Fix for xmlrpc false positive. Issue #260.

lib/wpscan/web_site.rb

@@ -26,36 +26,19 @@ class WebSite
   end
 
   def has_xml_rpc?
-    !xml_rpc_url.nil?
+    response = Browser.get_and_follow_location(xml_rpc_url)
+    response.body =~ %r{XML-RPC server accepts POST requests only}i    
   end
 
   # See http://www.hixie.ch/specs/pingback/pingback-1.0#TOC2.3
   def xml_rpc_url
     unless @xmlrpc_url
-      @xmlrpc_url = xml_rpc_url_from_headers() || xml_rpc_url_from_body()
+      @xmlrpc_url = @uri.merge('xmlrpc.php').to_s
     end
+
     @xmlrpc_url
   end
 
-  def xml_rpc_url_from_headers
-    headers    = Browser.get(@uri.to_s).headers_hash
-    xmlrpc_url = nil
-
-    unless headers.nil?
-      pingback_url = headers['X-Pingback']
-      unless pingback_url.nil? || pingback_url.empty?
-        xmlrpc_url = pingback_url
-      end
-    end
-    xmlrpc_url
-  end
-
-  def xml_rpc_url_from_body
-    body = Browser.get(@uri.to_s).body
-
-    body[%r{<link rel="pingback" href="([^"]+)" ?\/?>}, 1]
-  end
-
   # See if the remote url returns 30x redirect
   # This method is recursive
   # Return a string with the redirection or nil

lib/wpscan/wp_target.rb

@@ -43,9 +43,8 @@ class WpTarget < WebSite
     if response.body =~ /["'][^"']*\/wp-content\/[^"']*["']/i
       wordpress = true
     else
-      response = Browser.get_and_follow_location(xml_rpc_url)
 
-      if response.body =~ %r{XML-RPC server accepts POST requests only}i
+      if has_xml_rpc?
         wordpress = true
       else
         response = Browser.get_and_follow_location(login_url)

spec/lib/wpscan/web_site_spec.rb

@@ -63,111 +63,22 @@ describe 'WebSite' do
     end
   end
 
-  describe '#xml_rpc_url_from_headers' do
-    context 'when the x-pingback is' do
-
-      context 'correctly supplied' do
-        it 'returns the url in the header : http://example.localhost/xmlrpc.php' do
-          xmlrpc = 'http://example.localhost/xmlrpc.php'
-          stub_request(:get, web_site.url).
-            to_return(status: 200, headers: { 'X-Pingback' => xmlrpc })
-
-          web_site.xml_rpc_url_from_headers.should === xmlrpc
-        end
-      end
-
-      context 'not supplied' do
-        it 'returns nil' do
-          stub_request(:get, web_site.url).to_return(status: 200)
-          web_site.xml_rpc_url_from_headers.should be_nil
-        end
-
-        context 'but there is another header field' do
-          it 'returns nil' do
-            stub_request(:get, web_site.url).
-              to_return(status:200, headers: { 'another-field' => 'which we do not care' })
-
-            web_site.xml_rpc_url_from_headers.should be_nil
-          end
-        end
-      end
-
-      context 'empty' do
-        it 'returns nil' do
-          stub_request(:get, web_site.url).
-            to_return(status: 200, headers: { 'X-Pingback' => '' })
-
-          web_site.xml_rpc_url_from_headers.should be_nil
-        end
-      end
-
-    end
-  end
-
-  describe '#xml_rpc_url_from_body' do
-    context 'when the pattern does not match' do
-      it 'returns nil' do
-        stub_request_to_fixture(url: web_site.url, fixture: fixtures_dir + '/xml_rpc_url/body_dont_match.html')
-
-        web_site.xml_rpc_url_from_body.should be_nil
-      end
-    end
-
-    context 'when the pattern match' do
-      it 'return the url' do
-        stub_request_to_fixture(url: web_site.url, fixture: fixtures_dir + '/xml_rpc_url/body_match.html')
-
-        web_site.xml_rpc_url_from_body.should == 'http://lamp/wordpress-3.5.1/xmlrpc.php'
-      end
-    end
-  end
-
   describe '#xml_rpc_url' do
-    after :each do
-      web_site.xml_rpc_url.should === xmlrpc_url
-    end
-
-    context 'when found in the headers' do
-      let(:xmlrpc_url) { 'http://from-headers.localhost/xmlrpc.php' }
-
-      it 'returns the url' do
-        web_site.stub(xml_rpc_url_from_headers: xmlrpc_url)
-      end
-    end
-
-    context 'when found in the body' do
-      let(:xmlrpc_url) { 'http://from-body.localhost/xmlrpc.php' }
-
-      it 'returns the url' do
-        web_site.stub(
-          xml_rpc_url_from_headers: nil,
-          xml_rpc_url_from_body: xmlrpc_url
-        )
-      end
-    end
-
-    context 'when not found' do
-      let(:xmlrpc_url) { nil }
-
-      it 'returns nil' do
-        web_site.stub(
-          xml_rpc_url_from_headers: nil,
-          xml_rpc_url_from_body: nil
-        )
-      end
+    it 'returns the xmlrpc url' do
+      web_site.xml_rpc_url.should === "http://example.localhost/xmlrpc.php"
     end
   end
 
   describe '#has_xml_rpc?' do
     it 'returns true' do
-      stub_request(:get, web_site.url).
-        to_return(status: 200, headers: { 'X-Pingback' => 'xmlrpc' })
+      stub_request(:get, web_site.xml_rpc_url).
+        to_return(status: 200, body: "XML-RPC server accepts POST requests only")
 
       web_site.should have_xml_rpc
     end
 
     it 'returns false' do
-      stub_request(:get, web_site.url).to_return(status: 200)
+      stub_request(:get, web_site.xml_rpc_url).to_return(status: 200)
       web_site.should_not have_xml_rpc
     end
   end