fix registration detection

rspec tests

lib/wpscan/wp_target.rb

@@ -138,32 +138,42 @@ class WpTarget
   # Should check wp-login.php if registration is enabled or not
   def registration_enabled?
     resp = Browser.instance.get(registration_url)
-    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/
+    # redirect only on non multi sites
+    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/i
       enabled = false
-    else
+    # multi site registration form
+    elsif resp.code == 200 and resp.body =~ /<form id="setupform" method="post" action="[^"]*wp-signup\.php[^"]*">/i
       enabled = true
+    # normal registration form
+    elsif resp.code == 200 and resp.body =~ /<form name="registerform" id="registerform" action="[^"]*wp-login\.php[^"]*"/i
+      enabled = true
+    # registration disabled
+    else
+      enabled = false
     end
     enabled
   end
 
   def registration_url
-    @uri.merge("wp-login.php?action=register")
+    is_multisite? ? @uri.merge("wp-signup.php") : @uri.merge("wp-login.php?action=register")
   end
 
   def is_multisite?
-    # when multisite, there is no redirection or a redirect to the site itself
-    # otherwise redirect to wp-login.php
-    url = @uri.merge("wp-signup.php")
-    resp = Browser.instance.get(url)
-    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?action=register/
-      multisite = false
-    elsif resp.code == 302 and resp.headers_hash["location"] =~ /wp-signup\.php/
-      multisite = true
-    elsif resp.code == 200
-      multisite = true
-    else
-      multisite = false
+    unless @multisite
+      # when multi site, there is no redirection or a redirect to the site itself
+      # otherwise redirect to wp-login.php
+      url = @uri.merge("wp-signup.php")
+      resp = Browser.instance.get(url)
+      if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?action=register/
+        @multisite = false
+      elsif resp.code == 302 and resp.headers_hash["location"] =~ /wp-signup\.php/
+        @multisite = true
+      elsif resp.code == 200
+        @multisite = true
+      else
+        @multisite = false
+      end
     end
-    multisite
+    @multisite
   end
 end