fix registration detection

rspec tests

lib/wpscan/wp_target.rb

@@ -138,32 +138,42 @@ class WpTarget
   # Should check wp-login.php if registration is enabled or not
   def registration_enabled?
     resp = Browser.instance.get(registration_url)
-    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/
+    # redirect only on non multi sites
+    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/i
       enabled = false
-    else
+    # multi site registration form
+    elsif resp.code == 200 and resp.body =~ /<form id="setupform" method="post" action="[^"]*wp-signup\.php[^"]*">/i
       enabled = true
+    # normal registration form
+    elsif resp.code == 200 and resp.body =~ /<form name="registerform" id="registerform" action="[^"]*wp-login\.php[^"]*"/i
+      enabled = true
+    # registration disabled
+    else
+      enabled = false
     end
     enabled
   end
 
   def registration_url
-    @uri.merge("wp-login.php?action=register")
+    is_multisite? ? @uri.merge("wp-signup.php") : @uri.merge("wp-login.php?action=register")
   end
 
   def is_multisite?
-    # when multisite, there is no redirection or a redirect to the site itself
+    unless @multisite
-    # otherwise redirect to wp-login.php
+      # when multi site, there is no redirection or a redirect to the site itself
-    url = @uri.merge("wp-signup.php")
+      # otherwise redirect to wp-login.php
-    resp = Browser.instance.get(url)
+      url = @uri.merge("wp-signup.php")
-    if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?action=register/
+      resp = Browser.instance.get(url)
-      multisite = false
+      if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?action=register/
-    elsif resp.code == 302 and resp.headers_hash["location"] =~ /wp-signup\.php/
+        @multisite = false
-      multisite = true
+      elsif resp.code == 302 and resp.headers_hash["location"] =~ /wp-signup\.php/
-    elsif resp.code == 200
+        @multisite = true
-      multisite = true
+      elsif resp.code == 200
-    else
+        @multisite = true
-      multisite = false
+      else
+        @multisite = false
+      end
     end
-    multisite
+    @multisite
   end
 end

spec/lib/wpscan/wp_target_spec.rb

@@ -246,21 +246,54 @@ describe WpTarget do
   end
 
   describe "#registration_url" do
-    it "should return the correct url" do
+    it "should return the correct url (multisite)" do
+      # set to multi site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 200)
+      @wp_target.registration_url.to_s.should == "http://example.localhost/wp-signup.php"
+    end
+
+    it "should return the correct url (not multisite)" do
+      # set to single site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" })
       @wp_target.registration_url.to_s.should == "http://example.localhost/wp-login.php?action=register"
     end
   end
 
   describe "#registration_enabled?" do
-    it "should return false" do
+    it "should return false (multisite)" do
+      # set to multi site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 200)
       stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 302, :headers => { "Location" => "wp-login.php?registration=disabled" })
       @wp_target.registration_enabled?.should be_false
     end
 
-    it "should return true" do
+    it "should return true (multisite)" do
-      stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 200)
+      # set to multi site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 200)
+      stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 200, :body => %{<form id="setupform" method="post" action="wp-signup.php">})
       @wp_target.registration_enabled?.should be_true
     end
+
+    it "should return false (not multisite)" do
+      # set to single site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" })
+      stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 302, :headers => { "Location" => "wp-login.php?registration=disabled" })
+      @wp_target.registration_enabled?.should be_false
+    end
+
+    it "should return true (not multisite)" do
+      # set to single site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" })
+      stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 200, :body => %{<form name="registerform" id="registerform" action="wp-login.php"})
+      @wp_target.registration_enabled?.should be_true
+    end
+
+    it "should return false" do
+      # set to single site
+      stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" })
+      stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 500)
+      @wp_target.registration_enabled?.should be_false
+    end
   end
 
   describe "#is_multisite?" do
@@ -282,5 +315,10 @@ describe WpTarget do
       stub_request(:any, @url).to_return(:status => 200)
       @wp_target.is_multisite?.should be_true
     end
+
+    it "should return false" do
+      stub_request(:any, @url).to_return(:status => 500)
+      @wp_target.is_multisite?.should be_false
+    end
   end
 end