diff --git a/app/finders/config_backups/known_filenames.rb b/app/finders/config_backups/known_filenames.rb index 6dc9f38f..f93503f5 100644 --- a/app/finders/config_backups/known_filenames.rb +++ b/app/finders/config_backups/known_filenames.rb @@ -3,7 +3,7 @@ module WPScan module ConfigBackups # Config Backup finder class KnownFilenames < CMSScanner::Finders::Finder - include CMSScanner::Finders::Finder::Enumerator + include Finders::Finder::Enumerator # @param [ Hash ] opts # @option opts [ String ] :list @@ -14,15 +14,20 @@ module WPScan found = [] enumerate(potential_urls(opts), opts) do |res| - # Might need to improve that - next unless res.body =~ /define/i && res.body !~ /<\s?html/i - found << WPScan::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100) end found end + def valid_response?(res, _exclude_content = nil) + return unless res.code == 200 + + full_res = Browser.get(res.effective_url) + + full_res.body =~ /define/i && full_res.body !~ /<\s?html/i + end + # @param [ Hash ] opts # @option opts [ String ] :list Mandatory # diff --git a/spec/app/finders/config_backups/known_filenames_spec.rb b/spec/app/finders/config_backups/known_filenames_spec.rb index ba8c97a7..c1abdaa0 100644 --- a/spec/app/finders/config_backups/known_filenames_spec.rb +++ b/spec/app/finders/config_backups/known_filenames_spec.rb @@ -8,10 +8,10 @@ describe WPScan::Finders::ConfigBackups::KnownFilenames do describe '#aggressive' do before do expect(target).to receive(:sub_dir).at_least(1).and_return(false) - expect(target).to receive(:homepage_or_404?).at_least(1).and_return(false) + expect(target).to receive(:head_or_get_request_params).and_return(method: :head) finder.potential_urls(opts).each_key do |url| - stub_request(:get, url).to_return(status: 404) + stub_request(:head, url).to_return(status: 404) end end @@ -22,11 +22,12 @@ describe WPScan::Finders::ConfigBackups::KnownFilenames do end context 'when some files exist' do - let(:files) { ['%23wp-config.php%23', 'wp-config.bak'] } + let(:found_files) { ['%23wp-config.php%23', 'wp-config.bak'] } let(:config_backup) { File.read(fixtures.join('wp-config.php')) } before do - files.each do |file| + found_files.each do |file| + stub_request(:head, "#{url}#{file}").to_return(status: 200) stub_request(:get, "#{url}#{file}").to_return(body: config_backup) end end @@ -34,7 +35,7 @@ describe WPScan::Finders::ConfigBackups::KnownFilenames do it 'returns the expected Array' do expected = [] - files.each do |file| + found_files.each do |file| url = "#{target.url}#{file}" expected << WPScan::ConfigBackup.new( url,