garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #88 from FireFart/xmlrpc

Browse Source 
Detect XML Pingback URL
This commit is contained in:
erwanlr
2012-12-13 08:17:59 -08:00
parent 56573b8a28 5415af538a
commit d77a312844
12 changed files with 291 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
doc/Browser.html
View File

@@ -289,7 +289,7 @@
<div class="method-source-code" id="instance-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 59</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 61</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">instance</span>(<span class="ruby-identifier">options</span> = {})
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">@@instance</span>
<span class="ruby-identifier">@@instance</span> = <span class="ruby-identifier">new</span>(<span class="ruby-identifier">options</span>)
@@ -322,7 +322,7 @@
<div class="method-source-code" id="reset-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 66</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 68</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">reset</span>
<span class="ruby-identifier">@@instance</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-keyword">end</span></pre>
@@ -358,7 +358,7 @@
<div class="method-source-code" id="forge_request-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 166</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 168</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">forge_request</span>(<span class="ruby-identifier">url</span>, <span class="ruby-identifier">params</span> = {})
<span class="ruby-constant">Typhoeus</span><span class="ruby-operator">::</span><span class="ruby-constant">Request</span>.<span class="ruby-identifier">new</span>(
<span class="ruby-identifier">url</span>.<span class="ruby-identifier">to_s</span>,
@@ -391,7 +391,7 @@
<div class="method-source-code" id="get-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 154</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 156</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">get</span>(<span class="ruby-identifier">url</span>, <span class="ruby-identifier">params</span> = {})
<span class="ruby-identifier">run_request</span>(
<span class="ruby-identifier">forge_request</span>(<span class="ruby-identifier">url</span>, <span class="ruby-identifier">params</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-value">:method</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">:get</span>))
@@ -426,7 +426,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="load_config-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 126</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 128</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">load_config</span>(<span class="ruby-identifier">config_file</span> = <span class="ruby-keyword">nil</span>)
<span class="ruby-ivar">@config_file</span> = <span class="ruby-identifier">config_file</span> <span class="ruby-operator">||</span> <span class="ruby-ivar">@config_file</span>
@@ -464,7 +464,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="max_threads-3D-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 95</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 97</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">max_threads=</span>(<span class="ruby-identifier">max_threads</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">max_threads</span>.<span class="ruby-identifier">nil?</span> <span class="ruby-keyword">or</span> <span class="ruby-identifier">max_threads</span> <span class="ruby-operator">&lt;=</span> <span class="ruby-value">0</span>
<span class="ruby-identifier">max_threads</span> = <span class="ruby-value">1</span>
@@ -497,7 +497,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="merge_request_params-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 173</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 175</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">merge_request_params</span>(<span class="ruby-identifier">params</span> = {})
<span class="ruby-keyword">if</span> <span class="ruby-ivar">@proxy</span>
<span class="ruby-identifier">params</span> = <span class="ruby-identifier">params</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-value">:proxy</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-ivar">@proxy</span>)
@@ -507,6 +507,14 @@ browser object, hydra will not have the new @max_threads and
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">if</span> <span class="ruby-ivar">@basic_auth</span>
<span class="ruby-keyword">if</span> <span class="ruby-operator">!</span><span class="ruby-identifier">params</span>.<span class="ruby-identifier">has_key?</span>(<span class="ruby-value">:headers</span>)
<span class="ruby-identifier">params</span> = <span class="ruby-identifier">params</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-value">:headers</span> =<span class="ruby-operator">&gt;</span> {<span class="ruby-string">'Authorization'</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-ivar">@basic_auth</span>})
<span class="ruby-keyword">elsif</span> <span class="ruby-operator">!</span><span class="ruby-identifier">params</span>[<span class="ruby-value">:headers</span>].<span class="ruby-identifier">has_key?</span>(<span class="ruby-string">'Authorization'</span>)
<span class="ruby-identifier">params</span>[<span class="ruby-value">:headers</span>][<span class="ruby-string">'Authorization'</span>] = <span class="ruby-ivar">@basic_auth</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">params</span>.<span class="ruby-identifier">has_key?</span>(<span class="ruby-value">:disable_ssl_host_verification</span>)
<span class="ruby-identifier">params</span> = <span class="ruby-identifier">params</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-value">:disable_ssl_host_verification</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-keyword">true</span>)
<span class="ruby-keyword">end</span>
@@ -554,7 +562,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="post-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 160</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 162</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">post</span>(<span class="ruby-identifier">url</span>, <span class="ruby-identifier">params</span> = {})
<span class="ruby-identifier">run_request</span>(
<span class="ruby-identifier">forge_request</span>(<span class="ruby-identifier">url</span>, <span class="ruby-identifier">params</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-value">:method</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">:post</span>))
@@ -586,7 +594,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="proxy_auth-3D-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 102</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 104</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">proxy_auth=</span>(<span class="ruby-identifier">auth</span>)
<span class="ruby-keyword">unless</span> <span class="ruby-identifier">auth</span>.<span class="ruby-identifier">nil?</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">auth</span>.<span class="ruby-identifier">is_a?</span>(<span class="ruby-constant">Hash</span>)
@@ -631,7 +639,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="raise_invalid_proxy_format-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 121</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 123</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">raise_invalid_proxy_format</span>
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Invalid proxy auth format, expected username:password or {:proxy_username =&gt; username, :proxy_password =&gt; password}&quot;</span>
<span class="ruby-keyword">end</span></pre>
@@ -661,7 +669,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="user_agent-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 83</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 85</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">user_agent</span>
<span class="ruby-keyword">case</span> <span class="ruby-ivar">@user_agent_mode</span>
<span class="ruby-keyword">when</span> <span class="ruby-string">&quot;semi-static&quot;</span>
@@ -699,7 +707,7 @@ browser object, hydra will not have the new @max_threads and
<div class="method-source-code" id="user_agent_mode-3D-source">
<pre><span class="ruby-comment"># File lib/browser.rb, line 70</span>
<pre><span class="ruby-comment"># File lib/browser.rb, line 72</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">user_agent_mode=</span>(<span class="ruby-identifier">ua_mode</span>)
<span class="ruby-identifier">ua_mode</span> <span class="ruby-operator">||=</span> <span class="ruby-string">&quot;static&quot;</span>

