rdoc
This commit is contained in:
Christian Mehlmauer
@@ -67,6 +67,8 @@
|
||||
|
||||
<li><a href="#method-c-enumerate">::enumerate</a></li>
|
||||
|
||||
<li><a href="#method-c-generate_items">::generate_items</a></li>
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
@@ -146,6 +148,8 @@
|
||||
|
||||
<li><a href="./WpItem.html">WpItem</a></li>
|
||||
|
||||
<li><a href="./WpLoginProtection.html">WpLoginProtection</a></li>
|
||||
|
||||
<li><a href="./WpOptions.html">WpOptions</a></li>
|
||||
|
||||
<li><a href="./WpPlugin.html">WpPlugin</a></li>
|
||||
@@ -271,7 +275,7 @@
|
||||
<span class="ruby-keyword">end</span>
|
||||
<span class="ruby-identifier">url</span> = <span class="ruby-node">"#{target[:url]}#{target[:wp_content_dir]}/#{target[:path]}"</span>
|
||||
|
||||
<span class="ruby-identifier">request</span> = <span class="ruby-identifier">enum_browser</span>.<span class="ruby-identifier">forge_request</span>(<span class="ruby-identifier">url</span>, <span class="ruby-value">:cache_timeout</span> =<span class="ruby-operator">></span> <span class="ruby-value">0</span>, <span class="ruby-value">:follow_location</span> =<span class="ruby-operator">></span> <span class="ruby-keyword">true</span>)
|
||||
<span class="ruby-identifier">request</span> = <span class="ruby-identifier">enum_browser</span>.<span class="ruby-identifier">forge_request</span>(<span class="ruby-identifier">url</span>, { <span class="ruby-value">:cache_timeout</span> =<span class="ruby-operator">></span> <span class="ruby-value">0</span>, <span class="ruby-value">:follow_location</span> =<span class="ruby-operator">></span> <span class="ruby-keyword">true</span> })
|
||||
<span class="ruby-identifier">request_count</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
|
||||
|
||||
<span class="ruby-identifier">request</span>.<span class="ruby-identifier">on_complete</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">response</span><span class="ruby-operator">|</span>
|
||||
@@ -309,6 +313,88 @@
|
||||
|
||||
</div><!-- public-class-method-details -->
|
||||
|
||||
<div id="protected-class-method-details" class="method-section section">
|
||||
<h3 class="section-header">Protected Class Methods</h3>
|
||||
|
||||
|
||||
<div id="generate_items-method" class="method-detail ">
|
||||
<a name="method-c-generate_items"></a>
|
||||
|
||||
|
||||
<div class="method-heading">
|
||||
<span class="method-name">generate_items</span><span
|
||||
class="method-args">(options = {})</span>
|
||||
<span class="method-click-advice">click to toggle source</span>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="method-description">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="method-source-code" id="generate_items-source">
|
||||
<pre>
|
||||
<span class="ruby-comment"># File lib/wpscan/wp_enumerator.rb, line 88</span>
|
||||
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">generate_items</span>(<span class="ruby-identifier">options</span> = {})
|
||||
<span class="ruby-identifier">only_vulnerable</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:only_vulnerable_ones</span>]
|
||||
<span class="ruby-identifier">file</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:file</span>]
|
||||
<span class="ruby-identifier">vulns_file</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_file</span>]
|
||||
<span class="ruby-identifier">wp_content_dir</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:wp_content_dir</span>]
|
||||
<span class="ruby-identifier">url</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:url</span>]
|
||||
<span class="ruby-identifier">type</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:type</span>]
|
||||
<span class="ruby-identifier">targets_url</span> = []
|
||||
|
||||
<span class="ruby-keyword">if</span> <span class="ruby-identifier">only_vulnerable</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">false</span>
|
||||
<span class="ruby-comment"># Open and parse the 'most popular' plugin list...</span>
|
||||
