Ronin 是一个用于安全研究与开发的免费开源 Ruby 工具包。Ronin 还允许通过第三方 Git 仓库快速开发和分发代码、漏洞利用、有效载荷等。
[Ronin][website] 是一个免费且开源的 [Ruby] 工具包,用于安全研究和开发。Ronin 包含许多不同的 CLI 命令 和 [Ruby 库][ronin-rb],用于处理各种安全任务,例如编码/解码数据、过滤 IP/主机/URL、查询 ASN、查询 DNS、HTTP、[扫描 Web 漏洞][ronin-vulns-synopsis]、[爬取网站][ronin-web-spider]、[安装第三方仓库][ronin-repos-synopsis] 中的 [漏洞利用][ronin-exploits] 和/或 [有效载荷][ronin-payloads]、[运行漏洞利用][ronin-exploits-synopsis]、[开发新的漏洞利用][ronin-exploits-examples]、[管理本地数据库][ronin-db-synopsis]、[模糊测试数据][ronin-fuzzer]、[进行侦察][ronin-recon-synopsis] 等。
ronin 命令快速处理和查询各种数据。ronin irb Ruby REPL 中高效处理代码和数据。ronin 库快速原型化 Ruby 脚本。Usage: ronin [options] [COMMAND [ARGS...]]
Options: -h, --help Print help information
Arguments: [COMMAND] The command name to run [ARGS ...] Additional arguments for the command
Commands: archive asn banner-grab bitflip cert-dump cert-gen cert-grab completion decode, dec decrypt dns dns-proxy email-addr encode, enc encrypt entropy escape extract grep help hexdump highlight hmac homoglyph host http ip iprange irb md5 netcat, nc new pack proxy public-suffix-list quote rot sha1 sha256 sha512 strings tld-list tips typo typosquat unarchive unescape unhexdump unpack unquote url xor
Additional Ronin Commands: $ ronin-repos $ ronin-wordlists $ ronin-db $ ronin-web $ ronin-fuzzer $ ronin-masscan $ ronin-nmap $ ronin-recon $ ronin-payloads $ ronin-exploits $ ronin-vulns $ ronin-app
列出 ronin 命令:```shell
$ ronin help
查看命令的手册页:```shell $ ronin help COMMAND
获取使用 `ronin` 的随机提示:```shell
$ ronin tips
打开 Ronin Ruby REPL:```
$ ronin irb
, Jµ ▓▓█▓
J▌ ▐▓██▌ ████ ██ ▐███D
╓▄▓▓█████▌ ██µ ████ ▄███ÖJ██▌ ███▌
,╓µ▄▄▄▄▄▄▄▄µ;, ,▄▓██████████ ▐███ ▐███▀ ███▌ ████µ ▄███
¬∞MÆ▓███████████████████████▓M ▄██████▀▀╙████▌ ████▌ ████ ▄███ J█████ ███▌
█████▀▀▀▀▀███████ -████▀└ ████ ▐█████n ▄███O ███▌ ██████████ ▓████L ████▀ ▓████ ▓███Ö ███████ ███▌ ▓███ ▐█████████▀ ▄████▀ ,╓▄▄▄█████ J████Ü ,███▌ ▄███████████ J███▀ ████ █████ J█████████████████─ ████▌ ████ ██████████▌ ████ ▐███Ü ▐███Ü
███████████▀▀▀╙└ ▐████ J███▌ ▓███▌ ²█████ J███Ü ███▌ ▀█▌
▓██████████▌ ████▌ ████ ;████ ▀███▀ ███▌ J▀▀▀- █
▄█████▀ ▀█████µ ▐████ ,▄▓████▀ ████▀ ███ J███ `
J█████- ╙▀███▄ ████████████▀╙ J█▀▀▀ █U ▀█▌
████▀ ▀███ ▄████████▀▀ ╨ █
▓██▀ ²▀█▄ █▀▀▀╙└
▄██╜ ╙W
J█▀
▌└
┘
irb(ronin)>
启动并打开 Ronin 的交互式 Web 用户界面:```
$ ronin-app
以多种格式对数据进行十六进制转储:```shell $ ronin hexdump /bin/ls
将十六进制转储文件还原为其原始的原始二进制数据:```shell
$ ronin unhexdump -o data.bin hexdump.txt
打印文件中的所有可打印字符串:```shell $ ronin strings /bin/ls
从文件中打印所有字母字符串:```shell
$ ronin strings --alpha /bin/ls
从文件中输出所有字母数字字符串:```shell $ ronin strings --alpha-num /bin/ls
打印文件中所有数字字符串:```shell
$ ronin strings --numeric /bin/ls
打印文件中的所有十六进制字符串:```shell $ ronin strings --hex /bin/ls
枚举一个域名的所有位翻转:```shell
$ ronin bitflip microsoft --alpha-num --append .com
licrosoft.com
oicrosoft.com
iicrosoft.com
eicrosoft.com
Microsoft.com
mhcrosoft.com
mkcrosoft.com
mmcrosoft.com
macrosoft.com
mycrosoft.com
...