3
doc/README.html
View File

@@ -218,9 +218,6 @@ href="http://www.gnu.org/licenses/">www.gnu.org/licenses/</a>&gt;.</p>
<span class="ruby-constant">Update</span> <span class="ruby-identifier">cURL</span> <span class="ruby-identifier">to</span> <span class="ruby-identifier">version</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">7.21</span> (<span class="ruby-identifier">may</span> <span class="ruby-identifier">have</span> <span class="ruby-identifier">to</span> <span class="ruby-identifier">install</span> <span class="ruby-identifier">from</span> <span class="ruby-identifier">source</span>)
<span class="ruby-constant">See</span> <span class="ruby-identifier">http</span>:<span class="ruby-operator">/</span><span class="ruby-regexp">%rcode.google.com/</span><span class="ruby-identifier">p</span><span class="ruby-operator">/</span><span class="ruby-identifier">wpscan</span><span class="ruby-operator">/</span><span class="ruby-identifier">issues</span><span class="ruby-operator">/</span><span class="ruby-identifier">detail?</span><span class="ruby-identifier">id</span>=<span class="ruby-value">81</span>
<span class="ruby-operator">-</span> <span class="ruby-constant">If</span> <span class="ruby-identifier">you</span> <span class="ruby-identifier">have</span> <span class="ruby-identifier">one</span> <span class="ruby-identifier">the</span> <span class="ruby-identifier">following</span> <span class="ruby-identifier">errors</span><span class="ruby-operator">:</span> <span class="ruby-string">&quot;-bash: !t: event not found&quot;</span>, <span class="ruby-string">&quot;-bash: !u: event not found&quot;</span>
<span class="ruby-constant">It</span> <span class="ruby-identifier">happens</span> <span class="ruby-identifier">with</span> <span class="ruby-identifier">enumeration</span> <span class="ruby-operator">:</span> <span class="ruby-identifier">just</span> <span class="ruby-identifier">put</span> <span class="ruby-identifier">the</span> <span class="ruby-string">'t'</span> <span class="ruby-keyword">or</span> <span class="ruby-string">'u'</span> <span class="ruby-identifier">before</span> <span class="ruby-identifier">the</span> <span class="ruby-string">'p!'</span> <span class="ruby-operator">:</span> <span class="ruby-string">'-e tp!'</span> <span class="ruby-identifier">instead</span> <span class="ruby-identifier">of</span> <span class="ruby-string">'-e p!t'</span>
<span class="ruby-operator">-</span> <span class="ruby-constant">Proxy</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">working</span><span class="ruby-operator">:</span>
<span class="ruby-constant">Update</span> <span class="ruby-identifier">cURL</span> <span class="ruby-identifier">to</span> <span class="ruby-identifier">version</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">7.21</span><span class="ruby-value">.7</span> (<span class="ruby-identifier">may</span> <span class="ruby-identifier">have</span> <span class="ruby-identifier">to</span> <span class="ruby-identifier">install</span> <span class="ruby-identifier">from</span> <span class="ruby-identifier">source</span>).

95
doc/WebSite.html
View File

@@ -64,13 +64,17 @@
<ul class="link-list">
<li><a href="#method-i-has_basic_auth-3F">#has_basic_auth?</a>
<li><a href="#method-i-has_xml_rpc-3F">#has_xml_rpc?</a>
<li><a href="#method-i-is_online-3F">#is_online?</a>
<li><a href="#method-i-is_wordpress-3F">#is_wordpress?</a>
<li><a href="#method-i-redirection">#redirection</a>
<li><a href="#method-i-xmlrpc_url">#xmlrpc_url</a>
<li><a href="#method-i-xml_rpc_url">#xml_rpc_url</a>
</ul>
</nav>
@@ -200,6 +204,66 @@
<h3 class="section-header">Public Instance Methods</h3>
<div id="method-i-has_basic_auth-3F" class="method-detail ">
<div class="method-heading">
<span class="method-name">has_basic_auth?</span><span
class="method-args">()</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<div class="method-source-code" id="has_basic_auth-3F-source">
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 69</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">has_basic_auth?</span>
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">code</span> <span class="ruby-operator">==</span> <span class="ruby-value">401</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- has_basic_auth-3F-source -->
</div>
</div><!-- has_basic_auth-3F-method -->
<div id="method-i-has_xml_rpc-3F" class="method-detail ">
<div class="method-heading">
<span class="method-name">has_xml_rpc?</span><span
class="method-args">()</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<div class="method-source-code" id="has_xml_rpc-3F-source">
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 60</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">has_xml_rpc?</span>
<span class="ruby-operator">!</span><span class="ruby-identifier">xml_rpc_url</span>.<span class="ruby-identifier">nil?</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- has_xml_rpc-3F-source -->
</div>
</div><!-- has_xml_rpc-3F-method -->
<div id="method-i-is_online-3F" class="method-detail ">
<div class="method-heading">
@@ -216,7 +280,7 @@
<div class="method-source-code" id="is_online-3F-source">
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 52</span>
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 65</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">is_online?</span>
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">code</span> <span class="ruby-operator">!=</span> <span class="ruby-value">0</span>
<span class="ruby-keyword">end</span></pre>
@@ -259,7 +323,7 @@
<span class="ruby-identifier">wordpress</span> = <span class="ruby-keyword">true</span>
<span class="ruby-keyword">else</span>
<span class="ruby-identifier">response</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(
<span class="ruby-identifier">xmlrpc_url</span>(),
<span class="ruby-identifier">xml_rpc_url</span>,
{<span class="ruby-value">:follow_location</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-keyword">true</span>, <span class="ruby-value">:max_redirects</span> =<span class="ruby-operator">&gt;</span> <span class="ruby-value">2</span>}
)
@@ -297,7 +361,7 @@ redirection or nil</p>
<div class="method-source-code" id="redirection-source">
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 58</span>
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 75</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">redirection</span>(<span class="ruby-identifier">url</span> = <span class="ruby-keyword">nil</span>)
<span class="ruby-identifier">redirection</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">url</span> <span class="ruby-operator">||=</span> <span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">to_s</span>
@@ -319,10 +383,10 @@ redirection or nil</p>
</div><!-- redirection-method -->
<div id="method-i-xmlrpc_url" class="method-detail ">
<div id="method-i-xml_rpc_url" class="method-detail ">
<div class="method-heading">
<span class="method-name">xmlrpc_url</span><span
<span class="method-name">xml_rpc_url</span><span
class="method-args">()</span>
<span class="method-click-advice">click to toggle source</span>
</div>
@@ -334,19 +398,28 @@ redirection or nil</p>
<div class="method-source-code" id="xmlrpc_url-source">
<div class="method-source-code" id="xml_rpc_url-source">
<pre><span class="ruby-comment"># File lib/wpscan/modules/web_site.rb, line 47</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">xmlrpc_url</span>
<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;xmlrpc.php&quot;</span>).<span class="ruby-identifier">to_s</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">xml_rpc_url</span>
<span class="ruby-keyword">unless</span> <span class="ruby-ivar">@xmlrpc_url</span>
<span class="ruby-identifier">headers</span> = <span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-ivar">@uri</span>.<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">headers_hash</span>
<span class="ruby-identifier">value</span> = <span class="ruby-identifier">headers</span>[<span class="ruby-string">&quot;x-pingback&quot;</span>]
<span class="ruby-keyword">if</span> <span class="ruby-identifier">value</span>.<span class="ruby-identifier">nil?</span> <span class="ruby-keyword">or</span> <span class="ruby-identifier">value</span>.<span class="ruby-identifier">empty?</span>
<span class="ruby-ivar">@xmlrpc_url</span> = <span class="ruby-keyword">nil</span>
<span class="ruby-keyword">else</span>
<span class="ruby-ivar">@xmlrpc_url</span> = <span class="ruby-identifier">value</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-ivar">@xmlrpc_url</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- xmlrpc_url-source -->
</div><!-- xml_rpc_url-source -->
</div>
</div><!-- xmlrpc_url-method -->
</div><!-- xml_rpc_url-method -->
</section><!-- public-instance-method-details -->

