garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rspec tests

Browse Source
This commit is contained in:
Christian Mehlmauer
2012-09-17 22:43:24 +02:00
parent 6f5a16d066
commit 18cb395b4d
15 changed files with 359 additions and 495 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
doc/CREDITS.html
View File

@@ -156,7 +156,8 @@ should be in here, email ryandewhurst at gmail.</p>
potential solutions to bugs. Callum Pember - Implemented proxy support -
callumpember at gmail.com g0tmi1k - Additional timthumb checks + bug
reports. Melvin Lammerts - Reported a couple of fake vulnerabilities -
melvin at 12k.nl</p>
melvin at 12k.nl Christian Mehlmauer - @<em>FireFart</em> - Theme
enumeration</p>
</div>

201
doc/WpItem.html
View File

@@ -65,7 +65,7 @@
<h3 class="section-header">Methods</h3>
<ul class="link-list">
<li><a href="#method-i-3C-3D-3E">#<=></a></li>
<li><a href="#method-c-new">::new</a></li>
<li><a href="#method-i-3D-3D">#==</a></li>
@@ -83,8 +83,6 @@
<li><a href="#method-i-has_readme-3F">#has_readme?</a></li>
<li><a href="#method-i-location_uri_from_file_url">#location_uri_from_file_url</a></li>
<li><a href="#method-i-readme_url">#readme_url</a></li>
<li><a href="#method-i-to_s">#to_s</a></li>
@@ -227,6 +225,23 @@
<h3 class="section-header">Attributes</h3>
<div id="name-attribute-method" class="method-detail">
<a name="name"></a>
<a name="name="></a>
<div class="method-heading attribute-method-heading">
<span class="method-name">name</span><span
class="attribute-access-type">[RW]</span>
</div>
<div class="method-description">
</div>
</div>
<div id="path-attribute-method" class="method-detail">
<a name="path"></a>
@@ -258,6 +273,40 @@
</div>
</div>
<div id="vulns_xml-attribute-method" class="method-detail">
<a name="vulns_xml"></a>
<a name="vulns_xml="></a>
<div class="method-heading attribute-method-heading">
<span class="method-name">vulns_xml</span><span
class="attribute-access-type">[RW]</span>
</div>
<div class="method-description">
</div>
</div>
<div id="vulns_xpath-attribute-method" class="method-detail">
<a name="vulns_xpath"></a>
<a name="vulns_xpath="></a>
<div class="method-heading attribute-method-heading">
<span class="method-name">vulns_xpath</span><span
class="attribute-access-type">[RW]</span>
</div>
<div class="method-description">
</div>
</div>
@@ -283,17 +332,17 @@
<!-- Methods -->
<div id="public-instance-method-details" class="method-section section">
<h3 class="section-header">Public Instance Methods</h3>
<div id="public-class-method-details" class="method-section section">
<h3 class="section-header">Public Class Methods</h3>
<div id="3C-3D-3E-method" class="method-detail ">
<a name="method-i-3C-3D-3E"></a>
<div id="new-method" class="method-detail ">
<a name="method-c-new"></a>
<div class="method-heading">
<span class="method-name">&lt;=&gt;</span><span
class="method-args">(item)</span>
<span class="method-name">new</span><span
class="method-args">(options = {})</span>
<span class="method-click-advice">click to toggle source</span>
</div>
@@ -304,20 +353,37 @@
<div class="method-source-code" id="3C-3D-3E-source">
<div class="method-source-code" id="new-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 64</span>
<span class="ruby-keyword">def</span> <span class="ruby-operator">&lt;=&gt;</span>(<span class="ruby-identifier">item</span>)
<span class="ruby-identifier">item</span>.<span class="ruby-identifier">name</span> <span class="ruby-operator">&lt;=&gt;</span> <span class="ruby-ivar">@name</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 25</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">initialize</span>(<span class="ruby-identifier">options</span> = {})
<span class="ruby-ivar">@wp_content_dir</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:wp_content_dir</span>]
<span class="ruby-ivar">@url</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:url</span>]
<span class="ruby-ivar">@path</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:path</span>]
<span class="ruby-ivar">@name</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:name</span>] <span class="ruby-operator">||</span> <span class="ruby-identifier">extract_name_from_url</span>
<span class="ruby-ivar">@vulns_xml</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>]
<span class="ruby-ivar">@vulns_xpath</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xpath</span>]
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;url not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@url</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;path not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@path</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;wp_content_dir not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@wp_content_dir</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;name not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@name</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;vulns_xml not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@vulns_xml</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- 3C-3D-3E-source -->
</div><!-- new-source -->
</div>
</div><!-- 3C-3D-3E-method -->
</div><!-- new-method -->
</div><!-- public-class-method-details -->
<div id="public-instance-method-details" class="method-section section">
<h3 class="section-header">Public Instance Methods</h3>
<div id="3D-3D-method" class="method-detail ">
@@ -333,13 +399,13 @@
<div class="method-description">
<p><a href="Object.html">Object</a> comparer</p>
<div class="method-source-code" id="3D-3D-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 60</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 87</span>
