garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updates WP DF (also check non minified file paths) - Ref #1311

Browse Source
This commit is contained in:
erwanlr
2019-03-12 07:55:32 +00:00
parent adff971d62
commit d30d212cc5
5 changed files with 32 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
spec/fixtures/db/dynamic_finders.yml vendored
View File

@@ -40,8 +40,11 @@ wordpress:
xpath: //link[contains(@href,"wp-includes/")]/@href|//script[contains(@src,"wp-includes/")]/@src xpath: //link[contains(@href,"wp-includes/")]/@href|//script[contains(@src,"wp-includes/")]/@src
files: files:
- wp-includes/js/wp-embed.min.js - wp-includes/js/wp-embed.min.js
- wp-includes/js/wp-embed.js
- wp-includes/css/dashicons.min.css - wp-includes/css/dashicons.min.css
- wp-includes/css/dashicons.css
- wp-includes/js/comment-reply.min.js - wp-includes/js/comment-reply.min.js
- wp-includes/js/comment-reply.js
confidence_per_occurence: 40 confidence_per_occurence: 40
version: true version: true
CommonWpIncludesQueryParameterInHomepage: CommonWpIncludesQueryParameterInHomepage:
@@ -49,18 +52,30 @@ wordpress:
xpath: //link[contains(@href,"wp-includes/")]/@href|//script[contains(@src,"wp-includes/")]/@src xpath: //link[contains(@href,"wp-includes/")]/@href|//script[contains(@src,"wp-includes/")]/@src
files: files:
- wp-includes/css/buttons.min.css - wp-includes/css/buttons.min.css
- wp-includes/css/buttons.css
- wp-includes/css/admin-bar.min.css - wp-includes/css/admin-bar.min.css
- wp-includes/css/admin-bar.css
- wp-includes/js/wp-util.min.js - wp-includes/js/wp-util.min.js
- wp-includes/js/wp-util.js
- wp-includes/js/wp-backbone.min.js - wp-includes/js/wp-backbone.min.js
- wp-includes/js/wp-backbone.js
- wp-includes/js/utils.min.js - wp-includes/js/utils.min.js
- wp-includes/js/utils.js
- wp-includes/js/thickbox/thickbox.css - wp-includes/js/thickbox/thickbox.css
- wp-includes/js/wp-a11y.min.js - wp-includes/js/wp-a11y.min.js
- wp-includes/js/wp-a11y.js
- wp-includes/js/mediaelement/wp-mediaelement.min.css - wp-includes/js/mediaelement/wp-mediaelement.min.css
- wp-includes/js/mediaelement/wp-mediaelement.css
- wp-includes/js/mediaelement/wp-mediaelement.min.js - wp-includes/js/mediaelement/wp-mediaelement.min.js
- wp-includes/js/mediaelement/wp-mediaelement.js
- wp-includes/js/mediaelement/mediaelement-migrate.min.js - wp-includes/js/mediaelement/mediaelement-migrate.min.js
- wp-includes/js/mediaelement/mediaelement-migrate.js
- wp-includes/js/mediaelement/wp-playlist.min.js - wp-includes/js/mediaelement/wp-playlist.min.js
- wp-includes/js/mediaelement/wp-playlist.js
- wp-includes/js/wp-ajax-response.min.js - wp-includes/js/wp-ajax-response.min.js
- wp-includes/js/wp-ajax-response.js
- wp-includes/css/wp-pointer.min.css - wp-includes/css/wp-pointer.min.css
- wp-includes/css/wp-pointer.css
confidence_per_occurence: 10 confidence_per_occurence: 10
version: true version: true
PluginAndThemeQueryParameterInHomepage: PluginAndThemeQueryParameterInHomepage:
@@ -72,8 +87,11 @@ wordpress:
xpath: //link[contains(@href,"wp-includes/css/") or contains(@href,"wp-admin/css/")]/@href xpath: //link[contains(@href,"wp-includes/css/") or contains(@href,"wp-admin/css/")]/@href
files: files:
- wp-includes/css/buttons.min.css - wp-includes/css/buttons.min.css
- wp-includes/css/buttons.css
- wp-includes/css/dashicons.min.css - wp-includes/css/dashicons.min.css
- wp-includes/css/dashicons.css
- wp-admin/css/install.min.css - wp-admin/css/install.min.css
- wp-admin/css/install.css
confidence_per_occurence: 30 confidence_per_occurence: 30
version: true version: true
QueryParameterInUpgradePage: QueryParameterInUpgradePage:
@@ -82,7 +100,9 @@ wordpress:
xpath: //link[contains(@href,"wp-includes/css/") or contains(@href,"wp-admin/css/")]/@href xpath: //link[contains(@href,"wp-includes/css/") or contains(@href,"wp-admin/css/")]/@href
files: files:
- wp-includes/css/buttons.min.css - wp-includes/css/buttons.min.css
- wp-includes/css/buttons.css
- wp-admin/css/install.min.css - wp-admin/css/install.min.css
- wp-admin/css/install.css
confidence_per_occurence: 30 confidence_per_occurence: 30
version: true version: true
SitemapGenerator: SitemapGenerator:

7
spec/fixtures/dynamic_finders/expected.yml vendored
View File

@@ -50,6 +50,7 @@ wordpress:
confidence: 100 confidence: 100
interesting_entries: interesting_entries:
- http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1 - http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1
- http://wp.lab/wp-includes/css/buttons.css?ver=3.8.1
- http://wp.lab/wp-includes/css/admin-bar.min.css?ver=3.8.1 - http://wp.lab/wp-includes/css/admin-bar.min.css?ver=3.8.1
- https://wp.lab/wp-includes/js/wp-util.min.js?ver=3.8.1 - https://wp.lab/wp-includes/js/wp-util.min.js?ver=3.8.1
- https://wp.lab/wp-includes/js/wp-backbone.min.js?ver=3.8.1 - https://wp.lab/wp-includes/js/wp-backbone.min.js?ver=3.8.1
@@ -73,18 +74,20 @@ wordpress:
QueryParameterInInstallPage: QueryParameterInInstallPage:
number: 3.8.1 number: 3.8.1
found_by: Query Parameter In Install Page (Aggressive Detection) found_by: Query Parameter In Install Page (Aggressive Detection)
confidence: 90 confidence: 100
interesting_entries: interesting_entries:
- http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1 - http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1
- http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1 - http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1
- http://wp.lab/wp-admin/css/install.css?ver=3.8.1
- http://wp.lab/wp-includes/css/dashicons.min.css?ver=3.8.1 - http://wp.lab/wp-includes/css/dashicons.min.css?ver=3.8.1
QueryParameterInUpgradePage: QueryParameterInUpgradePage:
number: 3.8.1 number: 3.8.1
found_by: Query Parameter In Upgrade Page (Aggressive Detection) found_by: Query Parameter In Upgrade Page (Aggressive Detection)
confidence: 60 confidence: 90
interesting_entries: interesting_entries:
- http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1 - http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1
- http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1 - http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1
- http://wp.lab/wp-admin/css/install.css?ver=3.8.1
SitemapGenerator: SitemapGenerator:
number: 4.0 number: 4.0
found_by: Sitemap Generator (Aggressive Detection) found_by: Sitemap Generator (Aggressive Detection)

3
spec/fixtures/dynamic_finders/wp_version/query_parameter_in_install_page/wp-admin/install.php vendored
View File

@@ -7,6 +7,9 @@
<title>WordPress &rsaquo; Installation</title> <title>WordPress &rsaquo; Installation</title>
<link rel='stylesheet' id='buttons-css' href='http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='buttons-css' href='http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='install-css' href='http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='install-css' href='http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='install-css' href='http://wp.lab/wp-admin/css/install.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='dashicons-css' href='http://wp.lab/wp-includes/css/dashicons.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='dashicons-css' href='http://wp.lab/wp-includes/css/dashicons.min.css?ver=3.8.1' type='text/css' media='all' />
</head> </head>
<body class="wp-core-ui"> <body class="wp-core-ui">

3
spec/fixtures/dynamic_finders/wp_version/query_parameter_in_upgrade_page/wp-admin/upgrade.php vendored
View File

@@ -7,6 +7,9 @@
<title>WordPress &rsaquo; Update</title> <title>WordPress &rsaquo; Update</title>
<link rel='stylesheet' id='buttons-css' href='http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='buttons-css' href='http://wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='install-css' href='http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='install-css' href='http://wp.lab/wp-admin/css/install.min.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='install-css' href='http://wp.lab/wp-admin/css/install.css?ver=3.8.1' type='text/css' media='all' />
<!--[if lte IE 7]> <!--[if lte IE 7]>
<link rel='stylesheet' id='ie-css' href='http://wp.lab/wp-admin/css/ie.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='ie-css' href='http://wp.lab/wp-admin/css/ie.min.css?ver=3.8.1' type='text/css' media='all' />
<![endif]--> <![endif]-->

1
spec/fixtures/dynamic_finders/wp_version/query_parameter_passive_all.html vendored
View File

@@ -3,6 +3,7 @@
<script type="text/javascript" src="http://wp.lab/wp-includes/js/wp-embed.min.js?ver=3.8.1"></script> <script type="text/javascript" src="http://wp.lab/wp-includes/js/wp-embed.min.js?ver=3.8.1"></script>
<link rel='stylesheet' id='dashicons-css' href='wp-includes/css/dashicons.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='dashicons-css' href='wp-includes/css/dashicons.min.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='buttons-css' href='//wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1' type='text/css' media='all' /> <link rel='stylesheet' id='buttons-css' href='//wp.lab/wp-includes/css/buttons.min.css?ver=3.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='buttons-css' href='//wp.lab/wp-includes/css/buttons.css?ver=3.8.1' type='text/css' media='all' />