garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

they are nicknames

Browse Source 
rdoc
This commit is contained in:
Christian Mehlmauer
2012-09-20 22:53:37 +02:00
parent b05f735553
commit 133465c05e
18 changed files with 235 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/Array.html
View File

@@ -226,7 +226,7 @@
<div class="method-source-code" id="_grep_-source">
<pre>
<span class="ruby-comment"># File lib/common_helper.rb, line 57</span>
<span class="ruby-comment"># File lib/common_helper.rb, line 82</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">_grep_</span>(<span class="ruby-identifier">regexp</span>)
<span class="ruby-identifier">matches</span> = []
<span class="ruby-keyword">self</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">value</span><span class="ruby-operator">|</span>

7
doc/Malwares.html
View File

@@ -209,7 +209,7 @@
<div class="method-heading">
<span class="method-name">malware_pattern</span><span
class="method-args">(url)</span>
class="method-args">(url_regex)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
@@ -223,8 +223,9 @@
<div class="method-source-code" id="malware_pattern-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/modules/malwares.rb, line 56</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">malware_pattern</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-node">%{&lt;(?:script|iframe).* src=(?:&quot;|')(#{url}[^&quot;']*)(?:&quot;|')[^&gt;]*&gt;}</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">malware_pattern</span>(<span class="ruby-identifier">url_regex</span>)
<span class="ruby-comment"># no need to escape regex here, because malware.txt contains regex</span>
<span class="ruby-node">%{&lt;(?:script|iframe).* src=(?:&quot;|')(#{url_regex}[^&quot;']*)(?:&quot;|')[^&gt;]*&gt;}</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- malware_pattern-source -->

57
doc/Object.html
View File

@@ -77,6 +77,8 @@
<li><a href="#method-i-banner">#banner</a></li>
<li><a href="#method-i-get_equal_string_end">#get_equal_string_end</a></li>
<li><a href="#method-i-help">#help</a></li>
<li><a href="#method-i-require_files_from_directory">#require_files_from_directory</a></li>
@@ -368,7 +370,7 @@
<div class="method-source-code" id="banner-source">
<pre>
<span class="ruby-comment"># File lib/common_helper.rb, line 80</span>
<span class="ruby-comment"># File lib/common_helper.rb, line 105</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">banner</span>()
<span class="ruby-identifier">puts</span> <span class="ruby-string">'____________________________________________________'</span>
<span class="ruby-identifier">puts</span> <span class="ruby-string">&quot; __ _______ _____ &quot;</span>
@@ -397,6 +399,59 @@
</div><!-- banner-method -->
<div id="get_equal_string_end-method" class="method-detail ">
<a name="method-i-get_equal_string_end"></a>
<div class="method-heading">
<span class="method-name">get_equal_string_end</span><span
class="method-args">(stringarray = [""])</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<p>Gets the string all elements in stringarray ends with</p>
<div class="method-source-code" id="get_equal_string_end-source">
<pre>
<span class="ruby-comment"># File lib/common_helper.rb, line 55</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_equal_string_end</span>(<span class="ruby-identifier">stringarray</span> = [<span class="ruby-string">&quot;&quot;</span>])
<span class="ruby-identifier">already_found</span> = <span class="ruby-string">&quot;&quot;</span>
<span class="ruby-identifier">looping</span> = <span class="ruby-keyword">true</span>
<span class="ruby-identifier">counter</span> = <span class="ruby-value">-1</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">stringarray</span>.<span class="ruby-identifier">kind_of?</span> <span class="ruby-constant">Array</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">stringarray</span>.<span class="ruby-identifier">length</span> <span class="ruby-operator">&gt;</span> <span class="ruby-value">1</span>
<span class="ruby-identifier">base</span> = <span class="ruby-identifier">stringarray</span>[<span class="ruby-value">0</span>]
<span class="ruby-keyword">while</span> <span class="ruby-identifier">looping</span>
<span class="ruby-identifier">character</span> = <span class="ruby-identifier">base</span>[<span class="ruby-identifier">counter</span>, <span class="ruby-value">1</span>]
<span class="ruby-identifier">stringarray</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">s</span><span class="ruby-operator">|</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">s</span>[<span class="ruby-identifier">counter</span>, <span class="ruby-value">1</span>] <span class="ruby-operator">!=</span> <span class="ruby-identifier">character</span>
<span class="ruby-identifier">looping</span> = <span class="ruby-keyword">false</span>
<span class="ruby-keyword">break</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">looping</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">false</span> <span class="ruby-keyword">or</span> (<span class="ruby-identifier">counter</span> * <span class="ruby-value">-1</span> ) <span class="ruby-operator">&gt;=</span> <span class="ruby-identifier">base</span>.<span class="ruby-identifier">length</span>
<span class="ruby-keyword">break</span>
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">already_found</span> = <span class="ruby-node">&quot;#{character if character}#{already_found}&quot;</span>
<span class="ruby-identifier">counter</span> <span class="ruby-operator">-=</span> <span class="ruby-value">1</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">already_found</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- get_equal_string_end-source -->
</div>
</div><!-- get_equal_string_end-method -->
<div id="help-method" class="method-detail ">
<a name="method-i-help"></a>

