-# File lib/browser.rb, line 57 +# File lib/browser.rb, line 58 def self.instance(options = {}) unless @@instance @@instance = new(options) @@ -330,7 +337,7 @@diff --git a/doc/Updater.html b/doc/Updater.html index 9318f8ee..590e8588 100644 --- a/doc/Updater.html +++ b/doc/Updater.html @@ -91,6 +91,8 @@-# File lib/browser.rb, line 64 +# File lib/browser.rb, line 65 def self.reset @@instance = nil end@@ -369,11 +376,11 @@@@ -405,10 +412,10 @@-# File lib/browser.rb, line 140 +# File lib/browser.rb, line 142 def forge_request(url, params = {}) Typhoeus::Request.new( - url.to_s, - merge_request_params(params) + url.to_s, + merge_request_params(params) ) end@@ -443,7 +450,7 @@ browser object, hydra will not have the new @max_threads and-# File lib/browser.rb, line 128 +# File lib/browser.rb, line 130 def get(url, params = {}) run_request( - forge_request(url, params.merge(:method => :get)) + forge_request(url, params.merge(:method => :get)) ) end@@ -337,8 +339,7 @@ dirs = get_root_directories end urls = get_svn_project_urls(dirs) - entries = get_svn_file_entries(urls) - return entries + get_svn_file_entries(urls) end-# File lib/browser.rb, line 101 +# File lib/browser.rb, line 102 def load_config(config_file = nil) @config_file = config_file || @config_file @@ -484,7 +491,7 @@ browser object, hydra will not have the new @max_threads anddiff --git a/doc/Svn_Parser.html b/doc/Svn_Parser.html index 5728744f..42dfdb12 100644 --- a/doc/Svn_Parser.html +++ b/doc/Svn_Parser.html @@ -85,6 +85,8 @@-# File lib/browser.rb, line 93 +# File lib/browser.rb, line 94 def max_threads=(max_threads) if max_threads.nil? or max_threads <= 0 max_threads = 1 @@ -520,17 +527,17 @@ browser object, hydra will not have the new @max_threads and@@ -299,7 +319,7 @@-# File lib/browser.rb, line 147 +# File lib/browser.rb, line 149 def merge_request_params(params = {}) if @proxy params = params.merge(:proxy => @proxy) end - if !params.has_key?(:disable_ssl_host_verification) + unless params.has_key?(:disable_ssl_host_verification) params = params.merge(:disable_ssl_host_verification => true) end - if !params.has_key?(:disable_ssl_peer_verification) + unless params.has_key?(:disable_ssl_peer_verification) params = params.merge(:disable_ssl_peer_verification => true) end @@ -541,7 +548,7 @@ browser object, hydra will not have the new @max_threads and end # Used to enable the cache system if :cache_timeout > 0 - if !params.has_key?(:cache_timeout) + unless params.has_key?(:cache_timeout) params = params.merge(:cache_timeout => @cache_timeout) end @@ -576,10 +583,10 @@ browser object, hydra will not have the new @max_threads and@@ -611,15 +618,15 @@ browser object, hydra will not have the new @max_threads and-# File lib/browser.rb, line 134 +# File lib/browser.rb, line 136 def post(url, params = {}) run_request( - forge_request(url, params.merge(:method => :post)) + forge_request(url, params.merge(:method => :post)) ) end@@ -452,7 +453,7 @@ parse the response for the names.-# File lib/browser.rb, line 81 +# File lib/browser.rb, line 82 def user_agent case @user_agent_mode - when "semi-static" - unless @user_agent + when "semi-static" + unless @user_agent + @user_agent = @available_user_agents.sample + end + when "random" @user_agent = @available_user_agents.sample - end - when "random" - @user_agent = @available_user_agents.sample end @user_agent end@@ -652,11 +659,11 @@ browser object, hydra will not have the new @max_threads and@@ -411,17 +413,16 @@ parse the response for the names. @hydra.queue(request) if queue_count == @browser.max_threads - @hydra.run - queue_count = 0 - end + @hydra.run + queue_count = 0 + end end @hydra.run found_items.sort! - found_items.uniq! - return found_items + found_items.uniq end-# File lib/browser.rb, line 68 +# File lib/browser.rb, line 69 def user_agent_mode=(ua_mode) ua_mode ||= "static" - if @@user_agent_modes.include?(ua_mode) + if USER_AGENT_MODES.include?(ua_mode) @user_agent_mode = ua_mode # For semi-static user agent mode, the user agent has to be nil the first time (it will be set with the getter) @user_agent = nil if ua_mode === "semi-static" diff --git a/doc/BruteForce.html b/doc/BruteForce.html index de5d7045..4cd89924 100644 --- a/doc/BruteForce.html +++ b/doc/BruteForce.html @@ -77,6 +77,8 @@CREDITS +Gemfile +README @@ -304,21 +306,21 @@ on large wordlists, although bareable. if response.body =~ /login_error/ puts "\nIncorrect username and/or password." if @verbose elsif response.code == 302 - puts "\n [SUCCESS] Username : #{username} Password : #{password}\n" + puts "\n " + green("[SUCCESS]") + " Username : #{username} Password : #{password}\n" found << { :name => username, :password => password } password_found = true elsif response.timed_out? - puts "ERROR: Request timed out." + puts red("ERROR:") + " Request timed out." elsif response.code == 0 - puts "ERROR: No response from remote server. WAF/IPS?" + puts red("ERROR:") + " No response from remote server. WAF/IPS?" # code is a fixnum, needs a string for regex elsif response.code.to_s =~ /^50/ - puts "ERROR: Server error, try reducing the number of threads." + puts red("ERROR:") + " Server error, try reducing the number of threads." else - puts "\nERROR: We recieved an unknown response for #{password}..." + puts "\n" + red("ERROR:") + " We recieved an unknown response for #{password}..." if @verbose - puts "Code: #{response.code.to_s}" - puts "Body: #{response.body}" + puts red("Code: #{response.code.to_s}") + puts red("Body: #{response.body}") puts end end diff --git a/doc/CREDITS.html b/doc/CREDITS.html index 725d9ef4..de771b21 100644 --- a/doc/CREDITS.html +++ b/doc/CREDITS.html @@ -41,6 +41,8 @@CREDITS +Gemfile +README diff --git a/doc/CacheFileStore.html b/doc/CacheFileStore.html index 24ca0e9f..8d0b8139 100644 --- a/doc/CacheFileStore.html +++ b/doc/CacheFileStore.html @@ -91,6 +91,8 @@CREDITS +Gemfile +README @@ -276,10 +278,10 @@ binary format Marshal does not need any “require” # File lib/cache_file_store.rb, line 34 def initialize(storage_path, serializer = Marshal) @storage_path = File.expand_path(storage_path) - @serializer = serializer + @serializer = serializer # File.directory? for ruby <= 1.9 otherwise, it makes more sense to do Dir.exist? :/ - if !File.directory?(@storage_path) + unless File.directory?(@storage_path) Dir.mkdir(@storage_path) end end @@ -425,7 +427,7 @@ binary format Marshal does not need any “require”# File lib/cache_file_store.rb, line 58 def write_entry(key, data_to_store, cache_timeout) - if (cache_timeout > 0) + if cache_timeout > 0 File.open(get_entry_file_path(key), 'w') do |f| f.write(@serializer.dump(data_to_store)) end diff --git a/doc/Exploit.html b/doc/Exploit.html index 487ea20d..d1f36c7f 100644 --- a/doc/Exploit.html +++ b/doc/Exploit.html @@ -109,6 +109,8 @@CREDITS +Gemfile +README @@ -441,7 +443,7 @@ session_spawn_timer = Time.new while sessions.nil? or sessions.empty? # wait for a session to spawn with a timeout of 1 minute - if (Time.now - session_spawn_timer > 60) + if Time.now - session_spawn_timer > 60 puts "[ERROR] Session was not created... exiting." return false end diff --git a/doc/Generate_List.html b/doc/Generate_List.html index 5c6c747a..e27b93d9 100644 --- a/doc/Generate_List.html +++ b/doc/Generate_List.html @@ -91,6 +91,8 @@CREDITS +Gemfile +README @@ -263,23 +265,23 @@ # File lib/wpstools/generate_list.rb, line 27 def initialize(type, verbose) if type =~ /plugins/ - @type = "plugin" - @svn_url = 'http://plugins.svn.wordpress.org/' - @file_name = DATA_DIR + '/plugins.txt' - @popular_url = 'http://wordpress.org/extend/plugins/browse/popular/' - @popular_regex = %{<h3><a href="http://wordpress.org/extend/plugins/(.+)/">.+</a></h3>} + @type = "plugin" + @svn_url = 'http://plugins.svn.wordpress.org/' + @file_name = DATA_DIR + '/plugins.txt' + @popular_url = 'http://wordpress.org/extend/plugins/browse/popular/' + @popular_regex = %{<h3><a href="http://wordpress.org/extend/plugins/(.+)/">.+</a></h3>} elsif type =~ /themes/ - @type = "theme" - @svn_url = 'http://themes.svn.wordpress.org/' - @file_name = DATA_DIR + '/themes.txt' - @popular_url = 'http://wordpress.org/extend/themes/browse/popular/' - @popular_regex = %{<h3><a href="http://wordpress.org/extend/themes/(.+)">.+</a></h3>} + @type = "theme" + @svn_url = 'http://themes.svn.wordpress.org/' + @file_name = DATA_DIR + '/themes.txt' + @popular_url = 'http://wordpress.org/extend/themes/browse/popular/' + @popular_regex = %{<h3><a href="http://wordpress.org/extend/themes/(.+)">.+</a></h3>} else raise "Type #{type} not defined" end - @verbose = verbose - @browser = Browser.instance - @hydra = @browser.hydra + @verbose = verbose + @browser = Browser.instance + @hydra = @browser.hydra end@@ -265,8 +285,8 @@-# File lib/wpstools/generate_list.rb, line 100 +# File lib/wpstools/generate_list.rb, line 99 def save(items) items.sort! items.uniq! diff --git a/doc/GitUpdater.html b/doc/GitUpdater.html index 2dfd95bc..878ac76c 100644 --- a/doc/GitUpdater.html +++ b/doc/GitUpdater.html @@ -89,6 +89,8 @@CREDITS +Gemfile +README diff --git a/doc/Malwares.html b/doc/Malwares.html index 0e3d196a..f679e02a 100644 --- a/doc/Malwares.html +++ b/doc/Malwares.html @@ -81,6 +81,8 @@CREDITS +Gemfile +README @@ -333,8 +335,8 @@ # File lib/wpscan/modules/malwares.rb, line 28 def malwares(malwares_file_path = nil) if @malwares.nil? - malwares_found = [] - malwares_file = Malwares.malwares_file(malwares_file_path) + malwares_found = [] + malwares_file = Malwares.malwares_file(malwares_file_path) index_page_body = Browser.instance.get(@uri.to_s).body File.open(malwares_file, 'r') do |file| diff --git a/doc/Object.html b/doc/Object.html index 6bf2cd25..f6593bfd 100644 --- a/doc/Object.html +++ b/doc/Object.html @@ -77,10 +77,16 @@#banner +#colorize +#get_equal_string_end +#green +#help +#red +#require_files_from_directory #usage @@ -101,6 +107,8 @@CREDITS +Gemfile +README @@ -372,7 +380,7 @@+-# File lib/common_helper.rb, line 105 +# File lib/common_helper.rb, line 106 def banner() puts '____________________________________________________' puts " __ _______ _____ " @@ -401,6 +409,39 @@+ + + ++ ++ colorize(text, color_code) + click to toggle source ++ + ++ + + + + ++ + + + +++ ++# File lib/common_helper.rb, line 125 +def colorize(text, color_code) + "\e[#{color_code}m#{text}\e[0m" +end+@@ -435,7 +476,7 @@ break end end - if looping == false or (counter * -1 ) > base.length + if looping == false or (counter * -1) > base.length break end already_found = "#{character if character}#{already_found}" @@ -454,6 +495,39 @@++ + + ++ + ++ green(text) + click to toggle source ++ + ++ + + + + ++ + + + +++ ++# File lib/common_helper.rb, line 133 +def green(text) + colorize(text, 32) +end++ + + ++ ++ red(text) + click to toggle source ++ + ++ + + + + ++ + + + +++ ++# File lib/common_helper.rb, line 129 +def red(text) + colorize(text, 31) +end+diff --git a/doc/README.html b/doc/README.html index 0b0eca7b..dba47cfd 100644 --- a/doc/README.html +++ b/doc/README.html @@ -41,6 +41,8 @@@@ -414,11 +414,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_includeCREDITS +Gemfile +README diff --git a/doc/RpcClient.html b/doc/RpcClient.html index 8d018161..1402ac61 100644 --- a/doc/RpcClient.html +++ b/doc/RpcClient.html @@ -109,6 +109,8 @@CREDITS +Gemfile +README @@ -344,11 +346,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include@@ -382,8 +383,7 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include # File lib/wpscan/msfrpc_client.rb, line 72 def get_exploit_info(name) authenticate() - result = @server.call('module.info', @auth_token, 'exploit', name) - return result + @server.call('module.info', @auth_token, 'exploit', name) end-# File lib/wpscan/msfrpc_client.rb, line 96 +# File lib/wpscan/msfrpc_client.rb, line 93 def exploit(name, opts) authenticate() - result = @server.call('module.execute', @auth_token, 'exploit', name, opts) - return result + @server.call('module.execute', @auth_token, 'exploit', name, opts) end@@ -449,11 +448,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 80 +# File lib/wpscan/msfrpc_client.rb, line 79 def get_options(name) authenticate() - result = @server.call('module.options', @auth_token, 'exploit',name) - return result + @server.call('module.options', @auth_token, 'exploit',name) end@@ -484,11 +482,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 88 +# File lib/wpscan/msfrpc_client.rb, line 86 def get_payloads(name) authenticate() - result = @server.call('module.compatible_payloads', @auth_token, name) - return result + @server.call('module.compatible_payloads', @auth_token, name) end@@ -519,11 +516,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 104 +# File lib/wpscan/msfrpc_client.rb, line 100 def jobs() authenticate() - result = @server.call('job.list', @auth_token) - return result + @server.call('job.list', @auth_token) end@@ -597,11 +593,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 120 +# File lib/wpscan/msfrpc_client.rb, line 114 def kill_session(id) authenticate() - result = @server.call('session.stop', @auth_token, id) - return result + @server.call('session.stop', @auth_token, id) end@@ -632,11 +627,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 142 +# File lib/wpscan/msfrpc_client.rb, line 133 def meterpreter_read(id) authenticate() - result = @server.call('session.meterpreter_read', @auth_token, id) - return result + @server.call('session.meterpreter_read', @auth_token, id) end@@ -667,11 +661,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 148 +# File lib/wpscan/msfrpc_client.rb, line 138 def meterpreter_write(id, data) authenticate() - result = @server.call('session.meterpreter_write', @auth_token, id, data) - return result + @server.call('session.meterpreter_write', @auth_token, id, data) end@@ -702,11 +695,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 128 +# File lib/wpscan/msfrpc_client.rb, line 121 def read_shell(id) authenticate() - result = @server.call('session.shell_read', @auth_token, id) - return result + @server.call('session.shell_read', @auth_token, id) end@@ -737,11 +729,10 @@ wpscan -P wpscan -f -t Web -u /RPC2 name = exploit/unix/webapp/php_include-# File lib/wpscan/msfrpc_client.rb, line 112 +# File lib/wpscan/msfrpc_client.rb, line 107 def sessions() authenticate() - result = @server.call('session.list', @auth_token) - return result + @server.call('session.list', @auth_token) enddiff --git a/doc/SvnUpdater.html b/doc/SvnUpdater.html index ebb1f7f8..be911f42 100644 --- a/doc/SvnUpdater.html +++ b/doc/SvnUpdater.html @@ -87,6 +87,8 @@-# File lib/wpscan/msfrpc_client.rb, line 136 +# File lib/wpscan/msfrpc_client.rb, line 128 def write_shell(id, data) authenticate() - result = @server.call('session.shell_write', @auth_token, id, data) - return result + @server.call('session.shell_write', @auth_token, id, data) endCREDITS +Gemfile +README @@ -202,6 +204,24 @@ + +++ @@ -232,7 +252,7 @@Constants
++ +
+- REVISION_PATTERN
+ + + + +- TRUNK_URL
+ + + + +# File lib/updater/svn_updater.rb, line 26 def is_installed? - %[svn info "#{@repo_directory}" --xml 2>&1] =~ /revision=/ ? true : false + %[svn info "#@repo_directory" --xml 2>&1] =~ /revision=/ ? true : false end# File lib/updater/svn_updater.rb, line 30 def local_revision_number - local_revision = %[svn info "#{@repo_directory}" --xml 2>&1] - local_revision[@@revision_pattern, 1].to_s + local_revision = %[svn info "#@repo_directory" --xml 2>&1] + local_revision[REVISION_PATTERN, 1].to_s end# File lib/updater/svn_updater.rb, line 35 def update - %[svn up "#{@repo_directory}"] + %[svn up "#@repo_directory"] endCREDITS +Gemfile +README @@ -290,11 +292,11 @@# File lib/wpstools/parse_svn.rb, line 26 def initialize(svn_root, verbose, keep_empty_dirs = false) - @svn_root = svn_root - @verbose = verbose - @keep_empty_dirs = keep_empty_dirs - @svn_browser = Browser.instance - @svn_hydra = @svn_browser.hydra + @svn_root = svn_root + @verbose = verbose + @keep_empty_dirs = keep_empty_dirs + @svn_browser = Browser.instance + @svn_hydra = @svn_browser.hydra end
-# File lib/wpscan/modules/web_site.rb, line 50 +# File lib/wpscan/modules/web_site.rb, line 52 def is_online? Browser.instance.get(@uri.to_s).code != 0 end@@ -261,15 +263,17 @@ def is_wordpress? wordpress = false - response = Browser.instance.get(login_url(), - { :follow_location => true, :max_redirects => 2 } + response = Browser.instance.get( + login_url(), + {:follow_location => true, :max_redirects => 2} ) if response.body =~ %{WordPress} wordpress = true else - response = Browser.instance.get(xmlrpc_url(), - { :follow_location => true, :max_redirects => 2 } + response = Browser.instance.get( + xmlrpc_url(), + {:follow_location => true, :max_redirects => 2} ) if response.body =~ %{XML-RPC server accepts POST requests only} @@ -309,8 +313,9 @@ redirection or nil
-# File lib/wpscan/modules/web_site.rb, line 56 +# File lib/wpscan/modules/web_site.rb, line 58 def redirection(url = nil) + redirection = nil url ||= @uri.to_s response = Browser.instance.get(url) @@ -349,7 +354,7 @@ redirection or nil@@ -266,14 +269,14 @@ an array of backup config files url-# File lib/wpscan/modules/web_site.rb, line 45 +# File lib/wpscan/modules/web_site.rb, line 47 def xmlrpc_url @uri.merge("xmlrpc.php").to_s enddiff --git a/doc/WpConfigBackup.html b/doc/WpConfigBackup.html index f547a1c0..dd5ec418 100644 --- a/doc/WpConfigBackup.html +++ b/doc/WpConfigBackup.html @@ -77,6 +77,8 @@CREDITS +Gemfile +README @@ -222,10 +224,11 @@# File lib/wpscan/modules/wp_config_backup.rb, line 49 def self.config_backup_files - [ - 'wp-config.php~','#wp-config.php#','wp-config.php.save','wp-config.php.swp','wp-config.php.swo','wp-config.php_bak', - 'wp-config.bak', 'wp-config.php.bak', 'wp-config.save' - ] # thanks to Feross.org for these + %{ + wp-config.php~ #wp-config.php# wp-config.php.save wp-config.php.swp wp-config.php.swo wp-config.php_bak + wp-config.bak wp-config.php.bak wp-config.save wp-config.old wp-config.php.old wp-config.php.orig + wp-config.orig wp-config.php.original wp-config.original + } # thanks to Feross.org for these end# File lib/wpscan/modules/wp_config_backup.rb, line 24 def config_backup - found = [] - backups = WpConfigBackup.config_backup_files - browser = Browser.instance - hydra = browser.hydra + found = [] + backups = WpConfigBackup.config_backup_files + browser = Browser.instance + hydra = browser.hydra backups.each do |file| file_url = @uri.merge(URI.escape(file)).to_s - request = browser.forge_request(file_url) + request = browser.forge_request(file_url) request.on_complete do |response| if response.body[%{define}] and not response.body[%{<\s?html}] diff --git a/doc/WpDetector.html b/doc/WpDetector.html index 46ca318b..9cf2a0e3 100644 --- a/doc/WpDetector.html +++ b/doc/WpDetector.html @@ -85,6 +85,8 @@
-# File lib/wpscan/wp_enumerator.rb, line 88 +# File lib/wpscan/wp_enumerator.rb, line 84 def self.generate_items(options = {}) only_vulnerable = options[:only_vulnerable_ones] file = options[:file] @@ -346,18 +344,22 @@ wp_content_dir = options[:wp_content_dir] url = options[:url] type = options[:type] + plugins_dir = options[:wp_plugins_dir] targets_url = [] - if only_vulnerable == false + unless only_vulnerable # Open and parse the 'most popular' plugin list... - File.open(file, 'r') do |f| + File.open(file, "r") do |f| f.readlines.collect do |line| - targets_url << { + targets_url << WpItem.new( :url => url, :path => line.strip, :wp_content_dir => wp_content_dir, - :name => File.dirname(line.strip) - } + :name => File.dirname(line.strip), + :vulns_file => vulns_file, + :type => type, + :wp_plugins_dir => plugins_dir + ) end end end @@ -371,17 +373,20 @@ # We check if the plugin name from the plugin_vulns_file is already in targets, otherwise we add it xml.xpath(options[:vulns_xpath_2]).each do |node| name = node.attribute("name").text - targets_url << { + targets_url << WpItem.new( :url => url, :path => name, :wp_content_dir => wp_content_dir, - :name => name - } + :name => name, + :vulns_file => vulns_file, + :type => type, + :wp_plugins_dir => plugins_dir + ) end end - targets_url.flatten! - targets_url.uniq! + targets_url.flatten! { |t| t.name } + targets_url.uniq! { |t| t.name } # randomize the plugins array to *maybe* help in some crappy IDS/IPS/WAF detection targets_url.sort_by! { rand } enddiff --git a/doc/WpFullPathDisclosure.html b/doc/WpFullPathDisclosure.html index 0ec6f309..cf0b7495 100644 --- a/doc/WpFullPathDisclosure.html +++ b/doc/WpFullPathDisclosure.html @@ -77,6 +77,8 @@
# File lib/wpscan/wp_item.rb, line 25 -def initialize(options = {}) +def initialize(options) + @type = options[:type] @wp_content_dir = options[:wp_content_dir] || "wp-content" + @wp_plugin_dir = options[:wp_plugins_dir] || "plugins" @url = options[:url] @path = options[:path] @name = options[:name] || extract_name_from_url - @vulns_xml = options[:vulns_xml] - @vulns_xpath = options[:vulns_xpath].sub(/\$name\$/, @name) + @vulns_file = options[:vulns_file] + @vulns_xpath = options[:vulns_xpath].sub(/\$name\$/, @name) unless options[:vulns_xpath] == nil - raise("url not set") unless @url - raise("path not set") unless @path + raise("url not set") unless @url + raise("path not set") unless @path raise("wp_content_dir not set") unless @wp_content_dir - raise("name not set") unless @name - raise("vulns_xml not set") unless @vulns_xml + raise("name not set") unless @name + raise("vulns_file not set") unless @vulns_file + raise("type not set") unless @type end
-# File lib/wpscan/wp_item.rb, line 97 +# File lib/wpscan/wp_item.rb, line 121 def <=>(other) other.name <=> self.name end@@ -444,7 +485,7 @@
