https://ronin-rb.dev/blog/2023/02/01/ronin-2-0-0-finally-released.html install faq docs code blog Ronin logo Ronin 2.0.0 finally released! 2023-02-01 -- postmodern After nearly a full year of non-stop development since the initial announcement of The Big Refactor, 4153 commits made, 700 issues closed, and a month of beta testing, Ronin 2.0.0 has finally been released! What is Ronin? Ronin is a free and Open Source Ruby toolkit for security research and development. Ronin contains many different CLI commands and Ruby libraries for a variety of security tasks, such as encoding/decoding data, filter IPs/hosts/URLs, querying ASNs, querying DNS, HTTP, scanning for web vulnerabilities, spidering websites, install 3rd party repositories of exploits and/or payloads, run exploits, write new exploits, managing local databases, fuzzing data, and much more. Install Ronin can be installed via the ronin-install.sh installer bash script: curl -o ronin-install.sh https://raw.githubusercontent.com/ronin-rb/scripts/main/ronin-install.sh && bash ronin-install.sh Docker Ronin also has docker images, if you prefer using docker. docker pull roninrb/ronin docker run -it ronin What's New? * Many new APIs were added to ronin-support that allow working with various data encodings, encoding/decoding binary data, bit-flipping, cryptography, compressing/uncompressing data, reading/writing tar/zip archives, querying ASNs, parsing/ enumerating TLDs, parsing/enumerating Public Suffixes, enumerating IP ranges, and more. * Many new CLI commands were added to the main ronin command. * ronin-repos allows you to easily install and manage 3rd party git repositories of exploits, payloads, etc. * ronin-db allows managing databases, importing recon data, and query data. * ronin-db-activerecord provides ActiveRecord models for ronin-db and can be embedded into other Ruby apps, utils, or libraries. * ronin-payloads provides a stable API for writing custom payloads for exploits. It also ships with many common bind shell and reverse shell payloads. * ronin-exploits now has a stable API for writing custom exploits. It also has a CLI for generating and running exploits. * ronin-vulns provides classes for testing and exploiting URLs for common web vulnerabilities, such as Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), reflective Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects. It also has a CLI for testing URLs. * New micro-libraries were created, such as ronin-web-user_agents, ronin-web-server, and ronin-web-spider. What Do You Get? A Powerful CLI Ronin provides many powerful CLI commands: See ronin's README for more command examples. Powerful Ruby APIs Ronin is made up of different Ruby libraries and powerful APIs, that you can use in Ruby scripts, other Ruby apps, or in the Ruby console. #!/usr/bin/env ruby require 'ronin/support' require 'wordlist' domain = Ronin::Support::Network::Domain.new('github.com') wordlist = Wordlist.open('subdomains-10000.txt') wordlist.each do |word| host = domain.subdomain(word) if !host.cname && host.has_addresses? print_success "found subdomain: #{host}" end rescue Interrupt break end See the API documentation for more documentation and examples. A Rich Ecosystem The main ruby gem that provides the main ronin ronin command and pulls in the other ronin- gems as dependencies. A support library for other ronin-rb libraries which provides most of the APIs and ronin-support core-extensions which make Ruby much easier to use. tl;dr It's like pwntools combined with activesupport. ronin-core A "core" library which provides internal APIs for the other ronin-rb libraries. Supports installing and managing 3rd party git repositories of exploits, payloads, or ronin-repos potentially any other type of Ruby code. Other libraries such as ronin-exploits and ronin-payloads can load modules from git repositories installed via ronin-repos. Defines the ActiveRecord models and migrations ronin-db-activerecord for the ronin-db. ronin-db-activerecord can be used by other Ruby libraries or apps. Provides a command-line interface (CLI) to ronin-db ronin-db-activerecord. It provides the ronin-db command for managing and querying database(s). A small library which provides a Sinatra based web server customized specifically for security ronin-web-server related tasks. It provides additional routing methods, routing conditions, helper methods, as well as a reverse proxy. A small library that builds on top of the battle tested spidr library. It provides additional callback methods that are relevant ronin-web-spider to recon, such as every_host, every_cert, every_favicon, every_javascript, every_javascript_string, every_javascript_comment, every_html_comment, and every_comment. A small library for generating random but ronin-web-user_agents realistic looking User-Agent strings for a variety of web browsers, OSes, devices, etc. Brings together all of the other ronin-web- libraries and provides the ronin-web command ronin-web which provides numerous handy web related commands, such as diff, html, reverse-proxy, server, and spider. A Ruby DSL for writing assembly in pure-Ruby. ronin-code-asm It can assemble full programs or be used to write shellcode. A Ruby DSL for crafting SQL injections. It can ronin-code-sql also generate obfuscated SQL for bypassing filters. A Ruby library for blind vulnerability testing. It can test for Local File Inclusion (LFI), ronin-vulns Remote File Inclusion (RFI), SQL injection (SQLi), reflective Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects. A Post-Exploitation API for interacting with ronin-post_ex compromised systems. ronin-post_ex is used by both ronin-payloads and ronin-exploits. A Ruby micro-framework for writing exploit payloads as plain old Ruby classes. ronin-payloads ronin-payloads comes with common payloads (ex: exec_shell, bind_shell, reverse_shell) and can also load 3rd party payloads from ronin-repos. A Ruby micro-framework for writing and running exploits. ronin-exploits allows one to write exploits as plain old Ruby classes. ronin-exploits ronin-exploits can load and run 3rd party exploits from either Ruby files or from ronin-repos. tl;dr It's like a simpler and more modular version of Metasploit. A Ruby library and CLI for generating, ronin-fuzzer mutating, and fuzzing data. The goal of ronin-fuzzer is to be as configurable as possible. Interested? Does Ronin interest you? Do you have an idea for a feature or a new ronin- library? Checkout our GitHub, join our Discord server, and get involved! Special Thanks A special thank you to everyone who participated in the Open Beta. Also, a special thank you to everyone who voted in my many Twitter/ Mastodon polls, which helped shape Ronin's design. (c) 2008-2023 Hal Brodigan Pages * home * install * faq * docs * blog Social * github * discord * twitter * mastodon API Docs * ronin * ronin-support * ronin-core * ronin-repos * ronin-db-activerecord * ronin-db * ronin-web-server * ronin-web-spider * ronin-web-user_agents * ronin-web * ronin-code-asm * ronin-code-sql * ronin-post_ex * ronin-payloads * ronin-vulns * ronin-exploits * ronin-fuzzer GitHub * ronin-rb/ronin * ronin-rb/ronin-support * ronin-rb/ronin-core * ronin-rb/ronin-repos * ronin-rb/ronin-db-activerecord * ronin-rb/ronin-db * ronin-rb/ronin-web-server * ronin-rb/ronin-web-spider * ronin-rb/ronin-web-user_agents * ronin-rb/ronin-web * ronin-rb/ronin-code-asm * ronin-rb/ronin-code-sql * ronin-rb/ronin-post_ex * ronin-rb/ronin-payloads * ronin-rb/ronin-vulns * ronin-rb/ronin-exploits * ronin-rb/ronin-fuzzer