Uses the new CMSScanner Enumerator module
This commit is contained in:
@@ -26,81 +26,3 @@ module WPScan
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Better version of the CMSScanner Enumerator for plugins, themes and timthumbs,
|
||||
# put here as temporary until implemented in it (and considering other finders using it, such as
|
||||
# the config backups etc)
|
||||
module WPScan
|
||||
module Finders
|
||||
class Finder
|
||||
module Enumerator
|
||||
# @param [ Hash ] The target urls
|
||||
# @param [ Hash ] opts
|
||||
# @option opts [ Boolean ] :show_progression Wether or not to display the progress bar
|
||||
# @option opts [ Regexp ] :exclude_content
|
||||
#
|
||||
# @yield [ Typhoeus::Response, String ]
|
||||
def enumerate(urls, opts = {})
|
||||
create_progress_bar(opts.merge(total: urls.size))
|
||||
|
||||
urls.each do |url, slug|
|
||||
request = browser.forge_request(url, request_params)
|
||||
|
||||
request.on_complete do |res|
|
||||
progress_bar.increment
|
||||
|
||||
yield res, slug if valid_response?(res, opts[:exclude_content])
|
||||
end
|
||||
|
||||
hydra.queue(request)
|
||||
end
|
||||
|
||||
hydra.run
|
||||
end
|
||||
|
||||
# @return [ Hash ]
|
||||
def request_params
|
||||
@request_params ||= target.head_or_get_request_params.merge(cache_ttl: 0)
|
||||
end
|
||||
|
||||
# @param [ Typhoeus::Response ] res
|
||||
# @param [ Regexp,nil ] exclude_content
|
||||
#
|
||||
# @return [ Boolean ]
|
||||
# rubocop:disable Metrics/PerceivedComplexity
|
||||
def valid_response?(res, exclude_content = nil)
|
||||
return false unless valid_response_codes.include?(res.code)
|
||||
|
||||
return false if exclude_content && res.response_headers&.match(exclude_content)
|
||||
|
||||
# Perform a full get to check if homepage or custom 404
|
||||
if res.code == 200
|
||||
# The cache is not disabled to avoid additional request/s when checking
|
||||
# for directory listing
|
||||
full_res = Browser.get(res.effective_url)
|
||||
|
||||
return false if target.homepage_or_404?(full_res) ||
|
||||
exclude_content && full_res.body.match(exclude_content)
|
||||
end
|
||||
|
||||
true
|
||||
end
|
||||
# rubocop:enable Metrics/PerceivedComplexity
|
||||
|
||||
# @return [ Array<Integer> ]
|
||||
def valid_response_codes
|
||||
@valid_response_codes ||= [200, 401, 403, 301]
|
||||
end
|
||||
|
||||
# Idea here would be to check the opts[:found] which
|
||||
# contains items (such as plugins) found via other techniques,
|
||||
# and see their responses to refine the #response_codes
|
||||
def determine_valid_response_codes(opts)
|
||||
return if opts[:found].empty?
|
||||
|
||||
# TODO
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user