将字符串进行Base64编码:```shell $ ronin encode --base64 --string "foo bar baz" Zm9vIGJhciBiYXo=
Zlib压缩,Base64编码,然后URI编码一个字符串:```shell
$ ronin encode --zlib --base64 --uri --string "foo bar"
%65%4A%78%4C%79%38%39%58%53%45%6F%73%41%67%41%4B%63%41%4B%61%0A
Base64 解码字符串:```shell $ ronin decode --base64 --string "Zm9vIGJhciBiYXo=" foo bar baz
URI 解码、Base64 解码,然后对字符串进行 zlib 解压:```shell
$ ronin decode --uri --base64 --zlib --string "%65%4A%78%4C%79%38%39%58%53%45%6F%73%41%67%41%4B%63%41%4B%61%0A"
foo bar
对字符串进行URI转义:```shell $ ronin escape --uri --string "foo bar" foo%20bar
对字符串进行URI解转义:```shell
$ ronin unescape --uri --string "foo%20bar"
foo bar
将文件转换为引用的C字符串:```shell $ ronin quote --c file.bin "..."
将文件转换为带引号的 JavaScript 字符串:```shell
$ ronin quote --js file.bin
去除C字符串的引号:```shell $ ronin unquote --c --string '"\x66\x6f\x6f\x20\x62\x61\x72"' foo bar
### 文本
从文件中提取高熵数据:```shell
$ ronin entropy -e 5.0 index.html
Grep 搜索常见的数据模式:```shell $ ronin grep --hash index.html
从数据中提取常见模式:```shell
$ ronin extract --hash index.html
生成一个单词的随机拼写错误:```shell $ ronin typo microsoft microssoft
枚举一个单词的每个拼写错误变体:```shell
$ ronin typo --enum microsoft
microosoft
microsooft
microssoft
生成一个词的随机同形异义版本:```shell $ ronin homoglyph CEO CEO
枚举一个单词的每个同形词变体:```shell
$ ronin homoglyph --enum CEO
ϹEO
СEO
ⅭEO
CEO
CΕO
CЕO
CEO
CEΟ
CEО
CEO
语法高亮一个文件:```shell $ ronin highlight index.html
### 密码学
使用AES-256加密文件:```shell
$ ronin encrypt --cipher aes-256-cbc --password "..." file.txt > encrypted.bin
解密数据:```shell $ ronin decrypt --cipher aes-256-cbc --password "..." encrypted.bin
为文件生成 HMAC:```shell
$ ronin hmac --hash sha1 --password "too many secrets" data.txt
为字符串生成HMAC:```shell $ ronin hmac --hash sha1 --password "too many secrets" --string "..."
