Merges with Master (and solves conflicts)

.gitignore

@@ -21,3 +21,6 @@ doc/
 # Old files from v2
 cache/
 data/
+
+# Profiling reports
+bin/memprof*.report

app/finders/config_backups/known_filenames.rb

@@ -5,7 +5,7 @@ module WPScan
     module ConfigBackups
       # Config Backup finder
       class KnownFilenames < CMSScanner::Finders::Finder
-        include CMSScanner::Finders::Finder::Enumerator
+        include Finders::Finder::Enumerator
 
         # @param [ Hash ] opts
         # @option opts [ String ] :list
@@ -16,17 +16,20 @@ module WPScan
           found = []
 
           enumerate(potential_urls(opts), opts) do |res|
-            # Might need to improve that
+            found << Model::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
-            next unless res.body =~ /define/i && res.body !~ /<\s?html/i
-
-            found << Model::ConfigBackup.new(res.request.url,
-                                             found_by: DIRECT_ACCESS,
-                                             confidence: 100)
           end
 
           found
         end
 
+        def valid_response?(res, _exclude_content = nil)
+          return unless res.code == 200
+
+          full_res = Browser.get(res.effective_url)
+
+          full_res.body =~ /define/i && full_res.body !~ /<\s?html/i
+        end
+
         # @param [ Hash ] opts
         # @option opts [ String ] :list Mandatory
         #

app/finders/db_exports/known_locations.rb

@@ -6,7 +6,9 @@ module WPScan
       # DB Exports finder
       # See https://github.com/wpscanteam/wpscan-v3/issues/62
       class KnownLocations < CMSScanner::Finders::Finder
-        include CMSScanner::Finders::Finder::Enumerator
+        include Finders::Finder::Enumerator
+
+        SQL_PATTERN = /(?:DROP|(?:UN)?LOCK|CREATE) TABLE|INSERT INTO/.freeze
 
         # @param [ Hash ] opts
         # @option opts [ String ] :list
@@ -17,16 +19,21 @@ module WPScan
           found = []
 
           enumerate(potential_urls(opts), opts) do |res|
-            next unless res.code == 200 && res.body =~ /INSERT INTO/
+            found << Model::DbExport.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
-
-            found << Model::DbExport.new(res.request.url,
-                                         found_by: DIRECT_ACCESS,
-                                         confidence: 100)
           end
 
           found
         end
 
+        def valid_response?(res, _exclude_content = nil)
+          return false unless res.code == 200
+
+          return true if res.effective_url.end_with?('.zip') &&
+                         res.headers['Content-Type'] =~ %r{\Aapplication/zip}i
+
+          Browser.get(res.effective_url, headers: { 'Range' => 'bytes=0-3000' }).body =~ SQL_PATTERN ? true : false
+        end
+
         # @param [ Hash ] opts
         # @option opts [ String ] :list Mandatory
         #

app/finders/interesting_findings/tmm_db_migrate.rb

@@ -9,7 +9,7 @@ module WPScan
         def aggressive(_opts = {})
           path = 'wp-content/uploads/tmm_db_migrate/tmm_db_migrate.zip'
           url  = target.url(path)
-          res  = Browser.get(url)
+          res  = browser.forge_request(url, target.head_or_get_request_params).run
 
           return unless res.code == 200 && res.headers['Content-Type'] =~ %r{\Aapplication/zip}i
 

app/finders/interesting_findings/upload_sql_dump.rb

@@ -5,24 +5,25 @@ module WPScan
     module InterestingFindings
       # UploadSQLDump finder
       class UploadSQLDump < CMSScanner::Finders::Finder
-        SQL_PATTERN = /(?:(?:(?:DROP|CREATE) TABLE)|INSERT INTO)/.freeze
+        SQL_PATTERN = /(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO/.freeze
 
         # @return [ InterestingFinding ]
         def aggressive(_opts = {})
-          url = dump_url
+          head_res = browser.forge_request(dump_url, target.head_or_get_request_params).run
-          res = Browser.get(url)
 
-          return unless res.code == 200 && res.body =~ SQL_PATTERN
+          return unless head_res.code == 200
+
+          return unless Browser.get(dump_url, headers: { 'Range' => 'bytes=0-3000' }).body =~ SQL_PATTERN
 