<span class="ruby-keyword">def</span> <span class="ruby-operator">==</span>(<span class="ruby-identifier">item</span>)
<span class="ruby-identifier">item</span>.<span class="ruby-identifier">name</span> <span class="ruby-operator">==</span> <span class="ruby-ivar">@name</span>
<span class="ruby-keyword">end</span></pre>
@@ -366,13 +432,13 @@
<div class="method-description">
<p>Url for changelog.txt</p>
<div class="method-source-code" id="changelog_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 80</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 97</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">changelog_url</span>
<span class="ruby-identifier">get_url_without_filename</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;changelog.txt&quot;</span>)
<span class="ruby-keyword">end</span></pre>
@@ -405,10 +471,10 @@
<div class="method-source-code" id="directory_listing-3F-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 46</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 70</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">directory_listing?</span>
<span class="ruby-comment"># Need to remove to file part from the url</span>
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">location_uri_from_file_url</span>(<span class="ruby-identifier">get_url</span>.<span class="ruby-identifier">to_s</span>)).<span class="ruby-identifier">body</span>[<span class="ruby-regexp">%{&lt;title&gt;Index of}</span>] <span class="ruby-operator">?</span> <span class="ruby-keyword">true</span> <span class="ruby-operator">:</span> <span class="ruby-keyword">false</span>
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">get_url_without_filename</span>).<span class="ruby-identifier">body</span>[<span class="ruby-regexp">%{&lt;title&gt;Index of}</span>] <span class="ruby-operator">?</span> <span class="ruby-keyword">true</span> <span class="ruby-operator">:</span> <span class="ruby-keyword">false</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- directory_listing-3F-source -->
@@ -426,22 +492,22 @@
<div class="method-heading">
<span class="method-name">extract_name_from_url</span><span
class="method-args">(url)</span>
class="method-args">()</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<p>Extract item name from a url</p>
<div class="method-source-code" id="extract_name_from_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 51</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">extract_name_from_url</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-identifier">url</span>.<span class="ruby-identifier">to_s</span>[<span class="ruby-regexp">%{^(https?://.*/([^/]+)/)}</span>, <span class="ruby-value">2</span>]
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 76</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">extract_name_from_url</span>
<span class="ruby-identifier">get_url</span>.<span class="ruby-identifier">to_s</span>[<span class="ruby-regexp">%{^(https?://.*/([^/]+)/)}</span>, <span class="ruby-value">2</span>]
<span class="ruby-keyword">end</span></pre>
</div><!-- extract_name_from_url-source -->
@@ -466,15 +532,20 @@
<div class="method-description">
<p>Get the full url for this item</p>
<div class="method-source-code" id="get_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 23</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 41</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_url</span>
<span class="ruby-constant">URI</span>.<span class="ruby-identifier">parse</span>(<span class="ruby-node">&quot;#{@url.to_s}#@wp_content_dir/#@path&quot;</span>)
<span class="ruby-identifier">url</span> = <span class="ruby-ivar">@url</span>.<span class="ruby-identifier">to_s</span>.<span class="ruby-identifier">end_with?</span>(<span class="ruby-string">&quot;/&quot;</span>) <span class="ruby-operator">?</span> <span class="ruby-ivar">@url</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">:</span> <span class="ruby-node">&quot;#@url/&quot;</span>
<span class="ruby-comment"># remove first and last /</span>
<span class="ruby-identifier">wp_content_dir</span> = <span class="ruby-ivar">@wp_content_dir</span>.<span class="ruby-identifier">sub</span>(<span class="ruby-regexp">/^\//</span>, <span class="ruby-string">&quot;&quot;</span>).<span class="ruby-identifier">sub</span>(<span class="ruby-regexp">/\/$/</span>, <span class="ruby-string">&quot;&quot;</span>)
<span class="ruby-comment"># remove first /</span>
<span class="ruby-identifier">path</span> = <span class="ruby-ivar">@path</span>.<span class="ruby-identifier">sub</span>(<span class="ruby-regexp">/^\//</span>, <span class="ruby-string">&quot;&quot;</span>)
<span class="ruby-constant">URI</span>.<span class="ruby-identifier">parse</span>(<span class="ruby-node">&quot;#{url}#{wp_content_dir}/#{path}&quot;</span>)
<span class="ruby-keyword">end</span></pre>
</div><!-- get_url-source -->
@@ -499,21 +570,20 @@
<div class="method-description">
<p>Gets the full url for this item without filenames</p>
<div class="method-source-code" id="get_url_without_filename-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 27</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 51</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get_url_without_filename</span>
<span class="ruby-identifier">matches</span> = <span class="ruby-ivar">@path</span>.<span class="ruby-identifier">match</span>(<span class="ruby-regexp">%{^(.*/).*$}</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">matches</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> <span class="ruby-keyword">or</span> <span class="ruby-identifier">matches</span>.<span class="ruby-identifier">length</span> <span class="ruby-operator">&lt;</span> <span class="ruby-value">2</span>