计算字符串的MD5校验和:```shell
$ ronin md5 --string "hello world"
5eb63bbbe01eeed093cb22bb8f5acdc3
计算文件的MD5校验和:```shell $ ronin md5 file.txt
计算文件中每一行的 MD5 校验和:```shell
$ ronin md5 --multiline file.txt
计算字符串的 SHA1 校验和:```shell $ ronin sha1 --string "hello world" 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
计算文件的SHA1校验和:```shell
$ ronin sha1 file.txt
计算文件中每一行的SHA1校验和:```shell $ ronin sha1 --multiline file.txt
计算字符串的SHA256校验和:```shell
$ ronin sha256 --string "hello world"
b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
计算文件的SHA256校验和:```shell $ ronin sha256 file.txt
计算文件中每一行的 SHA256 校验和:```shell
$ ronin sha256 --multiline file.txt
计算字符串的SHA512校验和:```shell $ ronin sha512 --string "hello world" 309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f
计算文件的SHA512校验和:```shell
$ ronin sha512 file.txt
计算文件中每一行的 SHA512 校验和:```shell $ ronin sha512 --multiline file.txt
ROT-13 对字符串进行编码:```shell
$ ronin rot --string "The quick brown fox jumps over the lazy dog"
Gur dhvpx oebja sbk whzcf bire gur ynml qbt
XOR 编码一个字符串:```shell $ ronin xor --key ABC --string "The quick brown fox jumps over the lazy dog" "\x15*&a36(!(a 1.5-a$,9b)4/32b,7'1a6+$b/ 8:a&,&"
### 网络
查询IP地址的ASN:```shell
$ ronin asn -I 4.2.2.1
4.0.0.0/9 AS3356 (US) LEVEL3
获取系统的外部/公网 IP 地址:```shell $ ronin ip --public
将IP地址转换为十进制格式:```shell
$ ronin ip --decimal 127.0.0.1
2130706433
将 IP 地址文件转换为 URL:```shell $ ronin ip --file targets.txt --http
枚举IP CIDR范围内的每个IP地址:```shell
$ ronin iprange 10.1.0.0/15
10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
10.0.0.5
10.0.0.6
10.0.0.7
10.0.0.8
10.0.0.9
...
枚举 IP glob 范围内的每个 IP 地址:```shell $ ronin iprange 10.1-3.0.* 10.1.0.1 10.1.0.2 10.1.0.3 10.1.0.4 10.1.0.5 10.1.0.6 10.1.0.7 10.1.0.8 10.1.0.9 10.1.0.10 ...
枚举两个IP地址之间的每一个IP地址:```shell
$ ronin iprange --start 10.0.0.1 --stop 10.0.3.33
10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
10.0.0.5
10.0.0.6
10.0.0.7
10.0.0.8
10.0.0.9
10.0.0.10
连接到远程TCP服务:```shell $ ronin netcat -v example.com 80
在本地TCP端口上监听:```shell
$ ronin netcat -v -l 1337
连接到远程SSL/TLS服务:```shell $ ronin netcat -v --ssl example.com 443
连接到远程 UDP 服务:```shell
$ ronin netcat -v -u example.com 1337
监听本地UDP端口:```shell $ ronin netcat -v -u -l 1337
打开一个UNIX套接字:```shell
$ ronin netcat -v --unix /path/to/unix.socket
对所有从套接字接收到的数据进行十六进制转储:```shell $ ronin netcat --hexdump example.com 80 GET / HTTP/1.1 Host: example.com User-Agent: Ruby
00000000 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| 00000010 0a 41 67 65 3a 20 32 35 30 38 30 36 0d 0a 43 61 |.Age: 250806..Ca| 00000020 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 |che-Control: max| 00000030 2d 61 67 65 3d 36 30 34 38 30 30 0d 0a 43 6f 6e |-age=604800..Con| 00000040 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f |tent-Type: text/| 00000050 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 |html; charset=UT| ...
#### DNS
查询 DNS 记录:```shell
$ ronin dns -t TXT github.com
查找某个主机名所有已注册的顶级域名(TLD):
$ ronin host --enum-tlds --registered github.com
github.ac
github.actor
github.ae
github.africa
github.agency
github.ai
...
```
查找主机名的所有已注册公共后缀:```shell
$ ronin host --enum-suffix --registered github.com
example.com.ag
example.ai
example.al
example.am
example.com.ar
example.at
example.co.at
example.or.at
example.com.au
example.be
example.com.bh
...