2
doc/WpDetector.html
View File

@@ -292,7 +292,7 @@
<span class="ruby-identifier">regex2</span> = <span class="ruby-regexp">%{\\?/}</span>
<span class="ruby-identifier">regex3</span> = <span class="ruby-regexp">%{\\?/([^/\\&quot;']+)\\?(?:/|&quot;|')}</span>
<span class="ruby-comment"># Custom wp-content dir is now used in this regex</span>
<span class="ruby-identifier">names</span> = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">body</span>.<span class="ruby-identifier">scan</span>(<span class="ruby-node">/#{regex1}#{wp_content_dir}#{regex2}#{type}#{regex3}/</span>)
<span class="ruby-identifier">names</span> = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">body</span>.<span class="ruby-identifier">scan</span>(<span class="ruby-node">/#{regex1}#{Regexp.escape(wp_content_dir)}#{regex2}#{Regexp.escape(type)}#{regex3}/</span>)
<span class="ruby-identifier">names</span>.<span class="ruby-identifier">flatten!</span>
<span class="ruby-identifier">names</span>.<span class="ruby-identifier">uniq!</span>

16
doc/WpTarget.html
View File

@@ -414,7 +414,7 @@
<div class="method-source-code" id="debug_log_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 116</span>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 118</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">debug_log_url</span>
<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-node">&quot;#{wp_content_dir()}/debug.log&quot;</span>).<span class="ruby-identifier">to_s</span>
<span class="ruby-keyword">end</span></pre>
@@ -488,7 +488,7 @@
<div class="method-source-code" id="has_debug_log-3F-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 110</span>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 112</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">has_debug_log?</span>
<span class="ruby-comment"># We only get the first 700 bytes of the file to avoid loading huge file (like 2Go)</span>
<span class="ruby-identifier">response_body</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">debug_log_url</span>(), <span class="ruby-value">:headers</span> =<span class="ruby-operator">&gt;</span> { <span class="ruby-string">&quot;range&quot;</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-string">&quot;bytes=0-700&quot;</span>}).<span class="ruby-identifier">body</span>
@@ -564,7 +564,7 @@
<div class="method-source-code" id="registration_enabled-3F-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 121</span>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 123</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">registration_enabled?</span>
<span class="ruby-comment"># TODO</span>
<span class="ruby-keyword">end</span></pre>
@@ -597,7 +597,7 @@
<div class="method-source-code" id="registration_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 125</span>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 127</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">registration_url</span>
<span class="ruby-comment"># TODO</span>
<span class="ruby-keyword">end</span></pre>
@@ -733,11 +733,13 @@
<span class="ruby-keyword">def</span> <span class="ruby-identifier">wp_content_dir</span>
<span class="ruby-keyword">unless</span> <span class="ruby-ivar">@wp_content_dir</span>
<span class="ruby-identifier">index_body</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">body</span>
<span class="ruby-comment"># Only use the path because domain can be text or an ip</span>
<span class="ruby-identifier">uri_path</span> = <span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">path</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">index_body</span>[<span class="ruby-regexp">%{/wp-content/(?:themes|plugins)/}</span>]
<span class="ruby-keyword">if</span> <span class="ruby-identifier">index_body</span>[<span class="ruby-node">/#{Regexp.escape(uri_path)}\/wp-content\/(?:themes|plugins)\//</span>]
<span class="ruby-ivar">@wp_content_dir</span> = <span class="ruby-string">&quot;wp-content&quot;</span>
<span class="ruby-keyword">else</span>
<span class="ruby-ivar">@wp_content_dir</span> = <span class="ruby-identifier">index_body</span>[<span class="ruby-node">%{(?:href|src)=(?:&quot;|')#{@uri}/?([^&quot;']+)/(?:themes|plugins)/.*(?:&quot;|')}</span>, <span class="ruby-value">1</span>]
<span class="ruby-ivar">@wp_content_dir</span> = <span class="ruby-identifier">index_body</span>[<span class="ruby-node">/(?:href|src)\s*=\s*(?:&quot;|').+#{Regexp.escape(uri_path)}([^&quot;']+)\/(?:themes|plugins)\/.*(?:&quot;|')/</span>, <span class="ruby-value">1</span>]
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-ivar">@wp_content_dir</span>
@@ -771,7 +773,7 @@
<div class="method-source-code" id="wp_plugins_dir-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 103</span>
<span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 105</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">wp_plugins_dir</span>
<span class="ruby-keyword">unless</span> <span class="ruby-ivar">@wp_plugins_dir</span>
<span class="ruby-ivar">@wp_plugins_dir</span> = <span class="ruby-identifier">wp_content_dir</span>() <span class="ruby-operator">+</span> <span class="ruby-string">&quot;/plugins&quot;</span>

