Bumps version

Fixes #1215
Updates deps
2018-09-28 10:57:21 +01:00 · 2018-09-28 10:33:19 +01:00 · 2018-09-28 09:20:14 +01:00 · 2018-09-26 20:49:13 +01:00 · 2018-09-26 21:17:43 +02:00 · 2018-09-26 21:17:02 +02:00
2122 changed files with 984259 additions and 21166 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,17 +5,11 @@ bundle/
 cache/
 coverage/
 spec/
-dev/
 .*
 **/*.md
 *.md
 Dockerfile
 **/*.orig
 *.orig
-CREDITS
-data.zip
-DISCLAIMER.txt
-example.conf.json
-bin/
-log.txt
-
+bin/wpscan-docker*
+.wpscan/
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -0,0 +1,5 @@
+# Contributing to WPScan
+
+## Licensing
+
+By submitting code contributions to the WPScan development team via Github Pull Requests, or any other method, it is understood that the contributor is offering the WPScan company (company number 	83421476900012), which is registered in France, the unlimited, non-exclusive right to reuse, modify, and relicense the code.
--- a/.github/ISSUE_TEMPLATE.md
+++ b/.github/ISSUE_TEMPLATE.md
@@ -0,0 +1,27 @@
+### Subject of the issue
+Describe your issue here.
+
+### Your environment
+* Version of WPScan:
+* Version of Ruby:
+* Operating System (OS):
+
+### Steps to reproduce
+Tell us how to reproduce this issue.
+
+### Expected behavior
+Tell us what should happen.
+
+### Actual behavior
+Tell us what happens instead.
+
+### What have you already tried
+Tell us what you have already tried to do to fix the issue you are having.
+
+Things you have tried (where relevant):
+
+* Update WPScan to the latest version [ ]
+* Update Ruby to the latest version [ ]
+* Ensure you can reach the target site using cURL [ ]
+* Proxied WPScan through a HTTP proxy to view the raw traffic [ ]
+* Ensure you are using a supported Operating System (Linux and macOS) [ ]
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,3 @@
+## Licensing
+
+By submitting code contributions to the WPScan development team via Github Pull Requests, or any other method, it is understood that the contributor is offering the WPScan company (company number 	83421476900012), which is registered in France, the unlimited, non-exclusive right to reuse, modify, and relicense the code.
--- a/.gitignore
+++ b/.gitignore
@@ -1,16 +1,14 @@
-.ash_history
-cache
-coverage
+*.gem
+*.rbc
 .bundle
-.DS_Store
-.DS_Store?
-*.sublime-*
-.idea
-.*.swp
-log.txt
+.config
+coverage
+pkg
+rdoc
+Gemfile.lock
+
+# YARD artifacts
 .yardoc
-debug.log
-wordlist.txt
-rspec_results.html
-data/
-vendor/
+_yardoc
+doc/
+.wpscan/
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -0,0 +1,28 @@
+AllCops:
+  TargetRubyVersion: 2.3
+  Exclude:
+  - '*.gemspec'
+  - 'vendor/**/*'
+ClassVars:
+  Enabled: false
+LineLength:
+  Max: 120
+MethodLength:
+  Max: 20
+Lint/UriEscapeUnescape:
+  Enabled: false
+Metrics/AbcSize:
+  Max: 25
+Metrics/BlockLength:
+  Exclude:
+  - 'spec/**/*'
+Metrics/ClassLength:
+  Max: 150
+Metrics/CyclomaticComplexity:
+  Max: 8
+Style/Documentation:
+  Enabled: false
+Style/FrozenStringLiteralComment:
+  Enabled: false
+Style/FormatStringToken:
+  Enabled: false
--- a/.ruby-gemset
+++ b/.ruby-gemset
@@ -1 +1 @@
-wpscan
+wpscanv3
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.4.1
+2.5.0
--- a/.simplecov
+++ b/.simplecov
@@ -1,8 +0,0 @@
-SimpleCov.start do
-  add_filter "/spec/"
-  add_filter "_helper.rb"
-  add_filter "environment.rb"
-  add_filter "_plugin.rb"
-  add_filter "hacks.rb"
-  add_filter "output.rb"
-end
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,30 +2,30 @@ language: ruby
 sudo: false
 cache: bundler
 rvm:
-  - 2.1.9
-  - 2.2.0
-  - 2.2.1
-  - 2.2.2
-  - 2.2.3
-  - 2.2.4
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
+  - 2.3.4
+  - 2.3.5
+  - 2.3.6
+  - 2.3.7
  - 2.4.1
+  - 2.4.2
+  - 2.4.3
+  - 2.4.4
+  - 2.5.0
+  - 2.5.1
+  - ruby-head
 before_install:
-  - "env"
  - "echo 'gem: --no-ri --no-rdoc' > ~/.gemrc"
-  - "gem install bundler"
-  - "bundler --version"
-before_script:
-  - "unzip -o $TRAVIS_BUILD_DIR/data.zip -d $TRAVIS_BUILD_DIR"
+  - "gem update --system"
+matrix:
+  allow_failures:
+    - rvm: ruby-head
 script:
-  - "bundle exec rspec"
+  - bundle exec rubocop
+  - bundle exec rspec
 notifications:
  email:
    - team@wpscan.org
-# do not build gh-pages branch
-branches:
-  except:
-    - gh-pages
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,558 +0,0 @@
-# Changelog
-## Master
-[Work in progress](https://github.com/wpscanteam/wpscan/compare/2.9.3...master)
-
-## Version 2.9.3
-Released: 2017-07-19
-
-* Updated dependencies and required ruby version
-* Made some changes so wpscan works in ruby 2.4
-* Added a Gemfile.lock to lock all dependencies
-* You can now pass a wordlist from stdin via "--wordlist -"
-* Improved version detection regexes
-* Added an optional paramter to --log to specify a filename
-
-WPScan Database Statistics:
-* Total tracked wordpresses: 251
-* Total tracked plugins: 68818
-* Total tracked themes: 15132
-* Total vulnerable wordpresses: 243
-* Total vulnerable plugins: 1527
-* Total vulnerable themes: 280
-* Total wordpress vulnerabilities: 5263
-* Total plugin vulnerabilities: 2406
-* Total theme vulnerabilities: 349
-
-## Version 2.9.2
-Released: 2016-11-15
-
-* Fixed error when detecting plugins with UTF-8 characters
-* Use all possible finders to verify a detected version
-* Fix error when detecting a WordPress version not in our database
-* Added some additional clarification on error messages
-* Upgrade terminal-table gem
-* Add --cache-dir option
-* Add --disable-tls-checks options
-* Improve/add additional plugin passive detections
-* Remove scripts when calculating page hashes
-* Many other small bug fixes.
-
-WPScan Database Statistics:
-* Total tracked wordpresses: 194
-* Total tracked plugins: 63703
-* Total tracked themes: 13835
-* Total vulnerable wordpresses: 177
-* Total vulnerable plugins: 1382
-* Total vulnerable themes: 379
-* Total wordpress vulnerabilities: 2617
-* Total plugin vulnerabilities: 2190
-* Total theme vulnerabilities: 452
-
-## Version 2.9.1
-Released: 2016-05-06
-
-* Update to Ruby 2.3.1, drop older ruby support
-* New data file location
-* Added experimental Windows support
-* Display WordPress metadata on the detected version
-* Several small fixes
-
-WPScan Database Statistics:
-* Total vulnerable versions: 156
-* Total vulnerable plugins:  1324
-* Total vulnerable themes:   376
-* Total version vulnerabilities: 1998
-* Total plugin vulnerabilities:  2057
-* Total theme vulnerabilities:   449
-
-## Version 2.9
-Released: 2015-10-15
-
-New
-* GZIP Encoding in updater
-* Adds --throttle option to throttle requests
-* Uses new API and local database file structure
-* Adds last updated and latest version to plugins and themes
-
-Removed
-* ArchAssault from README
-* APIv1 local databases
-
-General core
-* Update to Ruby 2.2.3
-* Use yajl-ruby as JSON parser
-* New dependancy for Ubuntu 14.04 (libgmp-dev)
-* Use Travis container based infra and caching
-
-Fixed issues
-* Fix #835 - Readme requests to wp root dir
-* Fix #836 - Critical icon output twice when the site is not running WP
-* Fix #839 - Terminal-table dependency is broken
-* Fix #841 - error: undefined method `cells' for #<Array:0x000000029cc2f8>
-* Fix #852 - GZIP Encoding in updater
-* Fix #853 - APIv2 integration
-* Fix #858 - Detection FP
-* Fix #873 - false positive "site has Must Use Plugins"
-
-WPScan Database Statistics:
-* Total vulnerable versions: 132
-* Total vulnerable plugins:  1170
-* Total vulnerable themes:   368
-* Total version vulnerabilities: 1476
-* Total plugin vulnerabilities:  1913
-* Total theme vulnerabilities:   450
-
-## Version 2.8
-Released: 2015-06-22
-
-New
-* Warn the user to update his DB files
-* Added last db update to --version option (see #815)
-* Add db checksum to verbose logging during update
-* Option to hide banner
-* Continue if user chooses not to update + db exists
-* Don't update if user chooses default + no DBs exist
-* Updates request timeout values to realistic ones (and in seconds)
-
-Removed
-* Removed `Time.parse('2000-01-01')` expedient
-* Removed unnecessary 'return' and '()'
-* Removed debug output
-* Removed wpstools
-
-General core
-* Update to Ruby 2.2.2
-* Switch to mitre
-* Install bundler gem README
-* Switch from gnutls to openssl
-
-Fixed issues
-* Fix #789 - Add blackarch to readme
-* Fix #790 - Consider the target down after 30 requests timed out requests instead of 10
-* Fix #791 - Rogue character causing the scan of non-wordpress site to crash
-* Fix #792 - Adds the HttpError exception
-* Fix #795 - Remove GHOST warning
-* Fix #796 - Do not swallow exit code
-* Fix #797 - Increases the timeout values
-* Fix #801 - Forces UTF-8 encoding when enumerating usernames
-* Fix #803 - Increases default connect-timeout to 10s
-* Fix #804 - Updates the Theme detection pattern
-* Fix #816 - Ignores potential non version chars in theme version detection
-* Fix #819 - Removes potential spaces in robots.txt entries
-
-WPScan Database Statistics:
-* Total vulnerable versions: 98
-* Total vulnerable plugins:  1076
-* Total vulnerable themes:   361
-* Total version vulnerabilities: 1104
-* Total plugin vulnerabilities:  1763
-* Total theme vulnerabilities:   443
-
-## Version 2.7
-Released: 2015-03-16
-
-New
-* Detects version in release date format
-* Copyrights updated
-* WP version detection from stylesheets
-* New license
-* Global HTTP request counter
-* Add security-protection plugin detection
-* Add GHOST warning if XMLRPC enabled
-* Update databases from wpvulndb.com
-* Enumerate usernames from WP <= 3.0 (thanks berotti3)
-
-Removed
-* README.txt
-
-General core
-* Update to Ruby 2.2.1
-* Update to Ruby 2.2.0
-* Add addressable gem
-* Update Typhoeus gem to 0.7.0
-* IDN support: encode non-ascii domain names (thanks dctabuyz)
-* Improve page hash calculation (thanks dctabuyz)
-* Version detection regex improved
-
-Fixed issues
-* Fix #745 - Plugin version pattern in readme.txt file not detected
-* Fix #746 - Add a global counter for all active requests to server.
-* Fix #747 - Add 'security-protection' plugin to wp_login_protection module
-* Fix #753 - undefined method `round' for "10":String for request or connect timeouts
-* Fix #760 - typhoeus issue (infinite loop)
-
-WPScan Database Statistics:
-* Total vulnerable versions: 89
-* Total vulnerable plugins:  953
-* Total vulnerable themes:   329
-* Total version vulnerabilities: 1070
-* Total plugin vulnerabilities:  1451
-* Total theme vulnerabilities:   378
-
-## Version 2.6
-Released: 2014-12-19
-
-New
-* Updates the readmes to reflect the new --usernames option
-* Improves plugin/theme version detection by looking at the "Version:"
-* Solution to avoid mandatory blank newline at the end of the wordlist
-* Add check for valid credentials
-* Add Sucuri sponsor to banner
-* Add protocol to sucuri url in banner
-* Add response code to proxy error output
-* Add a statement about mandatory newlines at the end of list
-* Give warning if default username 'admin' is still used
-* License amendment to make it more clear about value added usage
-
-Removed
-* remove malwares
-* remove malware folder
-* Removes the theme version check from the readme, unrealistic scenario
-
-General core
-* Update to Ruby 2.1.5 and travis
-* Prevent parent theme infinite loop
-* Fixes the progressbar being overriden by next brute forcing attempts
-
-Fixed issues
-* Fix UTF-8 encode on security db file download
-* Fix #703 - Disable logging by default. Implement log option.
-* Fix #705 - Installation instructions for Ubuntu < 14.04 apparently incomplete
-* Fix #717 - Expand on readme.html finding output
-* Fix #716 - Adds the --version in the help
-* Fix #715 - Add new updating info to docs
-* Fix #727 - WpItems detection: Perform the passive check and filter only vulnerable results at the end if required
-* Fix #737 - Adds some readme files to check for plugin versions
-* Fix #739 - Adds the --usernames option
-
-WPScan Database Statistics:
-* Total vulnerable versions: 88
-* Total vulnerable plugins: 901
-* Total vulnerable themes: 313
-* Total version vulnerabilities: 1050
-* Total plugin vulnerabilities: 1355
-* Total theme vulnerabilities: 349
-
-## Version 2.5.1
-Released: 2014-09-29
-
-Fixes reference URL to WPVDB
-
-## Version 2.5
-Released: 2014-09-26 (@ BruCON 2014)
-
-New
-* Exit program after --update
-* Detect directory listing in upload folder
-* Be more verbose when no version can be detected
-* Added detection for Yoast Wordpress SEO plugin
-* Also ensure to not process empty Location headers
-* Ensures a nil location is not processed when enumerating usernames
-* Fix #626 - Detect 'Must_Use_Plugins'
-* better username extraction
-* Add a --cookie option. Ref #485
-* Add a --no-color option
-* Output: Give 'Fixed in' an informational tag
-* Added ArchAssault distro - WPScan comes pre-installed with this distro
-* Layout changes with new colors
-
-Removed
-* Removes the source code updaters
-* Removes the ListGenerator plugin from WPStools
-* Removes all files from data/
-
-General core
-* Update docs to reflect new updating logic
-* Little output change and coloring
-* Adds a missing verbose output
-* Re-build redirection url if begin with slash '/'
-* Fixes the remove_conditional_comments function
-* Ensures to give a string to Typhoeus
-* Fix wpstools check-vuln-ref-urls
-* Fix rspecs for new json
-* Only output if different from style_url
-* Add exception so 'ruby wpscan.rb http://domain.com' is detected
-* Added make to Debian installation, which is needed in minimal installation.
-* Add build-essentials requirement to Ubuntu > 14.04
-* Updated installation instr. for GNU/Linux Debian.
-* Changes VersionCompare#is_newer_or_same? by lesser_or_equal?
-* Fixes the location of the robots.txt check
-* Updates the recommended ruby version
-* Rspec 3.0 support
-* Adds ruby 2.1.2 to Travis
-* Updated ruby-progressbar to 1.5.0
-
-WordPress Fingerprints
-* Adds WP 4.0 fingerprints
-* Adds WP 3.9.2, 3.8.4 & 3.7.4 fingerprints - Ref #652
-* Adds 3.9.1 fingerprints
-
-Fixed issues
-* Fix #689 - Adds config file to check
-* Fix #694 - Output Arrays
-* Fix #693 - Adds pathname require statement
-* Fix #657 - generate method
-* Fix #685 - Potenial fix for 'marshal data too short' error
-* Fix #686 - Adds specs for relative URI in Location headers
-* Fix #435 - Update license
-* Fix #674 - Improves the Plugins & Themes passive detection
-* Fix #673 - Problem with the output
-* Fix #661 - Don't hash directories named like a file
-* Fix #653 - Fix for infinite loop in wpstools
-* Fix #625 - Only parse styles when needed
-* Fix #481 - Fix for Jetpack plugin false positive
-* Fix #480 - Properly removes the colour sequence from log
-* Fix #472 - WPScan stops after redirection if not WordPress website
-* Fix #464 - Readmes updated to reflect recent changes about the config file & batch mode
-
-Vulnerabilities
-* geoplaces4 also uses name GeoPlaces4beta
-* Added metasploit module's
-* Added some timthumb detections
-
-WPScan Database Statistics:
-* Total vulnerable versions: 87
-* Total vulnerable plugins: 854
-* Total vulnerable themes: 303
-* Total version vulnerabilities: 752
-* Total plugin vulnerabilities: 1351
-* Total theme vulnerabilities: 345
-
-## Version 2.4
-Released: 2014-04-17
-
-New
-* '--batch' switch option added - Fix #454
-* Add random-agent
-* Added more CLI options
-* Switch over to nist - Fix #301
-* New choice added when a redirection is detected - Fix #438
-
-Removed
-* Removed 'Total WordPress Sites in the World' counter from stats
-* Old wpscan repo links removed - Fix #440
-* Fingerprinting Dev script removed
-* Useless code removed
-
-General core
-* Rspecs update
-* Forcing Travis notify the team
-* Ruby 2.1.1 added to Travis
-* Equal output layout for interaction questions
-* Only output error trace if verbose if enabled
-* Memory improvements during wp-items enumerations
-* Fixed broken link checker, fixed some broken links
-* Couple more 404s fixed
-* Themes & Plugins list updated
-
-WordPress Fingerprints
-* WP 3.8.2 & 3.7.2 Fingerprints added - Fix #448
-* WP 3.8.3 & 3.7.3 fingerprints
-* WP 3.9 fingerprints
-
-Fixed issues
-* Fix #380 - Redirects in WP 3.6-3.0
-* Fix #413 - Check the version of the Timthumbs files found
-* Fix #429 - Error WpScan Cache Browser
-* Fix #431 - Version number comparison between '2.3.3' and '0.42b'
-* Fix #439 - Detect if the target goes down during the scan
-* Fix #451 - Do not rely only on files in wp-content for fingerprinting
-* Fix #453 - Documentation or inplemention of option parameters
-* Fix #455 - Fails with a message if the target returns a 403 during the wordpress check
-
-Vulnerabilities
-* Update WordPress Vulnerabilities
-* Fixed some duplicate vulnerabilities
-
-WPScan Database Statistics:
-* Total vulnerable versions: 79; 1 is new
-* Total vulnerable plugins: 748; 55 are new
-* Total vulnerable themes: 292; 41 are new
-* Total version vulnerabilities: 617; 326 are new
-* Total plugin vulnerabilities: 1162; 146 are new
-* Total theme vulnerabilities: 330; 47 are new
-
-## Version 2.3
-Released: 2014-02-11
-
-New
-* Brute forcing over https!
-* Detect and output parent theme!
-* Complete fingerprint script & hash search
-* New spell checker!
-* Added database modification dates in status report
-* Added 'Total WordPress Sites in the World' statistics
-* Added separator between Name and Version in Item
-* Added a "Work in progress" URL in the CHANGELOG
-
-Removed
-* Removed "Exiting!" sentence
-* Removed Backtrack Linux. Not maintained anymore.
-
-General core
-* Ruby 2.1.0 added to Travis
-* Updated the version of WebMock required
-* Better string concatenation in code (improves speed)
-* Some modifications in the output of an item
-* Output cosmetics
-* rspec-mocks version constraint released
-* Tabs replaced by spaces
-* Rspecs update
-* Indent code cleanup
-* Themes & Plugins lists regenerated
-
-Vulnerabilities
-* Update WordPress Vulnerabilities
-* Disabled some fake reported vulnerabilities
-* Fixed some duplicate vulnerabilities
-
-WPScan Database Statistics:
-* Total vulnerable versions: 78; 2 are new
-* Total vulnerable plugins: 693; 83 are new
-* Total vulnerable themes: 251; 55 are new
-* Total version vulnerabilities: 291 17 are new
-* Total plugin vulnerabilities: 1016; 236 are new
-* Total theme vulnerabilities: 283; 79 are new
-
-WordPress Fingerprints
-* Better fingerprints
-* WP 3.8.1 Fingerprinting
-* WP 3.8 Fingerprinting
-
-Fixed issues
-* Fix #404 - Brute forcing issue over https
-* Fix #398 - Removed a fake vuln in WP Super Cache
-* Fix #393 - sudo added to the bundle install cmd for Mac OSX
-* Fix #228, #327 - Infinite loop when self-redirect
-* Fix #201 - Incorrect Paramter Parsing when no url was supplied
-
-## Version 2.2
-Released: 2013-11-12
-
-New
-* Output the vulnerability fix if available
-* Added 'WordPress Version Vulnerability' statistics
-* Added Kali Linux on the list of pre-installed Linux distributions
-* Added hosted wordpress detection. See issue #343.
-* Add detection for all-in-one-seo-pack
-* Use less memory when brute forcing with a large wordlist
-* Memory Usage output
-* Added cve tag to xml file
-* Add documentation to readme
-* Add --version switch
-* Parse robots.txt
-* Show twitter usernames
-* Clean logfile on wpstools too
-* Added pingback header
-* Request_timeout and connect_timeout implemented
-* Output interesting http-headers
-* Kali Linux detection
-* Ensure that brute forcing results are output even if an error occurs or the user exits
-* Added debug output
-* Fixed Version compare for issue #179
-* Added ruby-progressbar version to Gemfile
-* Use the redirect_to parameter on bruteforce
-* Readded "junk removal" from usernames before output
-* Add license file
-* Output the timthumb version if found
-* New enumeration system
-* More error details for XSD checks
-* Added default wp-content dir detection, see Issue #141.
-* Added checks for well formed xml
-
-Changed
-* Trying a fix for Kali Linux
-* Make a seperator between plugin name and vulnerability name
-* It's WordPress, not Wordpress
-* Changed wordpress.com scanning error to warning. See issue #343.
-* Make output lines consistent
-* Replace packetstormsecurity.org to packetstormsecurity.com
-* Same URL syntax for all Packet Storm Security URL's
-* Packet Storm Security URL's don't need the 'friendly part' of the URL. So it can be neglected.
-* Use online documentation
-* User prompt on same line
-* Don't skip passwords that start with a hash. This is fairly common (see RockYou list for example).
-* Updated Fedora install instructions as per Issue #92
-* Slight update to security plugin warning. Issue #212.
-* Ruby-progressbar Gemfile version bump
-* Fix error with the -U option (undefined method 'merge' for #WpTarget:)
-* Banner artwork
-* Fix hacks.rb conflict
-* Handle when there are 2 headers of the same name
-* Releasing the Typhoeus version constraint
-* Amended Arch Linux install instructions. See issue #183.
-
-Updated
-* Plugins & Themes updated
-* Update README.md
-* Updated documentation
-
-Removed
-* Removed 'smileys' in output messages
-* Removed 'for WordPress' and 'plugin' in title strings.
-* Removed reference
-* Removed useless code
-* Removed duplicate vulnerabilities
-
-General core
-* Code cleaning
-* Fix typo's
-* Clean up rspecs
-* Themes & Plugins lists regenerated
-* Rspecs update
-* Code Factoring
-* Added checks for old ruby. Otherwise there will be syntax errors
-
-Vulnerabilities
-* Update WordPress Vulnerabilities
-* Update timthumb due to Secunia #54801
-* Added WP vuln: 3.4 - 3.5.1 wp-admin/users.php FPD
-
-WPScan Database Statistics:
-* Total vulnerable versions: 76; 4 are new
-* Total vulnerable plugins: 610; 201 are new
-* Total vulnerable themes: 196; 47 are new
-* Total version vulnerabilities: 274; 53 are new
-* Total plugin vulnerabilities: 780; 286 are new
-* Total theme vulnerabilities: 204; 52 are new
-
-Add WP Fingerprints
-* WP 3.7.1 Fingerprinting
-* WP 3.7 Fingerprinting
-* Ref #280 WP 3.6.1 fingerprint
-* Added WP 3.6 advanced fingerprint hash. See Issue #255.
-* Updated MD5 hash of WP 3.6 detection. See Issue #277.
-* WP 3.5.2 Fingerprint
-* Bug Fix : Wp 3.5 & 3.5.1 not detected from advanced fingerprinting.
-
-Fixed issues
-* Fix #249 - [ERROR] "\xF1" on US-ASCII
-* Fix #275 - [ERROR] "\xC3" on US-ASCII
-* Fix #271 - Further Instructions added to the Mac Install
-* Fix #266 - passive detection regex
-* Fix #265 - remove base64 images before passive detection
-* Fix #262 - [ERROR] bad component(expected absolute path component)
-* Fix #260 - Fixes Travis Fail, due to rspec-mock v2.14.3
-* Fix #208 - Fixed vulnerable plugins still appear in the results
-* Fix #245 - all theme enumeration error
-* Fix #241 - Cant convert array to string
-* Fix #232 - Crash while enumerating usernames
-* Fix #223 - New wordpress urls for most popular plugins & themes
-* Fix #177 - Passive Cache plugins detection (no spec)
-* Fix #169 - False reports
-* Fix #182 - Remove the progress-bar static length (120), and let it to automatic
-* Fix #181 - Don't exit if no usernames found during a simple enumeration (but exit if a brute force is asked)
-* Fix #200 - Log file not recording the list of username retireved
-* Fix #164 - README.txt detection
-* Fix #166 - ListGenerator using the old Browser#get method for full generation
-* Fix #153 - Disable error trace when it's from the main script
-* Fix #163 - in the proper way
-* Fix #144 - Use cookie jar to prevent infinite redirections loop
-* Fix #158 - Add the solution to 'no such file to load -- rubygems' in the README
-* Fix #152 - invalid ssl_certificate - response code 0
-* Fix #147 - can't modify frozen string
-* Fix #140 - xml_rpc_url in the body
-* Fix #153 - No error trace when 'No argument supplied'
-
-## Version 2.1
-Released 2013-3-4
--- a/21
+++ b/21
@@ -1,21 +0,0 @@
-**CREDITS**
-
-This file is used to state the individual WPScan Team members (core developers) and give credit to WPScan's other contributors. If you feel your name should be in here email team@wpscan.org.
-
-*WPScan Team*
-
-Erwan.LR - @erwan_lr - (Project Developer)
-Christian Mehlmauer - @_FireFart_ - (Project Developer)
-Peter van der Laan - pvdl - (Project Developer)
-Ryan Dewhurst - @ethicalhack3r (Project Lead)
-
-*Other Contributors*
-
-Henri Salo AKA fgeek - Reported lots of vulnerabilities
-Alip AKA Undead - alip.aswalid at gmail.com
-michee08 - Reported and gave potential solutions to bugs
-Callum Pember - Implemented proxy support - callumpember at gmail.com
-g0tmi1k - Additional timthumb checks + bug reports
-Melvin Lammerts - Reported a couple of fake vulnerabilities - melvin at 12k.nl
-Paolo Perego - @thesp0nge - Basic authentication
-Gianluca Brindisi - @gbrindisi - Ex Project Developer
--- a/DISCLAIMER.txt
+++ b/DISCLAIMER.txt
@@ -1,2 +0,0 @@
-WPScan is not responsible for misuse or for any damage that you may cause!
-You agree that you use this software at your own risk.
--- a/30
+++ b/30
@@ -1,29 +1,27 @@
-FROM ruby:2.4-alpine
+FROM ruby:2.5-alpine
 MAINTAINER WPScan Team <team@wpscan.org>

