💡 [REQUEST] - Generic environment variables in page yaml

[blaisebits]

Implementation PR

No response

Reference Issues

No response

Summary

In my current configuration, the CLI is running in docker, so when referencing the ${cwd} magic variable it references the path in the container. Examining the code it showed where this substitution takes place:

robopages-cli/src/book/mod.rs

Line 174 in 8803e70

Ok(text.replace("${cwd}", base_path.as_ref()))

It would be great if a secondary processing took place to check for environment variables and substitute those as well.

Basic Example

Using a modified version of the GoBuster page to use a specific wordlist from a directory on the host at ~/project/robopages/data

description: >
  Gobuster is a tool used for brute-force discovery of URIs (directories and files) in web sites, DNS subdomains (with wildcard support), Virtual Host names on target web servers, Open Amazon S3 buckets, Open Google Cloud buckets, TFTP servers

functions:
  gobuster_directory_brute_force:
    description: Perform a web server directory brute force to find hidden files and folders
    parameters:
      target:
        type: string
        description: The URL against which to perform brute force scan.
        examples:
          - http://www.example.com
          - https://supersight.totallyawesome.com

    container:
      force: true
      platform: linux/amd64
      image: ghcr.io/oj/gobuster:latest
      args:
        - --net=host
      volumes:
        - $WORKINGDIR/data:/data

    cmdline:
      - gobuster
      - dir
      - -t 
      - '20'
      - --no-color
      - --quiet
      - --no-progress
      - -w
      - /data/wordlists/web/quickhits.txt
      - -z
      - --no-color
      - -b
      - '404,403'
      - -u
      - ${target}

The ideal behavior would be when launching the server in docker to pass in the option -e WORKINGDIR=$PWD to pass the PWD as the WORKINGDIR environment variable to then be used when spinning up the GoBuster container to correctly reference the wordlist.

Drawbacks

I don't know Rust or I'd do it myself. Please don't hate me. We can still be friends.

Unresolved questions

No response

[GangGreenTemperTatum]

thanks for raising @blaisebits ! will take a look soon as i can here, i currently have robopages built from source and did a quick test, replacing:

      volumes:
        - $WORKINGDIR/data:/data

for:

     volumes:
        - ${cwd}:/data

.. inyour robopage seems to currently work as intended

robopages run --function gobuster_directory_brute_force
>> enter value for argument 'target': http://localhost:8080

[2025-05-27T19:22:34Z WARN ] executing: /usr/local/bin/docker run --rm -v/Users/ads/.robopages/robopages-main/cybersecurity/offensive/information-gathering:/data --net=host ghcr.io/oj/gobuster:latest dir -t 20 --no-color --quiet --no-progress -w /data/wordlists/web/quickhits.txt -z --no-color -b 404,403 -u http://localhost:8080
>> enter 'y' to proceed or any other key to cancel: y

lemme test a docker environment, to confirm are you using the latest build from ~25 days ago, not the prior? tyia!

[blaisebits]

Thanks for the check @GangGreenTemperTatum

I did also pull the latest container as the previous test was on an older version. I tested again with the robopages run through a wrapper to execute everything in docker:

#!/bin/bash
docker run -it --rm \
        -v/var/run/docker.sock:/var/run/docker.sock \
        -v$PWD/pages:/root/.robopages \
        -v$PWD/data:/data \
        --network=host \
        -e WORKINGDIR=$PWD \
        dreadnode/robopages "$@"

The command run showed the variable wasn't subbed in and returns an error about the volume name

$ ./robopages-cli.sh -V
robopages 0.4.0

$ ./robopages-cli.sh run --function gobuster_directory_brute_force
>> enter value for argument 'target': http://localhost:8080

[2025-06-01T02:27:21Z WARN ] executing: /usr/bin/docker run --rm -v$WORKINGDIR/data:/data --net=host ghcr.io/oj/gobuster:latest dir -t 20 --no-color --quiet --no-progress -w /data/wordlists/web/quickhits.txt -z --no-color -b 404,403 -u http://localhost:8080
>> enter 'y' to proceed or any other key to cancel: y

[2025-06-01T02:27:24Z WARN ] command failed with exit code: exit status: 125
[2025-06-01T02:27:24Z ERROR] command stderr (failure): docker: Error response from daemon: create $WORKINGDIR/data: "$WORKINGDIR/data" includes invalid characters for a local volume name, only "[a-zA-Z0-9][a-zA-Z0-9_.-]" are allowed. If you intended to pass a host directory, use absolute path