125
doc/WpUsernames.html
View File

@@ -59,11 +59,13 @@
<li><a href="#method-i-author_url">#author_url</a></li>
<li><a href="#method-i-extract_real_name_from_body">#extract_real_name_from_body</a></li>
<li><a href="#method-i-extract_nickname_from_body">#extract_nickname_from_body</a></li>
<li><a href="#method-i-get_real_name_from_response">#get_real_name_from_response</a></li>
<li><a href="#method-i-get_nickname_from_response">#get_nickname_from_response</a></li>
<li><a href="#method-i-get_real_name_from_url">#get_real_name_from_url</a></li>
<li><a href="#method-i-get_nickname_from_url">#get_nickname_from_url</a></li>
<li><a href="#method-i-remove_junk_from_nickname">#remove_junk_from_nickname</a></li>
<li><a href="#method-i-usernames">#usernames</a></li>
@@ -224,7 +226,7 @@
<div class="method-source-code" id="author_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 82</span>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 98</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">author_url</span>(<span class="ruby-identifier">author_id</span>)
<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-node">&quot;?author=#{author_id}&quot;</span>).<span class="ruby-identifier">to_s</span>
<span class="ruby-keyword">end</span></pre>
@@ -238,12 +240,12 @@
</div><!-- author_url-method -->
<div id="extract_real_name_from_body-method" class="method-detail ">
<a name="method-i-extract_real_name_from_body"></a>
<div id="extract_nickname_from_body-method" class="method-detail ">
<a name="method-i-extract_nickname_from_body"></a>
<div class="method-heading">
<span class="method-name">extract_real_name_from_body</span><span
<span class="method-name">extract_nickname_from_body</span><span
class="method-args">(body)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
@@ -255,28 +257,28 @@
<div class="method-source-code" id="extract_real_name_from_body-source">
<div class="method-source-code" id="extract_nickname_from_body-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 78</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">extract_real_name_from_body</span>(<span class="ruby-identifier">body</span>)
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 79</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">extract_nickname_from_body</span>(<span class="ruby-identifier">body</span>)
<span class="ruby-identifier">body</span>[<span class="ruby-regexp">%{&lt;title&gt;([^&lt;]*)&lt;/title&gt;}</span>, <span class="ruby-value">1</span>]
<span class="ruby-keyword">end</span></pre>
</div><!-- extract_real_name_from_body-source -->
</div><!-- extract_nickname_from_body-source -->
</div>
</div><!-- extract_real_name_from_body-method -->
</div><!-- extract_nickname_from_body-method -->
<div id="get_real_name_from_response-method" class="method-detail ">
<a name="method-i-get_real_name_from_response"></a>
<div id="get_nickname_from_response-method" class="method-detail ">
<a name="method-i-get_nickname_from_response"></a>
<div class="method-heading">
<span class="method-name">get_real_name_from_response</span><span
<span class="method-name">get_nickname_from_response</span><span
class="method-args">(resp)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
@@ -288,32 +290,32 @@
<div class="method-source-code" id="get_real_name_from_response-source">
<div class="method-source-code" id="get_nickname_from_response-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 70</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_real_name_from_response</span>(<span class="ruby-identifier">resp</span>)
<span class="ruby-identifier">real_name</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 71</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_nickname_from_response</span>(<span class="ruby-identifier">resp</span>)
<span class="ruby-identifier">nickname</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">resp</span>.<span class="ruby-identifier">code</span> <span class="ruby-operator">==</span> <span class="ruby-value">200</span>
<span class="ruby-identifier">real_name</span> = <span class="ruby-identifier">extract_real_name_from_body</span>(<span class="ruby-identifier">resp</span>.<span class="ruby-identifier">body</span>)
<span class="ruby-identifier">nickname</span> = <span class="ruby-identifier">extract_nickname_from_body</span>(<span class="ruby-identifier">resp</span>.<span class="ruby-identifier">body</span>)
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">real_name</span>
<span class="ruby-identifier">nickname</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- get_real_name_from_response-source -->
</div><!-- get_nickname_from_response-source -->
</div>
</div><!-- get_real_name_from_response-method -->
</div><!-- get_nickname_from_response-method -->
<div id="get_real_name_from_url-method" class="method-detail ">
<a name="method-i-get_real_name_from_url"></a>
<div id="get_nickname_from_url-method" class="method-detail ">
<a name="method-i-get_nickname_from_url"></a>
<div class="method-heading">
<span class="method-name">get_real_name_from_url</span><span
<span class="method-name">get_nickname_from_url</span><span
class="method-args">(url)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
@@ -325,25 +327,69 @@
<div class="method-source-code" id="get_real_name_from_url-source">
<div class="method-source-code" id="get_nickname_from_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 61</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_real_name_from_url</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 62</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_nickname_from_url</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-identifier">resp</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">url</span>, { <span class="ruby-value">:follow_location</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-keyword">true</span>, <span class="ruby-value">:max_redirects</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">2</span> })
<span class="ruby-identifier">real_name</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">nickname</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">resp</span>.<span class="ruby-identifier">code</span> <span class="ruby-operator">==</span> <span class="ruby-value">200</span>
<span class="ruby-identifier">real_name</span> = <span class="ruby-identifier">extract_real_name_from_body</span>(<span class="ruby-identifier">resp</span>.<span class="ruby-identifier">body</span>)
