garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixes #1318

Browse Source
This commit is contained in:
erwanlr
2019-03-20 08:41:39 +00:00
parent 5f2b8f8a2e
commit 6304fe4c19
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/wpscan/target/platform/wordpress/custom_directories.rb
View File

@@ -15,7 +15,7 @@ module WPScan
def content_dir
unless @content_dir
escaped_url = Regexp.escape(url).gsub(/https?/i, 'https?')
pattern = %r{#{escaped_url}([^\/]+)\/(?:themes|plugins|uploads|cache)\/}i
pattern = %r{#{escaped_url}([\w\s\-\/]+)\/(?:themes|plugins|uploads|cache)\/}i
in_scope_urls(homepage_res) do |url|
return @content_dir = Regexp.last_match[1] if url.match(pattern)

6
spec/fixtures/target/platform/wordpress/custom_directories/relative_two_sub_dir.html vendored Normal file
View File

@@ -0,0 +1,6 @@
<link rel='https://api.w.org/' href='https://ex.lo/wp-json/' />
<link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://ex.lo/cms/xmlrpc.php?rsd" />
<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://ex.lo/cms/wp-includes/wlwmanifest.xml" />
<link rel="shortcut icon" href="//ex.lo/cms/wp-content/uploads/2011/10/favicon.ico">
<link rel="apple-touch-icon-precomposed" href="//ex.lo/cms/wp-content/uploads/2011/10/favicon.ico">

4
spec/shared_examples/target/platform/wordpress/custom_directories.rb
View File

@@ -5,7 +5,7 @@ shared_examples 'WordPress::CustomDirectories' do
{
default: 'wp-content', https: 'wp-content', custom_w_spaces: 'custom content spaces',
relative_one: 'wp-content', relative_two: 'wp-content', cache: 'wp-content',
in_raw_js: 'wp-content', with_sub_dir: 'app'
in_raw_js: 'wp-content', with_sub_dir: 'app', relative_two_sub_dir: 'cms/wp-content'
}.each do |file, expected|
it "returns #{expected} for #{file}.html" do
stub_request(:get, target.url).to_return(body: File.read(fixtures.join("#{file}.html")))
@@ -47,7 +47,7 @@ shared_examples 'WordPress::CustomDirectories' do
end
describe '#sub_dir' do
{ default: false, with_sub_dir: 'wp' }.each do |file, expected|
{ default: false, with_sub_dir: 'wp', relative_two_sub_dir: 'cms' }.each do |file, expected|
it "returns #{expected} for #{file}.html" do
fixture = File.join(fixtures, "#{file}.html")