Class List Method List File List

# Class: CheckerPlugin

Inherits:
  Plugin
  - Object
  - Plugin
  - CheckerPlugin
  show all
Defined in:
  lib/wpstools/plugins/checker/checker_plugin.rb

## Instance Attribute Summary

### Attributes inherited from Plugin

#author, #registered_options

## Instance Method Summary (collapse)

- - (Object) check_local_vulnerable_files(dir_to_scan)
- - (Object) check_vuln_ref_urls
- - (CheckerPlugin) initialize constructor

  A new instance of CheckerPlugin.

- - (Object) run(options = {})

### Methods inherited from Plugin

#register_options

## Constructor Details

### - (`CheckerPlugin`) initialize

A new instance of CheckerPlugin

    5
    6
    7
    8
    9
    10
    11
    12
    # File 'lib/wpstools/plugins/checker/checker_plugin.rb', line 5

    def initialize
      super(author: 'WPScanTeam - @erwanlr')

      register_options(
        ['--check-vuln-ref-urls', '--cvru', 'Check all the vulnerabilities reference urls for 404'],
        ['--check-local-vulnerable-files LOCAL_DIRECTORY', '--clvf', 'Perform a recursive scan in the LOCAL_DIRECTORY to find vulnerable files or shells']
      )
    end

## Instance Method Details

### - (`Object`) check_local_vulnerable_files(dir_to_scan)

    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    # File 'lib/wpstools/plugins/checker/checker_plugin.rb', line 75

    def check_local_vulnerable_files(dir_to_scan)
      if Dir::exist?(dir_to_scan)
        xml_file               = LOCAL_FILES_FILE
        local_hashes           = {}
        file_extension_to_scan = '*.{js,php,swf,html,htm}'

        print '[+] Generating local hashes ... '

        Dir[File::join(dir_to_scan, '**', file_extension_to_scan)].each do |filename|
          sha1sum = Digest::SHA1.file(filename).hexdigest

          if local_hashes.has_key?(sha1sum)
            local_hashes[sha1sum] << filename
          else
            local_hashes[sha1sum] = [filename]
          end
        end

        puts 'done.'

        puts '[+] Checking for vulnerable files ...'

        xml = xml(xml_file)

        xml.xpath('//hash').each do |node|
          sha1sum = node.attribute('sha1').text

          if local_hashes.has_key?(sha1sum)
            local_filenames = local_hashes[sha1sum]
            vuln_title      = node.search('title').text
            vuln_filename   = node.search('file').text
            vuln_refrence   = node.search('reference').text

            puts "  #{vuln_filename} found :"
            puts '  | Location(s):'
            local_filenames.each do |file|
              puts "  |  - #{file}"
            end
            puts '  |'
            puts "  | Title: #{vuln_title}"
            puts "  | Refrence: #{vuln_refrence}" if !vuln_refrence.empty?
            puts
          end
        end

        puts 'done.'

      else
        puts "The supplied directory '#{dir_to_scan}' does not exist"
      end
    end

### - (`Object`) check_vuln_ref_urls

    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    # File 'lib/wpstools/plugins/checker/checker_plugin.rb', line 24

    def check_vuln_ref_urls
      vuln_ref_files   = [PLUGINS_VULNS_FILE, THEMES_VULNS_FILE, WP_VULNS_FILE]
      error_codes      = [404, 500, 403]
      not_found_regexp = %r{No Results Found|error 404|ID Invalid or Not Found}i

      puts '[+] Checking vulnerabilities reference urls'

      vuln_ref_files.each do |vuln_ref_file|
        xml = xml(vuln_ref_file)

        urls = []
        xml.xpath('//reference').each { |node| urls << node.text }

        urls.uniq!

        dead_urls       = []
        queue_count     = 0
        request_count   = 0
        browser         = Browser.instance
        hydra           = browser.hydra
        number_of_urls  = urls.size

        urls.each do |url|
          request = browser.forge_request(url, { cache_ttl: 0, followlocation: true })
          request_count += 1

          request.on_complete do |response|
            print "\r  [+] Checking #{vuln_ref_file} #{number_of_urls} total ... #{(request_count * 100) / number_of_urls}% complete."

            if error_codes.include?(response.code) or not_found_regexp.match(response.body)
              dead_urls << url
            end
          end

          hydra.queue(request)
          queue_count += 1

          if queue_count == browser.max_threads
            hydra.run
            queue_count = 0
          end
        end

        hydra.run
        puts
        unless dead_urls.empty?
          dead_urls.each { |url| puts "    Not Found #{url}" }
        end
      end
    end

### - (`Object`) run(options = {})

    14
    15
    16
    17
    18
    19
    20
    21
    22
    # File 'lib/wpstools/plugins/checker/checker_plugin.rb', line 14

    def run(options = {})
      if options[:check_vuln_ref_urls]
        check_vuln_ref_urls
      end

      if options[:check_local_vulnerable_files]
        check_local_vulnerable_files(options[:check_local_vulnerable_files])
      end
    end