<span class="ruby-identifier">nickname</span> = <span class="ruby-identifier">extract_nickname_from_body</span>(<span class="ruby-identifier">resp</span>.<span class="ruby-identifier">body</span>)
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">real_name</span>
<span class="ruby-identifier">nickname</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- get_real_name_from_url-source -->
</div><!-- get_nickname_from_url-source -->
</div>
</div><!-- get_real_name_from_url-method -->
</div><!-- get_nickname_from_url-method -->
<div id="remove_junk_from_nickname-method" class="method-detail ">
<a name="method-i-remove_junk_from_nickname"></a>
<div class="method-heading">
<span class="method-name">remove_junk_from_nickname</span><span
class="method-args">(usernames)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<div class="method-source-code" id="remove_junk_from_nickname-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/modules/wp_usernames.rb, line 83</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">remove_junk_from_nickname</span>(<span class="ruby-identifier">usernames</span>)
<span class="ruby-identifier">nicknames</span> = []
<span class="ruby-identifier">usernames</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">u</span><span class="ruby-operator">|</span>
<span class="ruby-identifier">nickname</span> = <span class="ruby-identifier">u</span>[<span class="ruby-value">:nickname</span>]
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">nickname</span> <span class="ruby-operator">==</span> <span class="ruby-string">&quot;empty&quot;</span>
<span class="ruby-identifier">nicknames</span> <span class="ruby-operator">&lt;&lt;</span> <span class="ruby-identifier">nickname</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">junk</span> = <span class="ruby-identifier">get_equal_string_end</span>(<span class="ruby-identifier">nicknames</span>)
<span class="ruby-identifier">usernames</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">u</span><span class="ruby-operator">|</span>
<span class="ruby-identifier">u</span>[<span class="ruby-value">:nickname</span>] = <span class="ruby-identifier">u</span>[<span class="ruby-value">:nickname</span>].<span class="ruby-identifier">sub</span>(<span class="ruby-node">/#{Regexp.escape(junk)}$/</span>, <span class="ruby-string">&quot;&quot;</span>)
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">usernames</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- remove_junk_from_nickname-source -->
</div>
</div><!-- remove_junk_from_nickname-method -->
<div id="usernames-method" class="method-detail ">
@@ -383,22 +429,23 @@ href="http://seclists.org/fulldisclosure/2011/May/493">seclists.org/fulldisclosu
<span class="ruby-identifier">response</span> = <span class="ruby-identifier">browser</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-identifier">username</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">real_name</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">nickname</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">response</span>.<span class="ruby-identifier">code</span> <span class="ruby-operator">==</span> <span class="ruby-value">301</span> <span class="ruby-comment"># username in location?</span>
<span class="ruby-identifier">username</span> = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">headers_hash</span>[<span class="ruby-string">'location'</span>][<span class="ruby-regexp">%{/author/([^/]+)/}</span>, <span class="ruby-value">1</span>]
<span class="ruby-comment"># Get the real name from the redirect site</span>
<span class="ruby-identifier">real_name</span> = <span class="ruby-identifier">get_real_name_from_url</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-identifier">nickname</span> = <span class="ruby-identifier">get_nickname_from_url</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-keyword">elsif</span> <span class="ruby-identifier">response</span>.<span class="ruby-identifier">code</span> <span class="ruby-operator">==</span> <span class="ruby-value">200</span> <span class="ruby-comment"># username in body?</span>
<span class="ruby-identifier">username</span> = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">body</span>[<span class="ruby-regexp">%{posts by (.*) feed}</span>, <span class="ruby-value">1</span>]
<span class="ruby-identifier">real_name</span> = <span class="ruby-identifier">get_real_name_from_response</span>(<span class="ruby-identifier">response</span>)
<span class="ruby-identifier">nickname</span> = <span class="ruby-identifier">get_nickname_from_response</span>(<span class="ruby-identifier">response</span>)
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">username</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">real_name</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">username</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">nickname</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">usernames</span> <span class="ruby-operator">&lt;&lt;</span> { <span class="ruby-value">:id</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-identifier">author_id</span>,
<span class="ruby-value">:name</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-identifier">username</span> <span class="ruby-operator">?</span> <span class="ruby-identifier">username</span> <span class="ruby-operator">:</span> <span class="ruby-string">&quot;empty&quot;</span>,
<span class="ruby-value">:real_name</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-identifier">real_name</span> <span class="ruby-operator">?</span> <span class="ruby-identifier">real_name</span> <span class="ruby-operator">:</span> <span class="ruby-string">&quot;empty&quot;</span>}
<span class="ruby-value">:nickname</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-identifier">nickname</span> <span class="ruby-operator">?</span> <span class="ruby-identifier">nickname</span> <span class="ruby-operator">:</span> <span class="ruby-string">&quot;empty&quot;</span>}
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-identifier">usernames</span> = <span class="ruby-identifier">remove_junk_from_nickname</span>(<span class="ruby-identifier">usernames</span>)
<span class="ruby-comment"># clean the array, remove nils and possible duplicates</span>
<span class="ruby-identifier">usernames</span>.<span class="ruby-identifier">flatten!</span>