<span class="ruby-identifier">dirname</span> = <span class="ruby-ivar">@path</span>
<span class="ruby-keyword">else</span>
<span class="ruby-identifier">dirname</span> = <span class="ruby-identifier">matches</span>[<span class="ruby-value">1</span>]
<span class="ruby-identifier">location_url</span> = <span class="ruby-identifier">get_url</span>.<span class="ruby-identifier">to_s</span>
<span class="ruby-identifier">valid_location_url</span> = <span class="ruby-identifier">location_url</span>[<span class="ruby-regexp">%{^(https?://.*/)[^.]+\.[^/]+$}</span>, <span class="ruby-value">1</span>]
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">valid_location_url</span>
<span class="ruby-identifier">valid_location_url</span> = <span class="ruby-identifier">add_trailing_slash</span>(<span class="ruby-identifier">location_url</span>)
<span class="ruby-keyword">end</span>
<span class="ruby-constant">URI</span>.<span class="ruby-identifier">parse</span>(<span class="ruby-node">&quot;#{@url.to_s}#@wp_content_dir/#{dirname}&quot;</span>)
<span class="ruby-constant">URI</span>.<span class="ruby-identifier">parse</span>(<span class="ruby-identifier">valid_location_url</span>)
<span class="ruby-keyword">end</span></pre>
</div><!-- get_url_without_filename-source -->
@@ -538,13 +608,13 @@
<div class="method-description">
<p>changelog.txt present?</p>
<div class="method-source-code" id="has_changelog-3F-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 92</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 111</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">has_changelog?</span>
<span class="ruby-keyword">unless</span> <span class="ruby-ivar">@changelog</span>
<span class="ruby-identifier">status</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">changelog_url</span>).<span class="ruby-identifier">code</span>
@@ -575,13 +645,13 @@
<div class="method-description">
<p>readme.txt present?</p>
<div class="method-source-code" id="has_readme-3F-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 84</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 102</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">has_readme?</span>
<span class="ruby-keyword">unless</span> <span class="ruby-ivar">@readme</span>
<span class="ruby-identifier">status</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">readme_url</span>).<span class="ruby-identifier">code</span>
@@ -599,43 +669,6 @@
</div><!-- has_readme-3F-method -->
<div id="location_uri_from_file_url-method" class="method-detail ">
<a name="method-i-location_uri_from_file_url"></a>
<div class="method-heading">
<span class="method-name">location_uri_from_file_url</span><span
class="method-args">(location_url)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<div class="method-source-code" id="location_uri_from_file_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 68</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">location_uri_from_file_url</span>(<span class="ruby-identifier">location_url</span>)
<span class="ruby-identifier">valid_location_url</span> = <span class="ruby-identifier">location_url</span>[<span class="ruby-regexp">%{^(https?://.*/)[^.]+\.[^/]+$}</span>, <span class="ruby-value">1</span>]
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">valid_location_url</span>
<span class="ruby-identifier">valid_location_url</span> = <span class="ruby-identifier">add_trailing_slash</span>(<span class="ruby-identifier">location_url</span>)
<span class="ruby-keyword">end</span>
<span class="ruby-constant">URI</span>.<span class="ruby-identifier">parse</span>(<span class="ruby-identifier">valid_location_url</span>)
<span class="ruby-keyword">end</span></pre>
</div><!-- location_uri_from_file_url-source -->
</div>
</div><!-- location_uri_from_file_url-method -->
<div id="readme_url-method" class="method-detail ">
<a name="method-i-readme_url"></a>
@@ -649,13 +682,13 @@
<div class="method-description">
<p>Url for readme.txt</p>
<div class="method-source-code" id="readme_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 76</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 92</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">readme_url</span>
<span class="ruby-identifier">get_url_without_filename</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;readme.txt&quot;</span>)
<span class="ruby-keyword">end</span></pre>
@@ -682,13 +715,13 @@
<div class="method-description">
<p>To string. Adds a version number if detected</p>
<div class="method-source-code" id="to_s-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 55</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 81</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">to_s</span>
<span class="ruby-identifier">item_version</span> = <span class="ruby-identifier">version</span>
<span class="ruby-node">&quot;#@name#{' v' + item_version.strip if item_version}&quot;</span>
@@ -716,13 +749,13 @@
<div class="method-description">
<p>Returns version number from readme.txt if it exists</p>
<div class="method-source-code" id="version-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 37</span>
<span class="ruby-comment"># File lib/wpscan/wp_item.rb, line 61</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">version</span>
<span class="ruby-keyword">unless</span> <span class="ruby-ivar">@version</span>
<span class="ruby-identifier">response</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">get_url</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;readme.txt&quot;</span>).<span class="ruby-identifier">to_s</span>)

