HELLO v3!!!

spec/app/finders/interesting_findings/backup_db_spec.rb

@@ -0,0 +1,64 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::BackupDB do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'backup_db') }
+  let(:wp_content) { 'wp-content' }
+  let(:dir_url)    { target.url("#{wp_content}/backup-db/") }
+
+  before { expect(target).to receive(:content_dir).at_least(1).and_return(wp_content) }
+
+  describe '#aggressive' do
+    before { stub_request(:get, dir_url).to_return(status: status, body: body) }
+
+    let(:body) { '' }
+
+    context 'when not a 200 or 403' do
+      let(:status) { 404 }
+
+      its(:aggressive) { should be_nil }
+    end
+
+    context 'when 200 and matching the homepage' do
+      before { expect(target).to receive(:homepage_or_404?).and_return(true) }
+
+      let(:status) { 200 }
+
+      its(:aggressive) { should be_nil }
+    end
+
+    context 'when 200 or 403' do
+      before { expect(target).to receive(:homepage_or_404?).and_return(false) }
+
+      let(:status) { 200 }
+
+      after do
+        found = finder.aggressive
+
+        expect(found).to eql WPScan::InterestingFinding.new(
+          dir_url,
+          confidence: 70,
+          found_by: described_class::DIRECT_ACCESS
+        )
+
+        expect(found.interesting_entries).to eq @expected_entries
+      end
+
+      context 'when no directory listing' do
+        it 'returns an empty interesting_findings attribute' do
+          @expected_entries = []
+        end
+      end
+
+      context 'when directory listing enabled' do
+        let(:body) { File.read(File.join(fixtures, 'dir_listing.html')) }
+
+        it 'returns the expected interesting_findings attribute' do
+          @expected_entries = %w[sqldump.sql test.txt]
+        end
+      end
+    end
+  end
+end

spec/app/finders/interesting_findings/debug_log_spec.rb

@@ -0,0 +1,34 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::DebugLog do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'debug_log') }
+  let(:wp_content) { 'wp-content' }
+  let(:log_url)    { target.url("#{wp_content}/debug.log") }
+
+  before { expect(target).to receive(:content_dir).at_least(1).and_return(wp_content) }
+
+  describe '#aggressive' do
+    before { stub_request(:get, log_url).to_return(body: body) }
+
+    context 'when empty file' do
+      let(:body) { '' }
+
+      its(:aggressive) { should be_nil }
+    end
+
+    context 'when a log file' do
+      let(:body) { File.read(File.join(fixtures, 'debug.log')) }
+
+      it 'returns the InterestingFinding' do
+        expect(finder.aggressive).to eql WPScan::InterestingFinding.new(
+          log_url,
+          confidence: 100,
+          found_by: described_class::DIRECT_ACCESS
+        )
+      end
+    end
+  end
+end

spec/app/finders/interesting_findings/duplicator_installer_log_spec.rb

@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::DuplicatorInstallerLog do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'duplicator_installer_log') }
+  let(:filename)   { 'installer-log.txt' }
+  let(:log_url)    { target.url(filename) }
+
+  describe '#aggressive' do
+    before do
+      expect(target).to receive(:sub_dir).at_least(1).and_return(false)
+      stub_request(:get, log_url).to_return(body: body)
+    end
+
+    context 'when the body does not match' do
+      let(:body) { '' }
+
+      its(:aggressive) { should be_nil }
+    end
+
+    context 'when the body matches' do
+      let(:body) { File.read(File.join(fixtures, filename)) }
+
+      it 'returns the InterestingFinding' do
+        expect(finder.aggressive).to eql WPScan::InterestingFinding.new(
+          log_url,
+          confidence: 100,
+          found_by: described_class::DIRECT_ACCESS
+        )
+      end
+    end
+  end
+end

spec/app/finders/interesting_findings/emergency_pwd_reset_script_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::EmergencyPwdResetScript do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'emergency_pwd_reset_script') }
+
+  describe '#aggressive' do
+    xit
+  end
+end

spec/app/finders/interesting_findings/full_path_disclosure_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::FullPathDisclosure do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'fpd') }
+  let(:file_url)   { target.url('wp-includes/rss-functions.php') }
+
+  describe '#aggressive' do
+    before do
+      expect(target).to receive(:sub_dir).at_least(1).and_return(false)
+      stub_request(:get, file_url).to_return(body: body)
+    end
+
+    context 'when empty file' do
+      let(:body) { '' }
+
+      its(:aggressive) { should be_nil }
+    end
+
+    context 'when a log file' do
+      let(:body) { File.read(File.join(fixtures, 'rss_functions.php')) }
+
+      it 'returns the InterestingFinding' do
+        found = finder.aggressive
+
+        expect(found).to eql WPScan::InterestingFinding.new(
+          file_url,
+          confidence: 100,
+          found_by: described_class::DIRECT_ACCESS
+        )
+        expect(found.interesting_entries).to eql %w[/blog/wp-includes/rss-functions.php]
+      end
+    end
+  end
+end

