diff --git a/lib/wpscan/web_site.rb b/lib/wpscan/web_site.rb index 3448f494..d5fc81c7 100644 --- a/lib/wpscan/web_site.rb +++ b/lib/wpscan/web_site.rb @@ -1,9 +1,11 @@ # encoding: UTF-8 require 'web_site/robots_txt' +require 'web_site/interesting_headers' class WebSite include WebSite::RobotsTxt + include WebSite::InterestingHeaders attr_reader :uri diff --git a/lib/wpscan/wp_target/interesting_headers.rb b/lib/wpscan/web_site/interesting_headers.rb similarity index 68% rename from lib/wpscan/wp_target/interesting_headers.rb rename to lib/wpscan/web_site/interesting_headers.rb index 9f1ba90d..31f826da 100644 --- a/lib/wpscan/wp_target/interesting_headers.rb +++ b/lib/wpscan/web_site/interesting_headers.rb @@ -1,6 +1,6 @@ # encoding: UTF-8 -class WpTarget < WebSite +class WebSite module InterestingHeaders # Checks for interesting headers @@ -8,10 +8,15 @@ class WpTarget < WebSite def interesting_headers response = Browser.head(@uri.to_s) headers = response.headers - InterestingHeaders.known_headers.each do |h| - headers.delete(h) + # Header Names are case insensitve so convert them to upcase + headers_uppercase = headers.inject({}) do |hash, keys| + hash[keys[0].upcase] = keys[1] + hash end - headers.to_a.compact.sort + InterestingHeaders.known_headers.each do |h| + headers_uppercase.delete(h.upcase) + end + headers_uppercase.to_a.compact.sort end protected @@ -25,7 +30,6 @@ class WpTarget < WebSite Content-Length Connection Etag - ETag Expires Last-Modified Pragma diff --git a/lib/wpscan/wp_target.rb b/lib/wpscan/wp_target.rb index 4c530c3a..ebc7197d 100644 --- a/lib/wpscan/wp_target.rb +++ b/lib/wpscan/wp_target.rb @@ -6,7 +6,6 @@ require 'wp_target/wp_readme' require 'wp_target/wp_registrable' require 'wp_target/wp_config_backup' require 'wp_target/wp_login_protection' -require 'wp_target/interesting_headers' require 'wp_target/wp_custom_directories' require 'wp_target/wp_full_path_disclosure' @@ -16,7 +15,6 @@ class WpTarget < WebSite include WpTarget::WpRegistrable include WpTarget::WpConfigBackup include WpTarget::WpLoginProtection - include WpTarget::InterestingHeaders include WpTarget::WpCustomDirectories include WpTarget::WpFullPathDisclosure diff --git a/spec/lib/wpscan/web_site_spec.rb b/spec/lib/wpscan/web_site_spec.rb index 26181a2a..c9e62eb5 100644 --- a/spec/lib/wpscan/web_site_spec.rb +++ b/spec/lib/wpscan/web_site_spec.rb @@ -7,6 +7,7 @@ describe 'WebSite' do subject(:web_site) { WebSite.new('http://example.localhost/') } it_behaves_like 'WebSite::RobotsTxt' + it_behaves_like 'WebSite::InterestingHeaders' before :all do Browser::reset diff --git a/spec/lib/wpscan/wp_target_spec.rb b/spec/lib/wpscan/wp_target_spec.rb index 7ee4e3d2..b852790f 100644 --- a/spec/lib/wpscan/wp_target_spec.rb +++ b/spec/lib/wpscan/wp_target_spec.rb @@ -23,7 +23,6 @@ describe WpTarget do it_behaves_like 'WpTarget::WpRegistrable' it_behaves_like 'WpTarget::WpConfigBackup' it_behaves_like 'WpTarget::WpLoginProtection' - it_behaves_like 'WpTarget::InterestingHeaders' it_behaves_like 'WpTarget::WpCustomDirectories' it_behaves_like 'WpTarget::WpFullPathDisclosure' diff --git a/spec/shared_examples/wp_target/interesting_headers.rb b/spec/shared_examples/web_site/interesting_headers.rb similarity index 56% rename from spec/shared_examples/wp_target/interesting_headers.rb rename to spec/shared_examples/web_site/interesting_headers.rb index bd65c1be..75c73d53 100644 --- a/spec/shared_examples/wp_target/interesting_headers.rb +++ b/spec/shared_examples/web_site/interesting_headers.rb @@ -1,27 +1,27 @@ # encoding: UTF-8 -shared_examples 'WpTarget::InterestingHeaders' do +shared_examples 'WebSite::InterestingHeaders' do - let(:known_headers) { WpTarget::InterestingHeaders.known_headers } + let(:known_headers) { WebSite::InterestingHeaders.known_headers } describe '#interesting_headers' do it 'returns MyTestHeader' do - stub_request(:head, wp_target.url). + stub_request(:head, web_site.url). to_return(status: 200, headers: { 'Mytestheader' => 'Mytestheadervalue' }) - wp_target.interesting_headers.should =~ [ [ 'Mytestheader', 'Mytestheadervalue' ] ] + web_site.interesting_headers.should =~ [ [ 'MYTESTHEADER', 'Mytestheadervalue' ] ] end it 'removes known headers' do - stub_request(:head, wp_target.url). + stub_request(:head, web_site.url). to_return(status: 200, headers: { 'Location' => 'a', 'Connection' => 'Close' }) - wp_target.interesting_headers.should be_empty + web_site.interesting_headers.should be_empty end it 'returns nothing' do - stub_request(:head, wp_target.url). + stub_request(:head, web_site.url). to_return(status: 200, headers: { }) - wp_target.interesting_headers.should be_empty + web_site.interesting_headers.should be_empty end end