-ARG BUNDLER_ARGS="--jobs=8 --without test"
+ARG BUNDLER_ARGS="--jobs=8 --without test development"

 RUN adduser -h /wpscan -g WPScan -D wpscan
 RUN echo "gem: --no-ri --no-rdoc" > /etc/gemrc

-COPY Gemfile /wpscan
-COPY Gemfile.lock /wpscan
-
-# runtime dependencies
-RUN apk add --no-cache libcurl procps && \
-  # build dependencies
-  apk add --no-cache --virtual build-deps alpine-sdk ruby-dev libffi-dev zlib-dev && \
-  bundle install --system --gemfile=/wpscan/Gemfile $BUNDLER_ARGS && \
-  apk del --no-cache build-deps
-
 COPY . /wpscan
 RUN chown -R wpscan:wpscan /wpscan

-USER wpscan
-
-RUN /wpscan/wpscan.rb --update --verbose --no-color
+# runtime dependencies
+RUN apk add --no-cache libcurl procps sqlite-libs && \
+  # build dependencies
+  apk add --no-cache --virtual build-deps git libcurl ruby-dev libffi-dev make gcc musl-dev zlib-dev procps sqlite-dev && \
+  bundle install --system --gemfile=/wpscan/Gemfile $BUNDLER_ARGS && \
+  apk del --no-cache build-deps

 WORKDIR /wpscan
+RUN rake install --trace

-ENTRYPOINT ["/wpscan/wpscan.rb"]
+USER wpscan
+RUN /usr/local/bundle/bin/wpscan --update --verbose
+
+ENTRYPOINT ["/usr/local/bundle/bin/wpscan"]
 CMD ["--help"]
+
--- a/15
+++ b/15
@@ -1,15 +1,2 @@
 source 'https://rubygems.org'
-
-gem 'typhoeus', '>=1.1.2'
-gem 'nokogiri', '>=1.7.0.1'
-gem 'addressable', '>=2.5.0'
-gem 'yajl-ruby', '>=1.3.0' # Better JSON parser regarding memory usage
-gem 'terminal-table', '>=1.6.0'
-gem 'ruby-progressbar', '>=1.8.1'
-
-group :test do
-  gem 'webmock', '>=2.3.2'
-  gem 'simplecov', '>=0.13.0'
-  gem 'rspec', '>=3.5.0'
-  gem 'rspec-its', '>=1.2.0'
-end
+gemspec
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,69 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    addressable (2.5.1)
-      public_suffix (~> 2.0, >= 2.0.2)
-    crack (0.4.3)
-      safe_yaml (~> 1.0.0)
-    diff-lcs (1.3)
-    docile (1.1.5)
-    ethon (0.10.1)
-      ffi (>= 1.3.0)
-    ffi (1.9.18)
-    hashdiff (0.3.4)
-    json (2.1.0)
-    mini_portile2 (2.2.0)
-    nokogiri (1.8.0)
-      mini_portile2 (~> 2.2.0)
-    public_suffix (2.0.5)
-    rspec (3.6.0)
-      rspec-core (~> 3.6.0)
-      rspec-expectations (~> 3.6.0)
-      rspec-mocks (~> 3.6.0)
-    rspec-core (3.6.0)
-      rspec-support (~> 3.6.0)
-    rspec-expectations (3.6.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.6.0)
-    rspec-its (1.2.0)
-      rspec-core (>= 3.0.0)
-      rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.6.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.6.0)
-    rspec-support (3.6.0)
-    ruby-progressbar (1.8.1)
-    safe_yaml (1.0.4)
-    simplecov (0.14.1)
-      docile (~> 1.1.0)
-      json (>= 1.8, < 3)
-      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.1)
-    terminal-table (1.8.0)
-      unicode-display_width (~> 1.1, >= 1.1.1)
-    typhoeus (1.1.2)
-      ethon (>= 0.9.0)
-    unicode-display_width (1.3.0)
-    webmock (3.0.1)
-      addressable (>= 2.3.6)
-      crack (>= 0.3.2)
-      hashdiff
-    yajl-ruby (1.3.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  addressable (>= 2.5.0)
-  nokogiri (>= 1.7.0.1)
-  rspec (>= 3.5.0)
-  rspec-its (>= 1.2.0)
-  ruby-progressbar (>= 1.8.1)
-  simplecov (>= 0.13.0)
-  terminal-table (>= 1.6.0)
-  typhoeus (>= 1.1.2)
-  webmock (>= 2.3.2)
-  yajl-ruby (>= 1.3.0)
-
-BUNDLED WITH
-   1.14.6
--- a/2
+++ b/2
@@ -1,6 +1,6 @@
 WPScan Public Source License

-The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2016 WPScan Team.
+The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2018 WPScan Team.

 Cases that include commercialization of WPScan require a commercial, non-free license. Otherwise, WPScan can be used without charge under the terms set out below.

--- a/README.md
+++ b/README.md
@@ -1,16 +1,87 @@
 ![alt text](https://raw.githubusercontent.com/wpscanteam/wpscan/gh-pages/wpscan_logo_407x80.png "WPScan - WordPress Security Scanner")

-
+[![Gem Version](https://badge.fury.io/rb/wpscan.svg)](https://badge.fury.io/rb/wpscan)
 [![Build Status](https://travis-ci.org/wpscanteam/wpscan.svg?branch=master)](https://travis-ci.org/wpscanteam/wpscan)
-[![Code Climate](https://img.shields.io/codeclimate/github/wpscanteam/wpscan.svg)](https://codeclimate.com/github/wpscanteam/wpscan)
-[![Dependency Status](https://img.shields.io/gemnasium/wpscanteam/wpscan.svg)](https://gemnasium.com/wpscanteam/wpscan)
-[![Docker Pulls](https://img.shields.io/docker/pulls/wpscanteam/wpscan.svg)](https://hub.docker.com/r/wpscanteam/wpscan/)
+[![Code Climate](https://codeclimate.com/github/wpscanteam/wpscan/badges/gpa.svg)](https://codeclimate.com/github/wpscanteam/wpscan)
+[![Patreon Donate](https://img.shields.io/badge/patreon-donate-green.svg)](https://www.patreon.com/wpscan)
+
+# INSTALL
+
+## Prerequisites:
+
+- Ruby >= 2.2.2 - Recommended: 2.3.3
+- Curl >= 7.21  - Recommended: latest - FYI the 7.29 has a segfault
+- RubyGems      - Recommended: latest
+
+### From RubyGems:
+
+```
+gem install wpscan
+```
+
+### From sources:
+
+Prerequisites: Git
+
+```
+git clone https://github.com/wpscanteam/wpscan
+
+cd wpscan/
+
+bundle install && rake install
+```
+
+# Docker
+
+Pull the repo with ```docker pull wpscanteam/wpscan```
+
+# Usage
+
+```wpscan --url blog.tld``` This will scan the blog using default options with a good compromise between speed and accuracy. For example, the plugins will be checked passively but their version with a mixed detection mode (passively + aggressively). Potential config backup files will also be checked, along with other interesting findings. If a more stealthy approach is required, then ```wpscan --stealthy --url blog.tld``` can be used.
+As a result, when using the ```--enumerate``` option, don't forget to set the ```--plugins-detection``` accordingly, as its default is 'passive'.
+
+For more options, open a terminal and type ```wpscan --help``` (if you built wpscan from the source, you should type the command outside of the git repo)
+
+The DB is located at ~/.wpscan/db
+
+WPScan can load all options (including the --url) from configuration files, the following locations are checked (order: first to last):
+
+* ~/.wpscan/cli_options.json
+* ~/.wpscan/cli_options.yml
+* pwd/.wpscan/cli_options.json
+* pwd/.wpscan/cli_options.yml
+
+If those files exist, options from them will be loaded and overridden if found twice.
+
+e.g:
+
+~/.wpscan/cli_options.yml:
+```
+proxy: 'http://127.0.0.1:8080'
+verbose: true
+```
+
+pwd/.wpscan/cli_options.yml:
+```
+proxy: 'socks5://127.0.0.1:9090'
+url: 'http://target.tld'
+```
+
+Running ```wpscan``` in the current directory (pwd), is the same as ```wpscan -v --proxy socks5://127.0.0.1:9090 --url http://target.tld```
+
+# PROJECT HOME
+
+[https://wpscan.org](https://wpscan.org)
+
+# VULNERABILITY DATABASE
+
+[https://wpvulndb.com](https://wpvulndb.com)

 # LICENSE

 ## WPScan Public Source License

-The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2016 WPScan Team.
+The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2018 WPScan Team.

 Cases that include commercialization of WPScan require a commercial, non-free license. Otherwise, WPScan can be used without charge under the terms set out below.