2
doc/WpTarget.html
View File

@@ -371,7 +371,7 @@
<div class="method-source-code" id="valid_response_codes-source">
<pre><span class="ruby-comment"># File lib/wpscan/wp_target.rb, line 77</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">valid_response_codes</span>
[<span class="ruby-value">200</span>, <span class="ruby-value">403</span>, <span class="ruby-value">301</span>, <span class="ruby-value">302</span>, <span class="ruby-value">500</span>]
[<span class="ruby-value">200</span>, <span class="ruby-value">301</span>, <span class="ruby-value">302</span>, <span class="ruby-value">401</span>, <span class="ruby-value">403</span>, <span class="ruby-value">500</span>]
<span class="ruby-keyword">end</span></pre>
</div><!-- valid_response_codes-source -->

27
doc/WpVersion.html
View File

@@ -357,25 +357,14 @@ etc)</p>
<p>Uses data/wp_versions.xml to try to identify a wordpress version.</p>
<p>It does this by using client side file hashing with a scoring system.</p>
<p>It does this by using client side file hashing</p>
<p>The scoring system is a number representing the uniqueness of a client side
file across all versions of wordpress.</p>
<p>Example:</p>
<p>Score - Hash - File - Versions</p>
<pre> 1 - 3e63c08553696a1dedb24b22ef6783c3 - /wp-content/themes/twentyeleven/style.css - 3.2.1
2 - 15fc925fd39bb496871e842b2a754c76 - /wp-includes/js/wp-lists.js - 2.6,2.5.1
3 - 3f03bce84d1d2a169b4bf4d8a0126e38 - /wp-includes/js/autosave.js - 2.9.2,2.9.1,2.9
/!\ Warning : this method might return false positive if the file used for fingerprinting is part of a theme (they can be updated)</pre>
<pre>/!\ Warning : this method might return false positive if the file used for fingerprinting is part of a theme (they can be updated)</pre>
<div class="method-source-code" id="find_from_advanced_fingerprinting-source">
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 136</span>
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 124</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find_from_advanced_fingerprinting</span>(<span class="ruby-identifier">options</span>)
<span class="ruby-identifier">target_uri</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:base_url</span>]
<span class="ruby-comment"># needed for rpsec tests</span>
@@ -394,7 +383,7 @@ file across all versions of wordpress.</p>
<span class="ruby-identifier">node</span>.<span class="ruby-identifier">search</span>(<span class="ruby-string">'hash'</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">hash</span><span class="ruby-operator">|</span>
<span class="ruby-keyword">if</span> <span class="ruby-identifier">hash</span>.<span class="ruby-identifier">attribute</span>(<span class="ruby-string">'md5'</span>).<span class="ruby-identifier">text</span> <span class="ruby-operator">==</span> <span class="ruby-identifier">md5sum</span>
<span class="ruby-keyword">return</span> <span class="ruby-identifier">hash</span>.<span class="ruby-identifier">search</span>(<span class="ruby-string">'versions'</span>).<span class="ruby-identifier">text</span>
<span class="ruby-keyword">return</span> <span class="ruby-identifier">hash</span>.<span class="ruby-identifier">search</span>(<span class="ruby-string">'version'</span>).<span class="ruby-identifier">text</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
<span class="ruby-keyword">end</span>
@@ -460,7 +449,7 @@ source.</p>
<div class="method-source-code" id="find_from_links_opml-source">
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 176</span>
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 164</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find_from_links_opml</span>(<span class="ruby-identifier">options</span>)
<span class="ruby-identifier">target_uri</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:base_url</span>]
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">target_uri</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;wp-links-opml.php&quot;</span>).<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">body</span>[<span class="ruby-node">%r{generator=&quot;wordpress/#{WpVersion.version_pattern}&quot;}</span>, <span class="ruby-value">1</span>]
@@ -562,7 +551,7 @@ source.</p>
<div class="method-source-code" id="find_from_readme-source">
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 162</span>
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 150</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find_from_readme</span>(<span class="ruby-identifier">options</span>)
<span class="ruby-identifier">target_uri</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:base_url</span>]
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">target_uri</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;readme.html&quot;</span>).<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">body</span>[<span class="ruby-node">%r{&lt;br /&gt;\sversion #{WpVersion.version_pattern}}</span>, <span class="ruby-value">1</span>]
@@ -630,7 +619,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=109">code.google.com/p/wp
<div class="method-source-code" id="find_from_sitemap_generator-source">
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 170</span>
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 158</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">find_from_sitemap_generator</span>(<span class="ruby-identifier">options</span>)
<span class="ruby-identifier">target_uri</span> = <span class="ruby-identifier">options</span>[<span class="ruby-value">:base_url</span>]
<span class="ruby-constant">Browser</span>.<span class="ruby-identifier">instance</span>.<span class="ruby-identifier">get</span>(<span class="ruby-identifier">target_uri</span>.<span class="ruby-identifier">merge</span>(<span class="ruby-string">&quot;sitemap.xml&quot;</span>).<span class="ruby-identifier">to_s</span>).<span class="ruby-identifier">body</span>[<span class="ruby-node">%r{generator=&quot;wordpress/#{WpVersion.version_pattern}&quot;}</span>, <span class="ruby-value">1</span>]
@@ -661,7 +650,7 @@ href="http://code.google.com/p/wpscan/issues/detail?id=109">code.google.com/p/wp
<div class="method-source-code" id="version_pattern-source">
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 182</span>
<pre><span class="ruby-comment"># File lib/wpscan/wp_version.rb, line 170</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">version_pattern</span>
<span class="ruby-string">'([^\r\n]+[\.][^\r\n]+)'</span>
<span class="ruby-keyword">end</span></pre>

