabled:"
output = ''
extensions.each do |key, ext|
output << "#{ext['name']}\n"
end
print_more output
end
#
# Print loaded modules
#
def print_loaded_modules
print_info "#{BeEF::Modules::get_enabled.count} modules enabled."
end
#
# Print WebSocket servers
#
def print_websocket_servers
config = BeEF::Core::Configuration.instance
ws_poll_timeout = config.get('beef.http.websocket.ws_poll_timeout')
print_info "Starting WebSocket server ws://#{config.beef_host}:#{config.get("beef.http.websocket.port").to_i} [timer: #{ws_poll_timeout}]"
if config.get("beef.http.websocket.secure")
print_info "Starting WebSocketSecure server on wss://[#{config.beef_host}:#{config.get("beef.http.websocket.secure_port").to_i} [timer: #{ws_poll_timeout}]"
end
end
end
end
end
end
end

Some files were not shown because too many files have changed in this diff Show More