🛡️ Ruby Security Toolkit

Offensive Security Tools Collection — Educational Purpose

A progressive collection of 9 security tools built from scratch in Ruby, organized by difficulty level. Covers network reconnaissance, vulnerability assessment, web application security, and packet analysis.

Installation • Tools • Usage • Architecture • Disclaimer

---

⚠️ LEGAL DISCLAIMER: These tools are developed strictly for educational purposes and authorized security testing only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and may result in criminal prosecution. See DISCLAIMER.md for full details.

---

🎯 Project Overview

This toolkit demonstrates practical offensive security concepts through progressive complexity levels:

┌──────────────────────────────────────────────────────────────────────┐
│                    RUBY SECURITY TOOLKIT                             │
├──────────────┬───────────────────┬───────────────────────────────────┤
│  🟢 BASIC    │  🟡 INTERMEDIATE  │  🔴 ADVANCED                     │
├──────────────┼───────────────────┼───────────────────────────────────┤
│ Port Scanner │ DNS Enumerator    │ Vulnerability Scanner            │
│ Password     │ Web Crawler       │ ├─ SQL Injection Module          │
│  Auditor     │ SSH Brute Force   │ ├─ XSS Detection Module         │
│ HTTP Header  │  Tester           │ ├─ Directory Traversal Module   │
│  Analyzer    │                   │ ├─ Hidden File Discovery Module │
│              │                   │ ├─ HTTP Header Analysis Module  │
│              │                   │ └─ SSL/TLS Analysis Module      │
│              │                   │ Packet Sniffer                   │
│              │                   │ ├─ TCP/UDP/ICMP Analysis         │
│              │                   │ ├─ DNS Query Extraction          │
│              │                   │ ├─ HTTP Traffic Monitor          │
│              │                   │ └─ Sensitive Data Detection      │
└──────────────┴───────────────────┴───────────────────────────────────┘

🔧 Tools Overview

🟢 Basic Level

🚪 Port Scanner Multi-threaded TCP connect scanner with service detection. Thread pool (100 concurrent) Known service mapping (21+ ports) Configurable port range & timeout Real-time progress display

🔑 Password Auditor Hash cracking tool supporting multiple algorithms. MD5, SHA1, SHA224, SHA256, SHA384, SHA512 Auto hash-type detection by length Built-in wordlist + external file support Performance metrics (speed, time)

🌐 HTTP Header Analyzer Security header auditing with scoring system. 8 security headers checked (HSTS, CSP, etc.) Information leakage detection (Server, X-Powered-By) Visual security score (0-100%) Redirect chain following

🟡 Intermediate Level

🔍 DNS Enumerator Subdomain discovery through DNS brute-forcing. Multi-threaded scanning (configurable) A, MX, TXT record queries Zone Transfer (AXFR) testing Built-in wordlist (70+ subdomains)

🕷️ Web Crawler Intelligent web spider for security reconnaissance. BFS-based crawling engine Form & hidden field discovery HTML comment extraction Sensitive path detection Nokogiri-powered HTML parsing

🔓 SSH Brute Force Tester SSH authentication testing tool. Banner grabbing (version detection) Multi-user × multi-password matrix Rate limiting & timeout control External wordlist support Built-in legal consent prompt

🔴 Advanced Level

🛡️ Vulnerability Scanner Modular web application vulnerability scanner with 6 detection modules. Module Vulnerability Severity SQL Injection 18 payloads, error-based detection Critical XSS (Reflected) 17 payloads, reflection detection High Directory Traversal LFI with encoding bypass Critical Hidden File/Dir 40+ paths (admin, config, backup) Medium-Critical HTTP Headers Missing security headers + cookies Medium-High SSL/TLS Certificate expiry & validation Critical Features: Plugin architecture • GET/POST testing • JSON report export • Severity-based sorting • Progress tracking