spec/app/finders/interesting_findings/mu_plugins_spec.rb

@@ -0,0 +1,16 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::MuPlugins do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'mu_plugins') }
+
+  describe '#passive' do
+    xit
+  end
+
+  describe '#aggressive' do
+    xit
+  end
+end

spec/app/finders/interesting_findings/multisite_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::Multisite do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'multisite') }
+
+  describe '#aggressive' do
+    xit
+  end
+end

spec/app/finders/interesting_findings/readme_spec.rb

@@ -0,0 +1,46 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::Readme do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'readme') }
+
+  describe '#aggressive' do
+    before do
+      expect(target).to receive(:sub_dir).at_least(1).and_return(false)
+
+      finder.potential_files.each do |file|
+        stub_request(:get, target.url(file)).to_return(status: 404)
+      end
+    end
+
+    context 'when no file present' do
+      its(:aggressive) { should be_nil }
+    end
+
+    # TODO: case when multiple files are present ? (should return only the first one found)
+    context 'when a file exists' do
+      let(:file)   { finder.potential_files.sample }
+      let(:readme) { File.read(File.join(fixtures, 'readme-3.9.2.html')) }
+
+      before { stub_request(:get, target.url(file)).to_return(body: readme) }
+
+      it 'returns the expected InterestingFinding' do
+        expected = WPScan::InterestingFinding.new(
+          target.url(file),
+          confidence: 100,
+          found_by: described_class::DIRECT_ACCESS
+        )
+
+        expect(finder.aggressive).to eql expected
+      end
+    end
+  end
+
+  describe '#potential_files' do
+    it 'does not contain duplicates' do
+      expect(finder.potential_files.flatten.uniq.length).to eql finder.potential_files.length
+    end
+  end
+end

spec/app/finders/interesting_findings/registration_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::Registration do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'registration') }
+
+  describe '#aggressive' do
+    xit
+  end
+end

spec/app/finders/interesting_findings/tmm_db_migrate_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::TmmDbMigrate do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'tmm_db_migrate') }
+
+  describe '#aggressive' do
+    xit
+  end
+end

spec/app/finders/interesting_findings/upload_direcrory_listing_spec.rb

@@ -0,0 +1,13 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::UploadDirectoryListing do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'upload_directory_listing') }
+  let(:wp_content) { 'wp-content' }
+
+  describe '#aggressive' do
+    xit
+  end
+end

spec/app/finders/interesting_findings/upload_sql_dump_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe WPScan::Finders::InterestingFindings::UploadSQLDump do
+  subject(:finder) { described_class.new(target) }
+  let(:target)     { WPScan::Target.new(url).extend(CMSScanner::Target::Server::Apache) }
+  let(:url)        { 'http://ex.lo/' }
+  let(:fixtures)   { File.join(FINDERS_FIXTURES, 'interesting_findings', 'upload_sql_dump') }
+  let(:wp_content) { 'wp-content' }
+
+  describe '#aggressive' do
+    before { expect(target).to receive(:content_dir).at_least(1).and_return(wp_content) }
+
+    after {  expect(finder.aggressive).to eql @expected }
+
+    context 'when not a 200' do
+      it 'returns nil' do
+        stub_request(:get, finder.dump_url).to_return(status: 404)
+
+        @expected = nil
+      end
+    end
+
+    context 'when a 200' do
+      before do
+        stub_request(:get, finder.dump_url)
+          .to_return(status: 200, body: File.read(File.join(fixtures, fixture)))
+      end
+
+      context 'when the body does not match a SQL dump' do
+        let(:fixture) { 'not_sql.txt' }
+
+        it 'returns nil' do
+          @expected = nil
+        end
+      end
+
+      context 'when the body matches a SQL dump' do
+        let(:fixture) { 'dump.sql' }
+
+        it 'returns the interesting findings' do
+          @expected = WPScan::InterestingFinding.new(
+            finder.dump_url,
+            confidence: 100,
+            found_by: described_class::DIRECT_ACCESS
+          )
+        end
+      end
+    end
+  end
+end