16
doc/created.rid
View File

@@ -1,16 +1,16 @@
Wed, 19 Sep 2012 22:43:09 +0200
Thu, 20 Sep 2012 22:51:52 +0200
./CREDITS Mon, 17 Sep 2012 20:18:24 +0200
./lib/browser.rb Sun, 16 Sep 2012 15:18:58 +0200
./lib/cache_file_store.rb Sat, 15 Sep 2012 08:04:03 +0200
./lib/common_helper.rb Tue, 18 Sep 2012 20:09:48 +0200
./lib/environment.rb Sat, 15 Sep 2012 08:04:16 +0200
./lib/common_helper.rb Thu, 20 Sep 2012 22:01:50 +0200
./lib/environment.rb Thu, 20 Sep 2012 22:12:57 +0200
./lib/updater/git_updater.rb Sat, 15 Sep 2012 08:00:23 +0200
./lib/updater/svn_updater.rb Sat, 15 Sep 2012 08:00:34 +0200
./lib/updater/updater.rb Sat, 15 Sep 2012 08:00:40 +0200
./lib/updater/updater_factory.rb Sat, 15 Sep 2012 08:00:46 +0200
./lib/wpscan/exploit.rb Sat, 15 Sep 2012 08:02:16 +0200
./lib/wpscan/modules/brute_force.rb Wed, 19 Sep 2012 21:41:41 +0200
./lib/wpscan/modules/malwares.rb Sat, 15 Sep 2012 08:01:01 +0200
./lib/wpscan/modules/malwares.rb Thu, 20 Sep 2012 22:23:58 +0200
./lib/wpscan/modules/web_site.rb Wed, 19 Sep 2012 21:33:46 +0200
./lib/wpscan/modules/wp_config_backup.rb Sat, 15 Sep 2012 08:01:11 +0200
./lib/wpscan/modules/wp_full_path_disclosure.rb Sat, 15 Sep 2012 08:01:17 +0200
@@ -19,15 +19,15 @@ Wed, 19 Sep 2012 22:43:09 +0200
./lib/wpscan/modules/wp_readme.rb Sat, 15 Sep 2012 08:01:52 +0200
./lib/wpscan/modules/wp_themes.rb Tue, 18 Sep 2012 22:28:05 +0200
./lib/wpscan/modules/wp_timthumbs.rb Wed, 19 Sep 2012 15:03:22 +0200
./lib/wpscan/modules/wp_usernames.rb Wed, 19 Sep 2012 22:09:14 +0200
./lib/wpscan/modules/wp_usernames.rb Thu, 20 Sep 2012 22:51:18 +0200
./lib/wpscan/msfrpc_client.rb Sat, 15 Sep 2012 08:02:28 +0200
./lib/wpscan/vulnerable.rb Wed, 19 Sep 2012 22:21:47 +0200
./lib/wpscan/wp_detector.rb Wed, 19 Sep 2012 22:29:50 +0200
./lib/wpscan/wp_detector.rb Thu, 20 Sep 2012 22:14:29 +0200
./lib/wpscan/wp_enumerator.rb Wed, 19 Sep 2012 22:30:45 +0200
./lib/wpscan/wp_item.rb Wed, 19 Sep 2012 22:21:19 +0200
./lib/wpscan/wp_options.rb Tue, 18 Sep 2012 22:28:27 +0200
./lib/wpscan/wp_plugin.rb Wed, 19 Sep 2012 22:20:29 +0200
./lib/wpscan/wp_target.rb Wed, 19 Sep 2012 17:40:16 +0200
./lib/wpscan/wp_target.rb Thu, 20 Sep 2012 22:16:44 +0200
./lib/wpscan/wp_theme.rb Wed, 19 Sep 2012 22:20:40 +0200
./lib/wpscan/wp_version.rb Wed, 19 Sep 2012 21:33:07 +0200
./lib/wpscan/wp_vulnerability.rb Sat, 15 Sep 2012 08:03:09 +0200
@@ -37,5 +37,5 @@ Wed, 19 Sep 2012 22:43:09 +0200
./lib/wpstools/parse_svn.rb Sat, 15 Sep 2012 23:36:25 +0200
./lib/wpstools/wpstools_helper.rb Sat, 15 Sep 2012 08:03:49 +0200
./README Thu, 13 Sep 2012 22:54:08 +0200
./wpscan.rb Wed, 19 Sep 2012 22:06:17 +0200
./wpscan.rb Thu, 20 Sep 2012 22:49:19 +0200
./wpstools.rb Sat, 15 Sep 2012 08:06:35 +0200