78
doc/WpscanOptions.html
View File

@@ -82,6 +82,8 @@
<li><a href="#method-c-option_to_instance_variable_setter">::option_to_instance_variable_setter</a>
<li><a href="#method-i-basic_auth-3D">#basic_auth=</a>
<li><a href="#method-i-enumerate_all_plugins-3D">#enumerate_all_plugins=</a>
<li><a href="#method-i-enumerate_all_themes-3D">#enumerate_all_themes=</a>
@@ -270,7 +272,7 @@ href="WpscanOptions.html">WpscanOptions</a></p>
<div class="method-source-code" id="load_from_arguments-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 159</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 165</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">load_from_arguments</span>
<span class="ruby-identifier">wpscan_options</span> = <span class="ruby-constant">WpscanOptions</span>.<span class="ruby-identifier">new</span>
@@ -308,7 +310,7 @@ href="WpscanOptions.html">WpscanOptions</a></p>
<div class="method-source-code" id="new-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 51</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 52</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">initialize</span>
<span class="ruby-constant">ACCESSOR_OPTIONS</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">option</span><span class="ruby-operator">|</span>
<span class="ruby-identifier">instance_variable_set</span>(<span class="ruby-node">&quot;@#{option}&quot;</span>, <span class="ruby-keyword">nil</span>)
@@ -349,7 +351,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="clean_option-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 256</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 263</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">clean_option</span>(<span class="ruby-identifier">option</span>)
<span class="ruby-identifier">cleaned_option</span> = <span class="ruby-identifier">option</span>.<span class="ruby-identifier">gsub</span>(<span class="ruby-regexp">%r^--?/</span>, <span class="ruby-string">''</span>)
<span class="ruby-identifier">cleaned_option</span>.<span class="ruby-identifier">gsub</span>(<span class="ruby-regexp">%r-/</span>, <span class="ruby-string">'_'</span>)
@@ -381,7 +383,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="get_opt_long-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 226</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 232</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">get_opt_long</span>
<span class="ruby-constant">GetoptLong</span>.<span class="ruby-identifier">new</span>(
[<span class="ruby-string">&quot;--url&quot;</span>, <span class="ruby-string">&quot;-u&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>],
@@ -399,7 +401,8 @@ any remaining ‘-’ by ‘_’</p>
[<span class="ruby-string">&quot;--wp-content-dir&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>],
[<span class="ruby-string">&quot;--wp-plugins-dir&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>],
[<span class="ruby-string">&quot;--config-file&quot;</span>, <span class="ruby-string">&quot;-c&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>],
[<span class="ruby-string">&quot;--exclude-content-based&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>]
[<span class="ruby-string">&quot;--exclude-content-based&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>],
[<span class="ruby-string">&quot;--basic-auth&quot;</span>, <span class="ruby-constant">GetoptLong</span><span class="ruby-operator">::</span><span class="ruby-constant">REQUIRED_ARGUMENT</span>]
)
<span class="ruby-keyword">end</span></pre>
</div><!-- get_opt_long-source -->
@@ -428,7 +431,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="is_long_option-3F-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 247</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 254</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">is_long_option?</span>(<span class="ruby-identifier">option</span>)
<span class="ruby-constant">ACCESSOR_OPTIONS</span>.<span class="ruby-identifier">include?</span>(<span class="ruby-value">:&quot;#{WpscanOptions.clean_option(option)}&quot;</span>)
<span class="ruby-keyword">end</span></pre>
@@ -458,7 +461,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="option_to_instance_variable_setter-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 261</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 268</span>
<span class="ruby-keyword">def</span> <span class="ruby-keyword">self</span>.<span class="ruby-identifier">option_to_instance_variable_setter</span>(<span class="ruby-identifier">option</span>)
<span class="ruby-identifier">cleaned_option</span> = <span class="ruby-constant">WpscanOptions</span>.<span class="ruby-identifier">clean_option</span>(<span class="ruby-identifier">option</span>)
<span class="ruby-identifier">option_syms</span> = <span class="ruby-constant">ACCESSOR_OPTIONS</span>.<span class="ruby-identifier">grep</span>(<span class="ruby-node">%r{^#{cleaned_option}$}</span>)
@@ -481,6 +484,37 @@ any remaining ‘-’ by ‘_’</p>
<h3 class="section-header">Public Instance Methods</h3>
<div id="method-i-basic_auth-3D" class="method-detail ">
<div class="method-heading">
<span class="method-name">basic_auth=</span><span
class="method-args">(basic_auth)</span>
<span class="method-click-advice">click to toggle source</span>
</div>
<div class="method-description">
<div class="method-source-code" id="basic_auth-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 140</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">basic_auth=</span>(<span class="ruby-identifier">basic_auth</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Invalid basic authentication format, login:password expected&quot;</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">basic_auth</span>.<span class="ruby-identifier">index</span>(<span class="ruby-string">':'</span>).<span class="ruby-identifier">nil?</span>
<span class="ruby-ivar">@basic_auth</span> = <span class="ruby-node">&quot;Basic #{Base64.encode64(basic_auth).chomp}&quot;</span>
<span class="ruby-keyword">end</span></pre>
</div><!-- basic_auth-3D-source -->
</div>
</div><!-- basic_auth-3D-method -->
<div id="method-i-enumerate_all_plugins-3D" class="method-detail ">
<div class="method-heading">
@@ -497,7 +531,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="enumerate_all_plugins-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 107</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 108</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_all_plugins=</span>(<span class="ruby-identifier">enumerate_all_plugins</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">enumerate_all_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">and</span> (<span class="ruby-ivar">@enumerate_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">or</span> <span class="ruby-ivar">@enumerate_only_vulnerable_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Please choose only one plugin enumeration option&quot;</span>
@@ -531,7 +565,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="enumerate_all_themes-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 131</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 132</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_all_themes=</span>(<span class="ruby-identifier">enumerate_all_themes</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">enumerate_all_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">and</span> (<span class="ruby-ivar">@enumerate_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">or</span> <span class="ruby-ivar">@enumerate_only_vulnerable_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Please choose only one theme enumeration option&quot;</span>
@@ -565,7 +599,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="enumerate_only_vulnerable_plugins-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 99</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 100</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_only_vulnerable_plugins=</span>(<span class="ruby-identifier">enumerate_only_vulnerable_plugins</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">enumerate_only_vulnerable_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">and</span> (<span class="ruby-ivar">@enumerate_all_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">or</span> <span class="ruby-ivar">@enumerate_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Please choose only one plugin enumeration option&quot;</span>
@@ -599,7 +633,7 @@ any remaining ‘-’ by ‘_’</p>
<div class="method-source-code" id="enumerate_only_vulnerable_themes-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 123</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 124</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_only_vulnerable_themes=</span>(<span class="ruby-identifier">enumerate_only_vulnerable_themes</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">enumerate_only_vulnerable_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">and</span> (<span class="ruby-ivar">@enumerate_all_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">or</span> <span class="ruby-ivar">@enumerate_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Please choose only one theme enumeration option&quot;</span>
@@ -637,7 +671,7 @@ href="http://1-10">u</a> will enumerate usernames from 1 to 10</p>
<div class="method-source-code" id="enumerate_options_from_string-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 194</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 200</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_options_from_string</span>(<span class="ruby-identifier">value</span>)
<span class="ruby-comment"># Usage of self is mandatory because there are overridden setters</span>
@@ -693,7 +727,7 @@ href="http://1-10">u</a> will enumerate usernames from 1 to 10</p>
<div class="method-source-code" id="enumerate_plugins-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 91</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 92</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_plugins=</span>(<span class="ruby-identifier">enumerate_plugins</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">enumerate_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">and</span> (<span class="ruby-ivar">@enumerate_all_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">or</span> <span class="ruby-ivar">@enumerate_only_vulnerable_plugins</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Please choose only one plugin enumeration option&quot;</span>
@@ -727,7 +761,7 @@ href="http://1-10">u</a> will enumerate usernames from 1 to 10</p>
<div class="method-source-code" id="enumerate_themes-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 115</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 116</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">enumerate_themes=</span>(<span class="ruby-identifier">enumerate_themes</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">enumerate_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">and</span> (<span class="ruby-ivar">@enumerate_all_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span> <span class="ruby-keyword">or</span> <span class="ruby-ivar">@enumerate_only_vulnerable_themes</span> <span class="ruby-operator">===</span> <span class="ruby-keyword">true</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Please choose only one theme enumeration option&quot;</span>
@@ -761,7 +795,7 @@ href="http://1-10">u</a> will enumerate usernames from 1 to 10</p>
<div class="method-source-code" id="has_options-3F-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 139</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 145</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">has_options?</span>
<span class="ruby-operator">!</span><span class="ruby-identifier">to_h</span>.<span class="ruby-identifier">empty?</span>
<span class="ruby-keyword">end</span></pre>
@@ -791,7 +825,7 @@ href="http://1-10">u</a> will enumerate usernames from 1 to 10</p>
<div class="method-source-code" id="proxy-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 75</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 76</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">proxy=</span>(<span class="ruby-identifier">proxy</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">proxy</span>.<span class="ruby-identifier">index</span>(<span class="ruby-string">':'</span>) <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Invalid proxy format. Should be host:port.&quot;</span>
@@ -825,7 +859,7 @@ href="http://1-10">u</a> will enumerate usernames from 1 to 10</p>
<div class="method-source-code" id="proxy_auth-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 83</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 84</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">proxy_auth=</span>(<span class="ruby-identifier">auth</span>)
<span class="ruby-keyword">if</span> <span class="ruby-identifier">auth</span>.<span class="ruby-identifier">index</span>(<span class="ruby-string">':'</span>) <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Invalid proxy auth format, username:password expected&quot;</span>
@@ -860,7 +894,7 @@ value</p>
<div class="method-source-code" id="set_option_from_cli-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 173</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 179</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">set_option_from_cli</span>(<span class="ruby-identifier">cli_option</span>, <span class="ruby-identifier">cli_value</span>)
<span class="ruby-keyword">if</span> <span class="ruby-constant">WpscanOptions</span>.<span class="ruby-identifier">is_long_option?</span>(<span class="ruby-identifier">cli_option</span>)
@@ -903,7 +937,7 @@ value</p>
<div class="method-source-code" id="threads-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 63</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 64</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">threads=</span>(<span class="ruby-identifier">threads</span>)
<span class="ruby-ivar">@threads</span> = <span class="ruby-identifier">threads</span>.<span class="ruby-identifier">is_a?</span>(<span class="ruby-constant">Integer</span>) <span class="ruby-operator">?</span> <span class="ruby-identifier">threads</span> <span class="ruby-operator">:</span> <span class="ruby-identifier">threads</span>.<span class="ruby-identifier">to_i</span>
<span class="ruby-keyword">end</span></pre>
@@ -933,7 +967,7 @@ value</p>
<div class="method-source-code" id="to_h-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 144</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 150</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">to_h</span>
<span class="ruby-identifier">options</span> = {}
@@ -972,7 +1006,7 @@ value</p>
<div class="method-source-code" id="url-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 57</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 58</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">url=</span>(<span class="ruby-identifier">url</span>)
<span class="ruby-identifier">raise</span> <span class="ruby-string">&quot;Empty URL given&quot;</span> <span class="ruby-keyword">if</span> <span class="ruby-operator">!</span><span class="ruby-identifier">url</span>
@@ -1004,7 +1038,7 @@ value</p>
<div class="method-source-code" id="wordlist-3D-source">
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 67</span>
<pre><span class="ruby-comment"># File lib/wpscan/wpscan_options.rb, line 68</span>
<span class="ruby-keyword">def</span> <span class="ruby-identifier">wordlist=</span>(<span class="ruby-identifier">wordlist</span>)
<span class="ruby-keyword">if</span> <span class="ruby-constant">File</span>.<span class="ruby-identifier">exists?</span>(<span class="ruby-identifier">wordlist</span>)
<span class="ruby-ivar">@wordlist</span> = <span class="ruby-identifier">wordlist</span>