```
查找所有具有地址的子域名:```shell
$ ronin host --enum-subdomains subdomains.txt --has-addresses google.com
www.google.com
mail.google.com
smtp.google.com
ns1.google.com
ns2.google.com
m.google.com
ns.google.com
blog.google.com
admin.google.com
news.google.com
vpn.google.com
ns3.google.com
...
```
枚举一个域名的所有可能的打字错误变体:```shell
$ ronin typosquat microsoft.com
microosoft.com
microsooft.com
microssoft.com
```
查找有效域名的所有已注册的域名抢注变体:```shell
$ ronin typosquat --registered microsoft.com
```
查找一个有效域名的所有类似域名及其地址:```shell
$ ronin typosquat --has-addresses microsoft.com
```
查找有效域名的所有未注册的typosquat域名:```shell
$ ronin typosquat --unregistered microsoft.com
```
反混淆电子邮件地址:```shell
$ ronin email-addr --deobfuscate "john [dot] smith [at] example [dot] com"
[email protected]
```
枚举电子邮件地址的所有混淆形式:```shell
$ ronin email-addr --enum-obfuscations [email protected]
john.smith @ example.com
john.smith AT example.com
john.smith at example.com
john.smith[AT]example.com
john.smith[at]example.com
...
```
#### SSL/TLS 证书
转储有关 SSL/TLS 证书的信息:```shell
$ ronin cert-dump https://example.com/
```
从主机和端口下载SSL/TLS证书:```shell
$ ronin cert-grab github.com:443
```
生成一个新的 SSL/TLS 证书:```shell
$ ronin cert-gen -c test.com -O "Test Co" -U "Test Dept" \
-L "Test City" -S NY -C US
```
#### HTTP
执行 HTTP `GET` 请求(带有语法高亮):```shell
$ ronin http https://example.com/
```
发送带有额外头部的HTTP请求:```shell
$ ronin http --post --header "Authorization: ..." https://foo.bar/
```
使用已知的 `User-Agent` 字符串发送一个HTTP请求:```shell
$ ronin http --post --user-agent chrome-android https://foo.bar/
```
发送一个带有自定义 `User-Agent` 字符串的HTTP请求:```shell
$ ronin http --post --user-agent-string "..." https://foo.bar/
```
打开一个交互式HTTP shell:```shell
$ ronin http --shell https://example.com/
https://example.com/> help
help [COMMAND] Prints the list of commands or additional help
get PATH[?QUERY] [BODY] Performs a GET request
head PATH[?QUERY] Performs a HEAD request
patch PATH[?QUERY] [BODY] Performs a PATCH request
post PATH[?QUERY] [BODY] Performs a POST request
put PATH [BODY] Performs a PUT request
copy PATH DEST Performs a COPY request
delete PATH[?QUERY] Performs a DELETE request
lock PATH[?QUERY] Performs a LOCK request
options PATH[?QUERY] Performs a OPTIONS request
mkcol PATH[?QUERY] Performs a MKCOL request
move PATH[?QUERY] DEST Performs a MOVE request
propfind PATH[?QUERY] Performs a PROPFIND request
proppatch PATH[?QUERY] Performs a PROPPATCH request
trace PATH[?QUERY] Performs a TRACE request
unlock PATH[?QUERY] Performs a UNLOCK request
cd PATH Changes the base URL path
headers [{set | unset} NAME [VALUE]] Manages the request headers
```
打印文件中每个URL的HTTP状态:```shell
$ ronin url --file urls.txt --status
```
### 生成器
生成一个预加载了 [ronin-support] 的新 Ruby 脚本:```shell
$ ronin new script foo.rb
```
生成一个带有 `Gemfile` 的新 Ruby 项目:```shell
$ ronin new project foo
```
生成一个新的 [nokogiri] Ruby 脚本用于解析 HTML/XML:
[nokogiri]: https://nokogiri.org/%60%60%60shell