-# File lib/wpscan/wp_item.rb, line 87 +# File lib/wpscan/wp_item.rb, line 111 def ==(other) other.name == self.name end@@ -477,7 +518,7 @@
-# File lib/wpscan/wp_item.rb, line 92 +# File lib/wpscan/wp_item.rb, line 116 def ===(other) other.name == self.name end@@ -510,7 +551,7 @@
-# File lib/wpscan/wp_item.rb, line 107 +# File lib/wpscan/wp_item.rb, line 131 def changelog_url get_url_without_filename.merge("changelog.txt") end@@ -543,7 +584,7 @@
-# File lib/wpscan/wp_item.rb, line 70 +# File lib/wpscan/wp_item.rb, line 94 def directory_listing? # Need to remove to file part from the url Browser.instance.get(get_url_without_filename).body[%{<title>Index of}] ? true : false @@ -577,7 +618,7 @@+-# File lib/wpscan/wp_item.rb, line 76 +# File lib/wpscan/wp_item.rb, line 100 def extract_name_from_url get_url.to_s[%{^(https?://.*/([^/]+)/)}, 2] end@@ -591,6 +632,50 @@+ + + ++ ++ get_sub_folder() + click to toggle source ++ + ++ + + + + ++ + + + +++ ++# File lib/wpscan/wp_item.rb, line 43 +def get_sub_folder + case @type + when "plugins" + folder = @wp_plugin_dir + when "themes" + folder = "themes" + when "timthumbs" + # not needed + folder = nil + else + raise("unknown type #@type") + end + folder +end+@@ -610,14 +695,20 @@@@ -648,7 +739,7 @@-# File lib/wpscan/wp_item.rb, line 41 +# File lib/wpscan/wp_item.rb, line 59 def get_url url = @url.to_s.end_with?("/") ? @url.to_s : "#@url/" # remove first and last / wp_content_dir = @wp_content_dir.sub(/^\//, "").sub(/\/$/, "") # remove first / path = @path.sub(/^\//, "") - URI.parse("#{url}#{wp_content_dir}/#{path}") + if type == "timthumbs" + # timthumbs have folder in path variable + ret = URI.parse("#{url}#{wp_content_dir}/#{path}") + else + ret = URI.parse("#{url}#{wp_content_dir}/#{get_sub_folder}/#{path}") + end + ret end-# File lib/wpscan/wp_item.rb, line 51 +# File lib/wpscan/wp_item.rb, line 75 def get_url_without_filename location_url = get_url.to_s valid_location_url = location_url[%{^(https?://.*/)[^.]+\.[^/]+$}, 1] @@ -686,7 +777,7 @@-# File lib/wpscan/wp_item.rb, line 121 +# File lib/wpscan/wp_item.rb, line 145 def has_changelog? unless @changelog status = Browser.instance.get(changelog_url).code @@ -723,7 +814,7 @@-# File lib/wpscan/wp_item.rb, line 112 +# File lib/wpscan/wp_item.rb, line 136 def has_readme? unless @readme status = Browser.instance.get(readme_url).code @@ -760,7 +851,7 @@-# File lib/wpscan/wp_item.rb, line 102 +# File lib/wpscan/wp_item.rb, line 126 def readme_url get_url_without_filename.merge("readme.txt") end@@ -793,7 +884,7 @@-# File lib/wpscan/wp_item.rb, line 81 +# File lib/wpscan/wp_item.rb, line 105 def to_s item_version = version "#@name#{' v' + item_version.strip if item_version}" @@ -827,7 +918,7 @@@@ -310,7 +313,7 @@ href="http://www.exploit-db.com/ghdb/3714/">www.exploit-db.com/ghdb/3714/-# File lib/wpscan/wp_item.rb, line 61 +# File lib/wpscan/wp_item.rb, line 85 def version unless @version response = Browser.instance.get(get_url.merge("readme.txt").to_s) diff --git a/doc/WpOptions.html b/doc/WpOptions.html index 21ef0ff6..871d1290 100644 --- a/doc/WpOptions.html +++ b/doc/WpOptions.html @@ -83,6 +83,8 @@CREDITS +Gemfile +README diff --git a/doc/WpPlugin.html b/doc/WpPlugin.html index 49db6f0a..884a062a 100644 --- a/doc/WpPlugin.html +++ b/doc/WpPlugin.html @@ -87,6 +87,8 @@CREDITS +Gemfile +README @@ -232,7 +234,8 @@# File lib/wpscan/wp_plugin.rb, line 20 def initialize(options = {}) - options[:vulns_xml] = options[:vulns_xml] || DATA_DIR + '/plugin_vulns.xml' + options[:vulns_file] = (options[:vulns_file] != nil and options[:vulns_file] != "") ? + options[:vulns_file] : DATA_DIR + "/plugin_vulns.xml" options[:vulns_xpath] = "//plugin[@name='$name$']/vulnerability" options[:vulns_xpath_2] = "//plugin" options[:type] = "plugins" @@ -276,9 +279,9 @@ href="http://www.exploit-db.com/ghdb/3714/">www.exploit-db.com/ghdb/3714/-# File lib/wpscan/wp_plugin.rb, line 33 +# File lib/wpscan/wp_plugin.rb, line 34 def error_log? - response_body = Browser.instance.get(error_log_url(), :headers => { "range" => "bytes=0-700"}).body + response_body = Browser.instance.get(error_log_url(), :headers => {"range" => "bytes=0-700"}).body response_body[%{PHP Fatal error}] ? true : false end-# File lib/wpscan/wp_plugin.rb, line 38 +# File lib/wpscan/wp_plugin.rb, line 39 def error_log_url get_url.merge("error_log").to_s enddiff --git a/doc/WpPlugins.html b/doc/WpPlugins.html index ac0dc6d2..9e1ce0e8 100644 --- a/doc/WpPlugins.html +++ b/doc/WpPlugins.html @@ -77,6 +77,8 @@CREDITS +Gemfile +README @@ -229,14 +231,16 @@ options[:vulns_xpath] = "//plugin[@name='#{@name}']/vulnerability" options[:vulns_xpath_2] = "//plugin" options[:type] = "plugins" - result = WpDetector.aggressive_detection(options) + result = WpDetector.aggressive_detection(options) plugins = [] result.each do |r| plugins << WpPlugin.new( - :url => r[:url], - :path => r[:path], - :wp_content_dir => r[:wp_content_dir], - :name => r[:name] + :url => r.url, + :path => r.path, + :wp_content_dir => r.wp_content_dir, + :name => r.name, + :type => "plugins", + :wp_plugins_dir => r.wp_plugin_dir ) end plugins.sort_by { |p| p.name } @@ -278,17 +282,19 @@ plugins can be found in the source code :@@ -778,7 +780,7 @@ # File lib/wpscan/wp_target.rb, line 105 def wp_plugins_dir unless @wp_plugins_dir - @wp_plugins_dir = wp_content_dir() + "/plugins" + @wp_plugins_dir = "plugins" end @wp_plugins_dir end diff --git a/doc/WpTheme.html b/doc/WpTheme.html index 5171a3b6..c74123fa 100644 --- a/doc/WpTheme.html +++ b/doc/WpTheme.html @@ -91,6 +91,8 @@-# File lib/wpscan/modules/wp_plugins.rb, line 49 +# File lib/wpscan/modules/wp_plugins.rb, line 51 def plugins_from_passive_detection(options) plugins = [] temp = WpDetector.passive_detection(options[:url], "plugins", options[:wp_content_dir]) temp.each do |item| plugins << WpPlugin.new( - :url => item[:url], - :name => item[:name], - :path => item[:path], - :wp_content_dir => options[:wp_content_dir] + :url => item.url, + :name => item.name, + :path => item.path, + :wp_content_dir => options[:wp_content_dir], + :type => "plugins", + :wp_plugins_dir => options[:wp_plugin_dir] ) end plugins.sort_by { |p| p.name } diff --git a/doc/WpReadme.html b/doc/WpReadme.html index 84ae682e..2ccec6db 100644 --- a/doc/WpReadme.html +++ b/doc/WpReadme.html @@ -77,6 +77,8 @@CREDITS +Gemfile +README diff --git a/doc/WpTarget.html b/doc/WpTarget.html index 8c08910c..ef4994fa 100644 --- a/doc/WpTarget.html +++ b/doc/WpTarget.html @@ -159,6 +159,8 @@CREDITS +Gemfile +README @@ -493,7 +495,7 @@ # File lib/wpscan/wp_target.rb, line 112 def has_debug_log? # We only get the first 700 bytes of the file to avoid loading huge file (like 2Go) - response_body = Browser.instance.get(debug_log_url(), :headers => { "range" => "bytes=0-700"}).body + response_body = Browser.instance.get(debug_log_url(), :headers => {"range" => "bytes=0-700"}).body response_body[%{\[[^\]]+\] PHP (?:Warning|Error|Notice):}] ? true : false endCREDITS +Gemfile +README @@ -286,7 +288,7 @@-# File lib/wpscan/wp_theme.rb, line 42 +# File lib/wpscan/wp_theme.rb, line 44 def self.find(target_uri) self.methods.grep(/find_from_/).each do |method_to_call| theme = self.send(method_to_call, target_uri) @@ -326,8 +328,10 @@# File lib/wpscan/wp_theme.rb, line 25 def initialize(options = {}) - options[:vulns_xml] = options[:vulns_xml] || DATA_DIR + '/wp_theme_vulns.xml' + options[:vulns_file] = (options[:vulns_file] != nil and options[:vulns_file] != "") ? + options[:vulns_file] : DATA_DIR + "/wp_theme_vulns.xml" options[:vulns_xpath] = "//theme[@name='$name$']/vulnerability" + options[:type] = "themes" @version = options[:version] @style_url = options[:style_url] super(options) @@ -367,11 +371,12 @@-# File lib/wpscan/wp_theme.rb, line 58 +# File lib/wpscan/wp_theme.rb, line 60 def self.find_from_css_link(target_uri) - response = Browser.instance.get(target_uri.to_s, { :follow_location => true, :max_redirects => 2 }) + response = Browser.instance.get(target_uri.to_s, {:follow_location => true, :max_redirects => 2}) - if matches = %{https?://[^"']+/themes/([^"']+)/style.css}.match(response.body) + matches = %{https?://[^"']+/themes/([^"']+)/style.css}.match(response.body) + if matches style_url = matches[0] theme_name = matches[1] @@ -413,14 +418,15 @@ href="http://code.google.com/p/wpscan/issues/detail?id=141">code.google.com/p/wp-# File lib/wpscan/wp_theme.rb, line 75 +# File lib/wpscan/wp_theme.rb, line 78 def self.find_from_wooframework(target_uri) body = Browser.instance.get(target_uri.to_s).body regexp = %{<meta name="generator" content="([^\s"]+)\s?([^"]+)?" />\s+<meta name="generator" content="WooFramework\s?([^"]+)?" />} - if matches = regexp.match(body) - woo_theme_name = matches[1] - woo_theme_version = matches[2] + matches = regexp.match(body) + if matches + woo_theme_name = matches[1] + woo_theme_version = matches[2] woo_framework_version = matches[3] # Not used at this time return new(:name => woo_theme_name, @@ -466,7 +472,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=141">code.google.com/p/wp@@ -481,7 +485,7 @@ upgrade.@@ -392,7 +394,9 @@ file across all versions of wordpress. # File lib/wpscan/wp_version.rb, line 94 def self.find_from_advanced_fingerprinting(options) target_uri = options[:url] - xml = Nokogiri::XML(File.open(DATA_DIR + '/wp_versions.xml')) do |config| + # needed for rpsec tests + version_xml = options[:version_xml] || DATA_DIR + "/wp_versions.xml" + xml = Nokogiri::XML(File.open(version_xml)) do |config| config.noblanks end @@ -402,11 +406,11 @@ file across all versions of wordpress. file_url = target_uri.merge(node.attribute('src').text).to_s file_url = file_url.gsub(/\$wp-plugins\$/, wp_plugins).gsub(/\$wp-content\$/, wp_content) response = Browser.instance.get(file_url) - md5sum = Digest::MD5.hexdigest(response.body) + md5sum = Digest::MD5.hexdigest(response.body) node.search('hash').each do |hash| if hash.attribute('md5').text == md5sum - return hash.search('versions').text + return hash.search('versions').text end end end @@ -448,7 +452,7 @@ upgrade. # File lib/wpscan/wp_version.rb, line 61 def self.find_from_meta_generator(options) target_uri = options[:url] - response = Browser.instance.get(target_uri.to_s, { :follow_location => true, :max_redirects => 2 }) + response = Browser.instance.get(target_uri.to_s, {:follow_location => true, :max_redirects => 2}) response.body[%{name="generator" content="wordpress ([^"]+)"}, 1] end-# File lib/wpscan/wp_theme.rb, line 51 +# File lib/wpscan/wp_theme.rb, line 53 def ===(wp_theme) wp_theme.name === @name and wp_theme.version === @version enddiff --git a/doc/WpTimthumbs.html b/doc/WpTimthumbs.html index 14cce904..7aff900d 100644 --- a/doc/WpTimthumbs.html +++ b/doc/WpTimthumbs.html @@ -79,6 +79,8 @@CREDITS +Gemfile +README @@ -258,12 +260,12 @@ # File lib/wpscan/modules/wp_timthumbs.rb, line 28 def