Fix #24 --exclude-content-based option added

lib/wpscan/wp_enumerator.rb

@@ -42,12 +42,13 @@ class WpEnumerator
       end
     end
 
-    found = []
-    queue_count = 0
-    request_count = 0
-    enum_browser = Browser.instance
-    enum_hydra = enum_browser.hydra
+    found          = []
+    queue_count    = 0
+    request_count  = 0
+    enum_browser   = Browser.instance
+    enum_hydra     = enum_browser.hydra
     enumerate_size = targets.size
+    exclude_regexp = options[:exclude_content_based] ? %r{#{options[:exclude_content_based]}} : nil
 
     targets.each do |target|
       url = target.get_full_url
@@ -61,7 +62,13 @@ class WpEnumerator
 
         if WpTarget.valid_response_codes.include?(response.code)
           if Digest::MD5.hexdigest(response.body) != options[:error_404_hash]
-            found << target
+            if options[:exclude_content_based]
+              unless response.body[exclude_regexp]
+                found << target
+              end
+            else
+              found << target
+            end
           end
         end
       end

lib/wpscan/wpscan_helper.rb

@@ -93,6 +93,8 @@ def help()
   puts "  Multiple values are allowed : '-e t,p' will enumerate timthumbs and plugins"
   puts "  If no option is supplied, the default is 'vt,tt,u,vp'"
   puts
+  puts "--exclude-content-based '<regexp or string>' Used with the enumeration option, will exclude all occurence based on the regexp or string supplied"
+  puts "                                             You do not need to provide the regexp delimiters, but you must write the quotes (simple or double)"
   puts "--config-file | -c <config file> Use the specified config file"
   puts "--follow-redirection  If the target url has a redirection, it will be followed without asking if you wanted to do so or not"
   puts "--wp-content-dir <wp content dir>  WPScan try to find the content directory (ie wp-content) by scanning the index page, however you can specified it. Subdirectories are allowed"

lib/wpscan/wpscan_options.rb

@@ -19,30 +19,31 @@
 class WpscanOptions
 
   ACCESSOR_OPTIONS = [
-      :enumerate_plugins,
-      :enumerate_only_vulnerable_plugins,
-      :enumerate_all_plugins,
-      :enumerate_themes,
-      :enumerate_only_vulnerable_themes,
-      :enumerate_all_themes,
-      :enumerate_timthumbs,
-      :enumerate_usernames,
-      :enumerate_usernames_range,
-      :proxy,
-      :proxy_auth,
-      :threads,
-      :url,
-      :wordlist,
-      :force,
-      :update,
-      :verbose,
-      :username,
-      :password,
-      :follow_redirection,
-      :wp_content_dir,
-      :wp_plugins_dir,
-      :help,
-      :config_file
+    :enumerate_plugins,
+    :enumerate_only_vulnerable_plugins,
+    :enumerate_all_plugins,
+    :enumerate_themes,
+    :enumerate_only_vulnerable_themes,
+    :enumerate_all_themes,
+    :enumerate_timthumbs,
+    :enumerate_usernames,
+    :enumerate_usernames_range,
+    :proxy,
+    :proxy_auth,
+    :threads,
+    :url,
+    :wordlist,
+    :force,
+    :update,
+    :verbose,
+    :username,
+    :password,
+    :follow_redirection,
+    :wp_content_dir,
+    :wp_plugins_dir,
+    :help,
+    :config_file,
+    :exclude_content_based
   ]
 
   attr_accessor *ACCESSOR_OPTIONS
@@ -238,7 +239,8 @@ class WpscanOptions
         ["--follow-redirection", GetoptLong::NO_ARGUMENT],
         ["--wp-content-dir", GetoptLong::REQUIRED_ARGUMENT],
         ["--wp-plugins-dir", GetoptLong::REQUIRED_ARGUMENT],
-        ["--config-file", "-c", GetoptLong::REQUIRED_ARGUMENT]
+        ["--config-file", "-c", GetoptLong::REQUIRED_ARGUMENT],
+        ["--exclude-content-based", GetoptLong::REQUIRED_ARGUMENT]
     )
   end