$ ronin new nokogiri foo.rb
```
生成一个新的 [ronin-web-server] Ruby 脚本:```shell
$ ronin new web-server my_server.rb
```
生成一个新的基于 [ronin-web-server] 的 Web 应用:```shell
$ ronin new web-app my_app
```
生成一个新的[ronin-web-spider] Ruby脚本:```shell
$ ronin new web-spider --host=example.com my_spider.rb
```
生成一个 [ronin-listener-dns] 脚本:```shell
$ ronin new dns-listener my_dns_listener.rb
```
生成一个 [ronin-dns-proxy] 脚本:```shell
$ ronin new dns-proxy my_dns_proxy.rb
```
生成一个 [ronin-listener-http] 脚本:```shell
$ ronin new http-listener my_http_listener.rb
```
生成一个 [ronin-exploits] 脚本:```shell
$ ronin new exploit my_exploit.rb
```
生成一个 [ronin-payloads] 脚本:```shell
$ ronin new payload my_payload.rb
```
### 归档
归档文件:```shell
$ ronin archive -o archive.zip file1.txt file2.txt
```
使用tar格式归档文件:```shell
$ ronin archive -o archive.tar file1.txt file2.txt
```
解压文件:```shell
$ ronin unarchive arch1.tar arch2.zip
```
使用显式格式解压缩文件:```shell
$ ronin unarchive -f zip arch2.jar
```
### 另请参阅
* [ronin-repos](https://github.com/ronin-rb/ronin-repos#synopsis)
* [ronin-wordlists](https://github.com/ronin-rb/ronin-wordlists#synopsis)
* [ronin-db](https://github.com/ronin-rb/ronin-db#synopsis)
* [ronin-web](https://github.com/ronin-rb/ronin-web#synopsis)
* [ronin-fuzzer](https://github.com/ronin-rb/ronin-fuzzer#synopsis)
* [ronin-payloads](https://github.com/ronin-rb/ronin-payloads#synopsis)
* [ronin-exploits](https://github.com/ronin-rb/ronin-exploits#synopsis)
* [ronin-vulns](https://github.com/ronin-rb/ronin-vulns#synopsis)
## 系统要求
* [gcc] / [clang]
* [make]
* [git]
* [libsqlite3]
* [Ruby] >= 3.2.0
* [open_namespace] ~> 0.4
* [rouge] ~> 3.0
* [io-endpoint] ~> 0.15
* [io-stream] ~> 0.8
* [wordlist] ~> 1.1
* [ronin-support] ~> 1.1
* [ronin-dns-proxy] ~> 0.1
* [ronin-core] ~> 0.2
* [ronin-repos] ~> 0.1
* [ronin-wordlists] ~> 0.1
* [ronin-db] ~> 0.1
* [ronin-listener] ~> 0.1
* [ronin-nmap] ~> 0.1
* [ronin-masscan] ~> 0.1
* [ronin-recon] ~> 0.1
* [ronin-fuzzer] ~> 0.1
* [ronin-web] ~> 2.0
* [ronin-code-asm] ~> 1.0
* [ronin-code-sql] ~> 2.0
* [ronin-payloads] ~> 0.1
* [ronin-exploits] ~> 1.0
* [ronin-vulns] ~> 0.2
* [ronin-app] ~> 0.1
## 安装
### Bash 脚本```shell
curl -o ronin-install.sh https://raw.githubusercontent.com/ronin-rb/scripts/main/ronin-install.sh && bash ronin-install.sh
```
### 手动安装
按照[手动安装说明][manual-instructions]中的步骤在你的平台上安装 Ronin 及其额外依赖项。
[manual-instructions]: https://ronin-rb.dev/install/#manual-instructions
### Docker
如果你更倾向于使用 [Docker],还可以选择 [Docker 镜像]:```shell
docker pull roninrb/ronin
docker run -it roninrb/ronin
```
此外,如果你想将你的主目录挂载到Docker镜像中:```shell
docker run --mount type=bind,source="$HOME",target=/home/ronin -it ronin
```
[Docker]: https://www.docker.com/
[Docker images]: https://hub.docker.com/r/roninrb/ronin
## 开发
1. [Fork 它!](https://github.com/ronin-rb/ronin/fork)
2. Clone 它!
3. `cd ronin`
4. `./scripts/setup`
5. `git checkout -b my_feature`
6. 编写代码!