📡 Packet Sniffer Low-level network traffic analyzer with raw binary packet parsing. Feature Detail Protocol Support TCP, UDP, ICMP, ARP Packet Parsing Raw binary (Ethernet → IP → Transport) HTTP Analysis Method extraction, host detection DNS Extraction Domain name decoding from queries Sensitive Data Password/token detection in cleartext Service Mapping 16+ known port-to-service mappings Features: pcaprub-based capture • BPF filtering • SYN/RST/FIN tracking • JSON logging • Real-time statistics

📦 Installation

Prerequisites

• Ruby 3.0+ (Download)
• Bundler (comes with Ruby)
• Npcap (Windows only, for Packet Sniffer — Download)

Setup

# 1. Clone the repository
git clone https://github.com/Bedirhan171/ruby-security-toolkit.git
cd ruby-security-toolkit

# 2. Install dependencies
gem install nokogiri    # Web Crawler & Vuln Scanner
gem install net-ssh     # SSH Brute Force Tester
gem install pcaprub     # Packet Sniffer

# Alternative: Install all at once
gem install nokogiri net-ssh pcaprub

Dependency Matrix

Tool	Standard Library Only	nokogiri	net-ssh	pcaprub
Port Scanner	✅	—	—	—
Password Auditor	✅	—	—	—
HTTP Header Analyzer	✅	—	—	—
DNS Enumerator	✅	—	—	—
Web Crawler	—	✅	—	—
SSH Brute Force	—	—	✅	—
Vulnerability Scanner	✅	—	—	—
Packet Sniffer	—	—	—	✅

💡 6 out of 8 tools work with Ruby's standard library alone — no external gems required!

🚀 Usage

Basic Tools

# Port Scanner — Interactive
ruby basic_project/port_scanner.rb

# Password Auditor — Interactive
ruby basic_project/password_auditor.rb

# HTTP Header Analyzer — Interactive
ruby basic_project/HTTP_Header_Analyzer.rb

Intermediate Tools

# DNS Enumerator — Interactive
ruby intermediate_project/Dns_enumerator.rb

# Web Crawler — Interactive
ruby intermediate_project/Web_crawler.rb

# SSH Brute Force Tester — Interactive (requires consent)
ruby intermediate_project/Ssh_bruteforce.rb

Advanced Tools

# Vulnerability Scanner — CLI
ruby advanced_project/vuln_scanner.rb <TARGET_URL> [param1,param2,...]

# Examples:
ruby advanced_project/vuln_scanner.rb http://localhost
ruby advanced_project/vuln_scanner.rb http://dvwa.local id,name,search

# Packet Sniffer — Requires admin/root privileges
sudo ruby advanced_project/packet_sniffer.rb [interface] [max_packets]

# Examples:
sudo ruby advanced_project/packet_sniffer.rb eth0 200
ruby advanced_project/packet_sniffer.rb              # Interactive mode

🧪 Lab Environment (Recommended)

# DVWA — Damn Vulnerable Web Application (for Vuln Scanner & Web Crawler)
docker run -d -p 80:80 vulnerables/web-dvwa

# Test the scanner
ruby advanced_project/vuln_scanner.rb http://localhost

# Test the crawler
ruby intermediate_project/Web_crawler.rb
# → Enter: http://localhost

🏗 Architecture

ruby-security-toolkit/
│
├── README.md                       # Project documentation (EN + TR)
├── DISCLAIMER.md                   # Legal & ethical usage policy
├── LICENSE                         # MIT License
├── .gitignore                      # Git ignore rules
│
├── basic_project/                  # 🟢 Beginner-level tools
│   ├── port_scanner.rb             # TCP connect scan (137 lines)
│   ├── password_auditor.rb         # Hash cracking (154 lines)
│   └── HTTP_Header_Analyzer.rb     # Security header audit (243 lines)
│
├── intermediate_project/           # 🟡 Intermediate-level tools
│   ├── Dns_enumerator.rb           # Subdomain brute-force (276 lines)
│   ├── Web_crawler.rb              # Web spider + form discovery (362 lines)
│   └── Ssh_bruteforce.rb           # SSH auth tester (289 lines)
│
└── advanced_project/               # 🔴 Advanced-level tools
    ├── vuln_scanner.rb             # Modular vuln scanner (781 lines)
    └── packet_sniffer.rb           # Raw packet analyzer (397 lines)