timthumbs(theme_name = nil, options = {}) if @wp_timthumbs.nil? - options[:type] = "timthumbs" - options[:only_vulnerable_ones] = false - options[:file] = options[:file] || DATA_DIR + "/timthumbs.txt" - options[:vulns_file] = "xxx" - options[:vulns_xpath] = "xxx" - options[:vulns_xpath_2] = "xxx" + options[:type] = "timthumbs" + options[:only_vulnerable_ones] = false + options[:file] = options[:file] || DATA_DIR + "/timthumbs.txt" + options[:vulns_file] = "xxx" + options[:vulns_xpath] = "xxx" + options[:vulns_xpath_2] = "xxx" WpOptions.check_options(options) if theme_name == nil @@ -312,19 +314,22 @@# File lib/wpscan/modules/wp_timthumbs.rb, line 49 def targets_url_from_theme(theme_name, options) - targets = [] + targets = [] theme_name = URI.escape(theme_name) %{ timthumb.php lib/timthumb.php inc/timthumb.php includes/timthumb.php scripts/timthumb.php tools/timthumb.php functions/timthumb.php }.each do |file| - targets << { + targets << WpItem.new( :url => options[:url], :path => "themes/#{theme_name}/#{file}", :wp_content_dir => options[:wp_content_dir], - :name => options[:name] - } + :name => theme_name, + :vulns_file => "XX", + :type => "timthumbs", + :wp_plugins_dir => options[:wp_plugins_dir] + ) end targets enddiff --git a/doc/WpUsernames.html b/doc/WpUsernames.html index b194bb81..79bda99b 100644 --- a/doc/WpUsernames.html +++ b/doc/WpUsernames.html @@ -85,6 +85,8 @@CREDITS +Gemfile +README @@ -333,7 +335,7 @@# File lib/wpscan/modules/wp_usernames.rb, line 60 def get_nickname_from_url(url) - resp = Browser.instance.get(url, { :follow_location => true, :max_redirects => 2 }) + resp = Browser.instance.get(url, {:follow_location => true, :max_redirects => 2}) nickname = nil if resp.code == 200 nickname = extract_nickname_from_body(resp.body) @@ -428,9 +430,9 @@ href="http://seclists.org/fulldisclosure/2011/May/493">seclists.org/fulldisclosu# File lib/wpscan/modules/wp_usernames.rb, line 28 def usernames(options = {}) - range = options[:range] || (1..10) - browser = Browser.instance - usernames = [] + range = options[:range] || (1..10) + browser = Browser.instance + usernames = [] range.each do |author_id| url = author_url(author_id) diff --git a/doc/WpVersion.html b/doc/WpVersion.html index ec9c5683..bca92ace 100644 --- a/doc/WpVersion.html +++ b/doc/WpVersion.html @@ -97,6 +97,8 @@CREDITS +Gemfile +README @@ -336,7 +338,7 @@ etc) def initialize(number, options = {}) @number = number @discovery_method = options[:discovery_method] - @vulns_xml = options[:vulns_xml] || DATA_DIR + '/wp_vulns.xml' + @vulns_file = options[:vulns_file] || DATA_DIR + '/wp_vulns.xml' @vulns_xpath = "//wordpress[@version='#{@number}']/vulnerability" end-# File lib/wpscan/wp_version.rb, line 117 +# File lib/wpscan/wp_version.rb, line 119 def self.find_from_readme(options) target_uri = options[:url] Browser.instance.get(target_uri.merge("readme.html").to_s).body[%{<br />\sversion #{WpVersion.version_pattern}}, 1] @@ -518,7 +522,7 @@ upgrade. # File lib/wpscan/wp_version.rb, line 68 def self.find_from_rss_generator(options) target_uri = options[:url] - response = Browser.instance.get(target_uri.merge("feed/").to_s, { :follow_location => true, :max_redirects => 2 }) + response = Browser.instance.get(target_uri.merge("feed/").to_s, {:follow_location => true, :max_redirects => 2}) response.body[%{<generator>http://wordpress.org/\?v=([^<]+)</generator>}, 1] end@@ -552,7 +556,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=109">code.google.com/p/wp-# File lib/wpscan/wp_version.rb, line 123 +# File lib/wpscan/wp_version.rb, line 125 def self.find_from_sitemap_generator(options) target_uri = options[:url] Browser.instance.get(target_uri.merge("sitemap.xml").to_s).body[%{generator="wordpress/#{WpVersion.version_pattern}"}, 1] @@ -587,7 +591,7 @@ one ‘.’diff --git a/doc/WpscanOptions.html b/doc/WpscanOptions.html index 27ba421f..003b1e9c 100644 --- a/doc/WpscanOptions.html +++ b/doc/WpscanOptions.html @@ -117,6 +117,8 @@-# File lib/wpscan/wp_version.rb, line 129 +# File lib/wpscan/wp_version.rb, line 131 def self.version_pattern '(.*(?=.)(?=.*\d)(?=.*[.]).*)' enddiff --git a/doc/WpVulnerability.html b/doc/WpVulnerability.html index 1566de4d..643cdf41 100644 --- a/doc/WpVulnerability.html +++ b/doc/WpVulnerability.html @@ -83,6 +83,8 @@CREDITS +Gemfile +README @@ -286,9 +288,9 @@# File lib/wpscan/wp_vulnerability.rb, line 22 def initialize(title, reference, type) - @title = title - @reference = reference - @type = type + @title = title + @reference = reference + @type = type endCREDITS +Gemfile +README @@ -280,7 +282,7 @@ href="WpscanOptions.html">WpscanOptions if ARGV.length > 0 WpscanOptions.get_opt_long.each do |opt, arg| - wpscan_options.set_option_from_cli(opt, arg) + wpscan_options.set_option_from_cli(opt, arg) end end @@ -357,7 +359,7 @@ any remaining ‘-’ by ‘_’-# File lib/wpscan/wpscan_options.rb, line 216 +# File lib/wpscan/wpscan_options.rb, line 217 def self.clean_option(option) cleaned_option = option.gsub(/^--?/, '') cleaned_option.gsub(/-/, '_') @@ -392,23 +394,23 @@ any remaining ‘-’ by ‘_’@@ -440,7 +442,7 @@ any remaining ‘-’ by ‘_’-# File lib/wpscan/wpscan_options.rb, line 188 +# File lib/wpscan/wpscan_options.rb, line 189 def self.get_opt_long GetoptLong.new( - ["--url", "-u", GetoptLong::REQUIRED_ARGUMENT], - ["--enumerate", "-e", GetoptLong::OPTIONAL_ARGUMENT], - ["--username", "-U", GetoptLong::REQUIRED_ARGUMENT], - ["--wordlist", "-w", GetoptLong::REQUIRED_ARGUMENT], - ["--threads", "-t",GetoptLong::REQUIRED_ARGUMENT], - ["--force", "-f",GetoptLong::NO_ARGUMENT], - ["--help", "-h", GetoptLong::NO_ARGUMENT], - ["--verbose", "-v", GetoptLong::NO_ARGUMENT] , - ["--proxy", GetoptLong::OPTIONAL_ARGUMENT], - ["--update", GetoptLong::NO_ARGUMENT], - ["--follow-redirection", GetoptLong::NO_ARGUMENT], - ["--wp-content-dir", GetoptLong::REQUIRED_ARGUMENT], - ["--wp-plugins-dir", GetoptLong::REQUIRED_ARGUMENT], - ["--config-file", "-c", GetoptLong::REQUIRED_ARGUMENT] + ["--url", "-u", GetoptLong::REQUIRED_ARGUMENT], + ["--enumerate", "-e", GetoptLong::OPTIONAL_ARGUMENT], + ["--username", "-U", GetoptLong::REQUIRED_ARGUMENT], + ["--wordlist", "-w", GetoptLong::REQUIRED_ARGUMENT], + ["--threads", "-t", GetoptLong::REQUIRED_ARGUMENT], + ["--force", "-f", GetoptLong::NO_ARGUMENT], + ["--help", "-h", GetoptLong::NO_ARGUMENT], + ["--verbose", "-v", GetoptLong::NO_ARGUMENT], + ["--proxy", GetoptLong::OPTIONAL_ARGUMENT], + ["--update", GetoptLong::NO_ARGUMENT], + ["--follow-redirection", GetoptLong::NO_ARGUMENT], + ["--wp-content-dir", GetoptLong::REQUIRED_ARGUMENT], + ["--wp-plugins-dir", GetoptLong::REQUIRED_ARGUMENT], + ["--config-file", "-c", GetoptLong::REQUIRED_ARGUMENT] ) end-# File lib/wpscan/wpscan_options.rb, line 207 +# File lib/wpscan/wpscan_options.rb, line 208 def self.is_long_option?(option) ACCESSOR_OPTIONS.include?(:"#{WpscanOptions.clean_option(option)}") end@@ -473,10 +475,10 @@ any remaining ‘-’ by ‘_’-# File lib/wpscan/wpscan_options.rb, line 221 +# File lib/wpscan/wpscan_options.rb, line 222 def self.option_to_instance_variable_setter(option) cleaned_option = WpscanOptions.clean_option(option) - option_syms = ACCESSOR_OPTIONS.grep(%{^#{cleaned_option}}) + option_syms = ACCESSOR_OPTIONS.grep(%{^#{cleaned_option}}) option_syms.length == 1 ? :"#{option_syms.at(0)}=" : nil end@@ -609,7 +611,8 @@ href="http://1-10">u will enumerate usernames from 1 to 10 if value =~ /u/ @enumerate_usernames = true # Check for usernames range - if matches = %{\[([\d]+)-([\d]+)\]}.match(value) + matches = %{\[([\d]+)-([\d]+)\]}.match(value) + if matches @enumerate_usernames_range = (matches[1].to_i..matches[2].to_i) end end @@ -794,11 +797,11 @@ value if WpscanOptions.is_long_option?(cli_option) self.send( - WpscanOptions.option_to_instance_variable_setter(cli_option), - cli_value + WpscanOptions.option_to_instance_variable_setter(cli_option), + cli_value ) elsif cli_option === "--enumerate" # Special cases - # Default value if no argument is given + # Default value if no argument is given cli_value = "T!tup!" if cli_value.length == 0 enumerate_options_from_string(cli_value) diff --git a/doc/created.rid b/doc/created.rid index fe69f93d..a561312f 100644 --- a/doc/created.rid +++ b/doc/created.rid @@ -1,42 +1,43 @@ -Fri, 21 Sep 2012 22:09:53 +0200 +Sat, 22 Sep 2012 23:49:14 +0200 ./CREDITS Mon, 17 Sep 2012 20:18:24 +0200 -./lib/browser.rb Sun, 16 Sep 2012 15:18:58 +0200 -./lib/cache_file_store.rb Sat, 15 Sep 2012 08:04:03 +0200 -./lib/common_helper.rb Fri, 21 Sep 2012 19:02:49 +0200 -./lib/environment.rb Thu, 20 Sep 2012 22:12:57 +0200 +./Gemfile Sat, 22 Sep 2012 00:14:07 +0200 +./lib/browser.rb Sat, 22 Sep 2012 15:51:15 +0200 +./lib/cache_file_store.rb Sat, 22 Sep 2012 15:00:03 +0200 +./lib/common_helper.rb Sat, 22 Sep 2012 16:08:50 +0200 +./lib/environment.rb Sat, 22 Sep 2012 09:22:22 +0200 ./lib/updater/git_updater.rb Sat, 15 Sep 2012 08:00:23 +0200 -./lib/updater/svn_updater.rb Sat, 15 Sep 2012 08:00:34 +0200 +./lib/updater/svn_updater.rb Sat, 22 Sep 2012 15:04:12 +0200 ./lib/updater/updater.rb Sat, 15 Sep 2012 08:00:40 +0200 ./lib/updater/updater_factory.rb Sat, 15 Sep 2012 08:00:46 +0200 -./lib/wpscan/exploit.rb Sat, 15 Sep 2012 08:02:16 +0200 -./lib/wpscan/modules/brute_force.rb Fri, 21 Sep 2012 20:51:52 +0200 -./lib/wpscan/modules/malwares.rb Thu, 20 Sep 2012 22:23:58 +0200 -./lib/wpscan/modules/web_site.rb Wed, 19 Sep 2012 21:33:46 +0200 -./lib/wpscan/modules/wp_config_backup.rb Sat, 15 Sep 2012 08:01:11 +0200 +./lib/wpscan/exploit.rb Fri, 21 Sep 2012 23:23:55 +0200 +./lib/wpscan/modules/brute_force.rb Sat, 22 Sep 2012 00:10:17 +0200 +./lib/wpscan/modules/malwares.rb Sat, 22 Sep 2012 15:01:32 +0200 +./lib/wpscan/modules/web_site.rb Sat, 22 Sep 2012 16:18:55 +0200 +./lib/wpscan/modules/wp_config_backup.rb Sat, 22 Sep 2012 15:01:32 +0200 ./lib/wpscan/modules/wp_full_path_disclosure.rb Sat, 15 Sep 2012 08:01:17 +0200 -./lib/wpscan/modules/wp_login_protection.rb Tue, 18 Sep 2012 17:51:20 +0200 -./lib/wpscan/modules/wp_plugins.rb Fri, 21 Sep 2012 15:27:28 +0200 +./lib/wpscan/modules/wp_login_protection.rb Sat, 22 Sep 2012 16:18:32 +0200 +./lib/wpscan/modules/wp_plugins.rb Sat, 22 Sep 2012 21:05:32 +0200 ./lib/wpscan/modules/wp_readme.rb Sat, 15 Sep 2012 08:01:52 +0200 -./lib/wpscan/modules/wp_themes.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/modules/wp_timthumbs.rb Wed, 19 Sep 2012 15:03:22 +0200 -./lib/wpscan/modules/wp_usernames.rb Fri, 21 Sep 2012 18:48:29 +0200 -./lib/wpscan/msfrpc_client.rb Sat, 15 Sep 2012 08:02:28 +0200 -./lib/wpscan/vulnerable.rb Wed, 19 Sep 2012 22:21:47 +0200 -./lib/wpscan/wp_detector.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/wp_enumerator.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/wp_item.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/wp_options.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/wp_plugin.