@@ -84,264 +155,3 @@ Running WPScan against websites without prior mutual consent may be illegal in y
 ### 11. Trademark

 The "wpscan" term is a registered trademark. This License does not grant the use of the "wpscan" trademark or the use of the WPScan logo.
-
-# INSTALL
-
-WPScan comes pre-installed on the following Linux distributions:
-
- [BackBox Linux](http://www.backbox.org/)
- [Kali Linux](http://www.kali.org/)
- [Pentoo](http://www.pentoo.ch/)
- [SamuraiWTF](http://samurai.inguardians.com/)
- [BlackArch](http://blackarch.org/)
-
-On macOS WPScan is packaged by [Homebrew](https://brew.sh/) as [`wpscan`](http://braumeister.org/formula/wpscan).
-
-Windows is not supported
-
-We suggest you use our official Docker image from https://hub.docker.com/r/wpscanteam/wpscan/ to avoid installation problems.
-
-# DOCKER
-Pull the repo with `docker pull wpscanteam/wpscan`
-
-## Start WPScan
-
-```
-docker run -it --rm wpscanteam/wpscan -u https://yourblog.com [options]
-```
-
-For the available Options, please see https://github.com/wpscanteam/wpscan#wpscan-arguments
-
-If you run the git version of wpscan we included some binstubs in ./bin for easier start of wpscan.
-
-## Examples
-
-Mount a local wordlist to the docker container and start a bruteforce attack for user admin
-
-```
-docker run -it --rm -v ~/wordlists:/wordlists wpscanteam/wpscan --url https://yourblog.com --wordlist /wordlists/crackstation.txt --username admin
-```
-
-Use logfile option
-```
-# the file must exist prior to starting the container, otherwise docker will create a directory with the filename
-touch ~/FILENAME
-docker run -it --rm -v ~/FILENAME:/wpscan/output.txt wpscanteam/wpscan --url https://yourblog.com --log /wpscan/output.txt
-```
-
-(This mounts the host directory `~/wordlists` to the container in the path `/wordlists`)
-
-Published on https://hub.docker.com/r/wpscanteam/wpscan/
-
-# Manual install
-
-## Prerequisites
-
- Ruby >= 2.1.9 - Recommended: 2.4.1
- Curl >= 7.21  - Recommended: latest - FYI the 7.29 has a segfault
- RubyGems      - Recommended: latest
- Git
-
-### Installing dependencies on Ubuntu
-
-    sudo apt-get install libcurl4-openssl-dev libxml2 libxml2-dev libxslt1-dev ruby-dev build-essential libgmp-dev zlib1g-dev
-
-### Installing dependencies on Debian
-
-    sudo apt-get install gcc git ruby ruby-dev libcurl4-openssl-dev make zlib1g-dev
-
-### Installing dependencies on Fedora
-
-    sudo dnf install gcc ruby-devel libxml2 libxml2-devel libxslt libxslt-devel libcurl-devel patch rpm-build
-
-### Installing dependencies on Arch Linux
-
-    pacman -Syu ruby
-    pacman -Syu libyaml
-
-### Installing dependencies on macOS
-
-Apple Xcode, Command Line Tools and the libffi are needed (to be able to install the FFI gem), See [http://stackoverflow.com/questions/17775115/cant-setup-ruby-environment-installing-fii-gem-error](http://stackoverflow.com/questions/17775115/cant-setup-ruby-environment-installing-fii-gem-error)
-
-## Installing with RVM (recommended when doing a manual install)
-
-If you are using GNOME Terminal, there are some steps required before executing the commands. See here for more information:
-https://rvm.io/integration/gnome-terminal#integrating-rvm-with-gnome-terminal
-
-    # Install all prerequisites for your OS (look above)
-    cd ~
-    curl -sSL https://rvm.io/mpapis.asc | gpg --import -
-    curl -sSL https://get.rvm.io | bash -s stable
-    source ~/.rvm/scripts/rvm
-    echo "source ~/.rvm/scripts/rvm" >> ~/.bashrc
-    rvm install 2.4.1
-    rvm use 2.4.1 --default
-    echo "gem: --no-ri --no-rdoc" > ~/.gemrc
-    git clone https://github.com/wpscanteam/wpscan.git
-    cd wpscan
-    gem install bundler
-    bundle install --without test
-
-## Installing manually (not recommended)
-
-    git clone https://github.com/wpscanteam/wpscan.git
-    cd wpscan
-    sudo gem install bundler && bundle install --without test
-
-# KNOWN ISSUES
-
-  - Typhoeus segmentation fault
-
-      Update cURL to version => 7.21 (may have to install from source)
-
-  - Proxy not working
-
-      Update cURL to version => 7.21.7 (may have to install from source).
-
-      Installation from sources :
-
-        Grab the sources from http://curl.haxx.se/download.html
-        Decompress the archive
-        Open the folder with the extracted files
-        Run ./configure
-        Run make
-        Run sudo make install
-        Run sudo ldconfig
-
-
-  - cannot load such file -- readline:
-
-        sudo aptitude install libreadline5-dev libncurses5-dev
-
-      Then, open the directory of the readline gem (you have to locate it)
-
-        cd ~/.rvm/src/ruby-XXXX/ext/readline
-        ruby extconf.rb
-        make
-        make install
-
-
-      See [http://vvv.tobiassjosten.net/ruby-on-rails/fixing-readline-for-the-ruby-on-rails-console/](http://vvv.tobiassjosten.net/ruby-on-rails/fixing-readline-for-the-ruby-on-rails-console/) for more details
-
-  - no such file to load -- rubygems
-
-      ```update-alternatives --config ruby```
-
-      And select your ruby version
-
-      See [https://github.com/wpscanteam/wpscan/issues/148](https://github.com/wpscanteam/wpscan/issues/148)
-
-# WPSCAN ARGUMENTS
-
-    --update                            Update the database to the latest version.
-    --url       | -u <target url>       The WordPress URL/domain to scan.
-    --force     | -f                    Forces WPScan to not check if the remote site is running WordPress.
-    --enumerate | -e [option(s)]        Enumeration.
-      option :
-        u        usernames from id 1 to 10
-        u[10-20] usernames from id 10 to 20 (you must write [] chars)
-        p        plugins
-        vp       only vulnerable plugins
-        ap       all plugins (can take a long time)
-        tt       timthumbs
-        t        themes
-        vt       only vulnerable themes
-        at       all themes (can take a long time)
-      Multiple values are allowed : "-e tt,p" will enumerate timthumbs and plugins
-      If no option is supplied, the default is "vt,tt,u,vp"
-
-    --exclude-content-based "<regexp or string>"
-                                        Used with the enumeration option, will exclude all occurrences based on the regexp or string supplied.
-                                        You do not need to provide the regexp delimiters, but you must write the quotes (simple or double).
-    --config-file  | -c <config file>   Use the specified config file, see the example.conf.json.
-    --user-agent   | -a <User-Agent>    Use the specified User-Agent.
-    --cookie <string>                   String to read cookies from.
-    --random-agent | -r                 Use a random User-Agent.
-    --follow-redirection                If the target url has a redirection, it will be followed without asking if you wanted to do so or not
-    --batch                             Never ask for user input, use the default behaviour.
-    --no-color                          Do not use colors in the output.
-    --log [filename]                    Creates a log.txt file with WPScan's output if no filename is supplied. Otherwise the filename is used for logging.
-    --no-banner                         Prevents the WPScan banner from being displayed.
-    --disable-accept-header             Prevents WPScan sending the Accept HTTP header.
-    --disable-referer                   Prevents setting the Referer header.
-    --disable-tls-checks                Disables SSL/TLS certificate verification.
-    --wp-content-dir <wp content dir>   WPScan try to find the content directory (ie wp-content) by scanning the index page, however you can specify it.
-                                        Subdirectories are allowed.
-    --wp-plugins-dir <wp plugins dir>   Same thing than --wp-content-dir but for the plugins directory.
-                                        If not supplied, WPScan will use wp-content-dir/plugins. Subdirectories are allowed
-    --proxy <[protocol://]host:port>    Supply a proxy. HTTP, SOCKS4 SOCKS4A and SOCKS5 are supported.
-                                        If no protocol is given (format host:port), HTTP will be used.
-    --proxy-auth <username:password>    Supply the proxy login credentials.
-    --basic-auth <username:password>    Set the HTTP Basic authentication.
-    --wordlist | -w <wordlist>          Supply a wordlist for the password brute forcer.
-                                        If the "-" option is supplied, the wordlist is expected via STDIN.
-    --username | -U <username>          Only brute force the supplied username.
-    --usernames     <path-to-file>      Only brute force the usernames from the file.
-    --cache-dir       <cache-directory> Set the cache directory.
-    --cache-ttl       <cache-ttl>       Typhoeus cache TTL.
-    --request-timeout <request-timeout> Request Timeout.
-    --connect-timeout <connect-timeout> Connect Timeout.
-    --threads  | -t <number of threads> The number of threads to use when multi-threading requests.
-    --max-threads     <max-threads>     Maximum Threads.
-    --throttle        <milliseconds>    Milliseconds to wait before doing another web request. If used, the --threads should be set to 1.
-    --help     | -h                     This help screen.
-    --verbose  | -v                     Verbose output.
-    --version                           Output the current version and exit.
-
-# WPSCAN EXAMPLES
-
-Do 'non-intrusive' checks...
-
-```ruby wpscan.rb --url www.example.com```
-
-Do wordlist password brute force on enumerated users using 50 threads...
-
-```ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --threads 50```
-
-Do wordlist password brute force on enumerated users using STDIN as the wordlist...
-
-```crunch 5 13 -f charset.lst mixalpha | ruby wpscan.rb --url www.example.com --wordlist -```
-
-Do wordlist password brute force on the 'admin' username only...
-
-```ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --username admin```
-
-Enumerate installed plugins...
-
-```ruby wpscan.rb --url www.example.com --enumerate p```
-
-Run all enumeration tools...
-
-```ruby wpscan.rb --url www.example.com --enumerate```
-
-Use custom content directory...
-
-```ruby wpscan.rb -u www.example.com --wp-content-dir custom-content```
-
-Update WPScan's databases...
-
-```ruby wpscan.rb --update```
-
-Debug output...
-
-```ruby wpscan.rb --url www.example.com --debug-output 2>debug.log```
-
-# PROJECT HOME
-
-[http://www.wpscan.org](http://www.wpscan.org)
-
-# VULNERABILITY DATABASE
-
-[https://wpvulndb.com](https://wpvulndb.com)
-
-# GIT REPOSITORY
-
-[https://github.com/wpscanteam/wpscan](https://github.com/wpscanteam/wpscan)
-
-# ISSUES
-
-[https://github.com/wpscanteam/wpscan/issues](https://github.com/wpscanteam/wpscan/issues)
-
-# DEVELOPER DOCUMENTATION
-
-[http://rdoc.info/github/wpscanteam/wpscan/frames](http://rdoc.info/github/wpscanteam/wpscan/frames)
--- a/24
+++ b/24
@@ -0,0 +1,24 @@
+# rubocop:disable all
+
+require 'bundler/gem_tasks'
+
+exec = []
+
+begin
+  require 'rubocop/rake_task'
+  RuboCop::RakeTask.new
+  exec << :rubocop
+rescue LoadError
+end
+
+begin
+  require 'rspec/core/rake_task'
+  RSpec::Core::RakeTask.new(:spec)
+  exec << :spec
+rescue LoadError
+end
+
+# Run rubocop & rspec before the build (only if installed)
+task build: exec
+
+# rubocop:enable all
--- a/app/app.rb
+++ b/app/app.rb
@@ -0,0 +1,3 @@
+require_relative 'models'
+require_relative 'finders'
+require_relative 'controllers'
--- a/app/controllers.rb
+++ b/app/controllers.rb
@@ -0,0 +1,7 @@
+require_relative 'controllers/core'
+require_relative 'controllers/custom_directories'
+require_relative 'controllers/wp_version'
+require_relative 'controllers/main_theme'
+require_relative 'controllers/enumeration'
+require_relative 'controllers/password_attack'
+require_relative 'controllers/aliases'
--- a/app/controllers/aliases.rb
+++ b/app/controllers/aliases.rb
@@ -0,0 +1,13 @@
+module WPScan
+  module Controller
+    # Controller to add the aliases in the CLI
+    class Aliases < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptAlias.new(['--stealthy'],
+                       alias_for: '--random-user-agent --detection-mode passive --plugins-version-detection passive')
+        ]
+      end
+    end
+  end
+end
--- a/app/controllers/core.rb
+++ b/app/controllers/core.rb
@@ -0,0 +1,104 @@
+module WPScan
+  module Controller
+    # Specific Core controller to include WordPress checks
+    class Core < CMSScanner::Controller::Core
+      # @return [ Array<OptParseValidator::Opt> ]
+      def cli_options
+        [OptURL.new(['--url URL', 'The URL of the blog to scan'],
+                    required_unless: %i[update help version], default_protocol: 'http')] +
+          super.drop(1) + # delete the --url from CMSScanner
+          [
+            OptChoice.new(['--server SERVER', 'Force the supplied server module to be loaded'],
+                          choices: %w[apache iis nginx],
+                          normalize: %i[downcase to_sym]),
+            OptBoolean.new(['--force', 'Do not check if the target is running WordPress']),
+            OptBoolean.new(['--[no-]update', 'Wether or not to update the Database'],
+                           required_unless: %i[url help version])
+          ]
+      end
+
+      # @return [ DB::Updater ]
+      def local_db
+        @local_db ||= DB::Updater.new(DB_DIR)
+      end
+
+      # @return [ Boolean ]
+      def update_db_required?
+        if local_db.missing_files?
+          raise MissingDatabaseFile if parsed_options[:update] == false
+
+          return true
+        end
+
+        return parsed_options[:update] unless parsed_options[:update].nil?
+
+        return false unless user_interaction? && local_db.outdated?
+
+        output('@notice', msg: 'It seems like you have not updated the database for some time.')
+        print '[?] Do you want to update now? [Y]es [N]o, default: [N]'
+
+        Readline.readline =~ /^y/i ? true : false
+      end
+
+      def update_db
+        output('db_update_started')
+        output('db_update_finished', updated: local_db.update, verbose: parsed_options[:verbose])
+
+        exit(0) unless parsed_options[:url]
+      end
+
+      def before_scan
+        @last_update = local_db.last_update
+
+        maybe_output_banner_help_and_version # From CMS Scanner
+
+        update_db if update_db_required?
+        setup_cache
+        check_target_availability
+        load_server_module
+        check_wordpress_state
+      end
+
+      # Raises errors if the target is hosted on wordpress.com or is not running WordPress
+      # Also check if the homepage_url is still the install url
+      def check_wordpress_state
+        raise WordPressHostedError if target.wordpress_hosted?
+
+        if Addressable::URI.parse(target.homepage_url).path =~ %r{/wp-admin/install.php$}i
+
+          output('not_fully_configured', url: target.homepage_url)
+
+          exit(WPScan::ExitCode::VULNERABLE)
+        end
+
+        raise NotWordPressError unless target.wordpress? || parsed_options[:force]
+      end
+
+      # Loads the related server module in the target
+      # and includes it in the WpItem class which will be needed
+      # to check if directory listing is enabled etc
+      #
+      # @return [ Symbol ] The server module loaded
+      def load_server_module
+        server = target.server || :Apache # Tries to auto detect the server
+
+        # Force a specific server module to be loaded if supplied
+        case parsed_options[:server]
+        when :apache
+          server = :Apache
+        when :iis
+          server = :IIS
+        when :nginx
+          server = :Nginx
+        end
+
+        mod = CMSScanner::Target::Server.const_get(server)
+
+        target.extend mod
+        WPScan::WpItem.include mod
+
+        server
+      end
+    end
+  end
+end
--- a/app/controllers/custom_directories.rb
+++ b/app/controllers/custom_directories.rb
@@ -0,0 +1,23 @@
+module WPScan
+  module Controller
+    # Controller to ensure that the wp-content and wp-plugins
+    # directories are found
+    class CustomDirectories < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptString.new(['--wp-content-dir DIR']),
+          OptString.new(['--wp-plugins-dir DIR'])
+        ]
+      end
+
+      def before_scan
+        target.content_dir = parsed_options[:wp_content_dir] if parsed_options[:wp_content_dir]
+        target.plugins_dir = parsed_options[:wp_plugins_dir] if parsed_options[:wp_plugins_dir]
+
+        return if target.content_dir
+
+        raise 'Unable to identify the wp-content dir, please supply it with --wp-content-dir'
+      end
+    end
+  end
+end
--- a/app/controllers/enumeration.rb
+++ b/app/controllers/enumeration.rb
@@ -0,0 +1,27 @@
+require_relative 'enumeration/cli_options'
+require_relative 'enumeration/enum_methods'
+
+module WPScan
+  module Controller
+    # Enumeration Controller
+    class Enumeration < CMSScanner::Controller::Base
+      def before_scan
+        DB::DynamicFinders::Plugin.create_versions_finders
+        DB::DynamicFinders::Theme.create_versions_finders
+      end
+
+      def run
+        enum = parsed_options[:enumerate] || {}
+
+        enum_plugins if enum_plugins?(enum)
+        enum_themes  if enum_themes?(enum)
+
+        %i[timthumbs config_backups db_exports medias].each do |key|
+          send("enum_#{key}".to_sym) if enum.key?(key)
+        end
+
+        enum_users if enum_users?(enum)
+      end
+    end
+  end
+end
--- a/app/controllers/enumeration/cli_options.rb
+++ b/app/controllers/enumeration/cli_options.rb
@@ -0,0 +1,163 @@
+module WPScan
+  module Controller
+    # Enumeration CLI Options
+    class Enumeration < CMSScanner::Controller::Base
+      def cli_options
+        cli_enum_choices + cli_plugins_opts + cli_themes_opts +
+          cli_timthumbs_opts + cli_config_backups_opts + cli_db_exports_opts +
+          cli_medias_opts + cli_users_opts
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      # rubocop:disable Metrics/MethodLength
+      def cli_enum_choices
+        [
+          OptMultiChoices.new(
+            ['--enumerate [OPTS]', '-e', 'Enumeration Process'],
+            choices: {
+              vp:  OptBoolean.new(['--vulnerable-plugins']),
+              ap:  OptBoolean.new(['--all-plugins']),
+              p:   OptBoolean.new(['--plugins']),
+              vt:  OptBoolean.new(['--vulnerable-themes']),
+              at:  OptBoolean.new(['--all-themes']),
+              t:   OptBoolean.new(['--themes']),
+              tt:  OptBoolean.new(['--timthumbs']),
+              cb:  OptBoolean.new(['--config-backups']),
+              dbe: OptBoolean.new(['--db-exports']),
+              u:   OptIntegerRange.new(['--users', 'User IDs range. e.g: u1-5'], value_if_empty: '1-10'),
+              m:   OptIntegerRange.new(['--medias', 'Media IDs range. e.g m1-15'], value_if_empty: '1-100')
+            },
