diff --git a/app/controllers/enumeration/cli_options.rb b/app/controllers/enumeration/cli_options.rb index 52e5d41a..ce37ade9 100644 --- a/app/controllers/enumeration/cli_options.rb +++ b/app/controllers/enumeration/cli_options.rb @@ -170,6 +170,12 @@ module WPScan ['--users-detection MODE', 'Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode.'], choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true + ), + OptRegexp.new( + [ + '--exclude-usernames REGEXP_OR_STRING', + 'Exclude usernames matching the Regexp/string (case insensitive). Regexp delimiters are not required.' + ], options: Regexp::IGNORECASE ) ] end diff --git a/app/finders/users.rb b/app/finders/users.rb index cfac4423..be91b521 100644 --- a/app/finders/users.rb +++ b/app/finders/users.rb @@ -11,6 +11,16 @@ require_relative 'users/yoast_seo_author_sitemap' module WPScan module Finders + # Specific Finders container to filter the usernames found + # and remove the ones matching ParsedCli.exclude_username if supplied + class UsersFinders < SameTypeFinders + def filter_findings + findings.delete_if { |user| ParsedCli.exclude_usernames.match?(user.username) } if ParsedCli.exclude_usernames + + findings + end + end + module Users # Users Finder class Base @@ -28,6 +38,10 @@ module WPScan Users::AuthorIdBruteForcing.new(target) << Users::LoginErrorMessages.new(target) end + + def finders + @finders ||= Finders::UsersFinders.new + end end end end diff --git a/app/finders/wp_version.rb b/app/finders/wp_version.rb index 77a9186d..8829221b 100644 --- a/app/finders/wp_version.rb +++ b/app/finders/wp_version.rb @@ -10,7 +10,7 @@ module WPScan module Finders # Specific Finders container to filter the version detected # and remove the one with low confidence to avoid false - # positive when there is not enought information to accurately + # positive when there is not enough information to accurately # determine it. class WpVersionFinders < UniqueFinders def filter_findings diff --git a/spec/app/controllers/enumeration_spec.rb b/spec/app/controllers/enumeration_spec.rb index 17d556a2..67ca32c8 100644 --- a/spec/app/controllers/enumeration_spec.rb +++ b/spec/app/controllers/enumeration_spec.rb @@ -76,7 +76,7 @@ describe WPScan::Controller::Enumeration do config_backups_list config_backups_detection db_exports_list db_exports_detection medias_detection - users_list users_detection] + users_list users_detection exclude_usernames] ) end end