16
doc/created.rid
View File

@@ -1,7 +1,7 @@
Fri, 07 Dec 2012 20:17:41 +0100
Thu, 13 Dec 2012 16:46:56 +0100
./CREDITS Tue, 25 Sep 2012 20:37:12 +0200
./Gemfile Thu, 06 Dec 2012 19:53:03 +0100
./lib/browser.rb Fri, 23 Nov 2012 18:46:41 +0100
./lib/browser.rb Thu, 13 Dec 2012 11:04:19 +0100
./lib/cache_file_store.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/common_helper.rb Sat, 10 Nov 2012 09:50:17 +0100
./lib/environment.rb Fri, 23 Nov 2012 18:46:41 +0100
@@ -12,7 +12,7 @@ Fri, 07 Dec 2012 20:17:41 +0100
./lib/wpscan/exploit.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/modules/brute_force.rb Thu, 06 Dec 2012 19:53:03 +0100
./lib/wpscan/modules/malwares.rb Sat, 10 Nov 2012 09:50:17 +0100
./lib/wpscan/modules/web_site.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/modules/web_site.rb Thu, 13 Dec 2012 16:41:55 +0100
./lib/wpscan/modules/wp_config_backup.rb Tue, 16 Oct 2012 22:00:10 +0200
./lib/wpscan/modules/wp_full_path_disclosure.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/modules/wp_login_protection.rb Tue, 25 Sep 2012 20:37:12 +0200
@@ -28,16 +28,16 @@ Fri, 07 Dec 2012 20:17:41 +0100
./lib/wpscan/wp_item.rb Sat, 10 Nov 2012 09:50:17 +0100
./lib/wpscan/wp_options.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/wp_plugin.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/wp_target.rb Thu, 06 Dec 2012 21:07:19 +0100
./lib/wpscan/wp_target.rb Thu, 13 Dec 2012 16:20:41 +0100
./lib/wpscan/wp_theme.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/wp_user.rb Thu, 06 Dec 2012 21:07:19 +0100
./lib/wpscan/wp_version.rb Sat, 10 Nov 2012 09:50:17 +0100
./lib/wpscan/wp_version.rb Thu, 13 Dec 2012 11:04:19 +0100
./lib/wpscan/wp_vulnerability.rb Tue, 25 Sep 2012 20:37:12 +0200
./lib/wpscan/wpscan_helper.rb Thu, 06 Dec 2012 19:53:03 +0100
./lib/wpscan/wpscan_options.rb Thu, 06 Dec 2012 19:53:03 +0100
./lib/wpscan/wpscan_options.rb Thu, 13 Dec 2012 11:04:19 +0100
./lib/wpstools/generate_list.rb Wed, 28 Nov 2012 20:07:48 +0100
./lib/wpstools/parse_svn.rb Sat, 10 Nov 2012 09:50:17 +0100
./lib/wpstools/wpstools_helper.rb Fri, 07 Dec 2012 20:17:22 +0100
./README Thu, 06 Dec 2012 19:53:03 +0100
./wpscan.rb Thu, 06 Dec 2012 19:53:03 +0100
./README Thu, 13 Dec 2012 11:04:19 +0100
./wpscan.rb Thu, 13 Dec 2012 16:23:41 +0100
./wpstools.rb Fri, 07 Dec 2012 20:17:22 +0100