44
doc/WpPlugin.html
View File

@@ -202,28 +202,6 @@
<!-- Attributes -->
<div id="attribute-method-details" class="method-section section">
<h3 class="section-header">Attributes</h3>
<div id="name-attribute-method" class="method-detail">
<a name="name"></a>
<div class="method-heading attribute-method-heading">
<span class="method-name">name</span><span
class="attribute-access-type">[R]</span>
</div>
<div class="method-description">
</div>
</div>
</div><!-- attribute-method-details -->
<!-- Methods -->
@@ -250,21 +228,11 @@
<div class="method-source-code" id="new-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_plugin.rb, line 25</span>
<span class="ruby-comment"># File lib/wpscan/wp_plugin.rb, line 20</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">initialize</span>(<span class="ruby-identifier">options</span> = {})
<span class="ruby-ivar">@url</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:url</span>]
<span class="ruby-ivar">@path</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:path</span>]
<span class="ruby-ivar">@wp_content_dir</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:wp_content_dir</span>]
<span class="ruby-ivar">@name</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:name</span>] <span class="ruby-operator">||</span> <span class="ruby-identifier">extract_name_from_url</span>(<span class="ruby-identifier">get_url</span>)
<span class="ruby-ivar">@vulns_xml</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>] <span class="ruby-operator">||</span> <span class="ruby-constant">DATA_DIR</span> <span class="ruby-operator">+</span> <span class="ruby-string">'/plugin_vulns.xml'</span>
<span class="ruby-ivar">@vulns_xpath</span> = <span class="ruby-node">&quot;//plugin[@name='#@name']/vulnerability&quot;</span>
<span class="ruby-ivar">@version</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;url not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@url</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;path not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@path</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;wp_content_dir not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@wp_content_dir</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;name not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@name</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;vulns_xml not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@vulns_xml</span>
<span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>] = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>] <span class="ruby-operator">||</span> <span class="ruby-constant">DATA_DIR</span> <span class="ruby-operator">+</span> <span class="ruby-string">'/plugin_vulns.xml'</span>
<span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xpath</span>] = <span class="ruby-node">&quot;//plugin[@name='#@name']/vulnerability&quot;</span>
<span class="ruby-keyword">super</span>(<span class="ruby-identifier">options</span>)
<span class="ruby-keyword">end</span></pre>
</div><!-- new-source -->
@@ -304,7 +272,7 @@ href="http://www.exploit-db.com/ghdb/3714/">www.exploit-db.com/ghdb/3714/</a></p
<div class="method-source-code" id="error_log-3F-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_plugin.rb, line 46</span>
<span class="ruby-comment"># File lib/wpscan/wp_plugin.rb, line 31</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">error_log?</span>
<span class="ruby-identifier">response_body</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">error_log_url</span>(), <span class="ruby-value">:headers</span> =<span class="ruby-operator">&gt;</span> { <span class="ruby-string">&quot;range&quot;</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-string">&quot;bytes=0-700&quot;</span>}).<span class="ruby-identifier">body</span>
<span class="ruby-identifier">response_body</span>[<span class="ruby-regexp">%{PHP Fatal error}</span>] <span class="ruby-operator">?</span> <span class="ruby-keyword">true</span> <span class="ruby-operator">:</span> <span class="ruby-keyword">false</span>
@@ -338,7 +306,7 @@ href="http://www.exploit-db.com/ghdb/3714/">www.exploit-db.com/ghdb/3714/</a></p
<div class="method-source-code" id="error_log_url-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_plugin.rb, line 51</span>
<span class="ruby-comment"># File lib/wpscan/wp_plugin.rb, line 36</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">error_log_url</span>
<span class="ruby-identifier">get_url</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;error_log&quot;</span>).<span class="ruby-identifier">to_s</span>
<span class="ruby-keyword">end</span></pre>