7. `bundle exec rake spec`
8. `git push origin my_feature`
## 许可证
版权所有 (c) 2006-2026 Hal Brodigan (postmodern.mod3 at gmail.com)
Ronin 是自由软件:您可以重新分发和/或修改
它,遵循由自由软件基金会发布的 GNU 通用公共许可证,
许可证版本 3,或(根据您的选择)任何后续版本。
Ronin 的分发是希望它有用,
但没有任何保证;甚至没有隐含的适销性或特定用途的保证。
详情请参阅 GNU 通用公共许可证。
您应该已经收到一份 GNU 通用公共许可证的副本
随 Ronin 一起。如果没有,请访问 <https://www.gnu.org/licenses/>。
[website]: https://ronin-rb.dev/
[ronin-rb]: https://github.com/ronin-rb/
[gcc]: http://gcc.gnu.org/
[clang]: http://clang.llvm.org/
[git]: https://git-scm.com/
[make]: https://www.gnu.org/software/automake/
[libsqlite3]: https://www.sqlite.org/index.html
[Ruby]: https://www.ruby-lang.org
[open_namespace]: https://github.com/postmodern/open_namespace#readme
[rouge]: https://github.com/rouge-ruby/rouge#readme
[io-endpoint]: https://github.com/socketry/io-endpoint#readme
[io-stream]: https://github.com/socketry/io-stream#readme
[wordlist]: https://github.com/postmodern/wordlist.rb#readme
[ronin-support]: https://github.com/ronin-rb/ronin-support#readme
[ronin-dns-proxy]: https://github.com/ronin-rb/ronin-dns-proxy#readme
[ronin-repos]: https://github.com/ronin-rb/ronin-repos#readme
[ronin-repos-synopsis]: https://github.com/ronin-rb/ronin-repos#readme
[ronin-wordlists]: https://github.com/ronin-rb/ronin-wordlists#readme
[ronin-wordlists-synopsis]: https://github.com/ronin-rb/ronin-wordlists#readme
[ronin-core]: https://github.com/ronin-rb/ronin-core#readme
[ronin-db]: https://github.com/ronin-rb/ronin-db#readme
[ronin-db-synopsis]: https://github.com/ronin-rb/ronin-db#readme
[ronin-listener]: https://github.com/ronin-rb/ronin-listener#readme
[ronin-listener-dns]: https://github.com/ronin-rb/ronin-listener-dns#readme
[ronin-listener-http]: https://github.com/ronin-rb/ronin-listener-http#readme
[ronin-nmap]: https://github.com/ronin-rb/ronin-nmap#readme
[ronin-masscan]: https://github.com/ronin-rb/ronin-masscan#readme
[ronin-recon]: https://github.com/ronin-rb/ronin-recon#readme
[ronin-recon-synopsis]: https://github.com/ronin-rb/ronin-recon#readme
[ronin-fuzzer]: https://github.com/ronin-rb/ronin-fuzzer#readme
[ronin-web]: https://github.com/ronin-rb/ronin-web#readme
[ronin-web-server]: https://github.com/ronin-rb/ronin-web-server#readme
[ronin-web-spider]: https://github.com/ronin-rb/ronin-web-spider#readme
[ronin-web-user_agents]: https://github.com/ronin-rb/ronin-web-user_agents#readme
[ronin-code-asm]: https://github.com/ronin-rb/ronin-code-asm#readme
[ronin-code-sql]: https://github.com/ronin-rb/ronin-code-sql#readme
[ronin-payloads]: https://github.com/ronin-rb/ronin-payloads#readme
[ronin-exploits]: https://github.com/ronin-rb/ronin-exploits#readme
[ronin-exploits-synopsis]: https://github.com/ronin-rb/ronin-exploits#readme
[ronin-exploits-examples]: https://github.com/ronin-rb/ronin-exploits#readme
[ronin-vulns]: https://github.com/ronin-rb/ronin-vulns#readme
[ronin-vulns-synopsis]: https://github.com/ronin-rb/ronin-vulns#readme
[ronin-app]: https://github.com/ronin-rb/ronin-app#readme