+            value_if_empty: 'vp,vt,tt,cb,dbe,u,m',
+            incompatible: [%i[vp ap p], %i[vt at t]],
+            default: { all_plugins: true, config_backups: true }
+          ),
+          OptRegexp.new(
+            [
+              '--exclude-content-based REGEXP_OR_STRING',
+              'Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration.',
+              'Both the headers and body are checked. Regexp delimiters are not required.'
+            ], options: Regexp::IGNORECASE
+          )
+        ]
+      end
+      # rubocop:enable Metrics/MethodLength
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_plugins_opts
+        [
+          OptSmartList.new(['--plugins-list LIST', 'List of plugins to enumerate']),
+          OptChoice.new(
+            ['--plugins-detection MODE',
+             'Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym, default: :passive
+          ),
+          OptBoolean.new(
+            ['--plugins-version-all',
+             'Check all the plugins version locations according to the choosen mode (--detection-mode, ' \
+             '--plugins-detection and --plugins-version-detection)']
+          ),
+          OptChoice.new(
+            ['--plugins-version-detection MODE',
+             'Use the supplied mode to check plugins versions instead of the --detection-mode ' \
+             'or --plugins-detection modes.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym, default: :mixed
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_themes_opts
+        [
+          OptSmartList.new(['--themes-list LIST', 'List of themes to enumerate']),
+          OptChoice.new(
+            ['--themes-detection MODE',
+             'Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          ),
+          OptBoolean.new(
+            ['--themes-version-all',
+             'Check all the themes version locations according to the choosen mode (--detection-mode, ' \
+             '--themes-detection and --themes-version-detection)']
+          ),
+          OptChoice.new(
+            ['--themes-version-detection MODE',
+             'Use the supplied mode to check themes versions instead of the --detection-mode ' \
+             'or --themes-detection modes.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_timthumbs_opts
+        [
+          OptFilePath.new(
+            ['--timthumbs-list FILE-PATH', 'List of timthumbs\' location to use'],
+            exists: true, default: File.join(DB_DIR, 'timthumbs-v3.txt')
+          ),
+          OptChoice.new(
+            ['--timthumbs-detection MODE',
+             'Use the supplied mode to enumerate Timthumbs, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_config_backups_opts
+        [
+          OptFilePath.new(
+            ['--config-backups-list FILE-PATH', 'List of config backups\' filenames to use'],
+            exists: true, default: File.join(DB_DIR, 'config_backups.txt')
+          ),
+          OptChoice.new(
+            ['--config-backups-detection MODE',
+             'Use the supplied mode to enumerate Config Backups, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_db_exports_opts
+        [
+          OptFilePath.new(
+            ['--db-exports-list FILE-PATH', 'List of DB exports\' paths to use'],
+            exists: true, default: File.join(DB_DIR, 'db_exports.txt')
+          ),
+          OptChoice.new(
+            ['--db-exports-detection MODE',
+             'Use the supplied mode to enumerate DB Exports, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_medias_opts
+        [
+          OptChoice.new(
+            ['--medias-detection MODE',
+             'Use the supplied mode to enumerate Medias, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_users_opts
+        [
+          OptSmartList.new(
+            ['--users-list LIST',
+             'List of users to check during the users enumeration from the Login Error Messages']
+          ),
+          OptChoice.new(
+            ['--users-detection MODE',
+             'Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+    end
+  end
+end
--- a/app/controllers/enumeration/enum_methods.rb
+++ b/app/controllers/enumeration/enum_methods.rb
@@ -0,0 +1,178 @@
+module WPScan
+  module Controller
+    # Enumeration Methods
+    class Enumeration < CMSScanner::Controller::Base
+      # @param [ String ] type (plugins or themes)
+      #
+      # @return [ String ] The related enumration message depending on the parsed_options and type supplied
+      def enum_message(type)
+        return unless %w[plugins themes].include?(type)
+
+        details = if parsed_options[:enumerate][:"vulnerable_#{type}"]
+                    'Vulnerable'
+                  elsif parsed_options[:enumerate][:"all_#{type}"]
+                    'All'
+                  else
+                    'Most Popular'
+                  end
+
+        "Enumerating #{details} #{type.capitalize}"
+      end
+
+      # @param [ String ] type (plugins, themes etc)
+      #
+      # @return [ Hash ]
+      def default_opts(type)
+        mode = parsed_options[:"#{type}_detection"] || parsed_options[:detection_mode]
+
+        {
+          mode: mode,
+          exclude_content: parsed_options[:exclude_content_based],
+          show_progression: user_interaction?,
+          version_detection: {
+            mode: parsed_options[:"#{type}_version_detection"] || mode,
+            confidence_threshold: parsed_options[:"#{type}_version_all"] ? 0 : 100
+          }
+        }
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Boolean ] Wether or not to enumerate the plugins
+      def enum_plugins?(opts)
+        opts[:plugins] || opts[:all_plugins] || opts[:vulnerable_plugins]
+      end
+
+      def enum_plugins
+        opts = default_opts('plugins').merge(
+          list: plugins_list_from_opts(parsed_options),
+          sort: true
+        )
+
+        output('@info', msg: enum_message('plugins')) if user_interaction?
+        # Enumerate the plugins & find their versions to avoid doing that when #version
+        # is called in the view
+        plugins = target.plugins(opts)
+
+        output('@info', msg: 'Checking Plugin Versions') if user_interaction? && !plugins.empty?
+
+        plugins.each(&:version)
+
+        plugins.select!(&:vulnerable?) if parsed_options[:enumerate][:vulnerable_plugins]
+
+        output('plugins', plugins: plugins)
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Array<String> ] The plugins list associated to the cli options
+      def plugins_list_from_opts(opts)
+        # List file provided by the user via the cli
+        return opts[:plugins_list] if opts[:plugins_list]
+
+        if opts[:enumerate][:all_plugins]
+          DB::Plugins.all_slugs
+        elsif opts[:enumerate][:plugins]
+          DB::Plugins.popular_slugs
+        else
+          DB::Plugins.vulnerable_slugs
+        end
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Boolean ] Wether or not to enumerate the themes
+      def enum_themes?(opts)
+        opts[:themes] || opts[:all_themes] || opts[:vulnerable_themes]
+      end
+
+      def enum_themes
+        opts = default_opts('themes').merge(
+          list: themes_list_from_opts(parsed_options),
+          sort: true
+        )
+
+        output('@info', msg: enum_message('themes')) if user_interaction?
+        # Enumerate the themes & find their versions to avoid doing that when #version
+        # is called in the view
+        themes = target.themes(opts)
+
+        output('@info', msg: 'Checking Theme Versions') if user_interaction? && !themes.empty?
+
+        themes.each(&:version)
+
+        themes.select!(&:vulnerable?) if parsed_options[:enumerate][:vulnerable_themes]
+
+        output('themes', themes: themes)
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Array<String> ] The themes list associated to the cli options
+      def themes_list_from_opts(opts)
+        # List file provided by the user via the cli
+        return opts[:themes_list] if opts[:themes_list]
+
+        if opts[:enumerate][:all_themes]
+          DB::Themes.all_slugs
+        elsif opts[:enumerate][:themes]
+          DB::Themes.popular_slugs
+        else
+          DB::Themes.vulnerable_slugs
+        end
+      end
+
+      def enum_timthumbs
+        opts = default_opts('timthumbs').merge(list: parsed_options[:timthumbs_list])
+
+        output('@info', msg: 'Enumerating Timthumbs') if user_interaction?
+        output('timthumbs', timthumbs: target.timthumbs(opts))
+      end
+
+      def enum_config_backups
+        opts = default_opts('config_backups').merge(list: parsed_options[:config_backups_list])
+
+        output('@info', msg: 'Enumerating Config Backups') if user_interaction?
+        output('config_backups', config_backups: target.config_backups(opts))
+      end
+
+      def enum_db_exports
+        opts = default_opts('db_exports').merge(list: parsed_options[:db_exports_list])
+
+        output('@info', msg: 'Enumerating DB Exports') if user_interaction?
+        output('db_exports', db_exports: target.db_exports(opts))
+      end
+
+      def enum_medias
+        opts = default_opts('medias').merge(range: parsed_options[:enumerate][:medias])
+
+        output('@info', msg: 'Enumerating Medias') if user_interaction?
+        output('medias', medias: target.medias(opts))
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Boolean ] Wether or not to enumerate the users
+      def enum_users?(opts)
+        opts[:users] || (parsed_options[:passwords] && !parsed_options[:username] && !parsed_options[:usernames])
+      end
+
+      def enum_users
+        opts = default_opts('users').merge(
+          range: enum_users_range,
+          list: parsed_options[:users_list]
+        )
+
+        output('@info', msg: 'Enumerating Users') if user_interaction?
+        output('users', users: target.users(opts))
+      end
+
+      # @return [ Range ] The user ids range to enumerate
+      # If the --enumerate is used, the default value is handled by the Option
+      # However, when using --passwords alone, the default has to be set by the code below
+      def enum_users_range
+        parsed_options[:enumerate][:users] || cli_enum_choices[0].choices[:u].validate(nil)
+      end
+    end
+  end
+end
--- a/app/controllers/main_theme.rb
+++ b/app/controllers/main_theme.rb
@@ -0,0 +1,27 @@
+module WPScan
+  module Controller
+    # Main Theme Controller
+    class MainTheme < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptChoice.new(
+            ['--main-theme-detection MODE',
+             'Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive],
+            normalize: :to_sym
+          )
+        ]
+      end
+
+      def run
+        output(
+          'theme',
+          theme: target.main_theme(
+            mode: parsed_options[:main_theme_detection] || parsed_options[:detection_mode]
+          ),
+          verbose: parsed_options[:verbose]
+        )
+      end
+    end
+  end
+end
--- a/app/controllers/password_attack.rb
+++ b/app/controllers/password_attack.rb
@@ -0,0 +1,108 @@
+module WPScan
+  module Controller
+    # Password Attack Controller
+    class PasswordAttack < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptFilePath.new(
+            ['--passwords FILE-PATH', '-P',
+             'List of passwords to use during the password attack.',
+             'If no --username/s option supplied, user enumeration will be run.'],
+            exists: true
+          ),
+          OptSmartList.new(['--usernames LIST', '-U', 'List of usernames to use during the password attack.']),
+          OptInteger.new(['--multicall-max-passwords MAX_PWD',
+                          'Maximum number of passwords to send by request with XMLRPC multicall'],
+                         default: 500),
+          OptChoice.new(['--password-attack ATTACK',
+                         'Force the supplied attack to be used rather than automatically determining one.'],
+                        choices: %w[wp-login xmlrpc xmlrpc-multicall],
+                        normalize: %i[downcase underscore to_sym])
+        ]
+      end
+
+      def run
+        return unless parsed_options[:passwords]
+
+        if user_interaction?
+          output('@info',
+                 msg: "Performing password attack on #{attacker.titleize} against #{users.size} user/s")
+        end
+
+        attack_opts = {
+          show_progression: user_interaction?,
+          multicall_max_passwords: parsed_options[:multicall_max_passwords]
+        }
+
+        begin
+          found = []
+
+          attacker.attack(users, passwords(parsed_options[:passwords]), attack_opts) do |user|
+            found << user
+
+            attacker.progress_bar.log("[SUCCESS] - #{user.username} / #{user.password}")
+          end
+        ensure
+          output('users', users: found)
+        end
+      end
+
+      # @return [ CMSScanner::Finders::Finder ] The finder used to perform the attack
+      def attacker
+        @attacker ||= attacker_from_cli_options || attacker_from_automatic_detection
+      end
+
+      # @return [ WPScan::XMLRPC ]
+      def xmlrpc
+        @xmlrpc ||= target.xmlrpc
+      end
+
+      # @return [ CMSScanner::Finders::Finder ]
+      def attacker_from_cli_options
+        return unless parsed_options[:password_attack]
+
+        case parsed_options[:password_attack]
+        when :wp_login
+          WPScan::Finders::Passwords::WpLogin.new(target)
+        when :xmlrpc
+          WPScan::Finders::Passwords::XMLRPC.new(xmlrpc)
+        when :xmlrpc_multicall
+          WPScan::Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+        end
+      end
+
+      # @return [ CMSScanner::Finders::Finder ]
+      def attacker_from_automatic_detection
+        if xmlrpc&.enabled? && xmlrpc.available_methods.include?('wp.getUsersBlogs')
+          wp_version = target.wp_version
+
+          if wp_version && wp_version < '4.4'
+            WPScan::Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+          else
+            WPScan::Finders::Passwords::XMLRPC.new(xmlrpc)
+          end
+        else
+          WPScan::Finders::Passwords::WpLogin.new(target)
+        end
+      end
+
+      # @return [ Array<Users> ] The users to brute force
+      def users
+        return target.users unless parsed_options[:usernames]
+
+        parsed_options[:usernames].reduce([]) do |acc, elem|
+          acc << CMSScanner::User.new(elem.chomp)
+        end
+      end
+
+      # @param [ String ] wordlist_path
+      #
+      # @return [ Array<String> ]
+      def passwords(wordlist_path)
+        @passwords ||= File.open(wordlist_path).reduce([]) do |acc, elem|
+          acc << elem.chomp
+        end
+      end
+    end
+  end
+end
--- a/app/controllers/wp_version.rb
+++ b/app/controllers/wp_version.rb
@@ -0,0 +1,34 @@
+module WPScan
+  module Controller
+    # Wp Version Controller
+    class WpVersion < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptBoolean.new(['--wp-version-all', 'Check all the version locations']),
+          OptChoice.new(
+            ['--wp-version-detection MODE',
+             'Use the supplied mode for the WordPress version detection, ' \
+             'instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive],
+            normalize: :to_sym
+          )
+        ]
+      end
+
+      def before_scan
+        WPScan::DB::DynamicFinders::Wordpress.create_versions_finders
+      end
+
+      def run
+        output(
+          'version',
+          version: target.wp_version(
+            mode: parsed_options[:wp_version_detection] || parsed_options[:detection_mode],
+            confidence_threshold: parsed_options[:wp_version_all] ? 0 : 100,
+            show_progression: user_interaction?
+          )
+        )
+      end
+    end
+  end
+end
--- a/app/finders.rb
+++ b/app/finders.rb
@@ -0,0 +1,15 @@
+require_relative 'finders/interesting_findings'
+require_relative 'finders/wp_items'
+require_relative 'finders/wp_version'
+require_relative 'finders/main_theme'
+require_relative 'finders/timthumb_version'
+require_relative 'finders/timthumbs'
+require_relative 'finders/config_backups'
+require_relative 'finders/db_exports'
+require_relative 'finders/medias'
+require_relative 'finders/users'
+require_relative 'finders/plugins'
+require_relative 'finders/plugin_version'
+require_relative 'finders/theme_version'
+require_relative 'finders/themes'
+require_relative 'finders/passwords'
--- a/app/finders/config_backups.rb
+++ b/app/finders/config_backups.rb
@@ -0,0 +1,17 @@
+require_relative 'config_backups/known_filenames'
+
+module WPScan
+  module Finders
+    module ConfigBackups
+      # Config Backup Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders << ConfigBackups::KnownFilenames.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/config_backups/known_filenames.rb
+++ b/app/finders/config_backups/known_filenames.rb
@@ -0,0 +1,46 @@
+module WPScan
+  module Finders
+    module ConfigBackups
+      # Config Backup finder
+      class KnownFilenames < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        # @option opts [ Boolean ] :show_progression
+        #
+        # @return [ Array<ConfigBackup> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(potential_urls(opts), opts) do |res|
+            # Might need to improve that
+            next unless res.body =~ /define/i && res.body !~ /<\s?html/i
+
+            found << WPScan::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list Mandatory
+        #
+        # @return [ Hash ]
+        def potential_urls(opts = {})
+          urls = {}
+
+          File.open(opts[:list]).each_with_index do |file, index|
+            urls[target.url(file.chomp)] = index
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Checking Config Backups -'))
+        end
+      end
+    end
+  end
+end
--- a/app/finders/db_exports.rb
+++ b/app/finders/db_exports.rb
@@ -0,0 +1,17 @@
+require_relative 'db_exports/known_locations'
+
+module WPScan
+  module Finders
+    module DbExports
+      # DB Exports Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders << DbExports::KnownLocations.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/db_exports/known_locations.rb
+++ b/app/finders/db_exports/known_locations.rb
@@ -0,0 +1,49 @@
+module WPScan
+  module Finders
+    module DbExports
+      # DB Exports finder
+      # See https://github.com/wpscanteam/wpscan-v3/issues/62
+      class KnownLocations < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        # @option opts [ Boolean ] :show_progression
+        #
+        # @return [ Array<DBExport> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(potential_urls(opts), opts) do |res|
+            next unless res.code == 200 && res.body =~ /INSERT INTO/
+
+            found << WPScan::DbExport.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list Mandatory
+        #
+        # @return [ Hash ]