Design Patterns Used

Pattern	Where	Purpose
Module (Mixin)	Vuln Scanner	Each vulnerability type is an independent module
Struct	Vuln Scanner	Lightweight data objects for findings
Strategy	Vuln Scanner	Plugin architecture for scan modules
BFS (Queue)	Web Crawler	Breadth-first URL traversal
Observer	Packet Sniffer	Event-driven packet processing
Thread Pool	Port Scanner, DNS Enum	Concurrent operations with Mutex sync
Template Method	All tools	Consistent banner → scan → report flow

🛡️ Security Concepts Covered

OWASP Top 10	Tool	Technique
A03:2021 – Injection	Vulnerability Scanner	SQL Injection detection (error-based, UNION, boolean)
A07:2021 – XSS	Vulnerability Scanner	Reflected XSS with filter bypass payloads
A01:2021 – Broken Access	Web Crawler, Vuln Scanner	Hidden admin panels, sensitive file discovery
A05:2021 – Security Misconfiguration	HTTP Header Analyzer	Missing HSTS, CSP, X-Frame-Options
A02:2021 – Cryptographic Failures	Password Auditor, SSL Module	Weak hash cracking, certificate validation
A07:2021 – Auth Failures	SSH Brute Force	Weak credential testing

📊 Technical Metrics

Metric	Value
Total Lines of Code	2,500+
Number of Tools	8
Languages	Ruby
External Dependencies	3 gems (6/8 tools need zero)
OWASP Coverage	6 of Top 10 categories
Payload Database	75+ unique payloads
Supported Hash Types	6 (MD5 → SHA512)

---

🇹🇷 Türkçe

Proje Hakkında

Bu proje, Ruby dilinde sıfırdan yazılmış 9 siber güvenlik aracından oluşan eğitim amaçlı bir koleksiyondur. Araçlar, zorluk seviyesine göre 3 kategoride organize edilmiştir:

• 🟢 Temel: Port Tarayıcı, Şifre Denetleyici, HTTP Başlık Analizci
• 🟡 Orta: DNS Keşfedici, Web Tarayıcı, SSH Brute Force Test Aracı
• 🔴 İleri: Zafiyet Tarayıcısı (6 modül), Paket Dinleyici

Kurulum

git clone https://github.com/Bedirhan171/ruby-security-toolkit.git
cd ruby-security-toolkit
gem install nokogiri net-ssh pcaprub

Kullanım

# Temel araçlar (etkileşimli)
ruby basic_project/port_scanner.rb
ruby basic_project/password_auditor.rb
ruby basic_project/HTTP_Header_Analyzer.rb

# Orta seviye araçlar (etkileşimli)
ruby intermediate_project/Dns_enumerator.rb
ruby intermediate_project/Web_crawler.rb
ruby intermediate_project/Ssh_bruteforce.rb

# İleri seviye araçlar
ruby advanced_project/vuln_scanner.rb http://hedef-url
sudo ruby advanced_project/packet_sniffer.rb eth0 200

Lab Ortamı

# DVWA kurulumu (Docker)
docker run -d -p 80:80 vulnerables/web-dvwa

# Zafiyet tarayıcısını test edin
ruby advanced_project/vuln_scanner.rb http://localhost

⚠️ YASAL UYARI: Bu araçlar yalnızca eğitim amaçlıdır. İzinsiz sistemlerde kullanımı TCK 243-245 kapsamında suç teşkil eder. Detaylar için DISCLAIMER.md dosyasını okuyun.

---

📄 License

This project is licensed under the MIT License.

---

🛡️ Ruby Security Toolkit — Learn offensive security by building tools from scratch.

Made with Whtrue