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/wp_target.rb Thu, 20 Sep 2012 22:16:44 +0200 -./lib/wpscan/wp_theme.rb Fri, 21 Sep 2012 15:27:28 +0200 -./lib/wpscan/wp_user.rb Fri, 21 Sep 2012 18:00:14 +0200 -./lib/wpscan/wp_version.rb Wed, 19 Sep 2012 21:33:07 +0200 -./lib/wpscan/wp_vulnerability.rb Sat, 15 Sep 2012 08:03:09 +0200 +./lib/wpscan/modules/wp_themes.rb Sat, 22 Sep 2012 21:32:34 +0200 +./lib/wpscan/modules/wp_timthumbs.rb Sat, 22 Sep 2012 23:24:13 +0200 +./lib/wpscan/modules/wp_usernames.rb Sat, 22 Sep 2012 15:01:32 +0200 +./lib/wpscan/msfrpc_client.rb Fri, 21 Sep 2012 23:32:27 +0200 +./lib/wpscan/vulnerable.rb Sat, 22 Sep 2012 21:23:01 +0200 +./lib/wpscan/wp_detector.rb Sat, 22 Sep 2012 21:23:10 +0200 +./lib/wpscan/wp_enumerator.rb Sat, 22 Sep 2012 23:22:53 +0200 +./lib/wpscan/wp_item.rb Sat, 22 Sep 2012 23:38:11 +0200 +./lib/wpscan/wp_options.rb Sat, 22 Sep 2012 20:33:35 +0200 +./lib/wpscan/wp_plugin.rb Sat, 22 Sep 2012 21:24:14 +0200 +./lib/wpscan/wp_target.rb Sat, 22 Sep 2012 23:47:42 +0200 +./lib/wpscan/wp_theme.rb Sat, 22 Sep 2012 21:24:57 +0200 +./lib/wpscan/wp_user.rb Sat, 22 Sep 2012 16:12:25 +0200 +./lib/wpscan/wp_version.rb Sat, 22 Sep 2012 21:25:11 +0200 +./lib/wpscan/wp_vulnerability.rb Sat, 22 Sep 2012 16:11:58 +0200 ./lib/wpscan/wpscan_helper.rb Sat, 15 Sep 2012 21:19:30 +0200 -./lib/wpscan/wpscan_options.rb Fri, 21 Sep 2012 22:04:11 +0200 -./lib/wpstools/generate_list.rb Sat, 15 Sep 2012 08:03:43 +0200 -./lib/wpstools/parse_svn.rb Sat, 15 Sep 2012 23:36:25 +0200 -./lib/wpstools/wpstools_helper.rb Sat, 15 Sep 2012 08:03:49 +0200 +./lib/wpscan/wpscan_options.rb Sat, 22 Sep 2012 15:01:32 +0200 +./lib/wpstools/generate_list.rb Sat, 22 Sep 2012 16:10:07 +0200 +./lib/wpstools/parse_svn.rb Sat, 22 Sep 2012 16:10:30 +0200 +./lib/wpstools/wpstools_helper.rb Sat, 22 Sep 2012 15:00:03 +0200 ./README Thu, 13 Sep 2012 22:54:08 +0200 -./wpscan.rb Fri, 21 Sep 2012 18:13:48 +0200 -./wpstools.rb Sat, 15 Sep 2012 08:06:35 +0200 +./wpscan.rb Sat, 22 Sep 2012 23:46:46 +0200 +./wpstools.rb Sat, 22 Sep 2012 14:59:30 +0200 diff --git a/doc/index.html b/doc/index.html index 1f08c240..cae72895 100644 --- a/doc/index.html +++ b/doc/index.html @@ -32,6 +32,8 @@CREDITS +Gemfile +README @@ -163,34 +165,34 @@::malwares_file — Malwares -::new — WpVersion - -::new — RpcClient - -::new — WpPlugin - -::new — Exploit +::new — WpTheme ::new — Svn_Parser -::new — WpUser - -::new — Generate_List - -::new — Updater - -::new — WpItem - -::new — CacheFileStore -::new — WpVulnerability -::new — WpTheme +::new — WpVersion ::new — WpscanOptions +::new — WpItem +::new — WpTarget +::new — CacheFileStore + +::new — RpcClient + +::new — Exploit + +::new — Updater + +::new — Generate_List + +::new — WpPlugin + +::new — WpUser +::option_to_instance_variable_setter — WpscanOptions ::passive_detection — WpDetector @@ -201,18 +203,18 @@::version_pattern — WpVersion -#<=> — WpItem -#<=> — WpUser -#== — WpItem +#<=> — WpItem -#=== — WpUser +#== — WpItem #=== — WpItem #=== — WpTheme +#=== — WpUser +#_grep_ — Array #add_http_protocol — Object @@ -237,6 +239,8 @@#clean — CacheFileStore +#colorize — Object +#config_backup — WpConfigBackup #debug_log_url — WpTarget @@ -297,10 +301,14 @@#get_popular_items — Generate_List +#get_sub_folder — WpItem +#get_url — WpItem #get_url_without_filename — WpItem +#green — Object +#grep — Array #has_better_wp_security_protection? — WpLoginProtection @@ -327,22 +335,22 @@#has_options? — WpscanOptions -#has_readme? — WpReadme -#has_readme? — WpItem +#has_readme? — WpReadme +#has_simple_login_lockdown_protection? — WpLoginProtection #has_timthumbs? — WpTimthumbs #help — Object -#is_installed? — SvnUpdater -#is_installed? — Updater #is_installed? — GitUpdater +#is_installed? — SvnUpdater +#is_online? — WebSite #is_wordpress? — WebSite @@ -351,22 +359,22 @@#jobs — RpcClient -#kill_session — RpcClient -#kill_session — Exploit +#kill_session — RpcClient +#last_session_id — Exploit #limit_login_attempts_url — WpLoginProtection #load_config — Browser -#local_revision_number — GitUpdater -#local_revision_number — Updater #local_revision_number — SvnUpdater +#local_revision_number — GitUpdater +#login — RpcClient #login_protection_plugin — WpLoginProtection @@ -385,10 +393,10 @@#meterpreter_read — Exploit -#meterpreter_write — Exploit -#meterpreter_write — RpcClient +#meterpreter_write — Exploit +#parse — Svn_Parser #plugins_from_aggressive_detection — WpPlugins @@ -403,14 +411,16 @@#read_entry — CacheFileStore -#read_shell — Exploit -#read_shell — RpcClient +#read_shell — Exploit +#readme_url — WpReadme #readme_url — WpItem +#red — Object +#redirection — WebSite #registration_enabled? — WpTarget @@ -453,10 +463,10 @@#to_s — WpItem -#update — Updater -#update — SvnUpdater +#update — Updater +#update — GitUpdater #url — WpTarget @@ -471,10 +481,10 @@#usernames — WpUsernames -#version — WpTarget -#version — WpItem +#version — WpTarget +#vulnerabilities — Vulnerable #wordlist= — WpscanOptions diff --git a/doc/lib/browser_rb.html b/doc/lib/browser_rb.html index 16915803..f0096ce8 100644 --- a/doc/lib/browser_rb.html +++ b/doc/lib/browser_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-16 15:18:58 +0200
+- 2012-09-22 15:51:15 +0200
- Requires
diff --git a/doc/lib/cache_file_store_rb.html b/doc/lib/cache_file_store_rb.html index 0150d8f3..595a337e 100644 --- a/doc/lib/cache_file_store_rb.html +++ b/doc/lib/cache_file_store_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:04:03 +0200
+- 2012-09-22 15:00:03 +0200
- Requires
diff --git a/doc/lib/common_helper_rb.html b/doc/lib/common_helper_rb.html index 8af94108..32ad0d46 100644 --- a/doc/lib/common_helper_rb.html +++ b/doc/lib/common_helper_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 19:02:49 +0200
+- 2012-09-22 16:08:50 +0200
- Requires
diff --git a/doc/lib/environment_rb.html b/doc/lib/environment_rb.html index 4b713387..892e4067 100644 --- a/doc/lib/environment_rb.html +++ b/doc/lib/environment_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-20 22:12:57 +0200
+- 2012-09-22 09:22:22 +0200
- Requires
diff --git a/doc/lib/updater/svn_updater_rb.html b/doc/lib/updater/svn_updater_rb.html index a533df4f..c9e63ab0 100644 --- a/doc/lib/updater/svn_updater_rb.html +++ b/doc/lib/updater/svn_updater_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:00:34 +0200
+- 2012-09-22 15:04:12 +0200
- Requires
diff --git a/doc/lib/wpscan/exploit_rb.html b/doc/lib/wpscan/exploit_rb.html index fb70bcee..53277be9 100644 --- a/doc/lib/wpscan/exploit_rb.html +++ b/doc/lib/wpscan/exploit_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:02:16 +0200
+- 2012-09-21 23:23:55 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/brute_force_rb.html b/doc/lib/wpscan/modules/brute_force_rb.html index 47ea5e5f..1c80c1ad 100644 --- a/doc/lib/wpscan/modules/brute_force_rb.html +++ b/doc/lib/wpscan/modules/brute_force_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 20:51:52 +0200
+- 2012-09-22 00:10:17 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/malwares_rb.html b/doc/lib/wpscan/modules/malwares_rb.html index 990f764a..89020e29 100644 --- a/doc/lib/wpscan/modules/malwares_rb.html +++ b/doc/lib/wpscan/modules/malwares_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-20 22:23:58 +0200
+- 2012-09-22 15:01:32 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/web_site_rb.html b/doc/lib/wpscan/modules/web_site_rb.html index de62b355..de62cc93 100644 --- a/doc/lib/wpscan/modules/web_site_rb.html +++ b/doc/lib/wpscan/modules/web_site_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-19 21:33:46 +0200
+- 2012-09-22 16:18:55 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/wp_config_backup_rb.html b/doc/lib/wpscan/modules/wp_config_backup_rb.html index 84e66052..e6baa6c2 100644 --- a/doc/lib/wpscan/modules/wp_config_backup_rb.html +++ b/doc/lib/wpscan/modules/wp_config_backup_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:01:11 +0200
+- 2012-09-22 15:01:32 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/wp_plugins_rb.html b/doc/lib/wpscan/modules/wp_plugins_rb.html index 5e6735aa..375773cb 100644 --- a/doc/lib/wpscan/modules/wp_plugins_rb.html +++ b/doc/lib/wpscan/modules/wp_plugins_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 15:27:28 +0200
+- 2012-09-22 21:05:32 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/wp_timthumbs_rb.html b/doc/lib/wpscan/modules/wp_timthumbs_rb.html index fbcf0959..408c7604 100644 --- a/doc/lib/wpscan/modules/wp_timthumbs_rb.html +++ b/doc/lib/wpscan/modules/wp_timthumbs_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-19 15:03:22 +0200
+- 2012-09-22 23:24:13 +0200
- Requires
diff --git a/doc/lib/wpscan/modules/wp_usernames_rb.html b/doc/lib/wpscan/modules/wp_usernames_rb.html index 0ca0eb12..c392b132 100644 --- a/doc/lib/wpscan/modules/wp_usernames_rb.html +++ b/doc/lib/wpscan/modules/wp_usernames_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 18:48:29 +0200
+- 2012-09-22 15:01:32 +0200
- Requires
diff --git a/doc/lib/wpscan/msfrpc_client_rb.html b/doc/lib/wpscan/msfrpc_client_rb.html index 37306089..80593e0b 100644 --- a/doc/lib/wpscan/msfrpc_client_rb.html +++ b/doc/lib/wpscan/msfrpc_client_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:02:28 +0200
+- 2012-09-21 23:32:27 +0200
- Requires
diff --git a/doc/lib/wpscan/vulnerable_rb.html b/doc/lib/wpscan/vulnerable_rb.html index 2463a78a..7c603908 100644 --- a/doc/lib/wpscan/vulnerable_rb.html +++ b/doc/lib/wpscan/vulnerable_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-19 22:21:47 +0200
+- 2012-09-22 21:23:01 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_detector_rb.html b/doc/lib/wpscan/wp_detector_rb.html index c37a5b59..451e993e 100644 --- a/doc/lib/wpscan/wp_detector_rb.html +++ b/doc/lib/wpscan/wp_detector_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 15:27:28 +0200
+- 2012-09-22 21:23:10 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_enumerator_rb.html b/doc/lib/wpscan/wp_enumerator_rb.html index bbabcea3..470f8b83 100644 --- a/doc/lib/wpscan/wp_enumerator_rb.html +++ b/doc/lib/wpscan/wp_enumerator_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 15:27:28 +0200
+- 2012-09-22 23:22:53 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_options_rb.html b/doc/lib/wpscan/wp_options_rb.html index c10fb07a..c2bdd2e8 100644 --- a/doc/lib/wpscan/wp_options_rb.html +++ b/doc/lib/wpscan/wp_options_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 15:27:28 +0200
+- 2012-09-22 20:33:35 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_plugin_rb.html b/doc/lib/wpscan/wp_plugin_rb.html index fc7fa984..87462010 100644 --- a/doc/lib/wpscan/wp_plugin_rb.html +++ b/doc/lib/wpscan/wp_plugin_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 15:27:28 +0200
