diff --git a/README.md b/README.md index 2417f05d..b52d194f 100644 --- a/README.md +++ b/README.md @@ -178,6 +178,7 @@ $ ronin-payloads list test/powershell test/python test/ruby + test/sql test/url test/xss ``` diff --git a/lib/ronin/payloads/builtin/test/sql.rb b/lib/ronin/payloads/builtin/test/sql.rb new file mode 100755 index 00000000..cdb70102 --- /dev/null +++ b/lib/ronin/payloads/builtin/test/sql.rb @@ -0,0 +1,53 @@ +# frozen_string_literal: true +# +# ronin-payloads - A Ruby micro-framework for writing and running exploit +# payloads. +# +# Copyright (c) 2007-2024 Hal Brodigan (postmodern.mod3 at gmail.com) +# +# ronin-payloads is free software: you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published +# by the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# ronin-payloads is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with ronin-payloads. If not, see . +# + +require 'ronin/payloads/sql_payload' + +module Ronin + module Payloads + module Test + # + # A test SQL payload. Allows using a custom SQL expression with exploits + # that require a SQL payload. + # + # @since 0.3.0 + # + class SQL < SQLPayload + + register 'test/sql' + + summary "A test SQL payload" + description <<~DESC + Allows specifying a custom SQL expression for exploits that require a + SQL payload. + DESC + + param :sql, String, default: %{SELECT(1)}, + desc: 'The SQL expression to execute' + + def build + @payload = params[:sql] + end + + end + end + end +end diff --git a/spec/builtin/test/sql_spec.rb b/spec/builtin/test/sql_spec.rb new file mode 100644 index 00000000..cd97d61c --- /dev/null +++ b/spec/builtin/test/sql_spec.rb @@ -0,0 +1,39 @@ +require 'spec_helper' +require 'ronin/payloads/builtin/test/sql' + +describe Ronin::Payloads::Test::SQL do + it "must inherit from Ronin::Payloads::SQLPayload" do + expect(described_class).to be < Ronin::Payloads::SQLPayload + end + + describe ".id" do + subject { described_class } + + it "must equal 'test/sql'" do + expect(subject.id).to eq('test/sql') + end + end + + describe "#build" do + context "when the sql param is not set" do + before { subject.build } + + it "must set #payload to 'SELECT(1)'" do + expect(subject.payload).to eq(%{SELECT(1)}) + end + end + + context "when the sql param is set" do + let(:sql) { 'SELECT("PWNED")' } + + before do + subject.params[:sql] = sql + subject.build + end + + it "must set #payload to the sql param" do + expect(subject.payload).to eq(sql) + end + end + end +end