2
doc/js/search_index.js
View File

File diff suppressed because one or more lines are too long

72
doc/table_of_contents.html
View File

@@ -229,33 +229,33 @@
<li class="method"><a href="Malwares.html#method-c-malwares_file">::malwares_file &mdash; Malwares</a>
<li class="method"><a href="WpTarget.html#method-c-new">::new &mdash; WpTarget</a>
<li class="method"><a href="WpPlugin.html#method-c-new">::new &mdash; WpPlugin</a>
<li class="method"><a href="WpscanOptions.html#method-c-new">::new &mdash; WpscanOptions</a>
<li class="method"><a href="RpcClient.html#method-c-new">::new &mdash; RpcClient</a>
<li class="method"><a href="WpVersion.html#method-c-new">::new &mdash; WpVersion</a>
<li class="method"><a href="WpPlugin.html#method-c-new">::new &mdash; WpPlugin</a>
<li class="method"><a href="WpItem.html#method-c-new">::new &mdash; WpItem</a>
<li class="method"><a href="WpTarget.html#method-c-new">::new &mdash; WpTarget</a>
<li class="method"><a href="WpUser.html#method-c-new">::new &mdash; WpUser</a>
<li class="method"><a href="CacheFileStore.html#method-c-new">::new &mdash; CacheFileStore</a>
<li class="method"><a href="WpVulnerability.html#method-c-new">::new &mdash; WpVulnerability</a>
<li class="method"><a href="Updater.html#method-c-new">::new &mdash; Updater</a>
<li class="method"><a href="Exploit.html#method-c-new">::new &mdash; Exploit</a>
<li class="method"><a href="WpVulnerability.html#method-c-new">::new &mdash; WpVulnerability</a>
<li class="method"><a href="Generate_List.html#method-c-new">::new &mdash; Generate_List</a>
<li class="method"><a href="WpTheme.html#method-c-new">::new &mdash; WpTheme</a>
<li class="method"><a href="Exploit.html#method-c-new">::new &mdash; Exploit</a>
<li class="method"><a href="Svn_Parser.html#method-c-new">::new &mdash; Svn_Parser</a>
<li class="method"><a href="RpcClient.html#method-c-new">::new &mdash; RpcClient</a>
<li class="method"><a href="WpTheme.html#method-c-new">::new &mdash; WpTheme</a>
<li class="method"><a href="WpscanOptions.html#method-c-option_to_instance_variable_setter">::option_to_instance_variable_setter &mdash; WpscanOptions</a>
@@ -273,11 +273,11 @@
<li class="method"><a href="WpItem.html#method-i-3D-3D">#== &mdash; WpItem</a>
<li class="method"><a href="WpTheme.html#method-i-3D-3D-3D">#=== &mdash; WpTheme</a>
<li class="method"><a href="WpItem.html#method-i-3D-3D-3D">#=== &mdash; WpItem</a>
<li class="method"><a href="WpUser.html#method-i-3D-3D-3D">#=== &mdash; WpUser</a>
<li class="method"><a href="WpItem.html#method-i-3D-3D-3D">#=== &mdash; WpItem</a>
<li class="method"><a href="WpTheme.html#method-i-3D-3D-3D">#=== &mdash; WpTheme</a>
<li class="method"><a href="Array.html#method-i-_grep_">#_grep_ &mdash; Array</a>
@@ -291,6 +291,8 @@
<li class="method"><a href="Object.html#method-i-banner">#banner &mdash; Object</a>
<li class="method"><a href="WpscanOptions.html#method-i-basic_auth-3D">#basic_auth= &mdash; WpscanOptions</a>
<li class="method"><a href="WpLoginProtection.html#method-i-better_wp_security_url">#better_wp_security_url &mdash; WpLoginProtection</a>
<li class="method"><a href="WpLoginProtection.html#method-i-bluetrait_event_viewer_url">#bluetrait_event_viewer_url &mdash; WpLoginProtection</a>
@@ -333,10 +335,10 @@
<li class="method"><a href="WpPlugin.html#method-i-error_log_url">#error_log_url &mdash; WpPlugin</a>
<li class="method"><a href="RpcClient.html#method-i-exploit">#exploit &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-exploit">#exploit &mdash; Exploit</a>
<li class="method"><a href="RpcClient.html#method-i-exploit">#exploit &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-exploit_info">#exploit_info &mdash; Exploit</a>
<li class="method"><a href="WpItem.html#method-i-extract_name_from_url">#extract_name_from_url &mdash; WpItem</a>
@@ -379,6 +381,8 @@
<li class="method"><a href="Array.html#method-i-grep">#grep &mdash; Array</a>
<li class="method"><a href="WebSite.html#method-i-has_basic_auth-3F">#has_basic_auth? &mdash; WebSite</a>
<li class="method"><a href="WpLoginProtection.html#method-i-has_better_wp_security_protection-3F">#has_better_wp_security_protection? &mdash; WpLoginProtection</a>
<li class="method"><a href="WpLoginProtection.html#method-i-has_bluetrait_event_viewer_protection-3F">#has_bluetrait_event_viewer_protection? &mdash; WpLoginProtection</a>
@@ -403,26 +407,28 @@
<li class="method"><a href="WpscanOptions.html#method-i-has_options-3F">#has_options? &mdash; WpscanOptions</a>
<li class="method"><a href="WpReadme.html#method-i-has_readme-3F">#has_readme? &mdash; WpReadme</a>
<li class="method"><a href="WpItem.html#method-i-has_readme-3F">#has_readme? &mdash; WpItem</a>
<li class="method"><a href="WpReadme.html#method-i-has_readme-3F">#has_readme? &mdash; WpReadme</a>
<li class="method"><a href="WpLoginProtection.html#method-i-has_simple_login_lockdown_protection-3F">#has_simple_login_lockdown_protection? &mdash; WpLoginProtection</a>
<li class="method"><a href="WpTimthumbs.html#method-i-has_timthumbs-3F">#has_timthumbs? &mdash; WpTimthumbs</a>
<li class="method"><a href="WebSite.html#method-i-has_xml_rpc-3F">#has_xml_rpc? &mdash; WebSite</a>
<li class="method"><a href="Object.html#method-i-help">#help &mdash; Object</a>
<li class="method"><a href="WpUser.html#method-i-id">#id &mdash; WpUser</a>
<li class="method"><a href="WpUser.html#method-i-id-3D">#id= &mdash; WpUser</a>
<li class="method"><a href="Updater.html#method-i-is_installed-3F">#is_installed? &mdash; Updater</a>
