From 41c6e0f18c17da3638eb043afc7fc8b48b0540a8 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Mon, 24 Sep 2012 23:03:38 +0200 Subject: [PATCH] rdoc --- doc/Object.html | 5 +- doc/WpTarget.html | 184 ++++++++++++++++++++++++++- doc/WpVersion.html | 38 +++++- doc/created.rid | 12 +- doc/index.html | 66 ++++++---- doc/lib/wpscan/wp_enumerator_rb.html | 2 +- doc/lib/wpscan/wp_target_rb.html | 2 +- doc/lib/wpscan/wp_version_rb.html | 2 +- doc/lib/wpscan/wpscan_helper_rb.html | 2 +- doc/wpscan_rb.html | 2 +- 10 files changed, 268 insertions(+), 47 deletions(-) diff --git a/doc/Object.html b/doc/Object.html index f6593bfd..7252d523 100644 --- a/doc/Object.html +++ b/doc/Object.html @@ -547,7 +547,7 @@ 
-# File lib/wpscan/wpscan_helper.rb, line 68
+# File lib/wpscan/wpscan_helper.rb, line 71
 def help()
   puts "Help :"
   puts
@@ -718,6 +718,9 @@
   puts "-Use custom content directory ..."
   puts "ruby #{script_name} -u www.example.com --wp-content-dir custom-content"
   puts
+  puts "-Use custom plugins directory ..."
+  puts "ruby #{script_name} -u www.example.com --wp-plugins-dir wp-content/custom-plugins"
+  puts
   puts "-Update ..."
   puts "ruby #{script_name} --update"
   puts
diff --git a/doc/WpTarget.html b/doc/WpTarget.html
index 7c9b1a0a..7d61e87d 100644
--- a/doc/WpTarget.html
+++ b/doc/WpTarget.html
@@ -75,12 +75,18 @@
           
           
  • #has_debug_log?
    • 
           
+          
  • #is_multisite?
    • 
+          
           
  • #login_url
    • 
           
           
  • #registration_enabled?
    • 
           
           
  • #registration_url
    • 
           
+          
  • #search_replace_db_2_exists?
    • 
+          
+          
  • #search_replace_db_2_url
    • 
+          
           
  • #theme
    • 
           
           
  • #url
    • 
@@ -91,6 +97,8 @@
           
           
  • #wp_plugins_dir
    • 
           
+          
  • #wp_plugins_dir_exists?
    • 
+
    @@ -418,7 +426,7 @@ 
    -# File lib/wpscan/wp_target.rb, line 118
+# File lib/wpscan/wp_target.rb, line 122
 def debug_log_url
   @uri.merge("#{wp_content_dir()}/debug.log").to_s
 end
    @@ -492,7 +500,7 @@ 
    -# File lib/wpscan/wp_target.rb, line 112
+# File lib/wpscan/wp_target.rb, line 116
 def has_debug_log?
   # We only get the first 700 bytes of the file to avoid loading huge file (like 2Go)
   response_body = Browser.instance.get(debug_log_url(), :headers => {"range" => "bytes=0-700"}).body
@@ -508,6 +516,54 @@
    +
    + + + +
    + is_multisite?() + click to toggle source +
    + + +
    + + + + + +
    +
    +# File lib/wpscan/wp_target.rb, line 161
+def is_multisite?
+  unless @multisite
+    # when multi site, there is no redirection or a redirect to the site itself
+    # otherwise redirect to wp-login.php
+    url = @uri.merge("wp-signup.php")
+    resp = Browser.instance.get(url)
+    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?action=register/
+      @multisite = false
+    elsif resp.code == 302 and resp.headers_hash["location"] =~ /wp-signup\.php/
+      @multisite = true
+    elsif resp.code == 200
+      @multisite = true
+    else
+      @multisite = false
+    end
+  end
+  @multisite
+end
    +
    + +
    + + + + +
    + +
    @@ -568,9 +624,23 @@ 
    -# File lib/wpscan/wp_target.rb, line 123
+# File lib/wpscan/wp_target.rb, line 139
 def registration_enabled?
-  # TODO
+  resp = Browser.instance.get(registration_url)
+  # redirect only on non multi sites
+  if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/
+    enabled = false
+  # multi site registration form
+  elsif resp.code == 200 and resp.body =~ /<form id="setupform" method="post" action="[^"]*wp-signup\.php[^"]*">/
+    enabled = true
+  # normal registration form
+  elsif resp.code == 200 and resp.body =~ /<form name="registerform" id="registerform" action="[^"]*wp-login\.php[^"]*"/
+    enabled = true
+  # registration disabled
+  else
+    enabled = false
+  end
+  enabled
 end
    @@ -601,9 +671,9 @@ 
    -# File lib/wpscan/wp_target.rb, line 127
+# File lib/wpscan/wp_target.rb, line 157
 def registration_url
-  # TODO
+  is_multisite? ? @uri.merge("wp-signup.php") : @uri.merge("wp-login.php?action=register")
 end
    @@ -615,6 +685,75 @@
    +
    + + + +
    + search_replace_db_2_exists?() + click to toggle source +
    + + +
    + + + + + +
    +
    +# File lib/wpscan/wp_target.rb, line 133
+def search_replace_db_2_exists?
+  resp = Browser.instance.get(search_replace_db_2_url)
+  resp.code == 200 && resp.body[%{by interconnect}]
+end
    +
    + +
    + + + + +
    + + +
    + + + +
    + search_replace_db_2_url() + click to toggle source +
    + + +
    + +