+        def potential_urls(opts = {})
+          urls        = {}
+          domain_name = target.uri.host[/(^[\w|-]+)/, 1]
+
+          File.open(opts[:list]).each_with_index do |path, index|
+            path.gsub!('{domain_name}', domain_name)
+
+            urls[target.url(path.chomp)] = index
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Checking DB Exports -'))
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings.rb
+++ b/app/finders/interesting_findings.rb
@@ -0,0 +1,34 @@
+require_relative 'interesting_findings/readme'
+require_relative 'interesting_findings/multisite'
+require_relative 'interesting_findings/debug_log'
+require_relative 'interesting_findings/backup_db'
+require_relative 'interesting_findings/mu_plugins'
+require_relative 'interesting_findings/registration'
+require_relative 'interesting_findings/tmm_db_migrate'
+require_relative 'interesting_findings/upload_sql_dump'
+require_relative 'interesting_findings/full_path_disclosure'
+require_relative 'interesting_findings/duplicator_installer_log'
+require_relative 'interesting_findings/upload_directory_listing'
+require_relative 'interesting_findings/emergency_pwd_reset_script'
+
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Interesting Files Finder
+      class Base < CMSScanner::Finders::InterestingFindings::Base
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          super(target)
+
+          %w[
+            Readme DebugLog FullPathDisclosure BackupDB DuplicatorInstallerLog
+            Multisite MuPlugins Registration UploadDirectoryListing TmmDbMigrate
+            UploadSQLDump EmergencyPwdResetScript
+          ].each do |f|
+            finders << InterestingFindings.const_get(f).new(target)
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/backup_db.rb
+++ b/app/finders/interesting_findings/backup_db.rb
@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # BackupDB finder
+      class BackupDB < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/backup-db/'
+          url  = target.url(path)
+          res  = Browser.get(url)
+
+          return unless [200, 403].include?(res.code) && !target.homepage_or_404?(res)
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 70,
+            found_by: DIRECT_ACCESS,
+            interesting_entries: target.directory_listing_entries(path),
+            references: { url: 'https://github.com/wpscanteam/wpscan/issues/422' }
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/debug_log.rb
+++ b/app/finders/interesting_findings/debug_log.rb
@@ -0,0 +1,20 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # debug.log finder
+      class DebugLog < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/debug.log'
+
+          return unless target.debug_log?(path)
+
+          WPScan::InterestingFinding.new(
+            target.url(path),
+            confidence: 100, found_by: DIRECT_ACCESS
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/duplicator_installer_log.rb
+++ b/app/finders/interesting_findings/duplicator_installer_log.rb
@@ -0,0 +1,23 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # DuplicatorInstallerLog finder
+      class DuplicatorInstallerLog < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url = target.url('installer-log.txt')
+          res = Browser.get(url)
+
+          return unless res.body =~ /DUPLICATOR INSTALL-LOG/
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            references: { url: 'https://www.exploit-db.com/ghdb/3981/' }
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/emergency_pwd_reset_script.rb
+++ b/app/finders/interesting_findings/emergency_pwd_reset_script.rb
@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Emergency Password Reset Script finder
+      class EmergencyPwdResetScript < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url  = target.url('/emergency.php')
+          res  = Browser.get(url)
+
+          return unless res.code == 200 && !target.homepage_or_404?(res)
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: res.body =~ /password/i ? 100 : 40,
+            found_by: DIRECT_ACCESS,
+            references: {
+              url: 'https://codex.wordpress.org/Resetting_Your_Password#Using_the_Emergency_Password_Reset_Script'
+            }
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/full_path_disclosure.rb
+++ b/app/finders/interesting_findings/full_path_disclosure.rb
@@ -0,0 +1,23 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Full Path Disclosure finder
+      class FullPathDisclosure < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path        = 'wp-includes/rss-functions.php'
+          fpd_entries = target.full_path_disclosure_entries(path)
+
+          return if fpd_entries.empty?
+
+          WPScan::InterestingFinding.new(
+            target.url(path),
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            interesting_entries: fpd_entries
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/mu_plugins.rb
+++ b/app/finders/interesting_findings/mu_plugins.rb
@@ -0,0 +1,49 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Must Use Plugins Directory checker
+      class MuPlugins < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def passive(_opts = {})
+          pattern = %r{#{target.content_dir}/mu\-plugins/}i
+
+          target.in_scope_urls(target.homepage_res) do |url|
+            next unless Addressable::URI.parse(url).path =~ pattern
+
+            url = target.url('wp-content/mu-plugins/')
+
+            return WPScan::InterestingFinding.new(
+              url,
+              confidence: 70,
+              found_by: 'URLs In Homepage (Passive Detection)',
+              to_s: "This site has 'Must Use Plugins': #{url}",
+              references: { url: 'http://codex.wordpress.org/Must_Use_Plugins' }
+            )
+          end
+          nil
+        end
+
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url = target.url('wp-content/mu-plugins/')
+          res = Browser.get_and_follow_location(url)
+
+          return unless [200, 401, 403].include?(res.code)
+          return if target.homepage_or_404?(res)
+
+          # TODO: add the check for --exclude-content once implemented ?
+
+          target.mu_plugins = true
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 80,
+            found_by: DIRECT_ACCESS,
+            to_s: "This site has 'Must Use Plugins': #{url}",
+            references: { url: 'http://codex.wordpress.org/Must_Use_Plugins' }
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/multisite.rb
+++ b/app/finders/interesting_findings/multisite.rb
@@ -0,0 +1,29 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Multisite checker
+      class Multisite < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url      = target.url('wp-signup.php')
+          res      = Browser.get(url)
+          location = res.headers_hash['location']
+
+          return unless [200, 302].include?(res.code)
+          return if res.code == 302 && location =~ /wp-login\.php\?action=register/
+          return unless res.code == 200 || res.code == 302 && location =~ /wp-signup\.php/
+
+          target.multisite = true
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            to_s: 'This site seems to be a multisite',
+            references: { url: 'http://codex.wordpress.org/Glossary#Multisite' }
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/readme.rb
+++ b/app/finders/interesting_findings/readme.rb
@@ -0,0 +1,26 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Readme.html finder
+      class Readme < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          potential_files.each do |file|
+            url = target.url(file)
+            res = Browser.get(url)
+
+            if res.code == 200 && res.body =~ /wordpress/i
+              return WPScan::InterestingFinding.new(url, confidence: 100, found_by: DIRECT_ACCESS)
+            end
+          end
+          nil
+        end
+
+        # @retun [ Array<String> ] The list of potential readme files
+        def potential_files
+          %w[readme.html olvasdel.html lisenssi.html liesmich.html]
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/registration.rb
+++ b/app/finders/interesting_findings/registration.rb
@@ -0,0 +1,31 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Registration Enabled checker
+      class Registration < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def passive(_opts = {})
+          # Maybe check in the homepage if there is the registration url ?
+        end
+
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          res = Browser.get_and_follow_location(target.registration_url)
+
+          return unless res.code == 200
+          return if res.html.css('form#setupform').empty? &&
+                    res.html.css('form#registerform').empty?
+
+          target.registration_enabled = true
+
+          WPScan::InterestingFinding.new(
+            res.effective_url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            to_s: "Registration is enabled: #{res.effective_url}"
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/tmm_db_migrate.rb
+++ b/app/finders/interesting_findings/tmm_db_migrate.rb
@@ -0,0 +1,24 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Tmm DB Migrate finder
+      class TmmDbMigrate < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/uploads/tmm_db_migrate/tmm_db_migrate.zip'
+          url  = target.url(path)
+          res  = Browser.get(url)
+
+          return unless res.code == 200 && res.headers['Content-Type'] =~ %r{\Aapplication/zip}i
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            references: { packetstorm: 131_957 }
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/upload_directory_listing.rb
+++ b/app/finders/interesting_findings/upload_directory_listing.rb
@@ -0,0 +1,24 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # UploadDirectoryListing finder
+      class UploadDirectoryListing < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/uploads/'
+
+          return unless target.directory_listing?(path)
+
+          url = target.url(path)
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            to_s: "Upload directory has listing enabled: #{url}"
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/interesting_findings/upload_sql_dump.rb
+++ b/app/finders/interesting_findings/upload_sql_dump.rb
@@ -0,0 +1,28 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # UploadSQLDump finder
+      class UploadSQLDump < CMSScanner::Finders::Finder
+        SQL_PATTERN = /(?:(?:(?:DROP|CREATE) TABLE)|INSERT INTO)/
+
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url = dump_url
+          res = Browser.get(url)
+
+          return unless res.code == 200 && res.body =~ SQL_PATTERN
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS
+          )
+        end
+
+        def dump_url
+          target.url('wp-content/uploads/dump.sql')
+        end
+      end
+    end
+  end
+end
--- a/app/finders/main_theme.rb
+++ b/app/finders/main_theme.rb
@@ -0,0 +1,22 @@
+require_relative 'main_theme/css_style'
+require_relative 'main_theme/woo_framework_meta_generator'
+require_relative 'main_theme/urls_in_homepage'
+
+module WPScan
+  module Finders
+    module MainTheme
+      # Main Theme Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders <<
+            MainTheme::CssStyle.new(target) <<
+            MainTheme::WooFrameworkMetaGenerator.new(target) <<
+            MainTheme::UrlsInHomepage.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/main_theme/css_style.rb
+++ b/app/finders/main_theme/css_style.rb
@@ -0,0 +1,43 @@
+module WPScan
+  module Finders
+    module MainTheme
+      # From the css style
+      class CssStyle < CMSScanner::Finders::Finder
+        include Finders::WpItems::URLsInHomepage
+
+        def create_theme(slug, style_url, opts)
+          WPScan::Theme.new(
+            slug,
+            target,
+            opts.merge(found_by: found_by, confidence: 70, style_url: style_url)
+          )
+        end
+
+        def passive(opts = {})
+          passive_from_css_href(target.homepage_res, opts) || passive_from_style_code(target.homepage_res, opts)
+        end
+
+        def passive_from_css_href(res, opts)
+          target.in_scope_urls(res, '//style/@src|//link/@href') do |url|
+            next unless Addressable::URI.parse(url).path =~ %r{/themes/([^\/]+)/style.css\z}i
+
+            return create_theme(Regexp.last_match[1], url, opts)
+          end
+          nil
+        end
+
+        def passive_from_style_code(res, opts)
+          res.html.css('style').each do |tag|
+            code = tag.text.to_s
+            next if code.empty?
+
+            next unless code =~ %r{#{item_code_pattern('themes')}\\?/style\.css[^"'\( ]*}i
+
+            return create_theme(Regexp.last_match[1], Regexp.last_match[0].strip, opts)
+          end
+          nil
+        end
+      end
+    end
+  end
+end
--- a/app/finders/main_theme/urls_in_homepage.rb
+++ b/app/finders/main_theme/urls_in_homepage.rb
@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module MainTheme
+      # URLs In Homepage Finder
+      class UrlsInHomepage < CMSScanner::Finders::Finder
+        include WpItems::URLsInHomepage
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<Theme> ]
+        def passive(opts = {})
+          found = []
+
+          slugs = items_from_links('themes', false) + items_from_codes('themes', false)
+
+          slugs.each_with_object(Hash.new(0)) { |slug, counts| counts[slug] += 1 }.each do |slug, occurences|
+            found << WPScan::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 2 * occurences))
+          end
+
+          found
+        end
+      end
+    end
+  end
+end
--- a/app/finders/main_theme/woo_framework_meta_generator.rb
+++ b/app/finders/main_theme/woo_framework_meta_generator.rb
@@ -0,0 +1,22 @@
+module WPScan
+  module Finders
+    module MainTheme
+      # From the WooFramework meta generators
+      class WooFrameworkMetaGenerator < CMSScanner::Finders::Finder
+        THEME_PATTERN     = %r{<meta name="generator" content="([^\s"]+)\s?([^"]+)?"\s+/?>}
+        FRAMEWORK_PATTERN = %r{<meta name="generator" content="WooFramework\s?([^"]+)?"\s+/?>}
+        PATTERN           = /#{THEME_PATTERN}\s+#{FRAMEWORK_PATTERN}/i
+
+        def passive(opts = {})
+          return unless target.homepage_res.body =~ PATTERN
+
+          WPScan::Theme.new(
+            Regexp.last_match[1],
+            target,
+            opts.merge(found_by: found_by, confidence: 80)
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/medias.rb
+++ b/app/finders/medias.rb
@@ -0,0 +1,17 @@
+require_relative 'medias/attachment_brute_forcing'
+
+module WPScan
+  module Finders
+    module Medias
+      # Medias Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders << Medias::AttachmentBruteForcing.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/medias/attachment_brute_forcing.rb
+++ b/app/finders/medias/attachment_brute_forcing.rb
@@ -0,0 +1,44 @@
+module WPScan
+  module Finders
+    module Medias
+      # Medias Finder
+      class AttachmentBruteForcing < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ Range ] :range Mandatory
+        #
+        # @return [ Array<Media> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(target_urls(opts), opts) do |res|
+            next unless res.code == 200
+
+            found << WPScan::Media.new(res.effective_url, opts.merge(found_by: found_by, confidence: 100))
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ Range ] :range Mandatory
+        #
+        # @return [ Hash ]
+        def target_urls(opts = {})
+          urls = {}
+
+          opts[:range].each do |id|
+            urls[target.uri.join("?attachment_id=#{id}").to_s] = id
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Brute Forcing Attachment IDs -'))
+        end
+      end
+    end
+  end
+end
--- a/app/finders/passwords.rb
+++ b/app/finders/passwords.rb
@@ -0,0 +1,3 @@
+require_relative 'passwords/wp_login'
+require_relative 'passwords/xml_rpc'
+require_relative 'passwords/xml_rpc_multicall'
--- a/app/finders/passwords/wp_login.rb
+++ b/app/finders/passwords/wp_login.rb
@@ -0,0 +1,22 @@
+module WPScan
+  module Finders
+    module Passwords
+      # Password attack against the wp-login.php
+      class WpLogin < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::BreadthFirstDictionaryAttack
+
+        def login_request(username, password)
+          target.login_request(username, password)
+        end
+
+        def valid_credentials?(response)
+          response.code == 302
+        end
+
+        def errored_response?(response)
+          response.code != 200 && response.body !~ /login_error/i
+        end
+      end
+    end
+  end
+end
--- a/app/finders/passwords/xml_rpc.rb
+++ b/app/finders/passwords/xml_rpc.rb
@@ -0,0 +1,22 @@
+module WPScan
+  module Finders
+    module Passwords
+      # Password attack against the XMLRPC interface
+      class XMLRPC < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::BreadthFirstDictionaryAttack
+
+        def login_request(username, password)
+          target.method_call('wp.getUsersBlogs', [username, password])
+        end
+
+        def valid_credentials?(response)
+          response.code == 200 && response.body =~ /blogName/
+        end
+
+        def errored_response?(response)
+          response.code != 200 && response.body !~ /login_error/i
+        end
+      end
+    end
+  end
+end
--- a/app/finders/passwords/xml_rpc_multicall.rb
+++ b/app/finders/passwords/xml_rpc_multicall.rb
@@ -0,0 +1,102 @@
+module WPScan
+  module Finders
+    module Passwords
+      # Password attack against the XMLRPC interface with the multicall method
+      # WP < 4.4 is vulnerable to such attack
+      class XMLRPCMulticall < CMSScanner::Finders::Finder
+        # @param [ Array<User> ] users
+        # @param [ Array<String> ] passwords
+        #
+        # @return [ Typhoeus::Response ]
+        def do_multi_call(users, passwords)
+          methods = []
+
+          users.each do |user|
+            passwords.each do |password|
+              methods << ['wp.getUsersBlogs', user.username, password]
+            end
+          end
+
+          target.multi_call(methods).run
+        end
+
+        # @param [ Array<CMSScanner::User> ] users
+        # @param [ Array<String> ] passwords
+        # @param [ Hash ] opts
+        # @option opts [ Boolean ] :show_progression
+        # @option opts [ Integer ] :multicall_max_passwords
+        #
+        # @yield [ CMSScanner::User ] When a valid combination is found
+        #
+        # TODO: Make rubocop happy about metrics etc
+        #
+        # rubocop:disable all
+        def attack(users, passwords, opts = {})
+          wordlist_index         = 0
+          max_passwords          = opts[:multicall_max_passwords]
+          current_passwords_size = passwords_size(max_passwords, users.size)
+