64
doc/index.html
View File

@@ -173,20 +173,20 @@
<li><a href="RpcClient.html#method-c-new">::new &mdash; RpcClient</a></li>
<li><a href="Updater.html#method-c-new">::new &mdash; Updater</a></li>
<li><a href="Svn_Parser.html#method-c-new">::new &mdash; Svn_Parser</a></li>
<li><a href="WpTheme.html#method-c-new">::new &mdash; WpTheme</a></li>
<li><a href="WpTarget.html#method-c-new">::new &mdash; WpTarget</a></li>
<li><a href="WpPlugin.html#method-c-new">::new &mdash; WpPlugin</a></li>
<li><a href="Generate_List.html#method-c-new">::new &mdash; Generate_List</a></li>
<li><a href="WpTheme.html#method-c-new">::new &mdash; WpTheme</a></li>
<li><a href="Exploit.html#method-c-new">::new &mdash; Exploit</a></li>
<li><a href="WpPlugin.html#method-c-new">::new &mdash; WpPlugin</a></li>
<li><a href="WpTarget.html#method-c-new">::new &mdash; WpTarget</a></li>
<li><a href="Updater.html#method-c-new">::new &mdash; Updater</a></li>
<li><a href="WpscanOptions.html#method-c-option_to_instance_variable_setter">::option_to_instance_variable_setter &mdash; WpscanOptions</a></li>
<li><a href="WpDetector.html#method-c-passive_detection">::passive_detection &mdash; WpDetector</a></li>
@@ -259,7 +259,7 @@
<li><a href="WpItem.html#method-i-extract_name_from_url">#extract_name_from_url &mdash; WpItem</a></li>
<li><a href="WpUsernames.html#method-i-extract_real_name_from_body">#extract_real_name_from_body &mdash; WpUsernames</a></li>
<li><a href="WpUsernames.html#method-i-extract_nickname_from_body">#extract_nickname_from_body &mdash; WpUsernames</a></li>
<li><a href="Browser.html#method-i-forge_request">#forge_request &mdash; Browser</a></li>
@@ -273,18 +273,20 @@
<li><a href="CacheFileStore.html#method-i-get_entry_file_path">#get_entry_file_path &mdash; CacheFileStore</a></li>
<li><a href="Object.html#method-i-get_equal_string_end">#get_equal_string_end &mdash; Object</a></li>
<li><a href="RpcClient.html#method-i-get_exploit_info">#get_exploit_info &mdash; RpcClient</a></li>
<li><a href="WpUsernames.html#method-i-get_nickname_from_response">#get_nickname_from_response &mdash; WpUsernames</a></li>
<li><a href="WpUsernames.html#method-i-get_nickname_from_url">#get_nickname_from_url &mdash; WpUsernames</a></li>
<li><a href="RpcClient.html#method-i-get_options">#get_options &mdash; RpcClient</a></li>
<li><a href="RpcClient.html#method-i-get_payloads">#get_payloads &mdash; RpcClient</a></li>
<li><a href="Generate_List.html#method-i-get_popular_items">#get_popular_items &mdash; Generate_List</a></li>
<li><a href="WpUsernames.html#method-i-get_real_name_from_response">#get_real_name_from_response &mdash; WpUsernames</a></li>
<li><a href="WpUsernames.html#method-i-get_real_name_from_url">#get_real_name_from_url &mdash; WpUsernames</a></li>
<li><a href="WpItem.html#method-i-get_url">#get_url &mdash; WpItem</a></li>
<li><a href="WpItem.html#method-i-get_url_without_filename">#get_url_without_filename &mdash; WpItem</a></li>
@@ -315,10 +317,10 @@
<li><a href="WpscanOptions.html#method-i-has_options-3F">#has_options? &mdash; WpscanOptions</a></li>
<li><a href="WpItem.html#method-i-has_readme-3F">#has_readme? &mdash; WpItem</a></li>
<li><a href="WpReadme.html#method-i-has_readme-3F">#has_readme? &mdash; WpReadme</a></li>