<li class="method"><a href="SvnUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; SvnUpdater</a>
<li class="method"><a href="GitUpdater.html#method-i-is_installed-3F">#is_installed? &mdash; GitUpdater</a>
<li class="method"><a href="Updater.html#method-i-is_installed-3F">#is_installed? &mdash; Updater</a>
<li class="method"><a href="WpTarget.html#method-i-is_multisite-3F">#is_multisite? &mdash; WpTarget</a>
<li class="method"><a href="WebSite.html#method-i-is_online-3F">#is_online? &mdash; WebSite</a>
@@ -433,20 +439,20 @@
<li class="method"><a href="RpcClient.html#method-i-jobs">#jobs &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-kill_session">#kill_session &mdash; Exploit</a>
<li class="method"><a href="RpcClient.html#method-i-kill_session">#kill_session &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-kill_session">#kill_session &mdash; Exploit</a>
<li class="method"><a href="Exploit.html#method-i-last_session_id">#last_session_id &mdash; Exploit</a>
<li class="method"><a href="WpLoginProtection.html#method-i-limit_login_attempts_url">#limit_login_attempts_url &mdash; WpLoginProtection</a>
<li class="method"><a href="Browser.html#method-i-load_config">#load_config &mdash; Browser</a>
<li class="method"><a href="SvnUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; SvnUpdater</a>
<li class="method"><a href="Updater.html#method-i-local_revision_number">#local_revision_number &mdash; Updater</a>
<li class="method"><a href="SvnUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; SvnUpdater</a>
<li class="method"><a href="GitUpdater.html#method-i-local_revision_number">#local_revision_number &mdash; GitUpdater</a>
<li class="method"><a href="RpcClient.html#method-i-login">#login &mdash; RpcClient</a>
@@ -463,10 +469,10 @@
<li class="method"><a href="Browser.html#method-i-merge_request_params">#merge_request_params &mdash; Browser</a>
<li class="method"><a href="Exploit.html#method-i-meterpreter_read">#meterpreter_read &mdash; Exploit</a>
<li class="method"><a href="RpcClient.html#method-i-meterpreter_read">#meterpreter_read &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-meterpreter_read">#meterpreter_read &mdash; Exploit</a>
<li class="method"><a href="Exploit.html#method-i-meterpreter_write">#meterpreter_write &mdash; Exploit</a>
<li class="method"><a href="RpcClient.html#method-i-meterpreter_write">#meterpreter_write &mdash; RpcClient</a>
@@ -499,10 +505,10 @@
<li class="method"><a href="CacheFileStore.html#method-i-read_entry">#read_entry &mdash; CacheFileStore</a>
<li class="method"><a href="RpcClient.html#method-i-read_shell">#read_shell &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-read_shell">#read_shell &mdash; Exploit</a>
<li class="method"><a href="RpcClient.html#method-i-read_shell">#read_shell &mdash; RpcClient</a>
<li class="method"><a href="WpItem.html#method-i-readme_url">#readme_url &mdash; WpItem</a>
<li class="method"><a href="WpReadme.html#method-i-readme_url">#readme_url &mdash; WpReadme</a>
@@ -529,10 +535,10 @@
<li class="method"><a href="Exploit.html#method-i-session_count">#session_count &mdash; Exploit</a>
<li class="method"><a href="Exploit.html#method-i-sessions">#sessions &mdash; Exploit</a>
<li class="method"><a href="RpcClient.html#method-i-sessions">#sessions &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-sessions">#sessions &mdash; Exploit</a>
<li class="method"><a href="Generate_List.html#method-i-set_file_name">#set_file_name &mdash; Generate_List</a>
<li class="method"><a href="WpscanOptions.html#method-i-set_option_from_cli">#set_option_from_cli &mdash; WpscanOptions</a>
@@ -557,12 +563,12 @@
<li class="method"><a href="WpItem.html#method-i-to_s">#to_s &mdash; WpItem</a>
<li class="method"><a href="SvnUpdater.html#method-i-update">#update &mdash; SvnUpdater</a>
<li class="method"><a href="GitUpdater.html#method-i-update">#update &mdash; GitUpdater</a>
<li class="method"><a href="Updater.html#method-i-update">#update &mdash; Updater</a>
<li class="method"><a href="SvnUpdater.html#method-i-update">#update &mdash; SvnUpdater</a>
<li class="method"><a href="WpTarget.html#method-i-url">#url &mdash; WpTarget</a>
<li class="method"><a href="WpscanOptions.html#method-i-url-3D">#url= &mdash; WpscanOptions</a>
@@ -575,10 +581,10 @@
<li class="method"><a href="WpUsernames.html#method-i-usernames">#usernames &mdash; WpUsernames</a>
<li class="method"><a href="WpItem.html#method-i-version">#version &mdash; WpItem</a>
<li class="method"><a href="WpTarget.html#method-i-version">#version &mdash; WpTarget</a>
<li class="method"><a href="WpItem.html#method-i-version">#version &mdash; WpItem</a>
<li class="method"><a href="Vulnerable.html#method-i-vulnerabilities">#vulnerabilities &mdash; Vulnerable</a>
<li class="method"><a href="WpscanOptions.html#method-i-wordlist-3D">#wordlist= &mdash; WpscanOptions</a>
@@ -591,11 +597,11 @@
<li class="method"><a href="CacheFileStore.html#method-i-write_entry">#write_entry &mdash; CacheFileStore</a>
<li class="method"><a href="RpcClient.html#method-i-write_shell">#write_shell &mdash; RpcClient</a>
<li class="method"><a href="Exploit.html#method-i-write_shell">#write_shell &mdash; Exploit</a>
<li class="method"><a href="WebSite.html#method-i-xmlrpc_url">#xmlrpc_url &mdash; WebSite</a>
<li class="method"><a href="RpcClient.html#method-i-write_shell">#write_shell &mdash; RpcClient</a>
<li class="method"><a href="WebSite.html#method-i-xml_rpc_url">#xml_rpc_url &mdash; WebSite</a>
</ul>

