diff --git a/lib/wpscan/modules/web_site.rb b/lib/wpscan/modules/web_site.rb index 8b08ceea..cd0cf41a 100644 --- a/lib/wpscan/modules/web_site.rb +++ b/lib/wpscan/modules/web_site.rb @@ -32,8 +32,8 @@ module WebSite wordpress = true else response = Browser.instance.get( - xmlrpc_url(), - {:follow_location => true, :max_redirects => 2} + xml_rpc_url, + {:follow_location => true, :max_redirects => 2} ) if response.body =~ %r{XML-RPC server accepts POST requests only}i @@ -44,8 +44,21 @@ module WebSite wordpress end - def xmlrpc_url - @uri.merge("xmlrpc.php").to_s + def xml_rpc_url + unless @xmlrpc_url + headers = Browser.instance.get(@uri.to_s).headers_hash + value = headers["x-pingback"] + if value.nil? or value.empty? + @xmlrpc_url = nil + else + @xmlrpc_url = value + end + end + @xmlrpc_url + end + + def has_xml_rpc? + !xml_rpc_url.nil? end # Checks if the remote website is up. diff --git a/lib/wpscan/wp_target.rb b/lib/wpscan/wp_target.rb index baaf41dd..214e6c74 100644 --- a/lib/wpscan/wp_target.rb +++ b/lib/wpscan/wp_target.rb @@ -178,21 +178,4 @@ class WpTarget end @multisite end - - def xml_rpc_url - unless @xmlrpc_url - headers = Browser.instance.get(@uri).headers_hash - value = headers["x-pingback"] - if value.nil? or value.empty? - @xmlrpc_url = "nope" - else - @xmlrpc_url = value - end - end - @xmlrpc_url - end - - def xml_rpc_enabled - xml_rpc_url != "nope" - end end diff --git a/spec/lib/wpscan/modules/web_site_spec.rb b/spec/lib/wpscan/modules/web_site_spec.rb index cf70f984..c270bda4 100644 --- a/spec/lib/wpscan/modules/web_site_spec.rb +++ b/spec/lib/wpscan/modules/web_site_spec.rb @@ -17,10 +17,10 @@ #++ shared_examples_for "WebSite" do - let(:fixtures_dir) { SPEC_FIXTURES_WPSCAN_MODULES_DIR + '/web_site' } + let(:fixtures_dir) { SPEC_FIXTURES_WPSCAN_MODULES_DIR + "/web_site" } before :each do - @module = WpScanModuleSpec.new('http://example.localhost/') + @module = WpScanModuleSpec.new("http://example.localhost/") @module.extend(WebSite) end @@ -30,16 +30,39 @@ shared_examples_for "WebSite" do end end - describe "#xmlrpc_url" do + describe "#xml_rpc_url" do it "should return the correct url : http://example.localhost/xmlrpc.php" do - @module.xmlrpc_url.should === "http://example.localhost/xmlrpc.php" + xmlrpc = "http://example.localhost/xmlrpc.php" + stub_request(:get, "http://example.localhost/"). + to_return(:status => 200, :body => "", :headers => { "X-Pingback" => xmlrpc}) + @module.xml_rpc_url.should === xmlrpc + end + + it "should return nil" do + stub_request(:get, "http://example.localhost/").to_return(:status => 200) + @module.xml_rpc_url.should be_nil + end + end + + describe "#has_xml_rpc?" do + it "should return true" do + stub_request(:get, "http://example.localhost/"). + to_return(:status => 200, :body => "", :headers => { "X-Pingback" => "xmlrpc"}) + @module.has_xml_rpc?.should be_true + end + + it "should return false" do + stub_request(:get, "http://example.localhost/").to_return(:status => 200) + @module.has_xml_rpc?.should be_false end end describe "#is_wordpress?" do # each url (wp-login and xmlrpc) pointed to a 404 before :each do - [@module.login_url, @module.xmlrpc_url].each do |url| + stub_request(:get, @module.uri.to_s). + to_return(:status => 200, :body => "", :headers => { "X-Pingback" => @module.uri.merge("xmlrpc.php")}) + [@module.login_url, @module.xml_rpc_url].each do |url| stub_request(:get, url).to_return(:status => 404, :body => "") end end @@ -50,14 +73,14 @@ shared_examples_for "WebSite" do it "should return true if the wp-login is found and is a valid wordpress one" do stub_request(:get, @module.login_url). - to_return(:status => 200, :body => File.new(fixtures_dir + '/wp-login.php')) + to_return(:status => 200, :body => File.new(fixtures_dir + "/wp-login.php")) @module.is_wordpress?.should be_true end it "should return true if the xmlrpc is found" do - stub_request(:get, @module.xmlrpc_url). - to_return(:status => 200, :body => File.new(fixtures_dir + '/xmlrpc.php')) + stub_request(:get, @module.xml_rpc_url). + to_return(:status => 200, :body => File.new(fixtures_dir + "/xmlrpc.php")) @module.is_wordpress?.should be_true end diff --git a/wpscan.rb b/wpscan.rb index ddb516a4..e8c0361a 100755 --- a/wpscan.rb +++ b/wpscan.rb @@ -144,7 +144,7 @@ begin puts green("[+]") + " User registration is enabled" end - if wp_target.xml_rpc_enabled + if wp_target.has_xml_rpc? puts green("[+]") + " XML-RPC Interface available under #{wp_target.xml_rpc_url}" end