+          create_progress_bar(total: (passwords.size / current_passwords_size.round(1)).ceil,
+                              show_progression: opts[:show_progression])
+
+          loop do
+            current_users     = users.select { |user| user.password.nil? }
+            current_passwords = passwords[wordlist_index, current_passwords_size]
+            wordlist_index   += current_passwords_size
+
+            break if current_users.empty? || current_passwords.nil? || current_passwords.empty?
+
+            res = do_multi_call(current_users, current_passwords)
+
+            progress_bar.increment
+
+            check_and_output_errors(res)
+
+            # Avoid to parse the response and iterate over all the structs in the document
+            # if there isn't any tag matching a valid combination
+            next unless res.body =~ /isAdmin/ # maybe a better one ?
+
+            Nokogiri::XML(res.body).xpath('//struct').each_with_index do |struct, index|
+              next if struct.text =~ /faultCode/
+
+              user = current_users[index / current_passwords.size]
+              user.password = current_passwords[index % current_passwords.size]
+
+              yield user
+
+              # Updates the current_passwords_size and progress_bar#total
+              # given that less requests will be done due to a valid combination found.
+              current_passwords_size = passwords_size(max_passwords, current_users.size - 1)
+
+              if current_passwords_size == 0
+                progress_bar.log('All Found') # remove ?
+                progress_bar.stop
+                break
+              end
+
+              progress_bar.total = progress_bar.progress + ((passwords.size - wordlist_index) / current_passwords_size.round(1)).ceil
+            end
+          end
+          # Maybe a progress_bar.stop ?
+        end
+        # rubocop:disable all
+
+        def passwords_size(max_passwords, users_size)
+          return 1 if max_passwords < users_size
+          return 0 if users_size == 0
+
+          max_passwords / users_size
+        end
+
+        # @param [ Typhoeus::Response ] res
+        def check_and_output_errors(res)
+          progress_bar.log("Incorrect response: #{res.code} / #{res.return_message}") unless res.code == 200
+
+          progress_bar.log('Parsing error, might be caused by a too high --max-passwords value (such as >= 2k)') if res.body =~ /parse error. not well formed/i
+
+          progress_bar.log('The requested method is not supported') if res.body =~ /requested method [^ ]+ does not exist/i
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugin_version.rb
+++ b/app/finders/plugin_version.rb
@@ -0,0 +1,38 @@
+require_relative 'plugin_version/readme'
+
+module WPScan
+  module Finders
+    module PluginVersion
+      # Plugin Version Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Plugin ] plugin
+        def initialize(plugin)
+          finders << PluginVersion::Readme.new(plugin)
+
+          load_specific_finders(plugin)
+        end
+
+        # Load the finders associated with the plugin
+        #
+        # @param [ WPScan::Plugin ] plugin
+        def load_specific_finders(plugin)
+          module_name = plugin.classify
+
+          return unless Finders::PluginVersion.constants.include?(module_name)
+
+          mod = Finders::PluginVersion.const_get(module_name)
+
+          mod.constants.each do |constant|
+            c = mod.const_get(constant)
+
+            next unless c.is_a?(Class)
+
+            finders << c.new(plugin)
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugin_version/readme.rb
+++ b/app/finders/plugin_version/readme.rb
@@ -0,0 +1,79 @@
+module WPScan
+  module Finders
+    module PluginVersion
+      # Plugin Version Finder from the readme.txt file
+      class Readme < CMSScanner::Finders::Finder
+        # @return [ Version ]
+        def aggressive(_opts = {})
+          found_by_msg = 'Readme - %s (Aggressive Detection)'
+
+          WPScan::WpItem::READMES.each do |file|
+            url = target.url(file)
+            res = Browser.get(url)
+
+            next unless res.code == 200 && !(numbers = version_numbers(res.body)).empty?
+
+            return numbers.reduce([]) do |a, e|
+              a << WPScan::Version.new(
+                e[0],
+                found_by: format(found_by_msg, e[1]),
+                confidence: e[2],
+                interesting_entries: [url]
+              )
+            end
+          end
+          nil
+        end
+
+        # @return [ Array<String, String, Integer> ] number, found_by, confidence
+        def version_numbers(body)
+          numbers = []
+
+          if (number = from_stable_tag(body))
+            numbers << [number, 'Stable Tag', 80]
+          end
+
+          if (number = from_changelog_section(body))
+            numbers << [number, 'ChangeLog Section', 50]
+          end
+
+          numbers
+        end
+
+        # @param [ String ] body
+        #
+        # @return [ String, nil ] The version number detected from the stable tag
+        def from_stable_tag(body)
+          return unless body =~ /\b(?:stable tag|version):\s*(?!trunk)([0-9a-z\.-]+)/i
+
+          number = Regexp.last_match[1]
+
+          number if number =~ /[0-9]+/
+        end
+
+        # @param [ String ] body
+        #
+        # @return [ String, nil ] The best version number detected from the changelog section
+        def from_changelog_section(body)
+          extracted_versions = body.scan(%r{[=]+\s+(?:v(?:ersion)?\s*)?([0-9\.-]+)[ \ta-z0-9\(\)\.\-\/]*[=]+}i)
+
+          return if extracted_versions.nil? || extracted_versions.empty?
+
+          extracted_versions.flatten!
+          # must contain at least one number
+          extracted_versions = extracted_versions.select { |x| x =~ /[0-9]+/ }
+
+          sorted = extracted_versions.sort do |x, y|
+            begin
+              Gem::Version.new(x) <=> Gem::Version.new(y)
+            rescue StandardError
+              0
+            end
+          end
+
+          sorted.last
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins.rb
+++ b/app/finders/plugins.rb
@@ -0,0 +1,33 @@
+require_relative 'plugins/urls_in_homepage'
+require_relative 'plugins/known_locations'
+# From the DynamicFinders
+require_relative 'plugins/comment'
+require_relative 'plugins/xpath'
+require_relative 'plugins/header_pattern'
+require_relative 'plugins/body_pattern'
+require_relative 'plugins/javascript_var'
+require_relative 'plugins/query_parameter'
+require_relative 'plugins/config_parser' # Not loaded below as not implemented
+
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders <<
+            Plugins::UrlsInHomepage.new(target) <<
+            Plugins::HeaderPattern.new(target) <<
+            Plugins::Comment.new(target) <<
+            Plugins::Xpath.new(target) <<
+            Plugins::BodyPattern.new(target) <<
+            Plugins::JavascriptVar.new(target) <<
+            Plugins::KnownLocations.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/body_pattern.rb
+++ b/app/finders/plugins/body_pattern.rb
@@ -0,0 +1,27 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from Dynamic Finder 'BodyPattern'
+      class BodyPattern < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 30
+
+        # @param [ Hash ] opts The options from the #passive, #aggressive methods
+        # @param [ Typhoeus::Response ] response
+        # @param [ String ] slug
+        # @param [ String ] klass
+        # @param [ Hash ] config The related dynamic finder config hash
+        #
+        # @return [ Plugin ] The detected plugin in the response, related to the config
+        def process_response(opts, response, slug, klass, config)
+          return unless response.body =~ config['pattern']
+
+          Plugin.new(
+            slug,
+            target,
+            opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/comment.rb
+++ b/app/finders/plugins/comment.rb
@@ -0,0 +1,31 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from the Dynamic Finder 'Comment'
+      class Comment < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 30
+
+        # @param [ Hash ] opts The options from the #passive, #aggressive methods
+        # @param [ Typhoeus::Response ] response
+        # @param [ String ] slug
+        # @param [ String ] klass
+        # @param [ Hash ] config The related dynamic finder config hash
+        #
+        # @return [ Plugin ] The detected plugin in the response, related to the config
+        def process_response(opts, response, slug, klass, config)
+          response.html.xpath(config['xpath'] || '//comment()').each do |node|
+            comment = node.text.to_s.strip
+
+            next unless comment =~ config['pattern']
+
+            return Plugin.new(
+              slug,
+              target,
+              opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
+            )
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/config_parser.rb
+++ b/app/finders/plugins/config_parser.rb
@@ -0,0 +1,31 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from Dynamic Finder 'ConfigParser'
+      class ConfigParser < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 40
+
+        # @param [ Hash ] opts The options from the #passive, #aggressive methods
+        # @param [ Typhoeus::Response ] response
+        # @param [ String ] slug
+        # @param [ String ] klass
+        # @param [ Hash ] config The related dynamic finder config hash
+        #
+        # @return [ Plugin ] The detected plugin in the response, related to the config
+        def _process_response(_opts, _response, slug, klass, config)
+          #
+          # TODO. Currently not implemented, and not even loaded by the Finders, as this
+          # finder only has an aggressive method, which has been disabled (globally)
+          # when checking for plugins
+          #
+
+          Plugin.new(
+            slug,
+            target,
+            opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/header_pattern.rb
+++ b/app/finders/plugins/header_pattern.rb
@@ -0,0 +1,41 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from Dynamic Finder 'HeaderPattern'
+      class HeaderPattern < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 30
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<Plugin> ]
+        def passive(opts = {})
+          found = []
+          headers = target.homepage_res.headers
+
+          return found if headers.empty?
+
+          DB::DynamicFinders::Plugin.passive_header_pattern_finder_configs.each do |slug, configs|
+            configs.each do |klass, config|
+              next unless headers[config['header']] && headers[config['header']].to_s =~ config['pattern']
+
+              found << Plugin.new(
+                slug,
+                target,
+                opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
+              )
+            end
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        #
+        # @return [ nil ]
+        def aggressive(_opts = {})
+          # None
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/javascript_var.rb
+++ b/app/finders/plugins/javascript_var.rb
@@ -0,0 +1,29 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from the Dynamic Finder 'JavascriptVar'
+      class JavascriptVar < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 60
+
+        # @param [ Hash ] opts The options from the #passive, #aggressive methods
+        # @param [ Typhoeus::Response ] response
+        # @param [ String ] slug
+        # @param [ String ] klass
+        # @param [ Hash ] config The related dynamic finder config hash
+        #
+        # @return [ Plugin ] The detected plugin in the response, related to the config
+        def process_response(opts, response, slug, klass, config)
+          response.html.xpath(config['xpath'] || '//script[not(@src)]').each do |node|
+            next if config['pattern'] && !node.text.match(config['pattern'])
+
+            return Plugin.new(
+              slug,
+              target,
+              opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
+            )
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/known_locations.rb
+++ b/app/finders/plugins/known_locations.rb
@@ -0,0 +1,48 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Known Locations Plugins Finder
+      class KnownLocations < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        #
+        # @return [ Array<Plugin> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(target_urls(opts), opts) do |res, slug|
+            # TODO: follow the location (from enumerate()) and remove the 301 here ?
+            # As a result, it might remove false positive due to redirection to the homepage
+            next unless [200, 401, 403, 301].include?(res.code)
+
+            found << WPScan::Plugin.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        #
+        # @return [ Hash ]
+        def target_urls(opts = {})
+          slugs       = opts[:list] || DB::Plugins.vulnerable_slugs
+          urls        = {}
+          plugins_url = target.plugins_url
+
+          slugs.each do |slug|
+            urls["#{plugins_url}#{URI.encode(slug)}/"] = slug
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Checking Known Locations -'))
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/query_parameter.rb
+++ b/app/finders/plugins/query_parameter.rb
@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from Dynamic Finder 'QueryParameter'
+      class QueryParameter < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 10
+
+        def passive(_opts = {})
+          # Handled by UrlsInHomePage, so no need to check this twice
+        end
+
+        # @param [ Hash ] opts The options from the #passive, #aggressive methods
+        # @param [ Typhoeus::Response ] response
+        # @param [ String ] slug
+        # @param [ String ] klass
+        # @param [ Hash ] config The related dynamic finder config hash
+        #
+        # @return [ Plugin ] The detected plugin in the response, related to the config
+        def process_response(opts, response, slug, klass, config)
+          # TODO: when a real case will be found
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/urls_in_homepage.rb
+++ b/app/finders/plugins/urls_in_homepage.rb
@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module Plugins
+      # URLs In Homepage Finder
+      # Typically, the items detected from URLs like
+      # /wp-content/plugins/<slug>/
+      class UrlsInHomepage < CMSScanner::Finders::Finder
+        include WpItems::URLsInHomepage
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<Plugin> ]
+        def passive(opts = {})
+          found = []
+
+          (items_from_links('plugins') + items_from_codes('plugins')).uniq.sort.each do |slug|
+            found << Plugin.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+          end
+
+          found
+        end
+      end
+    end
+  end
+end
--- a/app/finders/plugins/xpath.rb
+++ b/app/finders/plugins/xpath.rb
@@ -0,0 +1,29 @@
+module WPScan
+  module Finders
+    module Plugins
+      # Plugins finder from the Dynamic Finder 'Xpath'
+      class Xpath < WPScan::Finders::DynamicFinder::WpItems::Finder
+        DEFAULT_CONFIDENCE = 40
+
+        # @param [ Hash ] opts The options from the #passive, #aggressive methods
+        # @param [ Typhoeus::Response ] response
+        # @param [ String ] slug
+        # @param [ String ] klass
+        # @param [ Hash ] config The related dynamic finder config hash
+        #
+        # @return [ Plugin ] The detected plugin in the response, related to the config
+        def process_response(opts, response, slug, klass, config)
+          response.html.xpath(config['xpath']).each do |node|
+            next if config['pattern'] && !node.text.match(config['pattern'])
+
+            return Plugin.new(
+              slug,
+              target,
+              opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
+            )
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/theme_version.rb
+++ b/app/finders/theme_version.rb
@@ -0,0 +1,41 @@
+require_relative 'theme_version/style'
+require_relative 'theme_version/woo_framework_meta_generator'
+
+module WPScan
+  module Finders
+    module ThemeVersion
+      # Theme Version Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Theme ] theme
+        def initialize(theme)
+          finders <<
+            ThemeVersion::Style.new(theme) <<
+            ThemeVersion::WooFrameworkMetaGenerator.new(theme)
+
+          load_specific_finders(theme)
+        end
+
+        # Load the finders associated with the theme
+        #
+        # @param [ WPScan::Theme ] theme
+        def load_specific_finders(theme)
+          module_name = theme.classify
+
+          return unless Finders::ThemeVersion.constants.include?(module_name)
+
+          mod = Finders::ThemeVersion.const_get(module_name)
+
+          mod.constants.each do |constant|
+            c = mod.const_get(constant)
+
+            next unless c.is_a?(Class)
+
+            finders << c.new(theme)
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/theme_version/style.rb
+++ b/app/finders/theme_version/style.rb
@@ -0,0 +1,43 @@
+module WPScan
+  module Finders
+    module ThemeVersion
+      # Theme Version Finder from the style.css file
+      class Style < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        #
+        # @return [ Version ]
+        def passive(_opts = {})
+          return unless cached_style?
+
+          style_version
+        end
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Version ]
+        def aggressive(_opts = {})
+          return if cached_style?
+
+          style_version
+        end
+
+        # @return [ Boolean ]
+        def cached_style?
+          Typhoeus::Config.cache.get(browser.forge_request(target.style_url)) ? true : false
+        end
+
+        # @return [ Version ]
+        def style_version
+          return unless Browser.get(target.style_url).body =~ /Version:[\t ]*(?!trunk)([0-9a-z\.-]+)/i
+
+          WPScan::Version.new(
+            Regexp.last_match[1],
+            found_by: found_by,
+            confidence: 80,
+            interesting_entries: ["#{target.style_url}, Match: '#{Regexp.last_match}'"]
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/theme_version/woo_framework_meta_generator.rb
+++ b/app/finders/theme_version/woo_framework_meta_generator.rb
@@ -0,0 +1,19 @@
+module WPScan
+  module Finders
+    module ThemeVersion
+      # Theme Version Finder from the WooFramework generators
+      class WooFrameworkMetaGenerator < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        #
+        # @return [ Version ]
+        def passive(_opts = {})
+          return unless target.blog.homepage_res.body =~ Finders::MainTheme::WooFrameworkMetaGenerator::PATTERN
+
