diff --git a/lib/wpscan/target/platform/wordpress.rb b/lib/wpscan/target/platform/wordpress.rb index 2b60a174..96077ea1 100644 --- a/lib/wpscan/target/platform/wordpress.rb +++ b/lib/wpscan/target/platform/wordpress.rb @@ -32,8 +32,12 @@ module WPScan if %i[mixed aggressive].include?(detection_mode) %w[wp-admin/install.php wp-login.php].each do |path| - return true if in_scope_uris(Browser.get_and_follow_location(url(path))).any? do |uri| - WORDPRESS_PATTERN.match?(uri.path) + res = Browser.get_and_follow_location(url(path)) + + next unless res.code == 200 + + in_scope_uris(res, '//link/@href|//script/@src') do |uri| + return true if WORDPRESS_PATTERN.match?(uri.path) end end end diff --git a/spec/shared_examples/target/platform/wordpress.rb b/spec/shared_examples/target/platform/wordpress.rb index bcad262c..cf169f29 100644 --- a/spec/shared_examples/target/platform/wordpress.rb +++ b/spec/shared_examples/target/platform/wordpress.rb @@ -82,6 +82,25 @@ shared_examples WPScan::Target::Platform::WordPress do expect(subject.wordpress?(:mixed)).to be true end end + + context 'when a lot of irrelevant links' do + let(:body) do + Array.new(250) do |i| + "" + end.join("\n") + end + + it 'should not take a while to process check' do + stub_request(:get, target.url('wp-admin/install.php')).to_return(body: body) + stub_request(:get, target.url('wp-login.php')).to_return(body: body) + + time_start = Time.now + expect(subject.wordpress?(:mixed)).to be false + time_end = Time.now + + expect(time_end - time_start).to be < 1 + end + end end end end