64
doc/WpTheme.html
View File

@@ -75,8 +75,6 @@
<li><a href="#method-i-3D-3D-3D">#===</a></li>
<li><a href="#method-i-to_s">#to_s</a></li>
</ul>
</div>
@@ -286,7 +284,7 @@
<div class="method-source-code" id="find-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 53</span>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 42</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find</span>(<span class="ruby-identifier">target_uri</span>)
<span class="ruby-keyword">self</span>.<span class="ruby-identifier">methods</span>.<span class="ruby-identifier">grep</span>(<span class="ruby-regexp">/find_from_/</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">method_to_call</span><span class="ruby-operator">|</span>
<span class="ruby-identifier">theme</span> = <span class="ruby-keyword">self</span>.<span class="ruby-identifier">send</span>(<span class="ruby-identifier">method_to_call</span>, <span class="ruby-identifier">target_uri</span>)
@@ -326,21 +324,11 @@
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 25</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">initialize</span>(<span class="ruby-identifier">options</span> = {})
<span class="ruby-ivar">@url</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:url</span>]
<span class="ruby-ivar">@name</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:name</span>] <span class="ruby-operator">||</span> <span class="ruby-identifier">extract_name_from_url</span>(<span class="ruby-identifier">get_url</span>)
<span class="ruby-ivar">@path</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:path</span>]
<span class="ruby-ivar">@wp_content_dir</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:wp_content_dir</span>]
<span class="ruby-ivar">@vulns_xml</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>] <span class="ruby-operator">||</span> <span class="ruby-constant">DATA_DIR</span> <span class="ruby-operator">+</span> <span class="ruby-string">'/wp_theme_vulns.xml'</span>
<span class="ruby-ivar">@vulns_xpath</span> = <span class="ruby-node">&quot;//theme[@name='#{@name}']/vulnerability&quot;</span>
<span class="ruby-ivar">@version</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:version</span>]
<span class="ruby-ivar">@style_url</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:style_url</span>]
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;url not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@url</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;path not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@path</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;wp_content_dir not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@wp_content_dir</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;name not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@name</span>
<span class="ruby-identifier">raise</span>(<span class="ruby-string">&quot;vulns_xml not set&quot;</span>) <span class="ruby-keyword">unless</span> <span class="ruby-ivar">@vulns_xml</span>
<span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>] = <span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xml</span>] <span class="ruby-operator">||</span> <span class="ruby-constant">DATA_DIR</span> <span class="ruby-operator">+</span> <span class="ruby-string">'/wp_theme_vulns.xml'</span>
<span class="ruby-identifier">options</span>[<span class="ruby-value">:vulns_xpath</span>] = <span class="ruby-node">&quot;//theme[@name='#{@name}']/vulnerability&quot;</span>
<span class="ruby-ivar">@version</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:version</span>]
<span class="ruby-ivar">@style_url</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:style_url</span>]
<span class="ruby-keyword">super</span>(<span class="ruby-identifier">options</span>)
<span class="ruby-keyword">end</span></pre>
</div><!-- new-source -->
@@ -377,7 +365,7 @@
<div class="method-source-code" id="find_from_css_link-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 74</span>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 58</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find_from_css_link</span>(<span class="ruby-identifier">target_uri</span>)
<span class="ruby-identifier">response</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">target_uri</span>.<span class="ruby-identifier">to_s</span>, <span class="ruby-value">:follow_location</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-keyword">true</span>, <span class="ruby-value">:max_redirects</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">2</span>)
@@ -423,7 +411,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=141">code.google.com/p/wp
<div class="method-source-code" id="find_from_wooframework-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 91</span>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 75</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find_from_wooframework</span>(<span class="ruby-identifier">target_uri</span>)
<span class="ruby-identifier">body</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">target_uri</span>.<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">body</span>
<span class="ruby-identifier">regexp</span> = <span class="ruby-regexp">%{&lt;meta name=&quot;generator&quot; content=&quot;([^\s&quot;]+)\s?([^&quot;]+)?&quot; /&gt;\s+&lt;meta name=&quot;generator&quot; content=&quot;WooFramework\s?([^&quot;]+)?&quot; /&gt;}</span>
@@ -476,7 +464,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=141">code.google.com/p/wp
<div class="method-source-code" id="3D-3D-3D-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 67</span>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 51</span>
<span class="ruby-keyword">def</span> <span class="ruby-operator">===</span>(<span class="ruby-identifier">wp_theme</span>)
<span class="ruby-identifier">wp_theme</span>.<span class="ruby-identifier">name</span> <span class="ruby-operator">===</span> <span class="ruby-ivar">@name</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">wp_theme</span>.<span class="ruby-identifier">version</span> <span class="ruby-operator">===</span> <span class="ruby-ivar">@version</span>
<span class="ruby-keyword">end</span></pre>
@@ -490,40 +478,6 @@ href="http://code.google.com/p/wpscan/issues/detail?id=141">code.google.com/p/wp
</div><!-- 3D-3D-3D-method -->
<div id="to_s-method" class="method-detail ">
<a name="method-i-to_s"></a>
<div class="method-heading">
<span class="method-name">to_s</span><span
class="method-args">()</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<div class="method-source-code" id="to_s-source">
<pre>
<span class="ruby-comment"># File lib/wpscan/wp_theme.rb, line 62</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">to_s</span>
<span class="ruby-identifier">version</span> = <span class="ruby-identifier">version</span>()
<span class="ruby-node">&quot;#{@name}#{' v' + version if version}&quot;</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- to_s-source -->
</div>
</div><!-- to_s-method -->
</div><!-- public-instance-method-details -->
</div><!-- 5Buntitled-5D -->