           Model::UploadSQLDump.new(
-            url,
+            dump_url,
             confidence: 100,
             found_by: DIRECT_ACCESS
           )
         end
 
         def dump_url
-          target.url('wp-content/uploads/dump.sql')
+          @dump_url ||= target.url('wp-content/uploads/dump.sql')
         end
       end
     end

app/finders/timthumbs/known_locations.rb

@@ -30,9 +30,7 @@ module WPScan
         def valid_response?(res, _exclude_content = nil)
           return false unless res.code == 400
 
-          full_res = Browser.get(res.effective_url, cache_ttl: 0)
+          Browser.get(res.effective_url).body =~ /no image specified/i ? true : false
-
-          full_res.body =~ /no image specified/i ? true : false
         end
 
         # @param [ Hash ] opts

app/finders/users/rss_generator.rb

@@ -19,20 +19,20 @@ module WPScan
 
             begin
               res.xml.xpath('//item/dc:creator').each do |node|
-                potential_username = node.text.to_s
+                username = node.text.to_s
 
                 # Ignoring potential username longer than 60 characters and containing accents
                 # as they are considered invalid. See https://github.com/wpscanteam/wpscan/issues/1215
-                next if potential_username.length > 60 || potential_username =~ /[^\x00-\x7F]/
+                next if username.strip.empty? || username.length > 60 || username =~ /[^\x00-\x7F]/
 
-                potential_usernames << potential_username
+                potential_usernames << username
               end
             rescue Nokogiri::XML::XPath::SyntaxError
               next
             end
 
-            potential_usernames.uniq.each do |potential_username|
+            potential_usernames.uniq.each do |username|
-              found << Model::User.new(potential_username, found_by: found_by, confidence: 50)
+              found << Model::User.new(username, found_by: found_by, confidence: 50)
             end
 
             break

app/finders/users/wp_json_api.rb

@@ -55,7 +55,15 @@ module WPScan
 
         # @return [ String ] The URL of the API listing the Users
         def api_url
-          @api_url ||= target.url('wp-json/wp/v2/users/')
+          return @api_url if @api_url
+
+          target.in_scope_urls(target.homepage_res, "//link[@rel='https://api.w.org/']/@href").each do |url, _tag|
+            uri = Addressable::URI.parse(url.strip)
+
+            return @api_url = uri.join('wp/v2/users/').to_s if uri.path.include?('wp-json')
+          end
+
+          @api_url = target.url('wp-json/wp/v2/users/')
         end
       end
     end

app/models/wp_version.rb

@@ -26,13 +26,12 @@ module WPScan
         @all_numbers = []
 
         DB::Fingerprints.wp_fingerprints.each_value do |fp|
-          fp.each_value do |versions|
+          @all_numbers << fp.values
-            versions.each do |version|
-              @all_numbers << version unless @all_numbers.include?(version)
-            end
-          end
         end
 
+        # @all_numbers.flatten.uniq.sort! {} doesn't produce the same result here.
+        @all_numbers.flatten!
+        @all_numbers.uniq!
         @all_numbers.sort! { |a, b| Gem::Version.new(b) <=> Gem::Version.new(a) }
       end
 

bin/wpscan-memprof

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+
+require 'memory_profiler' # https://github.com/SamSaffron/memory_profiler
+require 'wpscan'
+
+report = MemoryProfiler.report(top: 15) do
+  WPScan::Scan.new do |s|
+    s.controllers <<
+      WPScan::Controller::CustomDirectories.new <<
+      WPScan::Controller::InterestingFindings.new <<
+      WPScan::Controller::WpVersion.new <<
+      WPScan::Controller::MainTheme.new <<
+      WPScan::Controller::Enumeration.new <<
+      WPScan::Controller::PasswordAttack.new <<
+      WPScan::Controller::Aliases.new
+
+    s.run
+  end
+end
+
+report.pretty_print(scale_bytes: true, to_file: 'memprof.report')

