Ref #53 Typhoeus > 0.4.2 support

lib/wpscan/modules/brute_force.rb

@@ -36,10 +36,11 @@ module BruteForce
       password_found = false
 
       File.open(wordlist_path, 'r').each do |password|
-
         # ignore file comments, but will miss passwords if they start with a hash...
         next if password[0, 1] == '#'
 
+        password.strip!
+
         # keep a count of the amount of requests to be sent
         request_count += 1
         queue_count   += 1
@@ -52,8 +53,8 @@ module BruteForce
         request = Browser.instance.forge_request(login_url,
           {
             method: :post,
-            params: { log: URI::encode(username), pwd: URI::encode(password) },
-            cache_timeout: 0
+            body: { log: URI::encode(username), pwd: URI::encode(password) },
+            cache_ttl: 0
           }
         )
 

lib/wpscan/modules/wp_config_backup.rb

@@ -23,10 +23,11 @@ module WpConfigBackup
   # See http://www.feross.org/cmsploit/
   # return an array of backup config files url
   def config_backup
-    found = []
-    backups = WpConfigBackup.config_backup_files
-    browser = Browser.instance
-    hydra = browser.hydra
+    found       = []
+    backups     = WpConfigBackup.config_backup_files
+    browser     = Browser.instance
+    hydra       = browser.hydra
+    queue_count = 0
 
     backups.each do |file|
       file_url = @uri.merge(URI.escape(file)).to_s
@@ -39,6 +40,12 @@ module WpConfigBackup
       end
 
       hydra.queue(request)
+      queue_count += 1
+
+      if queue_count == browser.max_threads
+        hydra.run
+        queue_count = 0
+      end
     end
 
     hydra.run

lib/wpscan/web_site.rb

@@ -48,12 +48,14 @@ class WebSite
 
   def xml_rpc_url
     unless @xmlrpc_url
-      headers = Browser.instance.get(@uri.to_s).headers_hash
-      value = headers['x-pingback']
-      if value.nil? or value.empty?
-        @xmlrpc_url = nil
-      else
-        @xmlrpc_url = value
+      headers     = Browser.instance.get(@uri.to_s).headers_hash
+      @xmlrpc_url = nil
+
+      unless headers.nil?
+        value = headers['X-Pingback']
+        unless value.nil? && value.empty?
+          @xmlrpc_url = value
+        end
       end
     end
     @xmlrpc_url