Adds the --usernames option - Fixes #739

lib/wpscan/wpscan_helper.rb

@@ -99,6 +99,7 @@ def help
   puts '--basic-auth <username:password>    Set the HTTP Basic authentication.'
   puts '--wordlist | -w <wordlist>          Supply a wordlist for the password bruter and do the brute.'
   puts '--username | -U <username>          Only brute force the supplied username.'
+  puts '--usernames     <path-to-file>      Only brute force the usernames from the file.'
   puts '--threads  | -t <number of threads> The number of threads to use when multi-threading requests.'
   puts '--cache-ttl       <cache-ttl>       Typhoeus cache TTL.'
   puts '--request-timeout <request-timeout> Request Timeout.'

lib/wpscan/wpscan_options.rb

@@ -23,6 +23,7 @@ class WpscanOptions
     :update,
     :verbose,
     :username,
+    :usernames,
     :password,
     :follow_redirection,
     :wp_content_dir,
@@ -68,6 +69,12 @@ class WpscanOptions
     end
   end
 
+  def usernames=(file)
+    fail "The file #{file} does not exist" unless File.exists?(file)
+
+    @usernames = file
+  end
+
   def proxy=(proxy)
     if proxy.index(':') == nil
       raise 'Invalid proxy format. Should be host:port.'
@@ -237,6 +244,7 @@ class WpscanOptions
       ['--url', '-u', GetoptLong::REQUIRED_ARGUMENT],
       ['--enumerate', '-e', GetoptLong::OPTIONAL_ARGUMENT],
       ['--username', '-U', GetoptLong::REQUIRED_ARGUMENT],
+      ['--usernames', GetoptLong::REQUIRED_ARGUMENT],
       ['--wordlist', '-w', GetoptLong::REQUIRED_ARGUMENT],
       ['--threads', '-t', GetoptLong::REQUIRED_ARGUMENT],
       ['--force', '-f', GetoptLong::NO_ARGUMENT],