+          return unless Regexp.last_match[1] == target.slug
+
+          WPScan::Version.new(Regexp.last_match[2], found_by: found_by, confidence: 80)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/themes.rb
+++ b/app/finders/themes.rb
@@ -0,0 +1,20 @@
+require_relative 'themes/urls_in_homepage'
+require_relative 'themes/known_locations'
+
+module WPScan
+  module Finders
+    module Themes
+      # themes Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders <<
+            Themes::UrlsInHomepage.new(target) <<
+            Themes::KnownLocations.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/themes/known_locations.rb
+++ b/app/finders/themes/known_locations.rb
@@ -0,0 +1,48 @@
+module WPScan
+  module Finders
+    module Themes
+      # Known Locations Themes Finder
+      class KnownLocations < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        #
+        # @return [ Array<Theme> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(target_urls(opts), opts) do |res, slug|
+            # TODO: follow the location (from enumerate()) and remove the 301 here ?
+            # As a result, it might remove false positive due to redirection to the homepage
+            next unless [200, 401, 403, 301].include?(res.code)
+
+            found << WPScan::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        #
+        # @return [ Hash ]
+        def target_urls(opts = {})
+          slugs       = opts[:list] || DB::Themes.vulnerable_slugs
+          urls        = {}
+          themes_url  = target.url('wp-content/themes/')
+
+          slugs.each do |slug|
+            urls["#{themes_url}#{URI.encode(slug)}/"] = slug
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Checking Known Locations -'))
+        end
+      end
+    end
+  end
+end
--- a/app/finders/themes/urls_in_homepage.rb
+++ b/app/finders/themes/urls_in_homepage.rb
@@ -0,0 +1,23 @@
+module WPScan
+  module Finders
+    module Themes
+      # URLs In Homepage Finder
+      class UrlsInHomepage < CMSScanner::Finders::Finder
+        include WpItems::URLsInHomepage
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<Theme> ]
+        def passive(opts = {})
+          found = []
+
+          (items_from_links('themes') + items_from_codes('themes')).uniq.sort.each do |slug|
+            found << WPScan::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+          end
+
+          found
+        end
+      end
+    end
+  end
+end
--- a/app/finders/timthumb_version.rb
+++ b/app/finders/timthumb_version.rb
@@ -0,0 +1,17 @@
+require_relative 'timthumb_version/bad_request'
+
+module WPScan
+  module Finders
+    module TimthumbVersion
+      # Timthumb Version Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Timthumb ] target
+        def initialize(target)
+          finders << TimthumbVersion::BadRequest.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/timthumb_version/bad_request.rb
+++ b/app/finders/timthumb_version/bad_request.rb
@@ -0,0 +1,21 @@
+module WPScan
+  module Finders
+    module TimthumbVersion
+      # Timthumb Version Finder from the body of a bad request
+      # See https://code.google.com/p/timthumb/source/browse/trunk/timthumb.php#435
+      class BadRequest < CMSScanner::Finders::Finder
+        # @return [ Version ]
+        def aggressive(_opts = {})
+          return unless Browser.get(target.url).body =~ /(TimThumb version\s*: ([^<]+))/
+
+          WPScan::Version.new(
+            Regexp.last_match[2],
+            found_by: 'Bad Request (Aggressive Detection)',
+            confidence: 90,
+            interesting_entries: ["#{target.url}, Match: '#{Regexp.last_match[1]}'"]
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/timthumbs.rb
+++ b/app/finders/timthumbs.rb
@@ -0,0 +1,17 @@
+require_relative 'timthumbs/known_locations'
+
+module WPScan
+  module Finders
+    module Timthumbs
+      # Timthumbs Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders << Timthumbs::KnownLocations.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/timthumbs/known_locations.rb
+++ b/app/finders/timthumbs/known_locations.rb
@@ -0,0 +1,56 @@
+module WPScan
+  module Finders
+    module Timthumbs
+      # Known Locations Timthumbs Finder
+      class KnownLocations < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list Mandatory
+        #
+        # @return [ Array<Timthumb> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(target_urls(opts), opts) do |res|
+            next unless res.code == 400 && res.body =~ /no image specified/i
+
+            found << WPScan::Timthumb.new(res.request.url, opts.merge(found_by: found_by, confidence: 100))
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list Mandatory
+        #
+        # @return [ Hash ]
+        def target_urls(opts = {})
+          urls = {}
+
+          File.open(opts[:list]).each_with_index do |path, index|
+            urls[target.url(path.chomp)] = index
+          end
+
+          # Add potential timthumbs located in the main theme
+          if target.main_theme
+            main_theme_timthumbs_paths.each do |path|
+              urls[target.main_theme.url(path)] = 1 # index not important there
+            end
+          end
+
+          urls
+        end
+
+        def main_theme_timthumbs_paths
+          %w[timthumb.php lib/timthumb.php inc/timthumb.php includes/timthumb.php
+             scripts/timthumb.php tools/timthumb.php functions/timthumb.php]
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Checking Known Locations -'))
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users.rb
+++ b/app/finders/users.rb
@@ -0,0 +1,28 @@
+require_relative 'users/author_posts'
+require_relative 'users/wp_json_api'
+require_relative 'users/oembed_api'
+require_relative 'users/rss_generator'
+require_relative 'users/author_id_brute_forcing'
+require_relative 'users/login_error_messages'
+
+module WPScan
+  module Finders
+    module Users
+      # Users Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders <<
+            Users::AuthorPosts.new(target) <<
+            Users::WpJsonApi.new(target) <<
+            Users::OembedApi.new(target) <<
+            Users::RSSGenerator.new(target) <<
+            Users::AuthorIdBruteForcing.new(target) <<
+            Users::LoginErrorMessages.new(target)
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users/author_id_brute_forcing.rb
+++ b/app/finders/users/author_id_brute_forcing.rb
@@ -0,0 +1,111 @@
+module WPScan
+  module Finders
+    module Users
+      # Author Id Brute Forcing
+      class AuthorIdBruteForcing < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ Range ] :range Mandatory
+        #
+        # @return [ Array<User> ]
+        def aggressive(opts = {})
+          found = []
+          found_by_msg = 'Author Id Brute Forcing - %s (Aggressive Detection)'
+
+          enumerate(target_urls(opts), opts) do |res, id|
+            username, found_by, confidence = potential_username(res)
+
+            next unless username
+
+            found << CMSScanner::User.new(
+              username,
+              id: id,
+              found_by: format(found_by_msg, found_by),
+              confidence: confidence
+            )
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ Range ] :range
+        #
+        # @return [ Hash ]
+        def target_urls(opts = {})
+          urls = {}
+
+          opts[:range].each do |id|
+            urls[target.uri.join("?author=#{id}").to_s] = id
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Brute Forcing Author IDs -'))
+        end
+
+        def request_params
+          { followlocation: true }
+        end
+
+        # @param [ Typhoeus::Response ] res
+        #
+        # @return [ Array<String, String, Integer>, nil ] username, found_by, confidence
+        def potential_username(res)
+          username = username_from_author_url(res.effective_url) || username_from_response(res)
+
+          return username, 'Author Pattern', 100 if username
+
+          username = display_name_from_body(res.body)
+
+          return username, 'Display Name', 50 if username
+        end
+
+        # @param [ String ] url
+        #
+        # @return [ String, nil ]
+        def username_from_author_url(url)
+          url[%r{/author/([^/\b]+)/?}i, 1]
+        end
+
+        # @param [ Typhoeus::Response ] res
+        #
+        # @return [ String, nil ] The username found
+        def username_from_response(res)
+          # Permalink enabled
+          target.in_scope_urls(res, '//link/@href|//a/@href') do |url|
+            username = username_from_author_url(url)
+            return username if username
+          end
+
+          # No permalink
+          res.body[/<body class="archive author author-([^\s]+)[ "]/i, 1]
+        end
+
+        # @param [ String ] body
+        #
+        # @return [ String, nil ]
+        def display_name_from_body(body)
+          page = Nokogiri::HTML.parse(body)
+          # WP >= 3.0
+          page.css('h1.page-title span').each do |node|
+            return node.text.to_s
+          end
+
+          # WP < 3.0
+          page.xpath('//link[@rel="alternate" and @type="application/rss+xml"]').each do |node|
+            title = node['title']
+
+            next unless title =~ /Posts by (.*) Feed\z/i
+
+            return Regexp.last_match[1] unless Regexp.last_match[1].empty?
+          end
+          nil
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users/author_posts.rb
+++ b/app/finders/users/author_posts.rb
@@ -0,0 +1,61 @@
+module WPScan
+  module Finders
+    module Users
+      # Author Posts
+      class AuthorPosts < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<User> ]
+        def passive(opts = {})
+          found_by_msg = 'Author Posts - %s (Passive Detection)'
+
+          usernames(opts).reduce([]) do |a, e|
+            a << CMSScanner::User.new(
+              e[0],
+              found_by: format(found_by_msg, e[1]),
+              confidence: e[2]
+            )
+          end
+        end
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<Array>> ]
+        def usernames(_opts = {})
+          found = potential_usernames(target.homepage_res)
+
+          return found unless found.empty?
+
+          target.homepage_res.html.css('header.entry-header a').each do |post_url_node|
+            url = post_url_node['href']
+
+            next if url.nil? || url.empty?
+
+            found += potential_usernames(Browser.get(url))
+          end
+
+          found.compact.uniq
+        end
+
+        # @param [ Typhoeus::Response ] res
+        #
+        # @return [ Array<Array> ]
+        def potential_usernames(res)
+          usernames = []
+
+          target.in_scope_urls(res, '//a/@href') do |url, node|
+            uri = Addressable::URI.parse(url)
+
+            if uri.path =~ %r{/author/([^/\b]+)/?\z}i
+              usernames << [Regexp.last_match[1], 'Author Pattern', 100]
+            elsif uri.query =~ /author=[0-9]+/
+              usernames << [node.text.to_s.strip, 'Display Name', 30]
+            end
+          end
+
+          usernames.uniq
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users/login_error_messages.rb
+++ b/app/finders/users/login_error_messages.rb
@@ -0,0 +1,45 @@
+module WPScan
+  module Finders
+    module Users
+      # Login Error Messages
+      #
+      # Existing username:
+      #   WP < 3.1 - Incorrect password.
+      #   WP >= 3.1 - The password you entered for the username admin is incorrect.
+      # Non existent username: Invalid username.
+      #
+      class LoginErrorMessages < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        #
+        # @return [ Array<User> ]
+        def aggressive(opts = {})
+          found = []
+
+          usernames(opts).each do |username|
+            res   = target.do_login(username, SecureRandom.hex[0, 8])
+            error = res.html.css('div#login_error').text.strip
+
+            return found if error.empty? # Protection plugin / error disabled
+
+            next unless error =~ /The password you entered for the username|Incorrect Password/i
+
+            found << CMSScanner::User.new(username, found_by: found_by, confidence: 100)
+          end
+
+          found
+        end
+
+        # @return [ Array<String> ] List of usernames to check
+        def usernames(opts = {})
+          # usernames from the potential Users found
+          unames = opts[:found].map(&:username)
+
+          [*opts[:list]].each { |uname| unames << uname.chomp }
+
+          unames.uniq
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users/oembed_api.rb
+++ b/app/finders/users/oembed_api.rb
@@ -0,0 +1,49 @@
+module WPScan
+  module Finders
+    module Users
+      # Since WP 4.4, the oembed API can disclose a user
+      # https://github.com/wpscanteam/wpscan/issues/1049
+      class OembedApi < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<User> ]
+        def passive(_opts = {})
+          # TODO: get the api_url from the Homepage and query it if present,
+          # then discard the aggressive check if same/similar URL
+        end
+
+        # @param [ Hash ] opts
+        #
+        # TODO: make this code pretty :x
+        #
+        # @return [ Array<User> ]
+        def aggressive(_opts = {})
+          found        = []
+          found_by_msg = 'Oembed API - %s (Aggressive Detection)'
+
+          oembed_data = JSON.parse(Browser.get(api_url).body)
+
+          if oembed_data['author_url'] =~ %r{/author/([^/]+)/?\z}
+            details = [Regexp.last_match[1], 'Author URL', 90]
+          elsif oembed_data['author_name'] && !oembed_data['author_name'].empty?
+            details = [oembed_data['author_name'].delete(' '), 'Author Name', 70]
+          end
+
+          return unless details
+
+          found << CMSScanner::User.new(details[0],
+                                        found_by: format(found_by_msg, details[1]),
+                                        confidence: details[2],
+                                        interesting_entries: [api_url])
+        rescue JSON::ParserError
+          found
+        end
+
+        # @return [ String ] The URL of the API listing the Users
+        def api_url
+          @api_url ||= target.url("wp-json/oembed/1.0/embed?url=#{target.url}&format=json")
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users/rss_generator.rb
+++ b/app/finders/users/rss_generator.rb
@@ -0,0 +1,44 @@
+module WPScan
+  module Finders
+    module Users
+      # Users disclosed from the dc:creator field in the RSS
+      # The names disclosed are display names, however depending on the configuration of the blog,
+      # they can be the same than usernames
+      class RSSGenerator < WPScan::Finders::WpVersion::RSSGenerator
+        def process_urls(urls, _opts = {})
+          found = []
+
+          urls.each do |url|
+            res = Browser.get_and_follow_location(url)
+
+            next unless res.code == 200 && res.body =~ /<dc\:creator>/i
+
+            potential_usernames = []
+
+            begin
+              res.xml.xpath('//item/dc:creator').each do |node|
+                potential_username = node.text.to_s
+
+                # Ignoring potential username longer than 60 characters and containing accents
+                # as they are considered invalid. See https://github.com/wpscanteam/wpscan/issues/1215
+                next if potential_username.length > 60 || potential_username =~ /[^\x00-\x7F]/
+
+                potential_usernames << potential_username
+              end
+            rescue Nokogiri::XML::XPath::SyntaxError
+              next
+            end
+
+            potential_usernames.uniq.each do |potential_username|
+              found << CMSScanner::User.new(potential_username, found_by: found_by, confidence: 50)
+            end
+
+            break
+          end
+
+          found
+        end
+      end
+    end
+  end
+end
--- a/app/finders/users/wp_json_api.rb
+++ b/app/finders/users/wp_json_api.rb
@@ -0,0 +1,35 @@
+module WPScan
+  module Finders
+    module Users
+      # WP JSON API
+      #
+      # Since 4.7 - Need more investigation as it seems WP 4.7.1 reduces the exposure, see https://github.com/wpscanteam/wpscan/issues/1038)
+      #
+      class WpJsonApi < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<User> ]
+        def aggressive(_opts = {})
+          found = []
+
+          JSON.parse(Browser.get(api_url).body)&.each do |user|
+            found << CMSScanner::User.new(user['slug'],
+                                          id: user['id'],
+                                          found_by: found_by,
+                                          confidence: 100,
+                                          interesting_entries: [api_url])
+          end
+
+          found
+        rescue JSON::ParserError, TypeError
+          found
+        end
+
+        # @return [ String ] The URL of the API listing the Users
+        def api_url
+          @api_url ||= target.url('wp-json/wp/v2/users/')
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_items.rb
+++ b/app/finders/wp_items.rb
@@ -0,0 +1 @@
+require_relative 'wp_items/urls_in_homepage'
--- a/app/finders/wp_items/urls_in_homepage.rb
+++ b/app/finders/wp_items/urls_in_homepage.rb
@@ -0,0 +1,68 @@
+module WPScan
+  module Finders
+    module WpItems
+      # URLs In Homepage Module to use in plugins & themes finders
+      module URLsInHomepage
+        # @param [ String ] type plugins / themes
+        # @param [ Boolean ] uniq Wether or not to apply the #uniq on the results
+        #
+        # @return [Array<String> ] The plugins/themes detected in the href, src attributes of the homepage
+        def items_from_links(type, uniq = true)
+          found = []
+
+          target.in_scope_urls(target.homepage_res) do |url|
+            next unless url =~ item_attribute_pattern(type)
+
+            found << Regexp.last_match[1]
+          end
+
+          uniq ? found.uniq.sort : found.sort
+        end
+
+        # @param [ String ] type plugins / themes
+        # @param [ Boolean ] uniq Wether or not to apply the #uniq on the results
+        #
+        # @return [Array<String> ] The plugins/themes detected in the javascript/style of the homepage
+        def items_from_codes(type, uniq = true)
+          found = []
+
+          target.homepage_res.html.css('script,style').each do |tag|
+            code = tag.text.to_s
+            next if code.empty?
+
+            code.scan(item_code_pattern(type)).flatten.uniq.each { |slug| found << slug }
+          end
+
+          uniq ? found.uniq.sort : found.sort
+        end
+
+        # @param [ String ] type
+        #
+        # @return [ Regexp ]
+        def item_attribute_pattern(type)
+          @item_attribute_pattern ||= %r{\A#{item_url_pattern(type)}([^/]+)/}i
+        end
+
+        # @param [ String ] type
+        #
+        # @return [ Regexp ]
+        def item_code_pattern(type)