bin/wpscan-stackprof

@@ -0,0 +1,24 @@
+#!/usr/bin/env ruby
+
+require 'stackprof' # https://github.com/tmm1/stackprof
+require 'wpscan'
+
+# The object mode produces a segfault currently: https://github.com/jfelchner/ruby-progressbar/issues/153
+# StackProf.run(mode: :object, out: '/tmp/stackprof-object.dump') do
+# StackProf.run(mode: :wall, out: '/tmp/stackprof-wall.dump') do
+StackProf.run(mode: :cpu, out: '/tmp/stackprof-cpu.dump', interval: 500) do
+  # Couldn't we just load the ./wpscan here ?
+  # require_relative 'wpscan' doesn't work
+  WPScan::Scan.new do |s|
+    s.controllers <<
+      WPScan::Controller::CustomDirectories.new <<
+      WPScan::Controller::InterestingFindings.new <<
+      WPScan::Controller::WpVersion.new <<
+      WPScan::Controller::MainTheme.new <<
+      WPScan::Controller::Enumeration.new <<
+      WPScan::Controller::PasswordAttack.new <<
+      WPScan::Controller::Aliases.new
+
+    s.run
+  end
+end

lib/wpscan/db/dynamic_finders/plugin.rb

@@ -62,7 +62,7 @@ module WPScan
 
         # @param [ String ] slug
         # @return [ Constant ]
-        def self.maybe_create_modudle(slug)
+        def self.maybe_create_module(slug)
           # What about slugs such as js_composer which will be done as JsComposer, just like js-composer
           constant_name = classify_slug(slug)
 
@@ -75,10 +75,7 @@ module WPScan
 
         def self.create_versions_finders
           versions_finders_configs.each do |slug, finders|
-            # Kind of an issue here, module is created even if there is no valid classes
+            mod = maybe_create_module(slug)
-            # Could put the #maybe_ directly in the #send() BUT it would be checked everytime,
-            # which is kind of a waste
-            mod = maybe_create_modudle(slug)
 
             finders.each do |finder_class, config|
               klass = config['class'] || finder_class

lib/wpscan/finders.rb

@@ -41,9 +41,6 @@ module WPScan
         #
         # @yield [ Typhoeus::Response, String ]
         def enumerate(urls, opts = {})
-          determine_request_params(urls, opts)
-          # determine_valid_response_codes(opts)
-
           create_progress_bar(opts.merge(total: urls.size))
 
           urls.each do |url, slug|
@@ -61,6 +58,11 @@ module WPScan
           hydra.run
         end
 
+        # @return [ Hash ]
+        def request_params
+          @request_params ||= target.head_or_get_request_params.merge(cache_ttl: 0)
+        end
+
         # @param [ Typhoeus::Response ] res
         # @param [ Regexp,nil ] exclude_content
         #
@@ -73,7 +75,9 @@ module WPScan
 
           # Perform a full get to check if homepage or custom 404
           if res.code == 200
-            full_res = Browser.get(res.effective_url, cache_ttl: 0)
+            # The cache is not disabled to avoid additional request/s when checking
+            # for directory listing
+            full_res = Browser.get(res.effective_url)
 
             return false if target.homepage_or_404?(full_res) ||
                             exclude_content && full_res.body.match(exclude_content)
@@ -83,23 +87,6 @@ module WPScan
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        # @return [ Hash ]
-        def request_params
-          @request_params ||= { cache_ttl: 0 }
-        end
-
-        # @param [ Hash ] urls
-        # @param [ Hash ] opts
-        def determine_request_params(urls, _opts)
-          head_res = Browser.head(urls.first[0], cache_ttl: 0)
-
-          @request_params = if head_res.code == 405
-                              { method: :get, maxfilesize: 1, cache_ttl: 0 }
-                            else
-                              { method: :head, cache_ttl: 0 }
-                            end
-        end
-
         # @return [ Array<Integer> ]
         def valid_response_codes
           @valid_response_codes ||= [200, 401, 403, 301]

lib/wpscan/target.rb

@@ -7,6 +7,15 @@ module WPScan
   class Target < CMSScanner::Target
     include Platform::WordPress
 
+    # @return [ Hash ]
+    def head_or_get_request_params
+      @head_or_get_request_params ||= if Browser.head(url).code == 405
+                                        { method: :get, maxfilesize: 1 }
+                                      else
+                                        { method: :head }
+                                      end
+    end
+
     # @return [ Boolean ]
     def vulnerable?
       [@wp_version, @main_theme, @plugins, @themes, @timthumbs].each do |e|

lib/wpscan/target/platform/wordpress/custom_directories.rb

@@ -17,7 +17,7 @@ module WPScan
         def content_dir
           unless @content_dir
             escaped_url = Regexp.escape(url).gsub(/https?/i, 'https?')
-            pattern     = %r{#{escaped_url}([^\/]+)\/(?:themes|plugins|uploads|cache)\/}i
+            pattern     = %r{#{escaped_url}([\w\s\-\/]+)\/(?:themes|plugins|uploads|cache)\/}i
 
