Uses the new CMSScanner Enumerator module

This commit is contained in:
erwanlr
2019-03-26 15:23:34 +00:00
parent 32270efd65
commit cfab2a9cd7
11 changed files with 51 additions and 122 deletions

View File

@@ -26,81 +26,3 @@ module WPScan
end
end
end
# Better version of the CMSScanner Enumerator for plugins, themes and timthumbs,
# put here as temporary until implemented in it (and considering other finders using it, such as
# the config backups etc)
module WPScan
module Finders
class Finder
module Enumerator
# @param [ Hash ] The target urls
# @param [ Hash ] opts
# @option opts [ Boolean ] :show_progression Wether or not to display the progress bar
# @option opts [ Regexp ] :exclude_content
#
# @yield [ Typhoeus::Response, String ]
def enumerate(urls, opts = {})
create_progress_bar(opts.merge(total: urls.size))
urls.each do |url, slug|
request = browser.forge_request(url, request_params)
request.on_complete do |res|
progress_bar.increment
yield res, slug if valid_response?(res, opts[:exclude_content])
end
hydra.queue(request)
end
hydra.run
end
# @return [ Hash ]
def request_params
@request_params ||= target.head_or_get_request_params.merge(cache_ttl: 0)
end
# @param [ Typhoeus::Response ] res
# @param [ Regexp,nil ] exclude_content
#
# @return [ Boolean ]
# rubocop:disable Metrics/PerceivedComplexity
def valid_response?(res, exclude_content = nil)
return false unless valid_response_codes.include?(res.code)
return false if exclude_content && res.response_headers&.match(exclude_content)
# Perform a full get to check if homepage or custom 404
if res.code == 200
# The cache is not disabled to avoid additional request/s when checking
# for directory listing
full_res = Browser.get(res.effective_url)
return false if target.homepage_or_404?(full_res) ||
exclude_content && full_res.body.match(exclude_content)
end
true
end
# rubocop:enable Metrics/PerceivedComplexity
# @return [ Array<Integer> ]
def valid_response_codes
@valid_response_codes ||= [200, 401, 403, 301]
end
# Idea here would be to check the opts[:found] which
# contains items (such as plugins) found via other techniques,
# and see their responses to refine the #response_codes
def determine_valid_response_codes(opts)
return if opts[:found].empty?
# TODO
end
end
end
end
end