diff --git a/lib/wpscan/errors/wordpress.rb b/lib/wpscan/errors/wordpress.rb
index 364524ad..a99b84a6 100644
--- a/lib/wpscan/errors/wordpress.rb
+++ b/lib/wpscan/errors/wordpress.rb
@@ -5,7 +5,7 @@ module WPScan
# WordPress hosted (*.wordpress.com)
class WordPressHosted < Standard
def to_s
- 'Scanning *.wordpress.com hosted blogs is not supported.'
+ 'The target appears to be hosted on WordPress.com. Scanning such site is not supported.'
end
end
diff --git a/lib/wpscan/target/platform/wordpress.rb b/lib/wpscan/target/platform/wordpress.rb
index 849e3e02..97d5f834 100644
--- a/lib/wpscan/target/platform/wordpress.rb
+++ b/lib/wpscan/target/platform/wordpress.rb
@@ -78,8 +78,19 @@ module WPScan
multisite? ? url('wp-signup.php') : url('wp-login.php?action=register')
end
+ # @return [ Boolean ] Whether or not the target is hosted on wordpress.com
def wordpress_hosted?
- /\.wordpress\.com$/i.match?(uri.host) ? true : false
+ return true if /\.wordpress\.com$/i.match?(uri.host)
+
+ unless content_dir(:passive)
+ pattern = %r{https?://s\d\.wp\.com#{WORDPRESS_PATTERN}}i.freeze
+
+ urls_from_page(homepage_res) do |url|
+ return true if url.match?(pattern)
+ end
+ end
+
+ false
end
# @param [ String ] username
diff --git a/spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html b/spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html
new file mode 100644
index 00000000..bb91c4ca
--- /dev/null
+++ b/spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html
@@ -0,0 +1,232 @@
+
+
+
+
+
+
+WP Lab
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html b/spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html
new file mode 100644
index 00000000..2637a721
--- /dev/null
+++ b/spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html
@@ -0,0 +1,2 @@
+
+
diff --git a/spec/shared_examples/target/platform/wordpress.rb b/spec/shared_examples/target/platform/wordpress.rb
index b827c40b..06a2c186 100644
--- a/spec/shared_examples/target/platform/wordpress.rb
+++ b/spec/shared_examples/target/platform/wordpress.rb
@@ -139,7 +139,9 @@ shared_examples WPScan::Target::Platform::WordPress do
end
describe '#wordpress_hosted?' do
- its(:wordpress_hosted?) { should be false }
+ let(:fixtures) { super().join('wordpress_hosted') }
+
+ # its(:wordpress_hosted?) { should be false }
context 'when the target host matches' do
let(:url) { 'http://ex.wordpress.com' }
@@ -150,7 +152,30 @@ shared_examples WPScan::Target::Platform::WordPress do
context 'when the target host doesn\'t matches' do
let(:url) { 'http://ex-wordpress.com' }
- its(:wordpress_hosted?) { should be false }
+ context 'when wp-content not detected' do
+ before do
+ expect(target).to receive(:content_dir).with(:passive).and_return(nil)
+ stub_request(:get, target.url).to_return(body: File.read(fixtures.join(fixture).to_s))
+ end
+
+ context 'when an URL matches a WP hosted' do
+ let(:fixture) { 'matches.html' }
+
+ its(:wordpress_hosted?) { should be true }
+ end
+
+ context 'when URLs don\'t match' do
+ let(:fixture) { 'no_match.html' }
+
+ its(:wordpress_hosted?) { should be false }
+ end
+ end
+
+ context 'when wp-content detected' do
+ before { expect(target).to receive(:content_dir).with(:passive).and_return('wp-content') }
+
+ its(:wordpress_hosted?) { should be false }
+ end
end
end