+          @item_code_pattern ||= %r{["'\( ]#{item_url_pattern(type)}([^\\\/\)"']+)}i
+        end
+
+        # @param [ String ] type
+        #
+        # @return [ Regexp ]
+        def item_url_pattern(type)
+          item_dir = type == 'plugins' ? target.plugins_dir : target.content_dir
+          item_url = type == 'plugins' ? target.plugins_url : target.content_url
+
+          url = /#{item_url.gsub(/\A(?:http|https)/i, 'https?').gsub('/', '\\\\\?\/')}/i
+          item_dir = %r{(?:#{url}|\\?\/#{item_dir.gsub('/', '\\\\\?\/')}\\?/)}i
+
+          type == 'plugins' ? item_dir : %r{#{item_dir}#{type}\\?\/}i
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_version.rb
+++ b/app/finders/wp_version.rb
@@ -0,0 +1,42 @@
+require_relative 'wp_version/rss_generator'
+require_relative 'wp_version/atom_generator'
+require_relative 'wp_version/rdf_generator'
+require_relative 'wp_version/readme'
+require_relative 'wp_version/unique_fingerprinting'
+
+module WPScan
+  module Finders
+    # Specific Finders container to filter the version detected
+    # and remove the one with low confidence to avoid false
+    # positive when there is not enought information to accurately
+    # determine it.
+    class WpVersionFinders < UniqueFinders
+      def filter_findings
+        best_finding = super
+
+        best_finding && best_finding.confidence >= 40 ? best_finding : false
+      end
+    end
+
+    module WpVersion
+      # Wp Version Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          (%w[RSSGenerator AtomGenerator RDFGenerator] +
+           WPScan::DB::DynamicFinders::Wordpress.versions_finders_configs.keys +
+           %w[Readme UniqueFingerprinting]
+          ).each do |finder_name|
+            finders << WpVersion.const_get(finder_name.to_sym).new(target)
+          end
+        end
+
+        def finders
+          @finders ||= Finders::WpVersionFinders.new
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_version/atom_generator.rb
+++ b/app/finders/wp_version/atom_generator.rb
@@ -0,0 +1,40 @@
+module WPScan
+  module Finders
+    module WpVersion
+      # Atom Generator Version Finder
+      class AtomGenerator < CMSScanner::Finders::Finder
+        include Finder::WpVersion::SmartURLChecker
+
+        def process_urls(urls, _opts = {})
+          found = Findings.new
+
+          urls.each do |url|
+            res = Browser.get_and_follow_location(url)
+
+            res.html.css('generator').each do |node|
+              next unless node.text.to_s.strip.casecmp('wordpress').zero?
+
+              found << create_version(
+                node['version'],
+                found_by: found_by,
+                entries: ["#{res.effective_url}, #{node.to_s.strip}"]
+              )
+            end
+          end
+
+          found
+        end
+
+        def passive_urls_xpath
+          '//link[@rel="alternate" and @type="application/atom+xml"]/@href'
+        end
+
+        def aggressive_urls(_opts = {})
+          %w[feed/atom/ ?feed=atom].reduce([]) do |a, uri|
+            a << target.url(uri)
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_version/rdf_generator.rb
+++ b/app/finders/wp_version/rdf_generator.rb
@@ -0,0 +1,38 @@
+module WPScan
+  module Finders
+    module WpVersion
+      # RDF Generator Version Finder
+      class RDFGenerator < CMSScanner::Finders::Finder
+        include Finder::WpVersion::SmartURLChecker
+
+        def process_urls(urls, _opts = {})
+          found = Findings.new
+
+          urls.each do |url|
+            res = Browser.get_and_follow_location(url)
+
+            res.html.xpath('//generatoragent').each do |node|
+              next unless node['rdf:resource'] =~ %r{\Ahttps?://wordpress\.(?:[a-z.]+)/\?v=(.*)\z}i
+
+              found << create_version(
+                Regexp.last_match[1],
+                found_by: found_by,
+                entries: ["#{res.effective_url}, #{node.to_s.strip}"]
+              )
+            end
+          end
+
+          found
+        end
+
+        def passive_urls_xpath
+          '//a[contains(@href, "rdf")]/@href'
+        end
+
+        def aggressive_urls(_opts = {})
+          [target.url('feed/rdf/')]
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_version/readme.rb
+++ b/app/finders/wp_version/readme.rb
@@ -0,0 +1,29 @@
+module WPScan
+  module Finders
+    module WpVersion
+      # Readme Version Finder
+      class Readme < CMSScanner::Finders::Finder
+        # @return [ WpVersion ]
+        def aggressive(_opts = {})
+          readme_url = target.url('readme.html') # Maybe move this into the Target ?
+
+          node = Browser.get(readme_url).html.css('h1#logo').last
+
+          return unless node&.text.to_s.strip =~ /\AVersion (.*)\z/i
+
+          number = Regexp.last_match(1)
+
+          return unless WPScan::WpVersion.valid?(number)
+
+          WPScan::WpVersion.new(
+            number,
+            found_by: 'Readme (Aggressive Detection)',
+            # Since WP 4.7, the Readme only contains the major version (ie 4.7, 4.8 etc)
+            confidence: number >= '4.7' ? 10 : 90,
+            interesting_entries: ["#{readme_url}, Match: '#{node.text.to_s.strip}'"]
+          )
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_version/rss_generator.rb
+++ b/app/finders/wp_version/rss_generator.rb
@@ -0,0 +1,43 @@
+module WPScan
+  module Finders
+    module WpVersion
+      # RSS Generator Version Finder
+      class RSSGenerator < CMSScanner::Finders::Finder
+        include Finder::WpVersion::SmartURLChecker
+
+        def process_urls(urls, _opts = {})
+          found = Findings.new
+
+          urls.each do |url|
+            res = Browser.get_and_follow_location(url)
+
+            res.html.xpath('//comment()[contains(., "wordpress")] | //generator').each do |node|
+              node_text = node.text.to_s.strip
+
+              next unless node_text =~ %r{\Ahttps?://wordpress\.(?:[a-z]+)/\?v=(.*)\z}i ||
+                          node_text =~ %r{\Agenerator="wordpress/([^"]+)"\z}i
+
+              found << create_version(
+                Regexp.last_match[1],
+                found_by: found_by,
+                entries: ["#{res.effective_url}, #{node.to_s.strip}"]
+              )
+            end
+          end
+
+          found
+        end
+
+        def passive_urls_xpath
+          '//link[@rel="alternate" and @type="application/rss+xml"]/@href'
+        end
+
+        def aggressive_urls(_opts = {})
+          %w[feed/ comments/feed/ feed/rss/ feed/rss2/].reduce([]) do |a, uri|
+            a << target.url(uri)
+          end
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_version/unique_fingerprinting.rb
+++ b/app/finders/wp_version/unique_fingerprinting.rb
@@ -0,0 +1,30 @@
+module WPScan
+  module Finders
+    module WpVersion
+      # Unique Fingerprinting Version Finder
+      class UniqueFingerprinting < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Fingerprinter
+
+        # @return [ WpVersion ]
+        def aggressive(opts = {})
+          fingerprint(DB::Fingerprints.wp_unique_fingerprints, opts) do |version_number, url, md5sum|
+            hydra.abort
+            progress_bar.finish
+
+            return WPScan::WpVersion.new(
+              version_number,
+              found_by: 'Unique Fingerprinting (Aggressive Detection)',
+              confidence: 100,
+              interesting_entries: ["#{url} md5sum is #{md5sum}"]
+            )
+          end
+          nil
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: 'Fingerprinting the version -'))
+        end
+      end
+    end
+  end
+end
--- a/app/models.rb
+++ b/app/models.rb
@@ -0,0 +1,10 @@
+require_relative 'models/interesting_finding'
+require_relative 'models/wp_version'
+require_relative 'models/xml_rpc'
+require_relative 'models/wp_item'
+require_relative 'models/timthumb'
+require_relative 'models/media'
+require_relative 'models/plugin'
+require_relative 'models/theme'
+require_relative 'models/config_backup'
+require_relative 'models/db_export'
--- a/app/models/config_backup.rb
+++ b/app/models/config_backup.rb
@@ -0,0 +1,5 @@
+module WPScan
+  # Config Backup
+  class ConfigBackup < InterestingFinding
+  end
+end
--- a/app/models/db_export.rb
+++ b/app/models/db_export.rb
@@ -0,0 +1,5 @@
+module WPScan
+  # DB Export
+  class DbExport < InterestingFinding
+  end
+end
--- a/app/models/interesting_finding.rb
+++ b/app/models/interesting_finding.rb
@@ -0,0 +1,6 @@
+module WPScan
+  # Custom class to include the WPScan::References module
+  class InterestingFinding < CMSScanner::InterestingFinding
+    include References
+  end
+end
--- a/app/models/media.rb
+++ b/app/models/media.rb
@@ -0,0 +1,5 @@
+module WPScan
+  # Media
+  class Media < InterestingFinding
+  end
+end
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
erwanlr	baaa11bb64	Bumps version	2018-09-28 10:57:21 +01:00
erwanlr	44e1179ce4	Fixes #1215	2018-09-28 10:33:19 +01:00
erwanlr	808521fb70	Updates deps	2018-09-28 09:20:14 +01:00
Erwan	ad8e97f432	Update README.md	2018-09-26 20:49:13 +01:00
Ryan Dewhurst	3c47652cc0	Add missing hidden files	2018-09-26 21:17:43 +02:00
Ryan Dewhurst	220ff0e3f7	Update readme	2018-09-26 21:17:02 +02:00
Ryan Dewhurst	d268a86795	HELLO v3!!!	2018-09-26 21:12:01 +02:00
Ryan Dewhurst	28b9c15256	So long hidden files!	2018-09-26 21:03:08 +02:00
Ryan Dewhurst	4f594d59cc	So long hombre	2018-09-26 21:00:28 +02:00
Ryan Dewhurst	a25b493064	Merge pull request #1211 from sudoaza/master Fixing error on missformated rss	2018-09-19 13:17:17 +02:00
aza	2acf88d83e	fixing error on missformated rss	2018-09-17 01:44:36 +02:00
Ryan Dewhurst	baf3b4bc2b	Add command line gif	2018-08-30 15:09:49 +02:00
Ryan Dewhurst	750411d9e1	Add Patreon shield/badge	2018-08-24 15:40:44 +02:00
Christian Mehlmauer	aa7b922d30	gem update	2018-07-17 17:59:01 +02:00
Christian Mehlmauer	fd660632e0	Update version for dev branch	2018-06-18 07:46:23 +02:00
Ryan Dewhurst	c7df7265ab	Ready for 2.9.4 release #1187	2018-06-15 09:40:06 +02:00
Ryan Dewhurst	42685a45b3	Missing space	2018-06-08 09:58:07 +02:00
Ryan Dewhurst	ce5d26a220	Enhacements to sql export code. Thanks to javiercasares for list.	2018-06-08 09:56:28 +02:00
Ryan Dewhurst	0e73774bd9	Add check for .sql backup files	2018-06-07 17:17:39 +02:00
Christian Mehlmauer	85b491472a	revert, just a test	2018-05-30 23:35:19 +02:00
Christian Mehlmauer	4b382acbad	change twitter handle	2018-05-30 23:32:46 +02:00
Ryan Dewhurst	12d15bfc7e	Update data.zip file	2018-05-30 14:39:58 +02:00
Ryan Dewhurst	ea1b6b9c17	Update version information	2018-05-30 14:39:31 +02:00
Ryan Dewhurst	5cb2d16601	Remove Gemnasium as deprecated	2018-05-30 12:56:25 +02:00
Christian Mehlmauer	913717bcf7	update gems	2018-05-30 12:51:50 +02:00
Ryan Dewhurst	99fe1855d9	Output is not plugin specific	2018-05-23 14:54:34 +02:00
Ryan Dewhurst	e2eb94be22	Grammar	2018-05-23 14:46:28 +02:00
Ryan Dewhurst	aca1b487ba	Remove spacer in output	2018-05-23 14:44:53 +02:00
Ryan Dewhurst	5820c53d0f	More informative output	2018-05-23 14:32:04 +02:00
Christian Mehlmauer	9298758acd	Merge pull request #1182 from g0tmi1k/users Multiple Features	2018-05-22 12:40:52 +02:00
g0tmi1k	a981c2b17b	@FireFart's suggestions	2018-05-22 10:06:57 +01:00
g0tmi1k	a783b53107	Fix grammar ..and bots	2018-05-15 11:17:03 +01:00
g0tmi1k	cf2881fda6	Fix bots issues? ...Happy now? Please?	2018-05-15 10:47:55 +01:00
g0tmi1k	59368a72bd	Don't fail silent.	2018-05-15 10:39:16 +01:00
g0tmi1k	439900a1ea	Misc fixes	2018-05-15 09:05:58 +01:00
g0tmi1k	44557797b0	Update data.zip location to be $HOME	2018-05-15 08:19:44 +01:00
g0tmi1k	ba065d5974	...Removed too much fat.	2018-05-15 08:09:24 +01:00
g0tmi1k	105e9cbcac	Sorted out .ignore & files + removed some fat	2018-05-15 07:52:40 +01:00
g0tmi1k	fe277c1e89	Make travis happy	2018-05-15 07:12:02 +01:00
g0tmi1k	b5e3e6280e	Trying to make code climate happier	2018-05-14 18:08:42 +01:00
g0tmi1k	f90a64ce81	Tried to make code climate happy	2018-05-14 17:56:49 +01:00
g0tmi1k	b9fa1e3587	Misc fixes and typos	2018-05-14 16:37:14 +01:00
g0tmi1k	4333ecb989	Check for sitemaps (using /robots.txt)	2018-05-14 16:36:52 +01:00
g0tmi1k	715d3d4ad6	Moved http response to a function	2018-05-14 16:35:41 +01:00
g0tmi1k	38f70a88ae	Follow any redirections (e.g. http -> https)	2018-05-14 16:17:12 +01:00
g0tmi1k	4b4b968710	Check HTTP status of each value in /robots.txt	2018-05-14 15:57:33 +01:00
g0tmi1k	3b94fc49a7	Fix EOL issue when checking /robots.txt	2018-05-14 15:12:35 +01:00
g0tmi1k	e41aab3a80	Re-worked off-line update only as a fall back (when possible)	2018-05-14 15:12:20 +01:00
g0tmi1k	9450ba6cc5	Add RSS author information	2018-05-14 13:44:02 +01:00
g0tmi1k	ae3c164350	Improved API output results	2018-05-14 13:43:49 +01:00
g0tmi1k	24e6820a90	Clean up wording	2018-05-14 13:43:33 +01:00
g0tmi1k	0e05f77fb7	Made offline extraction more verbose	2018-05-14 13:37:34 +01:00
g0tmi1k	de960ff9db	Fix offline extraction zip bug	2018-05-11 18:18:19 +01:00
g0tmi1k	1d0128af72	Move spacer to a function	2018-05-11 18:07:57 +01:00
g0tmi1k	285b1a1733	Cleaner output and fix a typo	2018-05-11 17:10:02 +01:00
g0tmi1k	ab67816dd9	Check for API access and /wp-json/'s users output	2018-05-11 17:01:06 +01:00
g0tmi1k	fea6665876	Re-order output around slightly	2018-05-11 16:59:25 +01:00
g0tmi1k	6cbc8c9924	Clean up some output confusion	2018-05-11 16:58:47 +01:00
g0tmi1k	f542a50213	Remove debug statement	2018-05-11 12:24:11 +01:00
g0tmi1k	fa430606ce	Move the last item to ~/.wpscan/	2018-05-11 11:25:18 +01:00
g0tmi1k	05d27c64be	Check location before using them	2018-05-11 11:21:14 +01:00
g0tmi1k	0cd680bb29	Add dev information to file locations	2018-05-11 11:20:58 +01:00
g0tmi1k	ced94a7338	Fix up .gitignore	2018-05-11 11:20:20 +01:00
g0tmi1k	b65a4d0a60	Fix up gemfile	2018-05-11 11:20:03 +01:00
g0tmi1k	2b85b44bd1	Add offline database update support	2018-05-11 11:19:51 +01:00
g0tmi1k	991c87a89e	Fix inconsistencies with line endings	2018-05-09 16:35:54 +01:00
g0tmi1k	37a72f0c72	Add /.well-known/security.txt check See https://securitytxt.org/	2018-05-09 16:34:30 +01:00
g0tmi1k	6c0a21c80d	Add /humans.txt check See http://humanstxt.org/	2018-05-09 16:33:44 +01:00
g0tmi1k	dc48008d43	Bug with user-agent being shown	2018-05-09 16:16:18 +01:00
g0tmi1k	5720d29492	Fix inconsistencies with line endings	2018-05-09 16:11:09 +01:00
g0tmi1k	358f3d59d8	Say when to use --force	2018-05-09 16:04:01 +01:00
g0tmi1k	b6c6a46d25	Remove un-needed single quotes in output	2018-05-09 13:58:23 +01:00
g0tmi1k	25c393d557	gitignore cleanup	2018-05-09 13:58:04 +01:00
g0tmi1k	435fb34233	Check for user-agents.txt before using it	2018-05-09 13:15:12 +01:00
g0tmi1k	2c40913a64	Misc wording fixes	2018-05-09 13:14:41 +01:00
g0tmi1k	e437b952da	Move timthumbs.txt to all the other data.zip files	2018-05-09 13:14:05 +01:00
g0tmi1k	282c595b38	Improve user prompt	2018-05-09 13:13:07 +01:00
g0tmi1k	c2c8d63e75	Show database date when updating	2018-05-09 13:12:27 +01:00
g0tmi1k	ad21d97d11	Grammar police!	2018-05-09 13:11:46 +01:00
g0tmi1k	5c27c78ed0	Add friendly reminder about using -u / --url	2018-05-09 13:10:34 +01:00
g0tmi1k	a53e9a5e12	Show the file being downloaded with verbose	2018-05-09 13:09:58 +01:00
g0tmi1k	c8036692ee	Display user-agent with verbose mode (Handy with --random-agent)	2018-05-09 13:09:33 +01:00
Ryan Dewhurst	b9535a3648	Merge pull request #1180 from g0tmi1k/fixes Stop trying to execute when it shouldn't	2018-05-09 10:05:14 +02:00
Ryan Dewhurst	651c364fa9	Merge pull request #1181 from g0tmi1k/users Add a quick message about doing more wordpress users to usage	2018-05-09 10:03:49 +02:00
g0tmi1k	958410d4c9	Add a quick message about doing more wordpress users to usage	2018-05-08 17:19:33 +01:00
g0tmi1k	e9fba126d2	Stop trying to execute when it shouldn't	2018-05-08 17:14:48 +01:00
Christian Mehlmauer	95d39cce5a	resolve	2018-05-08 07:53:45 +02:00
Christian Mehlmauer	32d9afdf9b	update	2018-05-08 07:52:51 +02:00
Christian Mehlmauer	7e9a4168ff	update	2018-05-08 07:50:32 +02:00
Christian Mehlmauer	9d6415a89b	update gems	2018-03-28 00:25:48 +02:00
erwanlr	1499b07176	Fixes #1152	2018-01-30 19:59:41 +00:00
Christian Mehlmauer	9c7188a312	Merge branch 'master' of github.com:wpscanteam/wpscan	2018-01-11 07:25:05 +01:00
Christian Mehlmauer	b63e28c150	update readme	2018-01-11 07:24:51 +01:00
ethicalhack3r	50d48902cf	Happy New Year!	2018-01-09 17:14:42 +01:00
Christian Mehlmauer	aa6899cbc5	ruby upgrade	2017-12-27 00:50:33 +01:00
Christian Mehlmauer	94e6b2eab6	upgrade ruby	2017-12-27 00:41:04 +01:00
erwanlr	54c0e79c58	Fixes #1154	2017-12-11 09:21:56 +00:00
erwanlr	859d7f1c60	Fixes spec, Ref #1147	2017-12-11 09:08:25 +00:00
Christian Mehlmauer	166112209e	fix #1147	2017-12-06 19:18:15 +01:00
Christian Mehlmauer	952395d0c1	try to fix travis	2017-11-25 16:37:30 +01:00
Christian Mehlmauer	c7061f8a51	try to fix travis	2017-11-25 16:34:01 +01:00
Erwan	0c71bce221	Fix #1149	2017-11-24 08:43:20 +00:00
Christian Mehlmauer	b2b4eebd78	Merge branch 'master' of github.com:wpscanteam/wpscan	2017-11-14 19:41:24 +01:00
Christian Mehlmauer	5257a8b997	update	2017-11-14 19:41:15 +01:00
ethicalhack3r	9844f9d8ab	Remove --max-threads option from output. Fix #1142	2017-11-08 10:59:33 +01:00
Christian Mehlmauer	000f275263	update bundler	2017-11-01 19:47:14 +01:00
Christian Mehlmauer	e5077c490a	Merge branch 'master' of github.com:wpscanteam/wpscan	2017-10-22 00:36:25 +02:00
Christian Mehlmauer	d76968c15f	update	2017-10-22 00:36:16 +02:00
Ryan Dewhurst	289ef5b0dd	Remove some known issues. Fix #1141	2017-10-11 10:51:19 +02:00
Ryan Dewhurst	7ec227873c	Update wording	2017-10-11 10:49:43 +02:00
Ryan Dewhurst	1deccfd477	Remove space	2017-10-11 10:40:10 +02:00
Ryan Dewhurst	286e6bd51a	Update banner	2017-10-11 10:35:11 +02:00
Ryan Dewhurst	8167fa2e17	Remove CREDITS file	2017-10-11 10:34:17 +02:00
Ryan Dewhurst	c960df0bb1	Update copyright dates	2017-10-11 10:31:12 +02:00
Christian Mehlmauer	ebf8d31c6c	specs	2017-10-09 12:59:43 +02:00
Christian Mehlmauer	082ae650fc	specs	2017-10-09 12:53:18 +02:00
Christian Mehlmauer	2f5599c863	specs	2017-10-09 12:43:35 +02:00
Christian Mehlmauer	a764bdd993	update	2017-10-09 12:30:28 +02:00
Christian Mehlmauer	ef46d2c956	update readme and changelog files	2017-10-09 12:26:09 +02:00
Christian Mehlmauer	d2c2c1defb	update	2017-09-18 20:40:51 +02:00
ethicalhack3r	dede023ec8	Update to Ruby 2.4.2	2017-09-14 19:50:31 +02:00
ethicalhack3r	d8a9b3aa77	Only show readme.html output when wp <= 4.8 #1127	2017-09-14 19:12:37 +02:00
Christian Mehlmauer	ad364e6a2e	bundle update	2017-09-04 20:01:19 +02:00
Christian Mehlmauer	523954e507	bundle update	2017-08-11 10:08:25 +02:00
Christian Mehlmauer	872bbdb8e0	more output	2017-08-01 18:19:03 +02:00
Christian Mehlmauer	3ca8727b64	Merge branch 'master' of github.com:wpscanteam/wpscan	2017-08-01 18:15:50 +02:00
Christian Mehlmauer	1d3ca87772	better output	2017-08-01 18:15:37 +02:00
Christian Mehlmauer	90c42f42a1	Update README.md	2017-07-21 13:25:38 +02:00
@@ -1 +1 @@
 .4.1
 .5.0
				`@@ -0,0 +1 @@`
				`require_relative 'wp_items/urls_in_homepage'`