Uses head or get method to enumerate config backups

This commit is contained in:
erwanlr
2019-03-22 20:35:22 +00:00
parent 231f5157bf
commit fa0582ce0b
2 changed files with 15 additions and 9 deletions

View File

@@ -3,7 +3,7 @@ module WPScan
module ConfigBackups
# Config Backup finder
class KnownFilenames < CMSScanner::Finders::Finder
include CMSScanner::Finders::Finder::Enumerator
include Finders::Finder::Enumerator
# @param [ Hash ] opts
# @option opts [ String ] :list
@@ -14,15 +14,20 @@ module WPScan
found = []
enumerate(potential_urls(opts), opts) do |res|
# Might need to improve that
next unless res.body =~ /define/i && res.body !~ /<\s?html/i
found << WPScan::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
end
found
end
def valid_response?(res, _exclude_content = nil)
return unless res.code == 200
full_res = Browser.get(res.effective_url)
full_res.body =~ /define/i && full_res.body !~ /<\s?html/i
end
# @param [ Hash ] opts
# @option opts [ String ] :list Mandatory
#