<li><a href="WpItem.html#method-i-has_readme-3F">#has_readme? &mdash; WpItem</a></li>
<li><a href="WpLoginProtection.html#method-i-has_simple_login_lockdown_protection-3F">#has_simple_login_lockdown_protection? &mdash; WpLoginProtection</a></li>
<li><a href="WpTimthumbs.html#method-i-has_timthumbs-3F">#has_timthumbs? &mdash; WpTimthumbs</a></li>
@@ -327,10 +329,10 @@
<li><a href="SvnUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; SvnUpdater</a></li>
<li><a href="GitUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; GitUpdater</a></li>
<li><a href="Updater.html#method-i-is_installed-3F">#is_installed? &mdash; Updater</a></li>
<li><a href="GitUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; GitUpdater</a></li>
<li><a href="WebSite.html#method-i-is_online-3F">#is_online? &mdash; WebSite</a></li>
<li><a href="WebSite.html#method-i-is_wordpress-3F">#is_wordpress? &mdash; WebSite</a></li>
@@ -349,12 +351,12 @@
<li><a href="Browser.html#method-i-load_config">#load_config &mdash; Browser</a></li>
<li><a href="GitUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; GitUpdater</a></li>
<li><a href="SvnUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; SvnUpdater</a></li>
<li><a href="Updater.html#method-i-local_revision_number">#local_revision_number &mdash; Updater</a></li>
<li><a href="GitUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; GitUpdater</a></li>
<li><a href="RpcClient.html#method-i-login">#login &mdash; RpcClient</a></li>
<li><a href="WpLoginProtection.html#method-i-login_protection_plugin">#login_protection_plugin &mdash; WpLoginProtection</a></li>
@@ -373,10 +375,10 @@
<li><a href="RpcClient.html#method-i-meterpreter_read">#meterpreter_read &mdash; RpcClient</a></li>
<li><a href="Exploit.html#method-i-meterpreter_write">#meterpreter_write &mdash; Exploit</a></li>
<li><a href="RpcClient.html#method-i-meterpreter_write">#meterpreter_write &mdash; RpcClient</a></li>
<li><a href="Exploit.html#method-i-meterpreter_write">#meterpreter_write &mdash; Exploit</a></li>
<li><a href="Svn_Parser.html#method-i-parse">#parse &mdash; Svn_Parser</a></li>
<li><a href="WpPlugins.html#method-i-plugins_from_aggressive_detection">#plugins_from_aggressive_detection &mdash; WpPlugins</a></li>
@@ -391,20 +393,22 @@
<li><a href="CacheFileStore.html#method-i-read_entry">#read_entry &mdash; CacheFileStore</a></li>
<li><a href="Exploit.html#method-i-read_shell">#read_shell &mdash; Exploit</a></li>
<li><a href="RpcClient.html#method-i-read_shell">#read_shell &mdash; RpcClient</a></li>
<li><a href="WpReadme.html#method-i-readme_url">#readme_url &mdash; WpReadme</a></li>
<li><a href="Exploit.html#method-i-read_shell">#read_shell &mdash; Exploit</a></li>
<li><a href="WpItem.html#method-i-readme_url">#readme_url &mdash; WpItem</a></li>
<li><a href="WpReadme.html#method-i-readme_url">#readme_url &mdash; WpReadme</a></li>
<li><a href="WebSite.html#method-i-redirection">#redirection &mdash; WebSite</a></li>
<li><a href="WpTarget.html#method-i-registration_enabled-3F">#registration_enabled? &mdash; WpTarget</a></li>
<li><a href="WpTarget.html#method-i-registration_url">#registration_url &mdash; WpTarget</a></li>
<li><a href="WpUsernames.html#method-i-remove_junk_from_nickname">#remove_junk_from_nickname &mdash; WpUsernames</a></li>
