-# File lib/wpscan/wpscan_helper.rb, line 68 +# File lib/wpscan/wpscan_helper.rb, line 71 def help() puts "Help :" puts @@ -718,6 +718,9 @@ puts "-Use custom content directory ..." puts "ruby #{script_name} -u www.example.com --wp-content-dir custom-content" puts + puts "-Use custom plugins directory ..." + puts "ruby #{script_name} -u www.example.com --wp-plugins-dir wp-content/custom-plugins" + puts puts "-Update ..." puts "ruby #{script_name} --update" puts diff --git a/doc/WpTarget.html b/doc/WpTarget.html index 7c9b1a0a..7d61e87d 100644 --- a/doc/WpTarget.html +++ b/doc/WpTarget.html @@ -75,12 +75,18 @@
-# File lib/wpscan/wp_target.rb, line 118 +# File lib/wpscan/wp_target.rb, line 122 def debug_log_url @uri.merge("#{wp_content_dir()}/debug.log").to_s end@@ -492,7 +500,7 @@
-# File lib/wpscan/wp_target.rb, line 112 +# File lib/wpscan/wp_target.rb, line 116 def has_debug_log? # We only get the first 700 bytes of the file to avoid loading huge file (like 2Go) response_body = Browser.instance.get(debug_log_url(), :headers => {"range" => "bytes=0-700"}).body @@ -508,6 +516,54 @@
+# File lib/wpscan/wp_target.rb, line 161 +def is_multisite? + unless @multisite + # when multi site, there is no redirection or a redirect to the site itself + # otherwise redirect to wp-login.php + url = @uri.merge("wp-signup.php") + resp = Browser.instance.get(url) + if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?action=register/ + @multisite = false + elsif resp.code == 302 and resp.headers_hash["location"] =~ /wp-signup\.php/ + @multisite = true + elsif resp.code == 200 + @multisite = true + else + @multisite = false + end + end + @multisite +end+
-# File lib/wpscan/wp_target.rb, line 123 +# File lib/wpscan/wp_target.rb, line 139 def registration_enabled? - # TODO + resp = Browser.instance.get(registration_url) + # redirect only on non multi sites + if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/ + enabled = false + # multi site registration form + elsif resp.code == 200 and resp.body =~ /<form id="setupform" method="post" action="[^"]*wp-signup\.php[^"]*">/ + enabled = true + # normal registration form + elsif resp.code == 200 and resp.body =~ /<form name="registerform" id="registerform" action="[^"]*wp-login\.php[^"]*"/ + enabled = true + # registration disabled + else + enabled = false + end + enabled end
-# File lib/wpscan/wp_target.rb, line 127 +# File lib/wpscan/wp_target.rb, line 157 def registration_url - # TODO + is_multisite? ? @uri.merge("wp-signup.php") : @uri.merge("wp-login.php?action=register") end
+# File lib/wpscan/wp_target.rb, line 133 +def search_replace_db_2_exists? + resp = Browser.instance.get(search_replace_db_2_url) + resp.code == 200 && resp.body[%{by interconnect}] +end+
Script for replacing strings in wordpress databases reveals databse +credentials after hitting submit interconnectit.com/124/search-and-replace-for-wordpress-databases/
+ + + ++# File lib/wpscan/wp_target.rb, line 129 +def search_replace_db_2_url + @uri.merge("searchreplacedb2.php").to_s +end+
+# File lib/wpscan/wp_version.rb, line 130 +def self.find_from_links_opml(options) + target_uri = options[:base_url] + Browser.instance.get(target_uri.merge("wp-links-opml.php").to_s).body[%{generator="wordpress/#{WpVersion.version_pattern}"}, 1] +end+
-# File lib/wpscan/wp_version.rb, line 131 +# File lib/wpscan/wp_version.rb, line 136 def self.version_pattern '([^\r\n]+[\.][^\r\n]+)' enddiff --git a/doc/created.rid b/doc/created.rid index b1138ea1..9eb437d9 100644 --- a/doc/created.rid +++ b/doc/created.rid @@ -1,4 +1,4 @@ -Sun, 23 Sep 2012 21:48:18 +0200 +Mon, 24 Sep 2012 23:03:20 +0200 ./CREDITS Mon, 17 Sep 2012 20:18:24 +0200 ./Gemfile Sat, 22 Sep 2012 00:14:07 +0200 ./lib/browser.rb Sat, 22 Sep 2012 15:51:15 +0200 @@ -24,20 +24,20 @@ Sun, 23 Sep 2012 21:48:18 +0200 ./lib/wpscan/msfrpc_client.rb Fri, 21 Sep 2012 23:32:27 +0200 ./lib/wpscan/vulnerable.rb Sat, 22 Sep 2012 21:23:01 +0200 ./lib/wpscan/wp_detector.rb Sun, 23 Sep 2012 19:40:56 +0200 -./lib/wpscan/wp_enumerator.rb Sun, 23 Sep 2012 19:58:52 +0200 +./lib/wpscan/wp_enumerator.rb Sun, 23 Sep 2012 22:46:23 +0200 ./lib/wpscan/wp_item.rb Sun, 23 Sep 2012 21:47:56 +0200 ./lib/wpscan/wp_options.rb Sun, 23 Sep 2012 19:35:16 +0200 ./lib/wpscan/wp_plugin.rb Sun, 23 Sep 2012 19:59:17 +0200 -./lib/wpscan/wp_target.rb Sun, 23 Sep 2012 20:07:45 +0200 +./lib/wpscan/wp_target.rb Mon, 24 Sep 2012 22:32:05 +0200 ./lib/wpscan/wp_theme.rb Sun, 23 Sep 2012 19:56:18 +0200 ./lib/wpscan/wp_user.rb Sat, 22 Sep 2012 16:12:25 +0200 -./lib/wpscan/wp_version.rb Sun, 23 Sep 2012 21:26:24 +0200 +./lib/wpscan/wp_version.rb Mon, 24 Sep 2012 18:06:00 +0200 ./lib/wpscan/wp_vulnerability.rb Sat, 22 Sep 2012 16:11:58 +0200 -./lib/wpscan/wpscan_helper.rb Sat, 15 Sep 2012 21:19:30 +0200 +./lib/wpscan/wpscan_helper.rb Sun, 23 Sep 2012 23:14:35 +0200 ./lib/wpscan/wpscan_options.rb Sat, 22 Sep 2012 15:01:32 +0200 ./lib/wpstools/generate_list.rb Sat, 22 Sep 2012 16:10:07 +0200 ./lib/wpstools/parse_svn.rb Sat, 22 Sep 2012 16:10:30 +0200 ./lib/wpstools/wpstools_helper.rb Sat, 22 Sep 2012 15:00:03 +0200 ./README Thu, 13 Sep 2012 22:54:08 +0200 -./wpscan.rb Sun, 23 Sep 2012 19:58:44 +0200 +./wpscan.rb Mon, 24 Sep 2012 22:53:35 +0200 ./wpstools.rb Sat, 22 Sep 2012 14:59:30 +0200 diff --git a/doc/index.html b/doc/index.html index d520143b..21ff156f 100644 --- a/doc/index.html +++ b/doc/index.html @@ -129,14 +129,16 @@