19
lib/wpscan/modules/web_site.rb
View File

@@ -32,7 +32,7 @@ module WebSite
wordpress = true
else
response = Browser.instance.get(
xmlrpc_url(),
xml_rpc_url,
{:follow_location => true, :max_redirects => 2}
)
@@ -44,8 +44,21 @@ module WebSite
wordpress
end
def xmlrpc_url
@uri.merge("xmlrpc.php").to_s
def xml_rpc_url
unless @xmlrpc_url
headers = Browser.instance.get(@uri.to_s).headers_hash
value = headers["x-pingback"]
if value.nil? or value.empty?
@xmlrpc_url = nil
else
@xmlrpc_url = value
end
end
@xmlrpc_url
end
def has_xml_rpc?
!xml_rpc_url.nil?
end
# Checks if the remote website is up.

39
spec/lib/wpscan/modules/web_site_spec.rb
View File

@@ -17,10 +17,10 @@
#++
shared_examples_for "WebSite" do
let(:fixtures_dir) { SPEC_FIXTURES_WPSCAN_MODULES_DIR + '/web_site' }
let(:fixtures_dir) { SPEC_FIXTURES_WPSCAN_MODULES_DIR + "/web_site" }
before :each do
@module = WpScanModuleSpec.new('http://example.localhost/')
@module = WpScanModuleSpec.new("http://example.localhost/")
@module.extend(WebSite)
end
@@ -30,16 +30,39 @@ shared_examples_for "WebSite" do
end
end
describe "#xmlrpc_url" do
describe "#xml_rpc_url" do
it "should return the correct url : http://example.localhost/xmlrpc.php" do
@module.xmlrpc_url.should === "http://example.localhost/xmlrpc.php"
xmlrpc = "http://example.localhost/xmlrpc.php"
stub_request(:get, "http://example.localhost/").
to_return(:status => 200, :body => "", :headers => { "X-Pingback" => xmlrpc})
@module.xml_rpc_url.should === xmlrpc
end
it "should return nil" do
stub_request(:get, "http://example.localhost/").to_return(:status => 200)
@module.xml_rpc_url.should be_nil
end
end
describe "#has_xml_rpc?" do
it "should return true" do
stub_request(:get, "http://example.localhost/").
to_return(:status => 200, :body => "", :headers => { "X-Pingback" => "xmlrpc"})
@module.has_xml_rpc?.should be_true
end
it "should return false" do
stub_request(:get, "http://example.localhost/").to_return(:status => 200)
@module.has_xml_rpc?.should be_false
end
end
describe "#is_wordpress?" do
# each url (wp-login and xmlrpc) pointed to a 404
before :each do
[@module.login_url, @module.xmlrpc_url].each do |url|
stub_request(:get, @module.uri.to_s).
to_return(:status => 200, :body => "", :headers => { "X-Pingback" => @module.uri.merge("xmlrpc.php")})
[@module.login_url, @module.xml_rpc_url].each do |url|
stub_request(:get, url).to_return(:status => 404, :body => "")
end
end
@@ -50,14 +73,14 @@ shared_examples_for "WebSite" do
it "should return true if the wp-login is found and is a valid wordpress one" do
stub_request(:get, @module.login_url).
to_return(:status => 200, :body => File.new(fixtures_dir + '/wp-login.php'))
to_return(:status => 200, :body => File.new(fixtures_dir + "/wp-login.php"))
@module.is_wordpress?.should be_true
end
it "should return true if the xmlrpc is found" do
stub_request(:get, @module.xmlrpc_url).
to_return(:status => 200, :body => File.new(fixtures_dir + '/xmlrpc.php'))
stub_request(:get, @module.xml_rpc_url).
to_return(:status => 200, :body => File.new(fixtures_dir + "/xmlrpc.php"))
@module.is_wordpress?.should be_true
end

4
wpscan.rb
View File

@@ -148,6 +148,10 @@ begin
puts green("[+]") + " User registration is enabled"
end
if wp_target.has_xml_rpc?
puts green("[+]") + " XML-RPC Interface available under #{wp_target.xml_rpc_url}"
end
if wp_target.has_malwares?
malwares = wp_target.malwares
puts red("[!]") + " #{malwares.size} malware(s) found :"