garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix #858

Browse Source
This commit is contained in:
Christian Mehlmauer
2015-08-22 21:50:01 +02:00
parent 3a6a451db1
commit ec68291bf0
2 changed files with 227 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files

444
lib/common/models/wp_version/findable.rb
View File

@@ -1,222 +1,222 @@
# encoding: UTF-8 # encoding: UTF-8
class WpVersion < WpItem class WpVersion < WpItem
module Findable module Findable
# Find the version of the blog designated from target_uri # Find the version of the blog designated from target_uri
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# @param [ String ] wp_content_dir # @param [ String ] wp_content_dir
# @param [ String ] wp_plugins_dir # @param [ String ] wp_plugins_dir
# #
# @return [ WpVersion ] # @return [ WpVersion ]
def find(target_uri, wp_content_dir, wp_plugins_dir, versions_xml) def find(target_uri, wp_content_dir, wp_plugins_dir, versions_xml)
methods.grep(/^find_from_/).each do |method| methods.grep(/^find_from_/).each do |method|
if method === :find_from_advanced_fingerprinting if method === :find_from_advanced_fingerprinting
version = send(method, target_uri, wp_content_dir, wp_plugins_dir, versions_xml) version = send(method, target_uri, wp_content_dir, wp_plugins_dir, versions_xml)
else else
version = send(method, target_uri) version = send(method, target_uri)
end end
if version if version
return new(target_uri, number: version, found_from: method) return new(target_uri, number: version, found_from: method)
end end
end end
nil nil
end end
# Used to check if the version is correct: must contain at least one dot. # Used to check if the version is correct: must contain at least one dot.
# #
# @return [ String ] # @return [ String ]
def version_pattern def version_pattern
'([^\r\n"\']+\.[^\r\n"\']+)' '([^\r\n"\',]+\.[^\r\n"\',]+)'
end end
protected protected
# Returns the first match of <pattern> in the body of the url # Returns the first match of <pattern> in the body of the url
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# @param [ Regex ] pattern # @param [ Regex ] pattern
# @param [ String ] path # @param [ String ] path
# #
# @return [ String ] # @return [ String ]
def scan_url(target_uri, pattern, path = nil) def scan_url(target_uri, pattern, path = nil)
url = path ? target_uri.merge(path).to_s : target_uri.to_s url = path ? target_uri.merge(path).to_s : target_uri.to_s
response = Browser.get_and_follow_location(url) response = Browser.get_and_follow_location(url)
response.body[pattern, 1] response.body[pattern, 1]
end end
# #
# DO NOT Change the order of the following methods # DO NOT Change the order of the following methods
# unless you know what you are doing # unless you know what you are doing
# See WpVersion.find # See WpVersion.find
# #
# Attempts to find the wordpress version from, # Attempts to find the wordpress version from,
# the generator meta tag in the html source. # the generator meta tag in the html source.
# #
# The meta tag can be removed however it seems, # The meta tag can be removed however it seems,
# that it is reinstated on upgrade. # that it is reinstated on upgrade.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_meta_generator(target_uri) def find_from_meta_generator(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{name="generator" content="wordpress #{version_pattern}"}i %r{name="generator" content="wordpress #{version_pattern}.*"}i
) )
end end
# Attempts to find the WordPress version from, # Attempts to find the WordPress version from,
# the generator tag in the RSS feed source. # the generator tag in the RSS feed source.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_rss_generator(target_uri) def find_from_rss_generator(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{<generator>http://wordpress.org/\?v=#{version_pattern}</generator>}i, %r{<generator>http://wordpress.org/\?v=#{version_pattern}</generator>}i,
'feed/' 'feed/'
) )
end end
# Attempts to find WordPress version from, # Attempts to find WordPress version from,
# the generator tag in the RDF feed source. # the generator tag in the RDF feed source.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_rdf_generator(target_uri) def find_from_rdf_generator(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{<admin:generatorAgent rdf:resource="http://wordpress.org/\?v=#{version_pattern}" />}i, %r{<admin:generatorAgent rdf:resource="http://wordpress.org/\?v=#{version_pattern}" />}i,
'feed/rdf/' 'feed/rdf/'
) )
end end
# Attempts to find the WordPress version from, # Attempts to find the WordPress version from,
# the generator tag in the Atom source. # the generator tag in the Atom source.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_atom_generator(target_uri) def find_from_atom_generator(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{<generator uri="http://wordpress.org/" version="#{version_pattern}">WordPress</generator>}i, %r{<generator uri="http://wordpress.org/" version="#{version_pattern}">WordPress</generator>}i,
'feed/atom/' 'feed/atom/'
) )
end end
def find_from_stylesheets_numbers(target_uri) def find_from_stylesheets_numbers(target_uri)
