diff --git a/app/finders/users/yoast_seo_author_sitemap.rb b/app/finders/users/yoast_seo_author_sitemap.rb new file mode 100644 index 00000000..857aa879 --- /dev/null +++ b/app/finders/users/yoast_seo_author_sitemap.rb @@ -0,0 +1,34 @@ +module WPScan + module Finders + module Users + # The YOAST SEO plugin has an author-sitemap.xml which can leak usernames + # See https://github.com/wpscanteam/wpscan/issues/1228 + class YoastSeoAuthorSitemap < CMSScanner::Finders::Finder + # @param [ Hash ] opts + # + # @return [ Array ] + def aggressive(_opts = {}) + found = [] + + Browser.get(sitemap_url).html.xpath('//url/loc').each do |user_tag| + username = user_tag.text.to_s[%r{/author/([^\/]+)/}, 1] + + next unless username && !username.strip.empty? + + found << CMSScanner::User.new(username, + found_by: found_by, + confidence: 100, + interesting_entries: [sitemap_url]) + end + + found + end + + # @return [ String ] The URL of the author-sitemap + def sitemap_url + @sitemap_url ||= target.url('author-sitemap.xml') + end + end + end + end +end diff --git a/spec/app/finders/users/yoast_seo_author_sitemap_spec.rb b/spec/app/finders/users/yoast_seo_author_sitemap_spec.rb new file mode 100644 index 00000000..36c820ef --- /dev/null +++ b/spec/app/finders/users/yoast_seo_author_sitemap_spec.rb @@ -0,0 +1,48 @@ +require 'spec_helper' + +describe WPScan::Finders::Users::YoastSeoAuthorSitemap do + subject(:finder) { described_class.new(target) } + let(:target) { WPScan::Target.new(url) } + let(:url) { 'http://wp.lab/' } + let(:fixtures) { FINDERS_FIXTURES.join('users', 'yoast_seo_author_sitemap') } + + describe '#aggressive' do + before do + allow(target).to receive(:sub_dir).and_return(false) + + stub_request(:get, finder.sitemap_url).to_return(body: body) + end + + context 'when not an XML response' do + let(:body) { '' } + + its(:aggressive) { should eql([]) } + end + + context 'when an XML response' do + context 'when no usernames disclosed' do + let(:body) { File.read(fixtures.join('no_usernames.xml')) } + + its(:aggressive) { should eql([]) } + end + + context 'when usernames disclosed' do + let(:body) { File.read(fixtures.join('usernames.xml')) } + + it 'returns the expected array of users' do + users = finder.aggressive + + expect(users.size).to eql 2 + + expect(users.first.username).to eql 'editor' + expect(users.first.confidence).to eql 100 + expect(users.first.interesting_entries).to eql ['http://wp.lab/author-sitemap.xml'] + + expect(users.last.username).to eql 'admin' + expect(users.last.confidence).to eql 100 + expect(users.last.interesting_entries).to eql ['http://wp.lab/author-sitemap.xml'] + end + end + end + end +end diff --git a/spec/fixtures/finders/users/yoast_seo_author_sitemap/no_usernames.xml b/spec/fixtures/finders/users/yoast_seo_author_sitemap/no_usernames.xml new file mode 100644 index 00000000..7267aaa7 --- /dev/null +++ b/spec/fixtures/finders/users/yoast_seo_author_sitemap/no_usernames.xml @@ -0,0 +1,4 @@ + + + + diff --git a/spec/fixtures/finders/users/yoast_seo_author_sitemap/usernames.xml b/spec/fixtures/finders/users/yoast_seo_author_sitemap/usernames.xml new file mode 100644 index 00000000..c76348fb --- /dev/null +++ b/spec/fixtures/finders/users/yoast_seo_author_sitemap/usernames.xml @@ -0,0 +1,20 @@ + + + + http://wp.lab/author/editor/ + 2018-10-22T19:56:51+00:00 + + + http://wp.lab/author/admin/ + 2018-10-22T19:54:23+00:00 + + + http://wp.lab/author// + 2018-10-22T19:54:23+00:00 + + + http://wp.lab/author/ / + 2018-10-22T19:54:23+00:00 + + +