+- 2012-09-22 21:24:14 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_target_rb.html b/doc/lib/wpscan/wp_target_rb.html index 49db64bb..3762198b 100644 --- a/doc/lib/wpscan/wp_target_rb.html +++ b/doc/lib/wpscan/wp_target_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-20 22:16:44 +0200
+- 2012-09-22 23:47:42 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_theme_rb.html b/doc/lib/wpscan/wp_theme_rb.html index f51956d0..9160117e 100644 --- a/doc/lib/wpscan/wp_theme_rb.html +++ b/doc/lib/wpscan/wp_theme_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 15:27:28 +0200
+- 2012-09-22 21:24:57 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_version_rb.html b/doc/lib/wpscan/wp_version_rb.html index ab7c8863..b98561a0 100644 --- a/doc/lib/wpscan/wp_version_rb.html +++ b/doc/lib/wpscan/wp_version_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-19 21:33:07 +0200
+- 2012-09-22 21:25:11 +0200
- Requires
diff --git a/doc/lib/wpscan/wp_vulnerability_rb.html b/doc/lib/wpscan/wp_vulnerability_rb.html index f1e4da8d..9445d06b 100644 --- a/doc/lib/wpscan/wp_vulnerability_rb.html +++ b/doc/lib/wpscan/wp_vulnerability_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:03:09 +0200
+- 2012-09-22 16:11:58 +0200
- Requires
diff --git a/doc/lib/wpscan/wpscan_options_rb.html b/doc/lib/wpscan/wpscan_options_rb.html index b2613571..f62ab684 100644 --- a/doc/lib/wpscan/wpscan_options_rb.html +++ b/doc/lib/wpscan/wpscan_options_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 22:04:11 +0200
+- 2012-09-22 15:01:32 +0200
- Requires
diff --git a/doc/lib/wpstools/generate_list_rb.html b/doc/lib/wpstools/generate_list_rb.html index dc2e0ff7..035ef828 100644 --- a/doc/lib/wpstools/generate_list_rb.html +++ b/doc/lib/wpstools/generate_list_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:03:43 +0200
+- 2012-09-22 16:10:07 +0200
- Requires
diff --git a/doc/lib/wpstools/parse_svn_rb.html b/doc/lib/wpstools/parse_svn_rb.html index 31aa2713..79aa1869 100644 --- a/doc/lib/wpstools/parse_svn_rb.html +++ b/doc/lib/wpstools/parse_svn_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 23:36:25 +0200
+- 2012-09-22 16:10:30 +0200
- Requires
diff --git a/doc/lib/wpstools/wpstools_helper_rb.html b/doc/lib/wpstools/wpstools_helper_rb.html index 43fdeb9a..73ddd09c 100644 --- a/doc/lib/wpstools/wpstools_helper_rb.html +++ b/doc/lib/wpstools/wpstools_helper_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:03:49 +0200
+- 2012-09-22 15:00:03 +0200
- Requires
diff --git a/doc/wpscan_rb.html b/doc/wpscan_rb.html index f49875ad..92570ed4 100644 --- a/doc/wpscan_rb.html +++ b/doc/wpscan_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-21 18:13:48 +0200
+- 2012-09-22 23:46:46 +0200
- Requires
diff --git a/doc/wpstools_rb.html b/doc/wpstools_rb.html index 9e7d1b49..9a7054e5 100644 --- a/doc/wpstools_rb.html +++ b/doc/wpstools_rb.html @@ -24,7 +24,7 @@
- Last Modified
-- 2012-09-15 08:06:35 +0200
+- 2012-09-22 14:59:30 +0200
- Requires
diff --git a/lib/wpscan/modules/wp_plugins.rb b/lib/wpscan/modules/wp_plugins.rb index e9dbed9f..68c1ad7e 100644 --- a/lib/wpscan/modules/wp_plugins.rb +++ b/lib/wpscan/modules/wp_plugins.rb @@ -31,10 +31,12 @@ module WpPlugins plugins = [] result.each do |r| plugins << WpPlugin.new( - :url => r[:url], - :path => r[:path], - :wp_content_dir => r[:wp_content_dir], - :name => r[:name] + :url => r.url, + :path => r.path, + :wp_content_dir => r.wp_content_dir, + :name => r.name, + :type => "plugins", + :wp_plugins_dir => r.wp_plugin_dir ) end plugins.sort_by { |p| p.name } @@ -52,10 +54,12 @@ module WpPlugins temp.each do |item| plugins << WpPlugin.new( - :url => item[:url], - :name => item[:name], - :path => item[:path], - :wp_content_dir => options[:wp_content_dir] + :url => item.url, + :name => item.name, + :path => item.path, + :wp_content_dir => options[:wp_content_dir], + :type => "plugins", + :wp_plugins_dir => options[:wp_plugin_dir] ) end plugins.sort_by { |p| p.name } diff --git a/lib/wpscan/modules/wp_themes.rb b/lib/wpscan/modules/wp_themes.rb index 5598aa80..97d6b302 100644 --- a/lib/wpscan/modules/wp_themes.rb +++ b/lib/wpscan/modules/wp_themes.rb @@ -20,7 +20,8 @@ module WpThemes def themes_from_aggressive_detection(options) options[:file] = options[:file] || "#{DATA_DIR}/themes.txt" - options[:vulns_file] = options[:vulns_file] || "#{DATA_DIR}/wp_theme_vulns.xml" + options[:vulns_file] = (options[:vulns_file] != nil and options[:vulns_file] != "") ? + options[:vulns_file] : DATA_DIR + "/wp_theme_vulns.xml" options[:vulns_xpath] = "//theme[@name='#{@name}']/vulnerability" options[:vulns_xpath_2] = "//theme" options[:type] = "themes" @@ -28,10 +29,10 @@ module WpThemes themes = [] result.each do |r| themes << WpTheme.new( - :url => r[:url], - :path => r[:path], - :wp_content_dir => r[:wp_content_dir], - :name => r[:name] + :url => r.url, + :path => r.path, + :wp_content_dir => r.wp_content_dir, + :name => r.name ) end themes.sort_by { |t| t.name } @@ -43,9 +44,9 @@ module WpThemes temp.each do |item| themes << WpTheme.new( - :url => item[:url], - :name => item[:name], - :path => item[:path], + :url => item.url, + :name => item.name, + :path => item.path, :wp_content_dir => options[:wp_content_dir] ) end diff --git a/lib/wpscan/modules/wp_timthumbs.rb b/lib/wpscan/modules/wp_timthumbs.rb index 067aefd7..cae99b4d 100644 --- a/lib/wpscan/modules/wp_timthumbs.rb +++ b/lib/wpscan/modules/wp_timthumbs.rb @@ -54,12 +54,15 @@ module WpTimthumbs timthumb.php lib/timthumb.php inc/timthumb.php includes/timthumb.php scripts/timthumb.php tools/timthumb.php functions/timthumb.php }.each do |file| - targets << { + targets << WpItem.new( :url => options[:url], :path => "themes/#{theme_name}/#{file}", :wp_content_dir => options[:wp_content_dir], - :name => options[:name] - } + :name => theme_name, + :vulns_file => "XX", + :type => "timthumbs", + :wp_plugins_dir => options[:wp_plugins_dir] + ) end targets end diff --git a/lib/wpscan/vulnerable.rb b/lib/wpscan/vulnerable.rb index 440ee590..67f6e9ab 100644 --- a/lib/wpscan/vulnerable.rb +++ b/lib/wpscan/vulnerable.rb @@ -18,13 +18,13 @@ class Vulnerable - attr_reader :vulns_xml, :vulns_xpath + attr_reader :vulns_file, :vulns_xpath # @return an array of WpVulnerability (can be empty) def vulnerabilities vulnerabilities = [] - xml = Nokogiri::XML(File.open(@vulns_xml)) do |config| + xml = Nokogiri::XML(File.open(@vulns_file)) do |config| config.noblanks end diff --git a/lib/wpscan/wp_detector.rb b/lib/wpscan/wp_detector.rb index ff8fe6b7..43933d36 100644 --- a/lib/wpscan/wp_detector.rb +++ b/lib/wpscan/wp_detector.rb @@ -31,7 +31,7 @@ class WpDetector already_present = false result.each do |r| # Already found via passive detection - if r[:name] == enum_result[:name] + if r.name == enum_result.name already_present = true break end @@ -60,12 +60,14 @@ class WpDetector names.uniq! names.each do |item| - items << { + items << WpItem.new( :url => url, :name => item, - :path => "#{type}/#{item}/", - :wp_content_dir => wp_content_dir - } + :type => type, + :path => "#{item}/", + :wp_content_dir => wp_content_dir, + :vulns_file => "" + ) end items end diff --git a/lib/wpscan/wp_enumerator.rb b/lib/wpscan/wp_enumerator.rb index d9f85602..11ae4eee 100644 --- a/lib/wpscan/wp_enumerator.rb +++ b/lib/wpscan/wp_enumerator.rb @@ -50,11 +50,7 @@ class WpEnumerator enumerate_size = targets.size targets.each do |target| - # Timthumb files have no /timthumbs/ directory - unless options[:type] =~ /timthumbs/i - target[:path] = "#{options[:type]}/#{target[:path]}" - end - url = "#{target[:url]}#{target[:wp_content_dir]}/#{target[:path]}" + url = target.get_url request = enum_browser.forge_request(url, { :cache_timeout => 0, :follow_location => true }) request_count += 1 @@ -92,18 +88,22 @@ class WpEnumerator wp_content_dir = options[:wp_content_dir] url = options[:url] type = options[:type] + plugins_dir = options[:wp_plugins_dir] targets_url = [] unless only_vulnerable # Open and parse the 'most popular' plugin list... - File.open(file, 'r') do |f| + File.open(file, "r") do |f| f.readlines.collect do |line| - targets_url << { + targets_url << WpItem.new( :url => url, :path => line.strip, :wp_content_dir => wp_content_dir, - :name => File.dirname(line.strip) - } + :name => File.dirname(line.strip), + :vulns_file => vulns_file, + :type => type, + :wp_plugins_dir => plugins_dir + ) end end end @@ -117,17 +117,20 @@ class WpEnumerator # We check if the plugin name from the plugin_vulns_file is already in targets, otherwise we add it xml.xpath(options[:vulns_xpath_2]).each do |node| name = node.attribute("name").text - targets_url << { + targets_url << WpItem.new( :url => url, :path => name, :wp_content_dir => wp_content_dir, - :name => name - } + :name => name, + :vulns_file => vulns_file, + :type => type, + :wp_plugins_dir => plugins_dir + ) end end - targets_url.flatten! - targets_url.uniq! + targets_url.flatten! { |t| t.name } + targets_url.uniq! { |t| t.name } # randomize the plugins array to *maybe* help in some crappy IDS/IPS/WAF detection targets_url.sort_by! { rand } end diff --git a/lib/wpscan/wp_item.rb b/lib/wpscan/wp_item.rb index bc9099ba..97b85f24 100644 --- a/lib/wpscan/wp_item.rb +++ b/lib/wpscan/wp_item.rb @@ -19,22 +19,40 @@ require "#{WPSCAN_LIB_DIR}/vulnerable" class WpItem < Vulnerable - attr_accessor :path, :url, :wp_content_dir, :name, :vulns_xml, :vulns_xpath + attr_accessor :path, :url, :wp_content_dir, :name, :vulns_file, :vulns_xpath, :wp_plugin_dir, :type @version = nil - def initialize(options = {}) + def initialize(options) + @type = options[:type] @wp_content_dir = options[:wp_content_dir] || "wp-content" + @wp_plugin_dir = options[:wp_plugins_dir] || "plugins" @url = options[:url] @path = options[:path] @name = options[:name] || extract_name_from_url - @vulns_xml = options[:vulns_xml] - @vulns_xpath = options[:vulns_xpath].sub(/\$name\$/, @name) + @vulns_file = options[:vulns_file] + @vulns_xpath = options[:vulns_xpath].sub(/\$name\$/, @name) unless options[:vulns_xpath] == nil raise("url not set") unless @url raise("path not set") unless @path raise("wp_content_dir not set") unless @wp_content_dir raise("name not set") unless @name - raise("vulns_xml not set") unless @vulns_xml + raise("vulns_file not set") unless @vulns_file + raise("type not set") unless @type + end + + def get_sub_folder + case @type + when "plugins" + folder = @wp_plugin_dir + when "themes" + folder = "themes" + when "timthumbs" + # not needed + folder = nil + else + raise("unknown type #@type") + end + folder end # Get the full url for this item @@ -44,7 +62,13 @@ class WpItem < Vulnerable wp_content_dir = @wp_content_dir.sub(/^\//, "").sub(/\/$/, "") # remove first / path = @path.sub(/^\//, "") - URI.parse("#{url}#{wp_content_dir}/#{path}") + if type == "timthumbs" + # timthumbs have folder in path