garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adds detection of wp-content from raw JS

Browse Source
This commit is contained in:
erwanlr
2019-03-14 09:14:55 +00:00
parent d30d212cc5
commit ab5f46e955
3 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/wpscan/target/platform/wordpress/custom_directories.rb
View File

@@ -15,11 +15,15 @@ module WPScan
def content_dir def content_dir
unless @content_dir unless @content_dir
escaped_url = Regexp.escape(url).gsub(/https?/i, 'https?') escaped_url = Regexp.escape(url).gsub(/https?/i, 'https?')
pattern = %r{#{escaped_url}(.+?)\/(?:themes|plugins|uploads|cache)\/}i pattern = %r{#{escaped_url}([^\/]+)\/(?:themes|plugins|uploads|cache)\/}i
in_scope_urls(homepage_res) do |url| in_scope_urls(homepage_res) do |url|
return @content_dir = Regexp.last_match[1] if url.match(pattern) return @content_dir = Regexp.last_match[1] if url.match(pattern)
end end
xpath_pattern_from_page('//script[not(@src)]', pattern, homepage_res) do |match|
return @content_dir = match[1]
end
end end
@content_dir @content_dir

2
spec/fixtures/target/platform/wordpress/custom_directories/in_raw_js.html vendored Normal file
View File

@@ -0,0 +1,2 @@
<script type='application/ld+json'>
{"@context":"https://schema.org","@type":"Organization","url":"https://ex.lo/","@id":"https://ex.lo/#organization","name":"WP Lab","logo":"http://ex.lo/wp-content/uploads/2019/02/lo.png"}</script>

3
spec/shared_examples/target/platform/wordpress/custom_directories.rb
View File

@@ -4,7 +4,8 @@ shared_examples 'WordPress::CustomDirectories' do
describe '#content_dir' do describe '#content_dir' do
{ {
default: 'wp-content', https: 'wp-content', custom_w_spaces: 'custom content spaces', default: 'wp-content', https: 'wp-content', custom_w_spaces: 'custom content spaces',
relative_one: 'wp-content', relative_two: 'wp-content', cache: 'wp-content' relative_one: 'wp-content', relative_two: 'wp-content', cache: 'wp-content',
in_raw_js: 'wp-content', with_sub_dir: 'app'
}.each do |file, expected| }.each do |file, expected|
it "returns #{expected} for #{file}.html" do it "returns #{expected} for #{file}.html" do
stub_request(:get, target.url).to_return(body: File.read(fixtures.join("#{file}.html"))) stub_request(:get, target.url).to_return(body: File.read(fixtures.join("#{file}.html")))