10
doc/created.rid
View File

@@ -1,5 +1,5 @@
Mon, 17 Sep 2012 19:45:07 +0200
./CREDITS Thu, 13 Sep 2012 22:54:08 +0200
Mon, 17 Sep 2012 22:40:58 +0200
./CREDITS Mon, 17 Sep 2012 20:18:24 +0200
./lib/browser.rb Sun, 16 Sep 2012 15:18:58 +0200
./lib/cache_file_store.rb Sat, 15 Sep 2012 08:04:03 +0200
./lib/common_helper.rb Sat, 15 Sep 2012 08:04:08 +0200
@@ -24,11 +24,11 @@ Mon, 17 Sep 2012 19:45:07 +0200
./lib/wpscan/vulnerable.rb Sat, 15 Sep 2012 08:02:37 +0200
./lib/wpscan/wp_detector.rb Mon, 17 Sep 2012 17:40:36 +0200
./lib/wpscan/wp_enumerator.rb Mon, 17 Sep 2012 17:54:28 +0200
./lib/wpscan/wp_item.rb Mon, 17 Sep 2012 19:43:28 +0200
./lib/wpscan/wp_item.rb Mon, 17 Sep 2012 22:04:16 +0200
./lib/wpscan/wp_options.rb Sun, 16 Sep 2012 23:02:21 +0200
./lib/wpscan/wp_plugin.rb Mon, 17 Sep 2012 19:43:42 +0200
./lib/wpscan/wp_plugin.rb Mon, 17 Sep 2012 22:03:47 +0200
./lib/wpscan/wp_target.rb Sun, 16 Sep 2012 23:48:55 +0200
./lib/wpscan/wp_theme.rb Mon, 17 Sep 2012 19:43:53 +0200
./lib/wpscan/wp_theme.rb Mon, 17 Sep 2012 22:23:12 +0200
./lib/wpscan/wp_version.rb Sun, 16 Sep 2012 23:48:18 +0200
./lib/wpscan/wp_vulnerability.rb Sat, 15 Sep 2012 08:03:09 +0200
./lib/wpscan/wpscan_helper.rb Sat, 15 Sep 2012 21:19:30 +0200

