diff --git a/lib/wpscan/wp_target/wp_full_path_disclosure.rb b/lib/wpscan/wp_target/wp_full_path_disclosure.rb index 2e97b404..9a3a23e8 100644 --- a/lib/wpscan/wp_target/wp_full_path_disclosure.rb +++ b/lib/wpscan/wp_target/wp_full_path_disclosure.rb @@ -11,6 +11,11 @@ class WpTarget < WebSite response.body[%r{Fatal error}i] ? true : false end + def full_path_disclosure_data + return nil unless has_full_path_disclosure? + Browser.get(full_path_disclosure_url()).body[%r{([^<]+\.php)}, 1] + end + # @return [ String ] def full_path_disclosure_url @uri.merge('wp-includes/rss-functions.php').to_s diff --git a/wpscan.rb b/wpscan.rb index 1e6f9cd0..10722a88 100755 --- a/wpscan.rb +++ b/wpscan.rb @@ -167,7 +167,7 @@ def main end if wp_target.has_full_path_disclosure? - puts warning("Full Path Disclosure (FPD) in: '#{wp_target.full_path_disclosure_url}'") + puts warning("Full Path Disclosure (FPD) in '#{wp_target.full_path_disclosure_url}': #{wp_target.full_path_disclosure_data}") end if wp_target.has_debug_log?