Improves Password Attack against wp-login.php to avoid FP

2019-03-14 19:21:39 +00:00
parent e7925de5bc
commit 4f9822743c
3 changed files with 13 additions and 4 deletions
--- a/app/finders/passwords/wp_login.rb
+++ b/app/finders/passwords/wp_login.rb
@@ -10,7 +10,8 @@ module WPScan
        end

        def valid_credentials?(response)
-          response.code == 302
+          response.code == 302 &&
+            response.headers['Set-Cookie']&.any? { |cookie| cookie =~ /wordpress_logged_in_/i }
        end

        def errored_response?(response)