40
doc/index.html
View File

@@ -163,27 +163,29 @@
<li><a href="CacheFileStore.html#method-c-new">::new &mdash; CacheFileStore</a></li>
<li><a href="WpVulnerability.html#method-c-new">::new &mdash; WpVulnerability</a></li>
<li><a href="WpscanOptions.html#method-c-new">::new &mdash; WpscanOptions</a></li>
<li><a href="WpVersion.html#method-c-new">::new &mdash; WpVersion</a></li>
<li><a href="WpTheme.html#method-c-new">::new &mdash; WpTheme</a></li>
<li><a href="WpVulnerability.html#method-c-new">::new &mdash; WpVulnerability</a></li>
<li><a href="WpscanOptions.html#method-c-new">::new &mdash; WpscanOptions</a></li>
<li><a href="WpItem.html#method-c-new">::new &mdash; WpItem</a></li>
<li><a href="RpcClient.html#method-c-new">::new &mdash; RpcClient</a></li>
<li><a href="Updater.html#method-c-new">::new &mdash; Updater</a></li>
<li><a href="Generate_List.html#method-c-new">::new &mdash; Generate_List</a></li>
<li><a href="Exploit.html#method-c-new">::new &mdash; Exploit</a></li>
<li><a href="Svn_Parser.html#method-c-new">::new &mdash; Svn_Parser</a></li>
<li><a href="WpPlugin.html#method-c-new">::new &mdash; WpPlugin</a></li>
<li><a href="WpTheme.html#method-c-new">::new &mdash; WpTheme</a></li>
<li><a href="WpTarget.html#method-c-new">::new &mdash; WpTarget</a></li>
<li><a href="Svn_Parser.html#method-c-new">::new &mdash; Svn_Parser</a></li>
<li><a href="Generate_List.html#method-c-new">::new &mdash; Generate_List</a></li>
<li><a href="Exploit.html#method-c-new">::new &mdash; Exploit</a></li>
<li><a href="WpscanOptions.html#method-c-option_to_instance_variable_setter">::option_to_instance_variable_setter &mdash; WpscanOptions</a></li>
@@ -195,8 +197,6 @@
<li><a href="WpVersion.html#method-c-version_pattern">::version_pattern &mdash; WpVersion</a></li>
<li><a href="WpItem.html#method-i-3C-3D-3E">#<=> &mdash; WpItem</a></li>
<li><a href="WpItem.html#method-i-3D-3D">#== &mdash; WpItem</a></li>
<li><a href="WpTheme.html#method-i-3D-3D-3D">#=== &mdash; WpTheme</a></li>
@@ -315,11 +315,11 @@
<li><a href="Object.html#method-i-help">#help &mdash; Object</a></li>
<li><a href="Updater.html#method-i-is_installed-3F">#is_installed? &mdash; Updater</a></li>
<li><a href="SvnUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; SvnUpdater</a></li>
<li><a href="GitUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; GitUpdater</a></li>
<li><a href="SvnUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; SvnUpdater</a></li>
<li><a href="Updater.html#method-i-is_installed-3F">#is_installed? &mdash; Updater</a></li>
<li><a href="WebSite.html#method-i-is_online-3F">#is_online? &mdash; WebSite</a></li>
@@ -339,14 +339,12 @@
<li><a href="Browser.html#method-i-load_config">#load_config &mdash; Browser</a></li>
<li><a href="Updater.html#method-i-local_revision_number">#local_revision_number &mdash; Updater</a></li>