             in_scope_urls(homepage_res) do |url|
               return @content_dir = Regexp.last_match[1] if url.match(pattern)

spec/app/finders/config_backups/known_filenames_spec.rb

@@ -10,10 +10,10 @@ describe WPScan::Finders::ConfigBackups::KnownFilenames do
   describe '#aggressive' do
     before do
       expect(target).to receive(:sub_dir).at_least(1).and_return(false)
-      expect(target).to receive(:homepage_or_404?).at_least(1).and_return(false)
+      expect(target).to receive(:head_or_get_request_params).and_return(method: :head)
 
       finder.potential_urls(opts).each_key do |url|
-        stub_request(:get, url).to_return(status: 404)
+        stub_request(:head, url).to_return(status: 404)
       end
     end
 
@@ -24,11 +24,12 @@ describe WPScan::Finders::ConfigBackups::KnownFilenames do
     end
 
     context 'when some files exist' do
-      let(:files) { ['%23wp-config.php%23', 'wp-config.bak'] }
+      let(:found_files) { ['%23wp-config.php%23', 'wp-config.bak'] }
       let(:config_backup) { File.read(fixtures.join('wp-config.php')) }
 
       before do
-        files.each do |file|
+        found_files.each do |file|
+          stub_request(:head, "#{url}#{file}").to_return(status: 200)
           stub_request(:get, "#{url}#{file}").to_return(body: config_backup)
         end
       end
@@ -36,7 +37,7 @@ describe WPScan::Finders::ConfigBackups::KnownFilenames do
       it 'returns the expected Array<ConfigBackup>' do
         expected = []
 
-        files.each do |file|
+        found_files.each do |file|
           url = "#{target.url}#{file}"
           expected << WPScan::Model::ConfigBackup.new(
             url,

spec/app/finders/db_exports/known_locations_spec.rb

@@ -27,10 +27,10 @@ describe WPScan::Finders::DbExports::KnownLocations do
   describe '#aggressive' do
     before do
       expect(target).to receive(:sub_dir).at_least(1).and_return(false)
-      expect(target).to receive(:homepage_or_404?).at_least(1).and_return(false)
+      expect(target).to receive(:head_or_get_request_params).and_return(method: :head)
 
       finder.potential_urls(opts).each_key do |url|
-        stub_request(:get, url).to_return(status: 404)
+        stub_request(:head, url).to_return(status: 404)
       end
     end
 
@@ -40,20 +40,28 @@ describe WPScan::Finders::DbExports::KnownLocations do
       end
     end
 
+    context 'when a zip returns a 200' do
+      xit
+    end
+
     context 'when some files exist' do
-      let(:files) { %w[ex.sql backups/db_backup.sql] }
+      let(:found_files) { %w[ex.sql backups/db_backup.sql] }
       let(:db_export) { File.read(fixtures.join('dump.sql')) }
 
       before do
-        files.each do |file|
+        found_files.each do |file|
-          stub_request(:get, "#{url}#{file}").to_return(body: db_export)
+          stub_request(:head, "#{url}#{file}").to_return(status: 200)
+
+          stub_request(:get, "#{url}#{file}")
+            .with(headers: { 'Range' => 'bytes=0-3000' })
+            .to_return(body: db_export)
         end
       end
 
       it 'returns the expected Array<DbExport>' do
         expected = []
 
-        files.each do |file|
+        found_files.each do |file|
           url = "#{target.url}#{file}"
           expected << WPScan::Model::DbExport.new(
             url,

spec/app/finders/interesting_findings/upload_sql_dump_spec.rb

@@ -8,13 +8,16 @@ describe WPScan::Finders::InterestingFindings::UploadSQLDump do
   let(:wp_content) { 'wp-content' }
 
   describe '#aggressive' do
-    before { expect(target).to receive(:content_dir).at_least(1).and_return(wp_content) }
+    before do
+      expect(target).to receive(:content_dir).at_least(1).and_return(wp_content)
+      expect(target).to receive(:head_or_get_request_params).and_return(method: :head)
+    end
 
     after { expect(finder.aggressive).to eql @expected }
 
     context 'when not a 200' do
       it 'returns nil' do
-        stub_request(:get, finder.dump_url).to_return(status: 404)
+        stub_request(:head, finder.dump_url).to_return(status: 404)
 
