Ronin 2.1.0 has finally been released! New database tables, new payloads, new recon engine, new Web UI, and more!
Stop wasting your time on annoying CTF challenges (and just use Ronin)!
Working on wrapping up the Ronin Phase II epic.
Solving Advent of Cyber 2023 Day 22 with ronin-exploits
Solving HackThisSite Programming Level 11 with Ronin
Solving HackThisSite Programming Level 1 with Ronin
ronin 2.0.5, ronin-support 1.0.3, ronin-db-activerecord 0.1.2, ronin-db 0.1.2, ronin-vulns 0.1.4, ronin-payloads 0.1.4, and ronin-exploits 1.0.3 released!
Proposal to deprecate "|command-here" inputs for Kernel.open() accepted
Dozens of Ruby-related CVEs have been caused by user input being passed to the top-level Kernel.open() method, which not only accepts paths or URIs (if open-uri has been loaded), but also "|command-here" commands which are then opened using IO.popen() resulting in Remote Command Execution (RCE) vulnerabilities. In the next minor Ruby version (3.3.0) a deprecation warning will be printed if a "|command-here" input is given to Kernel.open(). Hopefully, in Ruby 4.0 this insecure feature will be removed.
A website wordlist generator that's better than CeWL for ronin-web using ronin-web-spider (based on spidr) and the wordlist library. Current writing the man page, there's a lot of options to document.
Finding all TLD typos using Ruby and ronin-support
You may have recently read a news story about how a typo in a US military email address (
<mailbox>
@<domain>
.mil -><mailbox>
@<domain>
.ml) accidentally caused sensitive military secrets to be sent to a similar Mali email address for years.What if I told you, you could use Ronin to find all of the one-character-missing valid typos for all of the TLDs?
ronin-code-sql 2.1.0 released, a Ruby library for crafting complex SQL injections (SQLi).
Checkout what new features were added in ronin-code-sql 2.1.0. Using ronin-code-sql you can generate complex and obfuscated SQL injections (SQLi).
How to write a Ruby script for security research using the ronin-support library
A multi-part guide on how to write quick Ruby scripts using the ronin-support library. ronin-support is sort of like activesupport meets Python's pwnlib, but in Ruby.
How to port a Metasploit Exploit to Ronin Exploits
A step-by-step guide explaining how to port a Metasploit Exploit to Ronin Exploits. Ronin Exploits is a simpler, more Object Orientated, micro-framework for writing and running exploits.
Ronin has eight new guides! Ronin is a free and Open Source Ruby toolkit for security research and development.
Ever wanted to know more about the Ronin CLI, how to use ronin-repos or ronin-db, how to write Ruby scripts using ronin-support, or how to port Metasploit Payloads to ronin-payloads? We now have eight new Guides on those topics. Check it out!