variable + ret = URI.parse("#{url}#{wp_content_dir}/#{path}") + else + ret = URI.parse("#{url}#{wp_content_dir}/#{get_sub_folder}/#{path}") + end + ret end # Gets the full url for this item without filenames diff --git a/lib/wpscan/wp_plugin.rb b/lib/wpscan/wp_plugin.rb index 4e558def..0e9799f1 100644 --- a/lib/wpscan/wp_plugin.rb +++ b/lib/wpscan/wp_plugin.rb @@ -18,7 +18,8 @@ class WpPlugin < WpItem def initialize(options = {}) - options[:vulns_xml] = options[:vulns_xml] || DATA_DIR + '/plugin_vulns.xml' + options[:vulns_file] = (options[:vulns_file] != nil and options[:vulns_file] != "") ? + options[:vulns_file] : DATA_DIR + "/plugin_vulns.xml" options[:vulns_xpath] = "//plugin[@name='$name$']/vulnerability" options[:vulns_xpath_2] = "//plugin" options[:type] = "plugins" diff --git a/lib/wpscan/wp_target.rb b/lib/wpscan/wp_target.rb index 3df1f068..a1b7f636 100644 --- a/lib/wpscan/wp_target.rb +++ b/lib/wpscan/wp_target.rb @@ -104,7 +104,7 @@ class WpTarget def wp_plugins_dir unless @wp_plugins_dir - @wp_plugins_dir = wp_content_dir() + "/plugins" + @wp_plugins_dir = "plugins" end @wp_plugins_dir end diff --git a/lib/wpscan/wp_theme.rb b/lib/wpscan/wp_theme.rb index a19d28d6..50a1e73a 100644 --- a/lib/wpscan/wp_theme.rb +++ b/lib/wpscan/wp_theme.rb @@ -23,8 +23,10 @@ class WpTheme < WpItem attr_reader :name, :style_url, :version def initialize(options = {}) - options[:vulns_xml] = options[:vulns_xml] || DATA_DIR + '/wp_theme_vulns.xml' + options[:vulns_file] = (options[:vulns_file] != nil and options[:vulns_file] != "") ? + options[:vulns_file] : DATA_DIR + "/wp_theme_vulns.xml" options[:vulns_xpath] = "//theme[@name='$name$']/vulnerability" + options[:type] = "themes" @version = options[:version] @style_url = options[:style_url] super(options) diff --git a/lib/wpscan/wp_version.rb b/lib/wpscan/wp_version.rb index 5888feb8..4f69ecc4 100644 --- a/lib/wpscan/wp_version.rb +++ b/lib/wpscan/wp_version.rb @@ -25,7 +25,7 @@ class WpVersion < Vulnerable def initialize(number, options = {}) @number = number @discovery_method = options[:discovery_method] - @vulns_xml = options[:vulns_xml] || DATA_DIR + '/wp_vulns.xml' + @vulns_file = options[:vulns_file] || DATA_DIR + '/wp_vulns.xml' @vulns_xpath = "//wordpress[@version='#{@number}']/vulnerability" end diff --git a/spec/lib/wpscan/modules/wp_plugins_spec.rb b/spec/lib/wpscan/modules/wp_plugins_spec.rb index 26f82b25..9cf6c458 100644 --- a/spec/lib/wpscan/modules/wp_plugins_spec.rb +++ b/spec/lib/wpscan/modules/wp_plugins_spec.rb @@ -44,27 +44,27 @@ shared_examples_for "WpPlugins" do File.exist?(@plugin_vulns_file).should == true File.exist?(@plugins_file).should == true @targets = [WpPlugin.new({:url => "http://example.localhost/", - :path => "plugins/exclude-pages/exclude_pages.php", + :path => "exclude-pages/exclude_pages.php", :wp_content_dir => "wp-content", :name => "exclude-pages"}), WpPlugin.new({:url => "http://example.localhost/", - :path => "plugins/display-widgets/display-widgets.php", + :path => "display-widgets/display-widgets.php", :wp_content_dir => "wp-content", :name => "display-widgets"}), WpPlugin.new({:url => "http://example.localhost/", - :path => "plugins/media-library", + :path => "media-library", :wp_content_dir => "wp-content", :name => "media-library"}), WpPlugin.new({:url => "http://example.localhost/", - :path => "plugins/deans", + :path => "deans", :wp_content_dir => "wp-content", :name => "deans"}), WpPlugin.new({:url => "http://example.localhost/", - :path => "plugins/formidable/formidable.php", + :path => "formidable/formidable.php", :wp_content_dir => "wp-content", :name => "formidable"}), WpPlugin.new({:url => "http://example.localhost/", - :path => "plugins/regenerate-thumbnails/readme.txt", + :path => "regenerate-thumbnails/readme.txt", :wp_content_dir => "wp-content", :name => "regenerate-thumbnails"})] end diff --git a/spec/lib/wpscan/modules/wp_themes_spec.rb b/spec/lib/wpscan/modules/wp_themes_spec.rb index 77b6f730..e4001657 100644 --- a/spec/lib/wpscan/modules/wp_themes_spec.rb +++ b/spec/lib/wpscan/modules/wp_themes_spec.rb @@ -44,55 +44,55 @@ shared_examples_for "WpThemes" do File.exist?(@theme_vulns_file).should == true File.exist?(@themes_file).should == true @targets = [WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zenpro/404.php", + :path => "zenpro/404.php", :wp_content_dir => "wp-content", :name => "zenpro"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zeta-zip/404.php", + :path => "zeta-zip/404.php", :wp_content_dir => "wp-content", :name => "zeta-zip"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zfirst/404.php", + :path => "zfirst/404.php", :wp_content_dir => "wp-content", :name => "zfirst"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zgrey/404.php", + :path => "zgrey/404.php", :wp_content_dir => "wp-content", :name => "zgrey"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zindi-ii/404.php", + :path => "zindi-ii/404.php", :wp_content_dir => "wp-content", :name => "zindi-ii"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zindi/404.php", + :path => "zindi/404.php", :wp_content_dir => "wp-content", :name => "zindi"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zombie-apocalypse/404.php", + :path => "zombie-apocalypse/404.php", :wp_content_dir => "wp-content", :name => "zombie-apocalypse"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zsofa/404.php", + :path => "zsofa/404.php", :wp_content_dir => "wp-content", :name => "zsofa"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/zwei-seiten/404.php", + :path => "zwei-seiten/404.php", :wp_content_dir => "wp-content", :name => "zwei-seiten"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/twentyten/404.php", + :path => "twentyten/404.php", :wp_content_dir => "wp-content", :name => "twentyten"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/shopperpress", + :path => "shopperpress", :wp_content_dir => "wp-content", :name => "shopperpress"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/wise", + :path => "wise", :wp_content_dir => "wp-content", :name => "wise"}), WpTheme.new({:url => "http://example.localhost/", - :path => "themes/webfolio", + :path => "webfolio", :wp_content_dir => "wp-content", :name => "webfolio"})] end diff --git a/spec/lib/wpscan/modules/wp_timthumbs_spec.rb b/spec/lib/wpscan/modules/wp_timthumbs_spec.rb index cbfc47eb..e136c802 100644 --- a/spec/lib/wpscan/modules/wp_timthumbs_spec.rb +++ b/spec/lib/wpscan/modules/wp_timthumbs_spec.rb @@ -28,6 +28,8 @@ shared_examples_for "WpTimthumbs" do @options[:error_404_hash] = "xx" @options[:show_progress_bar] = false @options[:only_vulnerable_ones] = false + @options[:vulns_file] = "xx" + @options[:type] = "timthumbs" @module = WpScanModuleSpec.new(@url) @fixtures_dir = SPEC_FIXTURES_WPSCAN_MODULES_DIR + "/wp_timthumbs" @timthumbs_file = @fixtures_dir + "/timthumbs.txt" @@ -58,8 +60,7 @@ shared_examples_for "WpTimthumbs" do targets.length.should > 0 temp = [] targets.each do |t| - url = "#{t[:url]}#{t[:wp_content_dir]}/#{t[:path]}" - temp << url + temp << t.get_url.to_s end temp.sort.should === @targets_from_theme.sort end @@ -68,8 +69,6 @@ shared_examples_for "WpTimthumbs" do describe "#timthumbs and #has_timthumbs?" do before :each do @options[:file] = @timthumbs_file - @options[:vulns_file] = "xxx" - @options[:type] = "timthumbs" @targets_from_file.each do |url| stub_request(:get, url).to_return(:status => 404) end @@ -92,7 +91,7 @@ shared_examples_for "WpTimthumbs" do urls = [] urls_hash = WpEnumerator.generate_items(@options) urls_hash.each do |u| - url = "#{u[:url]}#{u[:wp_content_dir]}/#{u[:path]}" + url = u.get_url.to_s urls << url stub_request(:get, url).to_return(:status => 404) end @@ -107,8 +106,7 @@ shared_examples_for "WpTimthumbs" do temp = [] timthumbs.each do |t| - url = "#{t[:url]}#{t[:wp_content_dir]}/#{t[:path]}" - temp << url + temp << t.get_url.to_s end temp.sort.should === expected.sort @module.has_timthumbs?(nil).should be_true diff --git a/spec/lib/wpscan/wp_item_spec.rb b/spec/lib/wpscan/wp_item_spec.rb index 28375cf6..89dac96f 100644 --- a/spec/lib/wpscan/wp_item_spec.rb +++ b/spec/lib/wpscan/wp_item_spec.rb @@ -21,10 +21,11 @@ require File.expand_path(File.dirname(__FILE__) + '/wpscan_helper') describe WpPlugin do before :each do @instance = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", - :path => "plugins/test/asdf.php", - :vulns_xml => "XXX.xml", + :path => "test/asdf.php", + :vulns_file => "XXX.xml", :name => "test", - :vulns_xpath => "XX" + :vulns_xpath => "XX", + :type => "plugins" ) end @@ -32,7 +33,7 @@ describe WpPlugin do it "should create a correct instance" do @instance.wp_content_dir.should == "wp-content" @instance.url.should == "http://sub.example.com/path/to/wordpress/" - @instance.path.should == "plugins/test/asdf.php" + @instance.path.should == "test/asdf.php" end end @@ -43,13 +44,15 @@ describe WpPlugin do it "should return the correct url (custom wp_content_dir)" do @instance.wp_content_dir = "custom" + @instance.type = "plugins" @instance.get_url.to_s.should == "http://sub.example.com/path/to/wordpress/custom/plugins/test/asdf.php" end it "should trim / and add missing / before concatenating url" do @instance.wp_content_dir = "/custom/" @instance.url = "http://sub.example.com/path/to/wordpress" - @instance.path = "plugins/test/asdf.php" + @instance.path = "test/asdf.php" + @instance.type = "plugins" @instance.get_url.to_s.should == "http://sub.example.com/path/to/wordpress/custom/plugins/test/asdf.php" end end @@ -67,12 +70,14 @@ describe WpPlugin do it "should trim / and add missing / before concatenating url" do @instance.wp_content_dir = "/custom/" @instance.url = "http://sub.example.com/path/to/wordpress" - @instance.path = "plugins/test/asdf.php" + @instance.path = "test/asdf.php" + @instance.type = "plugins" @instance.get_url_without_filename.to_s.should == "http://sub.example.com/path/to/wordpress/custom/plugins/test/" end it "should not remove the last foldername" do - @instance.path = "plugins/test/" + @instance.path = "test/" + @instance.type = "plugins" @instance.get_url_without_filename.to_s.should == "http://sub.example.com/path/to/wordpress/wp-content/plugins/test/" end @@ -82,7 +87,8 @@ describe WpPlugin do end it "should add the last slash if it's not present" do - @instance.path = "plugins/test-one" + @instance.path = "test-one" + @instance.type = "plugins" @instance.get_url_without_filename.to_s.should == "http://sub.example.com/path/to/wordpress/wp-content/plugins/test-one/" end end @@ -145,17 +151,20 @@ describe WpPlugin do it "should extract the correct name" do @instance.wp_content_dir = "/custom/" @instance.url = "http://sub.example.com/path/to/wordpress" - @instance.path = "plugins/test2/asdf.php" + @instance.path = "test2/asdf.php" + @instance.type = "plugins" @instance.extract_name_from_url.should == "test2" end it "should extract the correct plugin name" do - @instance.path = "plugins/testplugin/" + @instance.path = "testplugin/" + @instance.type = "plugins" @instance.extract_name_from_url.should == "testplugin" end it "should extract the correct theme name" do - @instance.path = "themes/testtheme/" + @instance.path = "testtheme/" + @instance.type = "plugins" @instance.extract_name_from_url.should == "testtheme" end end @@ -175,8 +184,9 @@ describe WpPlugin do describe "#==" do it "should return false" do instance2 = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", - :path => "plugins/newname/asdf.php", - :vulns_xml => "XXX.xml", + :path => "newname/asdf.php", + :type => "plugins", + :vulns_file => "XXX.xml", :vulns_xpath => "XX" ) (@instance==instance2).should == false @@ -184,14 +194,82 @@ describe WpPlugin do it "should return true" do instance2 = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", - :path => "plugins/test/asdf.php", - :vulns_xml => "XXX.xml", + :path => "test/asdf.php", + :type => "plugins", + :vulns_file => "XXX.xml", :vulns_xpath => "XX" ) (@instance==instance2).should == true end end + describe "#get_sub_folder" do + it "should return plugins" do + item = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", + :path => "test/asdf.php", + :vulns_file => "XXX.xml", + :wp_content_dir => "wp-content", + :wp_plugins_dir => "plugins", + :name => "test", + :vulns_xpath => "XX", + :type => "plugins" + ) + item.get_sub_folder.should == "plugins" + end + + it "should return custom-plugins" do + item = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", + :path => "test/asdf.php", + :vulns_file => "XXX.xml", + :wp_content_dir => "wp-content", + :wp_plugins_dir => "custom-plugins", + :name => "test", + :vulns_xpath => "XX", + :type => "plugins" + ) + item.get_sub_folder.should == "custom-plugins" + end + + it "should return themes" do + item = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", + :path => "test/asdf.php", + :vulns_file => "XXX.xml", + :wp_content_dir => "wp-content", + :wp_plugins_dir => "plugins", + :name => "test", + :vulns_xpath => "XX", + :type => "themes" + ) + item.get_sub_folder.should == "themes" + end + + it "should return nil" do + item = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", + :path => "test/asdf.php", + :vulns_file => "XXX.xml", + :wp_content_dir => "wp-content", + :wp_plugins_dir => "plugins", + :name => "test", + :vulns_xpath => "XX", + :type => "timthumbs" + ) + item.get_sub_folder.should == nil + end + + it "should raise an exception" do + item = WpItem.new(:url => "http://sub.example.com/path/to/wordpress/", + :path => "test/asdf.php", + :vulns_file => "XXX.xml", + :wp_content_dir => "wp-content", + :wp_plugins_dir => "plugins", + :name => "test", + :vulns_xpath => "XX", + :type => "type" + ) + expect { item.get_sub_folder }.to raise_error(RuntimeError, "unknown type type") + end + end + describe "#readme_url" do it "should return the corrent plugin readme url" do @instance.readme_url.to_s.should == "http://sub.example.com/path/to/wordpress/wp-content/plugins/test/readme.txt" @@ -199,17 +277,20 @@ describe WpPlugin do it "should return the corrent plugin readme url (custom wp_content)" do @instance.wp_content_dir = "custom" + @instance.type = "plugins" @instance.readme_url.to_s.should == "http://sub.example.com/path/to/wordpress/custom/plugins/test/readme.txt" end it "should return the corrent theme readme url" do - @instance.path = "themes/test/asdf.php" + @instance.path = "test/asdf.php" + @instance.type = "themes" @instance.readme_url.to_s.should == "http://sub.example.com/path/to/wordpress/wp-content/themes/test/readme.txt" end it "should return the corrent theme readme url (custom wp_content)" do @instance.wp_content_dir = "custom" - @instance.path = "themes/test/asdf.php" + @instance.path = "test/asdf.php" + @instance.type = "themes" @instance.readme_url.to_s.should == "http://sub.example.com/path/to/wordpress/custom/themes/test/readme.txt" end end @@ -221,17 +302,20 @@ describe WpPlugin do it "should return the corrent plugin changelog url (custom wp_content)" do @instance.wp_content_dir = "custom" + @instance.type = "plugins" @instance.changelog_url.to_s.should == "http://sub.example.com/path/to/wordpress/custom/plugins/test/changelog.txt" end it "should return the corrent theme changelog url" do - @instance.path = "themes/test/asdf.php" + @instance.path = "test/asdf.php" + @instance.type = "themes" @instance.changelog_url.to_s.should == "http://sub.example.com/path/to/wordpress/wp-content/themes/test/changelog.txt" end it "should return the corrent theme changelog url (custom wp_content)" do @instance.wp_content_dir = "custom" - @instance.path = "themes/test/asdf.php" + @instance.path = "test/asdf.php" + @instance.type = "themes" @instance.changelog_url.to_s.should == "http://sub.example.com/path/to/wordpress/custom/themes/test/changelog.txt" end end diff --git a/spec/lib/wpscan/wp_plugin_spec.rb b/spec/lib/wpscan/wp_plugin_spec.rb index db56fc27..7ca5deee 100644 --- a/spec/lib/wpscan/wp_plugin_spec.rb +++ b/spec/lib/wpscan/wp_plugin_spec.rb @@ -44,7 +44,7 @@ describe WpPlugin do describe "#error_log_url" do it "should return a correct url" do temp = WpPlugin.new(:url => "http://wordpress.com", - :path => "plugins/test/asdf.php") + :path => "test/asdf.php") temp.error_log_url.to_s.should == "http://wordpress.com/wp-content/plugins/test/error_log" end end @@ -52,7 +52,7 @@ describe WpPlugin do describe "#error_log?" do before :each do @temp = WpPlugin.new(:url => "http://wordpress.com", - :path => "plugins/test/asdf.php") + :path => "test/asdf.php") end it "should return true" do diff --git a/spec/lib/wpscan/wp_target_spec.rb b/spec/lib/wpscan/wp_target_spec.rb index 06672519..39a5c988 100644 --- a/spec/lib/wpscan/wp_target_spec.rb +++ b/spec/lib/wpscan/wp_target_spec.rb @@ -24,9 +24,10 @@ describe WpTarget do Browser.reset @options = { - :config_file => SPEC_FIXTURES_CONF_DIR + '/browser/browser.conf.json', - :cache_timeout => 0, - :wp_plugins_dir => "wp-content/plugins" + :config_file => SPEC_FIXTURES_CONF_DIR + '/browser/browser.conf.json', + :cache_timeout => 0, + :wp_content_dir => "wp-content", + :wp_plugins_dir => "plugins" } @wp_target = WpTarget.new("http://example.localhost/", @options) end @@ -162,9 +163,9 @@ describe WpTarget do @expected = "custom-plugins" end - it "should return 'wp-content/plugins'" do + it "should return 'plugins'" do @stub_value = "wp-content" - @expected = "wp-content/plugins" + @expected = "plugins" end end diff --git a/spec/lib/wpscan/wp_theme_spec.rb b/spec/lib/wpscan/wp_theme_spec.rb index 0821bd0c..8aac5e43 100644 --- a/spec/lib/wpscan/wp_theme_spec.rb +++ b/spec/lib/wpscan/wp_theme_spec.rb @@ -181,12 +181,12 @@ describe WpTheme do it "should return false (name not equal)" do instance = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/name/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "1.0" ) instance2 = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/newname/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "1.0" ) (instance===instance2).should == false @@ -195,12 +195,12 @@ describe WpTheme do it "should return false (version not equal)" do instance = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/name/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "1.0" ) instance2 = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/name/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "2.0" ) (instance===instance2).should == false @@ -209,12 +209,12 @@ describe WpTheme do it "should return false (version and name not equal)" do instance = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/name/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "1.0" ) instance2 = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/newname/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "2.0" ) (instance===instance2).should == false @@ -223,12 +223,12 @@ describe WpTheme do it "should return true" do instance = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/test/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "1.0" ) instance2 = WpTheme.new(:url => "http://sub.example.com/path/to/wordpress/", :path => "themes/test/asdf.php", - :vulns_xml => "XXX.xml", + :vulns_file => "XXX.xml", :version => "1.0" ) (instance===instance2).should == true diff --git a/spec/lib/wpscan/wp_version_spec.rb b/spec/lib/wpscan/wp_version_spec.rb index 91a1618c..1a8ab437 100644 --- a/spec/lib/wpscan/wp_version_spec.rb +++ b/spec/lib/wpscan/wp_version_spec.rb @@ -154,7 +154,7 @@ describe WpVersion do describe "#initialize" do it "should initialize a WpVersion object" do - v = WpVersion.new(1, {:discovery_method => "method", :vulns_xml => "asdf.xml"}) + v = WpVersion.new(1, {:discovery_method => "method", :vulns_file => "asdf.xml"}) v.number.should == 1 v.discovery_method.should == "method" end diff --git a/spec/lib/wpscan/wp_vulnerability_spec.rb b/spec/lib/wpscan/wp_vulnerability_spec.rb index 7c646f1a..470eee46 100644 --- a/spec/lib/wpscan/wp_vulnerability_spec.rb +++ b/spec/lib/wpscan/wp_vulnerability_spec.rb @@ -3,11 +3,11 @@ describe "#vulnerabilities" do let(:location_url) { "http://example.localhost/" } let(:fixtures_dir) { SPEC_FIXTURES_WPSCAN_WP_PLUGIN_DIR + "/vulnerabilities" } - let(:vulns_xml) { fixtures_dir + "/plugin_vulns.xml" } + let(:vulns_file) { fixtures_dir + "/plugin_vulns.xml" } let(:wp_plugin) { WpPlugin.new(:url => location_url, :name => "spec-plugin", :path => "plugins/spec-plugin/", - :vulns_xml => vulns_xml) + :vulns_file => vulns_file) } @@ -15,7 +15,7 @@ describe "#vulnerabilities" do WpPlugin.new(:url => "http://example.localhost/", :name => "no-vulns", :path => "plugins/no-vulns/", - :vulns_xml => vulns_xml).vulnerabilities.should be_empty + :vulns_file => vulns_file).vulnerabilities.should be_empty end it "should return an arry with 2 vulnerabilities" do diff --git a/wpscan.rb b/wpscan.rb index 7fac4a76..45a9394f 100755 --- a/wpscan.rb +++ b/wpscan.rb @@ -119,7 +119,7 @@ begin end wp_target.config_backup.each do |file_url| - puts red("[!]") + " A wp-config.php backup file has been found '#{file_url}'" + puts red("[!] A wp-config.php backup file has been found '#{file_url}'") end if wp_target.has_malwares? @@ -186,6 +186,7 @@ begin options[:show_progress_bar] = true options[:wp_content_dir] = wp_target.wp_content_dir options[:error_404_hash] = wp_target.error_404_hash + options[:wp_plugins_dir] = wp_target.wp_plugins_dir plugins = wp_target.plugins_from_aggressive_detection(options) unless plugins.empty? @@ -295,7 +296,7 @@ begin puts timthumbs.each do |t| - puts " | " + red("[!]") + " #{t[:url]}#{t[:wp_content_dir]}/#{t[:path]}" + puts " | " + red("[!]") + " #{t.get_url.to_s}" end puts puts red(" * Reference: http://www.exploit-db.com/exploits/17602/")