    Script for replacing strings in wordpress databases reveals databse +credentials after hitting submit interconnectit.com/124/search-and-replace-for-wordpress-databases/

    + + + +
    +
    +# File lib/wpscan/wp_target.rb, line 129
+def search_replace_db_2_url
+  @uri.merge("searchreplacedb2.php").to_s
+end
    +
    + +
    + + + + +
    + +
    @@ -794,6 +933,39 @@
    +
    + + + +
    + wp_plugins_dir_exists?() + click to toggle source +
    + + +
    + + + + + +
    +
    +# File lib/wpscan/wp_target.rb, line 112
+def wp_plugins_dir_exists?
+  Browser.instance.get(@uri.merge(wp_plugins_dir)).code != 404
+end
    +
    + +
    + + + + +
    + +
    diff --git a/doc/WpVersion.html b/doc/WpVersion.html index f6b35a5f..ed12430c 100644 --- a/doc/WpVersion.html +++ b/doc/WpVersion.html @@ -69,6 +69,8 @@
  • ::find_from_advanced_fingerprinting
    • +
  • ::find_from_links_opml
    • +
  • ::find_from_meta_generator
  • ::find_from_readme
    • @@ -426,6 +428,40 @@ file across all versions of wordpress.

    +
    + + + +
    + find_from_links_opml(options) + click to toggle source +
    + + +
    + + + + + + + +
    + + + + +
    + +
    @@ -590,7 +626,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=109">code.google.com/p/wp 
    -# File lib/wpscan/wp_version.rb, line 131
+# File lib/wpscan/wp_version.rb, line 136
 def self.version_pattern
   '([^\r\n]+[\.][^\r\n]+)'
 end
    diff --git a/doc/created.rid b/doc/created.rid index b1138ea1..9eb437d9 100644 --- a/doc/created.rid +++ b/doc/created.rid @@ -1,4 +1,4 @@ -Sun, 23 Sep 2012 21:48:18 +0200 +Mon, 24 Sep 2012 23:03:20 +0200 ./CREDITS Mon, 17 Sep 2012 20:18:24 +0200 ./Gemfile Sat, 22 Sep 2012 00:14:07 +0200 ./lib/browser.rb Sat, 22 Sep 2012 15:51:15 +0200 @@ -24,20 +24,20 @@ Sun, 23 Sep 2012 21:48:18 +0200 ./lib/wpscan/msfrpc_client.rb Fri, 21 Sep 2012 23:32:27 +0200 ./lib/wpscan/vulnerable.rb Sat, 22 Sep 2012 21:23:01 +0200 ./lib/wpscan/wp_detector.rb Sun, 23 Sep 2012 19:40:56 +0200 -./lib/wpscan/wp_enumerator.rb Sun, 23 Sep 2012 19:58:52 +0200 +./lib/wpscan/wp_enumerator.rb Sun, 23 Sep 2012 22:46:23 +0200 ./lib/wpscan/wp_item.rb Sun, 23 Sep 2012 21:47:56 +0200 ./lib/wpscan/wp_options.rb Sun, 23 Sep 2012 19:35:16 +0200 ./lib/wpscan/wp_plugin.rb Sun, 23 Sep 2012 19:59:17 +0200 -./lib/wpscan/wp_target.rb Sun, 23 Sep 2012 20:07:45 +0200 +./lib/wpscan/wp_target.rb Mon, 24 Sep 2012 22:32:05 +0200 ./lib/wpscan/wp_theme.rb Sun, 23 Sep 2012 19:56:18 +0200 ./lib/wpscan/wp_user.rb Sat, 22 Sep 2012 16:12:25 +0200 -./lib/wpscan/wp_version.rb Sun, 23 Sep 2012 21:26:24 +0200 +./lib/wpscan/wp_version.rb Mon, 24 Sep 2012 18:06:00 +0200 ./lib/wpscan/wp_vulnerability.rb Sat, 22 Sep 2012 16:11:58 +0200 -./lib/wpscan/wpscan_helper.rb Sat, 15 Sep 2012 21:19:30 +0200 +./lib/wpscan/wpscan_helper.rb Sun, 23 Sep 2012 23:14:35 +0200 ./lib/wpscan/wpscan_options.rb Sat, 22 Sep 2012 15:01:32 +0200 ./lib/wpstools/generate_list.rb Sat, 22 Sep 2012 16:10:07 +0200 ./lib/wpstools/parse_svn.rb Sat, 22 Sep 2012 16:10:30 +0200 ./lib/wpstools/wpstools_helper.rb Sat, 22 Sep 2012 15:00:03 +0200 ./README Thu, 13 Sep 2012 22:54:08 +0200 -./wpscan.rb Sun, 23 Sep 2012 19:58:44 +0200 +./wpscan.rb Mon, 24 Sep 2012 22:53:35 +0200 ./wpstools.rb Sat, 22 Sep 2012 14:59:30 +0200 diff --git a/doc/index.html b/doc/index.html index d520143b..21ff156f 100644 --- a/doc/index.html +++ b/doc/index.html @@ -129,14 +129,16 @@
  • ::enumerate — WpEnumerator
    • -
  • ::find — WpVersion
    • -
  • ::find — WpTheme
    • +
  • ::find — WpVersion
    • +
  • ::find_from_advanced_fingerprinting — WpVersion
  • ::find_from_css_link — WpTheme
    • +
  • ::find_from_links_opml — WpVersion
    • +
  • ::find_from_meta_generator — WpVersion
  • ::find_from_readme — WpVersion
    • @@ -165,33 +167,33 @@
  • ::malwares_file — Malwares
    • -
  • ::new — WpTheme
    • +
  • ::new — WpPlugin
    • -
  • ::new — Svn_Parser
    • - -
  • ::new — WpVulnerability
    • - -
  • ::new — WpVersion
    • - -
  • ::new — WpscanOptions
    • - -
  • ::new — WpItem
    • +
  • ::new — Generate_List
  • ::new — WpTarget
  • ::new — CacheFileStore
    • -
  • ::new — RpcClient
    • -
  • ::new — Exploit
    • +
  • ::new — WpUser
    • + +
  • ::new — Svn_Parser
    • + +
  • ::new — WpscanOptions
    • + +
  • ::new — WpVulnerability
    • +
  • ::new — Updater
    • -
  • ::new — Generate_List
    • +
  • ::new — RpcClient
    • -
  • ::new — WpPlugin
    • +
  • ::new — WpTheme
    • -
  • ::new — WpUser
    • +
  • ::new — WpItem
    • + +
  • ::new — WpVersion
  • ::option_to_instance_variable_setter — WpscanOptions
    • @@ -203,10 +205,10 @@
  • ::version_pattern — WpVersion
    • -
  • #<=> — WpUser
    • -
  • #<=> — WpItem
    • +
  • #<=> — WpUser
    • +
  • #== — WpItem
  • #=== — WpItem
    • @@ -265,10 +267,10 @@
  • #error_log_url — WpPlugin
    • -
  • #exploit — RpcClient
    • -
  • #exploit — Exploit
    • +
  • #exploit — RpcClient
    • +
  • #exploit_info — Exploit
  • #extract_name_from_url — WpItem
    • @@ -345,11 +347,13 @@
  • #help — Object
    • +
  • #is_installed? — SvnUpdater
    • +
  • #is_installed? — Updater
  • #is_installed? — GitUpdater
