From 6df2564d1a49c619e467853f5455a8e3ee61387a Mon Sep 17 00:00:00 2001 From: erwanlr Date: Thu, 18 Apr 2019 14:17:00 +0100 Subject: [PATCH] Improves Target#wordpress_hosted? --- lib/wpscan/errors/wordpress.rb | 2 +- lib/wpscan/target/platform/wordpress.rb | 13 +- .../wordpress/wordpress_hosted/matches.html | 232 ++++++++++++++++++ .../wordpress/wordpress_hosted/no_match.html | 2 + .../target/platform/wordpress.rb | 29 ++- 5 files changed, 274 insertions(+), 4 deletions(-) create mode 100644 spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html create mode 100644 spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html diff --git a/lib/wpscan/errors/wordpress.rb b/lib/wpscan/errors/wordpress.rb index 364524ad..a99b84a6 100644 --- a/lib/wpscan/errors/wordpress.rb +++ b/lib/wpscan/errors/wordpress.rb @@ -5,7 +5,7 @@ module WPScan # WordPress hosted (*.wordpress.com) class WordPressHosted < Standard def to_s - 'Scanning *.wordpress.com hosted blogs is not supported.' + 'The target appears to be hosted on WordPress.com. Scanning such site is not supported.' end end diff --git a/lib/wpscan/target/platform/wordpress.rb b/lib/wpscan/target/platform/wordpress.rb index 849e3e02..97d5f834 100644 --- a/lib/wpscan/target/platform/wordpress.rb +++ b/lib/wpscan/target/platform/wordpress.rb @@ -78,8 +78,19 @@ module WPScan multisite? ? url('wp-signup.php') : url('wp-login.php?action=register') end + # @return [ Boolean ] Whether or not the target is hosted on wordpress.com def wordpress_hosted? - /\.wordpress\.com$/i.match?(uri.host) ? true : false + return true if /\.wordpress\.com$/i.match?(uri.host) + + unless content_dir(:passive) + pattern = %r{https?://s\d\.wp\.com#{WORDPRESS_PATTERN}}i.freeze + + urls_from_page(homepage_res) do |url| + return true if url.match?(pattern) + end + end + + false end # @param [ String ] username diff --git a/spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html b/spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html new file mode 100644 index 00000000..bb91c4ca --- /dev/null +++ b/spec/fixtures/target/platform/wordpress/wordpress_hosted/matches.html @@ -0,0 +1,232 @@ + + + + + + +WP Lab + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + diff --git a/spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html b/spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html new file mode 100644 index 00000000..2637a721 --- /dev/null +++ b/spec/fixtures/target/platform/wordpress/wordpress_hosted/no_match.html @@ -0,0 +1,2 @@ + + diff --git a/spec/shared_examples/target/platform/wordpress.rb b/spec/shared_examples/target/platform/wordpress.rb index b827c40b..06a2c186 100644 --- a/spec/shared_examples/target/platform/wordpress.rb +++ b/spec/shared_examples/target/platform/wordpress.rb @@ -139,7 +139,9 @@ shared_examples WPScan::Target::Platform::WordPress do end describe '#wordpress_hosted?' do - its(:wordpress_hosted?) { should be false } + let(:fixtures) { super().join('wordpress_hosted') } + + # its(:wordpress_hosted?) { should be false } context 'when the target host matches' do let(:url) { 'http://ex.wordpress.com' } @@ -150,7 +152,30 @@ shared_examples WPScan::Target::Platform::WordPress do context 'when the target host doesn\'t matches' do let(:url) { 'http://ex-wordpress.com' } - its(:wordpress_hosted?) { should be false } + context 'when wp-content not detected' do + before do + expect(target).to receive(:content_dir).with(:passive).and_return(nil) + stub_request(:get, target.url).to_return(body: File.read(fixtures.join(fixture).to_s)) + end + + context 'when an URL matches a WP hosted' do + let(:fixture) { 'matches.html' } + + its(:wordpress_hosted?) { should be true } + end + + context 'when URLs don\'t match' do + let(:fixture) { 'no_match.html' } + + its(:wordpress_hosted?) { should be false } + end + end + + context 'when wp-content detected' do + before { expect(target).to receive(:content_dir).with(:passive).and_return('wp-content') } + + its(:wordpress_hosted?) { should be false } + end end end