<span class="ruby-constant">File</span>.<span class="ruby-identifier">open</span>(<span class="ruby-identifier">file</span>, <span class="ruby-string">'r'</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">f</span><span class="ruby-operator">|</span>
|
||||
<span class="ruby-identifier">f</span>.<span class="ruby-identifier">readlines</span>.<span class="ruby-identifier">collect</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">line</span><span class="ruby-operator">|</span>
|
||||
<span class="ruby-identifier">targets_url</span> <span class="ruby-operator"><<</span> {
|
||||
<span class="ruby-value">:url</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">url</span>,
|
||||
<span class="ruby-value">:path</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">line</span>.<span class="ruby-identifier">strip</span>,
|
||||
<span class="ruby-value">:wp_content_dir</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">wp_content_dir</span>,
|
||||
<span class="ruby-value">:name</span> =<span class="ruby-operator">></span> <span class="ruby-constant">File</span>.<span class="ruby-identifier">dirname</span>(<span class="ruby-identifier">line</span>.<span class="ruby-identifier">strip</span>)
|
||||
}
|
||||
<span class="ruby-keyword">end</span>
|
||||
<span class="ruby-keyword">end</span>
|
||||
<span class="ruby-keyword">end</span>
|
||||
|
||||
<span class="ruby-comment"># Timthumbs have no XML file</span>
|
||||
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">type</span> <span class="ruby-operator">=~</span> <span class="ruby-regexp">/timthumbs/</span>
|
||||
<span class="ruby-identifier">xml</span> = <span class="ruby-constant">Nokogiri</span><span class="ruby-operator">::</span><span class="ruby-constant">XML</span>(<span class="ruby-constant">File</span>.<span class="ruby-identifier">open</span>(<span class="ruby-identifier">vulns_file</span>)) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">config</span><span class="ruby-operator">|</span>
|
||||
<span class="ruby-identifier">config</span>.<span class="ruby-identifier">noblanks</span>
|
||||
<span class="ruby-keyword">end</span>
|
||||
|
||||
<span class="ruby-comment"># We check if the plugin name from the plugin_vulns_file is already in targets, otherwise we add it</span>
|
||||
<span class="ruby-identifier">xml</span>.<span class="ruby-identifier">xpath</span>(<span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xpath_2</span>]).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">node</span><span class="ruby-operator">|</span>
|
||||
<span class="ruby-identifier">name</span> = <span class="ruby-identifier">node</span>.<span class="ruby-identifier">attribute</span>(<span class="ruby-string">"name"</span>).<span class="ruby-identifier">text</span>
|
||||
<span class="ruby-identifier">targets_url</span> <span class="ruby-operator"><<</span> {
|
||||
<span class="ruby-value">:url</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">url</span>,
|
||||
<span class="ruby-value">:path</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">name</span>,
|
||||
<span class="ruby-value">:wp_content_dir</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">wp_content_dir</span>,
|
||||
<span class="ruby-value">:name</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">name</span>
|
||||
}
|
||||
<span class="ruby-keyword">end</span>
|
||||
<span class="ruby-keyword">end</span>
|
||||
|
||||
<span class="ruby-identifier">targets_url</span>.<span class="ruby-identifier">flatten!</span>
|
||||
<span class="ruby-identifier">targets_url</span>.<span class="ruby-identifier">uniq!</span>
|
||||
<span class="ruby-comment"># randomize the plugins array to *maybe* help in some crappy IDS/IPS/WAF detection</span>
|
||||
<span class="ruby-identifier">targets_url</span>.<span class="ruby-identifier">sort_by!</span> { <span class="ruby-identifier">rand</span> }
|
||||
<span class="ruby-keyword">end</span></pre>
|
||||
</div><!-- generate_items-source -->
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
</div><!-- generate_items-method -->
|
||||
|
||||
|
||||
</div><!-- protected-class-method-details -->
|
||||
|
||||
</div><!-- 5Buntitled-5D -->
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user