    • -
  • #is_installed? — SvnUpdater
    • +
  • #is_multisite? — WpTarget
  • #is_online? — WebSite
    • @@ -415,10 +419,10 @@
  • #read_shell — Exploit
    • -
  • #readme_url — WpReadme
    • -
  • #readme_url — WpItem
    • +
  • #readme_url — WpReadme
    • +
  • #red — Object
  • #redirection — WebSite
    • @@ -435,6 +439,10 @@
  • #save — Generate_List
    • +
  • #search_replace_db_2_exists? — WpTarget
    • + +
  • #search_replace_db_2_url — WpTarget
    • +
  • #session_count — Exploit
  • #sessions — Exploit
    • @@ -463,10 +471,10 @@
  • #to_s — WpItem
    • -
  • #update — SvnUpdater
    • -
  • #update — Updater
    • +
  • #update — SvnUpdater
    • +
  • #update — GitUpdater
  • #url — WpTarget
    • @@ -493,12 +501,14 @@
  • #wp_plugins_dir — WpTarget
    • +
  • #wp_plugins_dir_exists? — WpTarget
    • +
  • #write_entry — CacheFileStore
    • -
  • #write_shell — Exploit
    • -
  • #write_shell — RpcClient
    • +
  • #write_shell — Exploit
    • +
  • #xmlrpc_url — WebSite
    • diff --git a/doc/lib/wpscan/wp_enumerator_rb.html b/doc/lib/wpscan/wp_enumerator_rb.html index caabd18d..f64c7577 100644 --- a/doc/lib/wpscan/wp_enumerator_rb.html +++ b/doc/lib/wpscan/wp_enumerator_rb.html @@ -24,7 +24,7 @@
    Last Modified
    -
    2012-09-23 19:58:52 +0200
    +
    2012-09-23 22:46:23 +0200
    Requires
    diff --git a/doc/lib/wpscan/wp_target_rb.html b/doc/lib/wpscan/wp_target_rb.html index cf1a80b4..366fa012 100644 --- a/doc/lib/wpscan/wp_target_rb.html +++ b/doc/lib/wpscan/wp_target_rb.html @@ -24,7 +24,7 @@
    Last Modified
    -
    2012-09-23 20:07:45 +0200
    +
    2012-09-24 22:32:05 +0200
    Requires
    diff --git a/doc/lib/wpscan/wp_version_rb.html b/doc/lib/wpscan/wp_version_rb.html index 065afc9d..e0853401 100644 --- a/doc/lib/wpscan/wp_version_rb.html +++ b/doc/lib/wpscan/wp_version_rb.html @@ -24,7 +24,7 @@
    Last Modified
    -
    2012-09-23 21:26:24 +0200
    +
    2012-09-24 18:06:00 +0200
    Requires
    diff --git a/doc/lib/wpscan/wpscan_helper_rb.html b/doc/lib/wpscan/wpscan_helper_rb.html index 59de5d12..f501b731 100644 --- a/doc/lib/wpscan/wpscan_helper_rb.html +++ b/doc/lib/wpscan/wpscan_helper_rb.html @@ -24,7 +24,7 @@
    Last Modified
    -
    2012-09-15 21:19:30 +0200
    +
    2012-09-23 23:14:35 +0200
    Requires
    diff --git a/doc/wpscan_rb.html b/doc/wpscan_rb.html index 1d5ee923..7e78a657 100644 --- a/doc/wpscan_rb.html +++ b/doc/wpscan_rb.html @@ -24,7 +24,7 @@
    Last Modified
    -
    2012-09-23 19:58:44 +0200
    +
    2012-09-24 22:53:35 +0200
    Requires