         @expected = nil
       end
@@ -22,8 +25,11 @@ describe WPScan::Finders::InterestingFindings::UploadSQLDump do
 
     context 'when a 200' do
       before do
+        stub_request(:head, finder.dump_url).to_return(status: 200)
+
         stub_request(:get, finder.dump_url)
-          .to_return(status: 200, body: File.read(fixtures.join(fixture)))
+          .with(headers: { 'Range' => 'bytes=0-3000' })
+          .to_return(body: File.read(fixtures.join(fixture)))
       end
 
       context 'when the body does not match a SQL dump' do

spec/app/finders/users/wp_json_api_spec.rb

@@ -7,7 +7,10 @@ describe WPScan::Finders::Users::WpJsonApi do
   let(:fixtures)   { FINDERS_FIXTURES.join('users', 'wp_json_api') }
 
   describe '#aggressive' do
-    before { allow(target).to receive(:sub_dir).and_return(false) }
+    before do
+      allow(target).to receive(:sub_dir).and_return(false)
+      allow(finder).to receive(:api_url).and_return(target.url('wp-json/wp/v2/users/'))
+    end
 
     context 'when only one page of results' do
       before do
@@ -80,4 +83,54 @@ describe WPScan::Finders::Users::WpJsonApi do
       end
     end
   end
+
+  describe '#api_url' do
+    let(:fixtures) { super().join('api_url') }
+
+    context 'when url in the homepage' do
+      {
+        in_scope: 'https://wp.lab/wp-json/wp/v2/users/',
+        out_of_scope: 'http://wp.lab/wp-json/wp/v2/users/'
+      }.each do |fixture, expected|
+        it "returns #{expected} for #{fixture}.html" do
+          stub_request(:get, target.url).to_return(body: File.read(fixtures.join("#{fixture}.html")))
+
+          expect(finder.api_url).to eql expected
+        end
+      end
+
+      context 'when subdir' do
+        before { allow(target).to receive(:subdir).and_return('cms') }
+
+        {
+          in_scope_subdir: 'https://wp.lab/cms/wp-json/wp/v2/users/',
+          in_scope_subdir_ignored: 'https://wp.lab/wp-json/wp/v2/users/'
+        }.each do |fixture, expected|
+          it "returns #{expected} for #{fixture}.html" do
+            stub_request(:get, target.url).to_return(body: File.read(fixtures.join("#{fixture}.html")))
+
+            expect(finder.api_url).to eql expected
+          end
+        end
+      end
+    end
+
+    context 'when not in the homepage' do
+      before { stub_request(:get, target.url) }
+
+      its(:api_url) { should eql target.url('wp-json/wp/v2/users/') }
+    end
+
+    context 'when api_url already found' do
+      before { allow(target).to receive(:sub_dir).and_return(false) }
+
+      it 'does not check the homepage again' do
+        url = target.url('wp-json/wp/v2/users/')
+
+        finder.instance_variable_set(:@api_url, url)
+
+        expect(finder.api_url).to eql url
+      end
+    end
+  end
 end

spec/fixtures/finders/users/rss_generator/feed.xml

@@ -59,5 +59,23 @@
       <dc:creator><dc:creator><![CDATA[Michael Schrage. <p>Michael Schrage is a researcher at the MIT Sloan School of Management Initiative on the Digital Economy, where he does research and advisory work on how digital media transforms agency, human capital, and innovation.</p>
 ]]></dc:creator></dc:creator>
     </item>
+
+    <item>
+      <title>Hello world!</title>
+      <link>http://ex.lo/2018/09/23/hello-world/</link>
+      <comments>http://ex.lo/2018/09/23/hello-world/#comments</comments>
+      <pubDate>Sun, 23 Sep 2018 11:31:56 +0000</pubDate>
+      <!-- Should be ignored as empty username -->
+      <dc:creator><![CDATA[]]></dc:creator>
+    </item>
+
+    <item>
+      <title>Hello world!</title>
+      <link>http://ex.lo/2018/09/23/hello-world/</link>
+      <comments>http://ex.lo/2018/09/23/hello-world/#comments</comments>
+      <pubDate>Sun, 23 Sep 2018 11:31:56 +0000</pubDate>
+      <!-- Should be ignored as empty username -->
+      <dc:creator><![CDATA[ ]]></dc:creator>
+    </item>
   </channel>
 </rss>