<li><a href="SvnUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; SvnUpdater</a></li>
<li><a href="GitUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; GitUpdater</a></li>
<li><a href="Updater.html#method-i-local_revision_number">#local_revision_number &mdash; Updater</a></li>
<li><a href="WpItem.html#method-i-location_uri_from_file_url">#location_uri_from_file_url &mdash; WpItem</a></li>
<li><a href="RpcClient.html#method-i-login">#login &mdash; RpcClient</a></li>
<li><a href="WpLoginProtection.html#method-i-login_protection_plugin">#login_protection_plugin &mdash; WpLoginProtection</a></li>
@@ -361,14 +359,14 @@
<li><a href="Browser.html#method-i-merge_request_params">#merge_request_params &mdash; Browser</a></li>
<li><a href="Exploit.html#method-i-meterpreter_read">#meterpreter_read &mdash; Exploit</a></li>
<li><a href="RpcClient.html#method-i-meterpreter_read">#meterpreter_read &mdash; RpcClient</a></li>
<li><a href="Exploit.html#method-i-meterpreter_write">#meterpreter_write &mdash; Exploit</a></li>
<li><a href="Exploit.html#method-i-meterpreter_read">#meterpreter_read &mdash; Exploit</a></li>
<li><a href="RpcClient.html#method-i-meterpreter_write">#meterpreter_write &mdash; RpcClient</a></li>
<li><a href="Exploit.html#method-i-meterpreter_write">#meterpreter_write &mdash; Exploit</a></li>
<li><a href="Svn_Parser.html#method-i-parse">#parse &mdash; Svn_Parser</a></li>
<li><a href="WpPlugins.html#method-i-plugins_from_aggressive_detection">#plugins_from_aggressive_detection &mdash; WpPlugins</a></li>
@@ -427,8 +425,6 @@
<li><a href="WpItem.html#method-i-to_s">#to_s &mdash; WpItem</a></li>
<li><a href="WpTheme.html#method-i-to_s">#to_s &mdash; WpTheme</a></li>
<li><a href="GitUpdater.html#method-i-update">#update &mdash; GitUpdater</a></li>
<li><a href="Updater.html#method-i-update">#update &mdash; Updater</a></li>
@@ -447,10 +443,10 @@
<li><a href="WpUsernames.html#method-i-usernames">#usernames &mdash; WpUsernames</a></li>
<li><a href="WpItem.html#method-i-version">#version &mdash; WpItem</a></li>
<li><a href="WpTarget.html#method-i-version">#version &mdash; WpTarget</a></li>
<li><a href="WpItem.html#method-i-version">#version &mdash; WpItem</a></li>
<li><a href="Vulnerable.html#method-i-vulnerabilities">#vulnerabilities &mdash; Vulnerable</a></li>
<li><a href="WpscanOptions.html#method-i-wordlist-3D">#wordlist= &mdash; WpscanOptions</a></li>

2
doc/lib/wpscan/wp_plugin_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-17 19:43:42 +0200</dd>
<dd class="modified-date">2012-09-17 22:03:47 +0200</dd>
<dt class="requires">Requires</dt>

2
doc/lib/wpscan/wp_theme_rb.html
View File

@@ -24,7 +24,7 @@
<div id="metadata">
<dl>
<dt class="modified-date">Last Modified</dt>
<dd class="modified-date">2012-09-17 19:43:53 +0200</dd>
<dd class="modified-date">2012-09-17 22:23:12 +0200</dd>
<dt class="requires">Requires</dt>