wp_versions = WpVersion.all wp_versions = WpVersion.all
found = {} found = {}
pattern = /\bver=([0-9\.]+)/i pattern = /\bver=([0-9\.]+)/i
Nokogiri::HTML(Browser.get(target_uri.to_s).body).css('link,script').each do |tag| Nokogiri::HTML(Browser.get(target_uri.to_s).body).css('link,script').each do |tag|
%w(href src).each do |attribute| %w(href src).each do |attribute|
attr_value = tag.attribute(attribute).to_s attr_value = tag.attribute(attribute).to_s
next if attr_value.nil? || attr_value.empty? next if attr_value.nil? || attr_value.empty?
uri = Addressable::URI.parse(attr_value) uri = Addressable::URI.parse(attr_value)
next unless uri.query && uri.query.match(pattern) next unless uri.query && uri.query.match(pattern)
version = Regexp.last_match[1].to_s version = Regexp.last_match[1].to_s
found[version] ||= 0 found[version] ||= 0
found[version] += 1 found[version] += 1
end end
end end
found.delete_if { |v, _| !wp_versions.include?(v) } found.delete_if { |v, _| !wp_versions.include?(v) }
best_guess = found.sort_by(&:last).last best_guess = found.sort_by(&:last).last
# best_guess[0]: version number, [1] numbers of occurences # best_guess[0]: version number, [1] numbers of occurences
best_guess && best_guess[1] > 1 ? best_guess[0] : nil best_guess && best_guess[1] > 1 ? best_guess[0] : nil
end end
# Uses data/wp_versions.xml to try to identify a # Uses data/wp_versions.xml to try to identify a
# wordpress version. # wordpress version.
# #
# It does this by using client side file hashing # It does this by using client side file hashing
# #
# /!\ Warning : this method might return false positive if the file used for fingerprinting is part of a theme (they can be updated) # /!\ Warning : this method might return false positive if the file used for fingerprinting is part of a theme (they can be updated)
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# @param [ String ] wp_content_dir # @param [ String ] wp_content_dir
# @param [ String ] wp_plugins_dir # @param [ String ] wp_plugins_dir
# @param [ String ] versions_xml The path to the xml containing all versions # @param [ String ] versions_xml The path to the xml containing all versions
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_advanced_fingerprinting(target_uri, wp_content_dir, wp_plugins_dir, versions_xml) def find_from_advanced_fingerprinting(target_uri, wp_content_dir, wp_plugins_dir, versions_xml)
xml = xml(versions_xml) xml = xml(versions_xml)
# This wp_item will take care of encoding the path # This wp_item will take care of encoding the path
# and replace variables like $wp-content$ & $wp-plugins$ # and replace variables like $wp-content$ & $wp-plugins$
wp_item = WpItem.new(target_uri, wp_item = WpItem.new(target_uri,
wp_content_dir: wp_content_dir, wp_content_dir: wp_content_dir,
wp_plugins_dir: wp_plugins_dir) wp_plugins_dir: wp_plugins_dir)
xml.xpath('//file').each do |node| xml.xpath('//file').each do |node|
wp_item.path = node.attribute('src').text wp_item.path = node.attribute('src').text
response = Browser.get(wp_item.url) response = Browser.get(wp_item.url)
md5sum = Digest::MD5.hexdigest(response.body) md5sum = Digest::MD5.hexdigest(response.body)
node.search('hash').each do |hash| node.search('hash').each do |hash|
if hash.attribute('md5').text == md5sum if hash.attribute('md5').text == md5sum
return hash.search('version').text return hash.search('version').text
end end
end end
end end
nil nil
end end
# Attempts to find the WordPress version from the readme.html file. # Attempts to find the WordPress version from the readme.html file.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_readme(target_uri) def find_from_readme(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{<br />\sversion #{version_pattern}}i, %r{<br />\sversion #{version_pattern}}i,
'readme.html' 'readme.html'
) )
end end
# Attempts to find the WordPress version from the sitemap.xml file. # Attempts to find the WordPress version from the sitemap.xml file.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_sitemap_generator(target_uri) def find_from_sitemap_generator(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{generator="wordpress/#{version_pattern}"}i, %r{generator="wordpress/#{version_pattern}"}i,
'sitemap.xml' 'sitemap.xml'
) )
end end
# Attempts to find the WordPress version from the p-links-opml.php file. # Attempts to find the WordPress version from the p-links-opml.php file.
# #
# @param [ URI ] target_uri # @param [ URI ] target_uri
# #
# @return [ String ] The version number # @return [ String ] The version number
def find_from_links_opml(target_uri) def find_from_links_opml(target_uri)
scan_url( scan_url(
target_uri, target_uri,
%r{generator="wordpress/#{version_pattern}"}i, %r{generator="wordpress/#{version_pattern}"}i,
'wp-links-opml.php' 'wp-links-opml.php'
) )
end end
end end
end end

5
spec/lib/common/models/wp_version/findable_spec.rb
View File

@@ -65,6 +65,11 @@ describe 'WpVersion::Findable' do
@fixture = '/3.5_minified.html' @fixture = '/3.5_minified.html'
@expected = '3.5' @expected = '3.5'
end end
it 'returns 3.5.1' do
@fixture = '/3.5.1_mobile.html'
@expected = '3.5.1'
end
end end
end end