spec/fixtures/finders/users/wp_json_api/api_url/in_scope.html

@@ -0,0 +1 @@
+<link rel='https://api.w.org/' href='https://wp.lab/wp-json/' />

spec/fixtures/finders/users/wp_json_api/api_url/in_scope_subdir.html

@@ -0,0 +1,6 @@
+<link rel='https://api.w.org/' href='https://wp.lab/cms/wp-json/' />
+<link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://wp.lab/cms/xmlrpc.php?rsd" />
+<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://wp.lab/cms/wp-includes/wlwmanifest.xml" />
+<link rel='shortlink' href='https://wp.lab/' />
+<link rel="alternate" type="application/json+oembed" href="https://wp.lab/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwp.lab%2F" />
+<link rel="alternate" type="text/xml+oembed" href="https://wp.lab/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwp.lab%2F&#038;format=xml" />

spec/fixtures/finders/users/wp_json_api/api_url/in_scope_subdir_ignored.html

@@ -0,0 +1,6 @@
+<link rel='https://api.w.org/' href='https://wp.lab/wp-json/' />
+<link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://wp.lab/cms/xmlrpc.php?rsd" />
+<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://wp.lab/cms/wp-includes/wlwmanifest.xml" />
+<link rel='shortlink' href='https://wp.lab/' />
+<link rel="alternate" type="application/json+oembed" href="https://wp.lab/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwp.lab%2F" />
+<link rel="alternate" type="text/xml+oembed" href="https://wp.lab/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwp.lab%2F&#038;format=xml" />

spec/fixtures/finders/users/wp_json_api/api_url/out_of_scope.html

@@ -0,0 +1 @@
+<link rel='https://api.w.org/' href='https://out-there.com/wp-json/' />

spec/fixtures/target/platform/wordpress/custom_directories/relative_two_sub_dir.html

@@ -0,0 +1,6 @@
+<link rel='https://api.w.org/' href='https://ex.lo/wp-json/' />
+<link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://ex.lo/cms/xmlrpc.php?rsd" />
+<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://ex.lo/cms/wp-includes/wlwmanifest.xml" />
+
+<link rel="shortcut icon" href="//ex.lo/cms/wp-content/uploads/2011/10/favicon.ico">
+<link rel="apple-touch-icon-precomposed" href="//ex.lo/cms/wp-content/uploads/2011/10/favicon.ico">

spec/shared_examples/target/platform/wordpress/custom_directories.rb

@@ -7,7 +7,7 @@ shared_examples 'WordPress::CustomDirectories' do
     {
       default: 'wp-content', https: 'wp-content', custom_w_spaces: 'custom content spaces',
       relative_one: 'wp-content', relative_two: 'wp-content', cache: 'wp-content',
-      in_raw_js: 'wp-content', with_sub_dir: 'app'
+      in_raw_js: 'wp-content', with_sub_dir: 'app', relative_two_sub_dir: 'cms/wp-content'
     }.each do |file, expected|
       it "returns #{expected} for #{file}.html" do
         stub_request(:get, target.url).to_return(body: File.read(fixtures.join("#{file}.html")))
@@ -49,7 +49,7 @@ shared_examples 'WordPress::CustomDirectories' do
   end
 
   describe '#sub_dir' do
-    { default: false, with_sub_dir: 'wp' }.each do |file, expected|
+    { default: false, with_sub_dir: 'wp', relative_two_sub_dir: 'cms' }.each do |file, expected|
       it "returns #{expected} for #{file}.html" do
         fixture = File.join(fixtures, "#{file}.html")
 

wpscan.gemspec

@@ -25,10 +25,12 @@ Gem::Specification.new do |s|
 
   s.add_development_dependency 'bundler',   '>= 1.6'
   s.add_development_dependency 'coveralls', '~> 0.8.0'
+  s.add_development_dependency 'memory_profiler', '~> 0.9.13'
   s.add_development_dependency 'rake', '~> 12.3'
   s.add_development_dependency 'rspec', '~> 3.8.0'
   s.add_development_dependency 'rspec-its', '~> 1.2.0'
   s.add_development_dependency 'rubocop', '~> 0.66.0'
   s.add_development_dependency 'simplecov', '~> 0.16.1'
+  s.add_development_dependency 'stackprof', '~> 0.2.12'
   s.add_development_dependency 'webmock', '~> 3.5.1'
 end