Do not cache login requests - Fixes #1395

2019-09-16 10:37:43 +01:00
parent b77e611a90
commit ab950d6ffc
3 changed files with 3 additions and 2 deletions
--- a/app/finders/passwords/xml_rpc.rb
+++ b/app/finders/passwords/xml_rpc.rb
@@ -8,7 +8,7 @@ module WPScan
        include CMSScanner::Finders::Finder::BreadthFirstDictionaryAttack

        def login_request(username, password)
-          target.method_call('wp.getUsersBlogs', [username, password])
+          target.method_call('wp.getUsersBlogs', [username, password], cache_ttl: 0)
        end

        def valid_credentials?(response)
--- a/app/finders/passwords/xml_rpc_multicall.rb
+++ b/app/finders/passwords/xml_rpc_multicall.rb
@@ -19,7 +19,7 @@ module WPScan
            end
          end

-          target.multi_call(methods).run
+          target.multi_call(methods, cache_ttl: 0).run
        end

        # @param [ Array<Model::User> ] users