<li><a href="GitUpdater.html#method-i-repo_directory_arguments">#repo_directory_arguments &mdash; GitUpdater</a></li>
<li><a href="Object.html#method-i-require_files_from_directory">#require_files_from_directory &mdash; Object</a></li>
@@ -413,10 +417,10 @@
<li><a href="Exploit.html#method-i-session_count">#session_count &mdash; Exploit</a></li>
<li><a href="Exploit.html#method-i-sessions">#sessions &mdash; Exploit</a></li>
<li><a href="RpcClient.html#method-i-sessions">#sessions &mdash; RpcClient</a></li>
<li><a href="Exploit.html#method-i-sessions">#sessions &mdash; Exploit</a></li>
<li><a href="WpscanOptions.html#method-i-set_option_from_cli">#set_option_from_cli &mdash; WpscanOptions</a></li>
<li><a href="WpLoginProtection.html#method-i-simple_login_lockdown_url">#simple_login_lockdown_url &mdash; WpLoginProtection</a></li>
@@ -439,11 +443,11 @@
<li><a href="WpItem.html#method-i-to_s">#to_s &mdash; WpItem</a></li>
<li><a href="Updater.html#method-i-update">#update &mdash; Updater</a></li>
<li><a href="GitUpdater.html#method-i-update">#update &mdash; GitUpdater</a></li>
<li><a href="SvnUpdater.html#method-i-update">#update &mdash; SvnUpdater</a></li>
<li><a href="GitUpdater.html#method-i-update">#update &mdash; GitUpdater</a></li>
<li><a href="Updater.html#method-i-update">#update &mdash; Updater</a></li>
<li><a href="WpTarget.html#method-i-url">#url &mdash; WpTarget</a></li>
@@ -471,10 +475,10 @@
<li><a href="CacheFileStore.html#method-i-write_entry">#write_entry &mdash; CacheFileStore</a></li>
<li><a href="Exploit.html#method-i-write_shell">#write_shell &mdash; Exploit</a></li>
<li><a href="RpcClient.html#method-i-write_shell">#write_shell &mdash; RpcClient</a></li>
<li><a href="Exploit.html#method-i-write_shell">#write_shell &mdash; Exploit</a></li>
<li><a href="WebSite.html#method-i-xmlrpc_url">#xmlrpc_url &mdash; WebSite</a></li>
</ul>

2
doc/lib/common_helper_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-18 20:09:48 +0200</dd>
<dd class="modified-date">2012-09-20 22:01:50 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/lib/environment_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-15 08:04:16 +0200</dd>
<dd class="modified-date">2012-09-20 22:12:57 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/lib/wpscan/modules/malwares_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-15 08:01:01 +0200</dd>
<dd class="modified-date">2012-09-20 22:23:58 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/lib/wpscan/modules/wp_usernames_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-19 22:09:14 +0200</dd>
<dd class="modified-date">2012-09-20 22:51:18 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/lib/wpscan/wp_detector_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-19 22:29:50 +0200</dd>
<dd class="modified-date">2012-09-20 22:14:29 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/lib/wpscan/wp_target_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-19 17:40:16 +0200</dd>
<dd class="modified-date">2012-09-20 22:16:44 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/wpscan_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-19 22:06:17 +0200</dd>
<dd class="modified-date">2012-09-20 22:49:19 +0200</dd>
<dt class="requires">Requires</dt>