Bumps version

Fixes #1378
Adds DFs
2019-08-06 16:10:21 +01:00 · 2019-08-06 13:01:22 +01:00 · 2019-08-03 10:56:22 +01:00 · 2019-08-03 10:19:49 +02:00 · 2019-08-01 05:31:24 +00:00 · 2019-07-31 15:46:59 +01:00
1416 changed files with 310125 additions and 1629 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -8,8 +8,9 @@ spec/
 .*
 **/*.md
 *.md
+!README.md
 Dockerfile
 **/*.orig
 *.orig
-bin/wpscan-docker*
+bin/wpscan-*
 .wpscan/
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,3 +1,14 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Before submitting an issue, please make sure you fully read any potential error messages output and did some research on your own.
+
 ### Subject of the issue
 Describe your issue here.

@@ -24,4 +35,4 @@ Things you have tried (where relevant):
 * Update Ruby to the latest version [ ]
 * Ensure you can reach the target site using cURL [ ]
 * Proxied WPScan through a HTTP proxy to view the raw traffic [ ]
-* Ensure you are using a supported Operating System (Linux and macOS) [ ]
+* Ensure you are using a supported Operating System (Linux and macOS) [ ]
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
--- a/.github/ISSUE_TEMPLATE/other-issue.md
+++ b/.github/ISSUE_TEMPLATE/other-issue.md
@@ -0,0 +1,10 @@
+---
+name: Other Issue
+about: Create a report which is not a related to a Bug or Feature
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Before submitting an issue, please make sure you fully read any potential error messages output and did some research on your own.
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,15 @@ Gemfile.lock
 _yardoc
 doc/
 .wpscan/
+
+.ash_history
+.DS_Store
+.DS_Store?
+.idea/
+
+# Old files from v2
+cache/
+data/
+
+# Profiling reports
+bin/memprof*.report
--- a/.rspec
+++ b/.rspec
@@ -1,2 +1,3 @@
 --color
 --fail-fast
+--require spec_helper
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,5 +1,6 @@
+require: rubocop-performance
 AllCops:
-  TargetRubyVersion: 2.3
+  TargetRubyVersion: 2.4
  Exclude:
  - '*.gemspec'
  - 'vendor/**/*'
@@ -9,6 +10,8 @@ LineLength:
  Max: 120
 MethodLength:
  Max: 20
+  Exclude:
+  - 'app/controllers/enumeration/cli_options.rb'
 Lint/UriEscapeUnescape:
  Enabled: false
 Metrics/AbcSize:
@@ -18,11 +21,11 @@ Metrics/BlockLength:
  - 'spec/**/*'
 Metrics/ClassLength:
  Max: 150
+  Exclude:
+  - 'app/controllers/enumeration/cli_options.rb'
 Metrics/CyclomaticComplexity:
  Max: 8
 Style/Documentation:
  Enabled: false
-Style/FrozenStringLiteralComment:
-  Enabled: false
 Style/FormatStringToken:
  Enabled: false
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.5.0
+2.6.2
--- a/.simplecov
+++ b/.simplecov
@@ -0,0 +1,4 @@
+SimpleCov.start do
+  add_filter '/spec/'
+  add_filter 'helper'
+end
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,24 +2,26 @@ language: ruby
 sudo: false
 cache: bundler
 rvm:
-  - 2.3.0
-  - 2.3.1
-  - 2.3.2
-  - 2.3.3
-  - 2.3.4
-  - 2.3.5
-  - 2.3.6
-  - 2.3.7
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
+  - 2.4.5
+  - 2.4.6
  - 2.5.0
  - 2.5.1
+  - 2.5.2
+  - 2.5.3
+  - 2.5.4
+  - 2.5.5
+  - 2.6.0
+  - 2.6.1
+  - 2.6.2
+  - 2.6.3
  - ruby-head
 before_install:
  - "echo 'gem: --no-ri --no-rdoc' > ~/.gemrc"
-  - "gem update --system"
+  - gem update --system
 matrix:
  allow_failures:
    - rvm: ruby-head
--- a/36
+++ b/36
@@ -1,27 +1,41 @@
-FROM ruby:2.5-alpine
-MAINTAINER WPScan Team <team@wpscan.org>
+FROM ruby:2.6.3-alpine AS builder
+LABEL maintainer="WPScan Team <team@wpscan.org>"

 ARG BUNDLER_ARGS="--jobs=8 --without test development"

-RUN adduser -h /wpscan -g WPScan -D wpscan
 RUN echo "gem: --no-ri --no-rdoc" > /etc/gemrc

 COPY . /wpscan
-RUN chown -R wpscan:wpscan /wpscan

-# runtime dependencies
-RUN apk add --no-cache libcurl procps sqlite-libs && \
-  # build dependencies
-  apk add --no-cache --virtual build-deps git libcurl ruby-dev libffi-dev make gcc musl-dev zlib-dev procps sqlite-dev && \
-  bundle install --system --gemfile=/wpscan/Gemfile $BUNDLER_ARGS && \
-  apk del --no-cache build-deps
+RUN apk add --no-cache git libcurl ruby-dev libffi-dev make gcc musl-dev zlib-dev procps sqlite-dev && \
+  bundle install --system --clean --no-cache --gemfile=/wpscan/Gemfile $BUNDLER_ARGS && \
+  # temp fix for https://github.com/bundler/bundler/issues/6680
+  rm -rf /usr/local/bundle/cache

 WORKDIR /wpscan
 RUN rake install --trace

+# needed so non superusers can read gems
+RUN chmod -R a+r /usr/local/bundle
+
+
+FROM ruby:2.6.3-alpine
+LABEL maintainer="WPScan Team <team@wpscan.org>"
+
+RUN adduser -h /wpscan -g WPScan -D wpscan
+
+COPY --from=builder /usr/local/bundle /usr/local/bundle
+
+RUN chown -R wpscan:wpscan /wpscan
+
+# runtime dependencies
+RUN apk add --no-cache libcurl procps sqlite-libs
+
+WORKDIR /wpscan
+
 USER wpscan
+
 RUN /usr/local/bundle/bin/wpscan --update --verbose

 ENTRYPOINT ["/usr/local/bundle/bin/wpscan"]
 CMD ["--help"]
-
--- a/4
+++ b/4
@@ -1,2 +1,6 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 gemspec
+
+# gem 'cms_scanner', branch: 'xxx', git: 'https://github.com/wpscanteam/CMSScanner.git'
--- a/10
+++ b/10
@@ -1,14 +1,14 @@
 WPScan Public Source License

-The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2018 WPScan Team.
+The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2019 WPScan Team.

 Cases that include commercialization of WPScan require a commercial, non-free license. Otherwise, WPScan can be used without charge under the terms set out below.

 1. Definitions

-1.1 “License” means this document.
-1.2 “Contributor” means each individual or legal entity that creates, contributes to the creation of, or owns WPScan.
-1.3 “WPScan Team” means WPScan’s core developers, an updated list of whom can be found within the CREDITS file.
+1.1 "License" means this document.
+1.2 "Contributor" means each individual or legal entity that creates, contributes to the creation of, or owns WPScan.
+1.3 "WPScan Team" means WPScan’s core developers.

 2. Commercialization

@@ -59,7 +59,7 @@ WPScan is provided under an AS-IS basis and without any support, updates or main

 8. Disclaimer of Warranty

-WPScan is provided under this License on an “as is” basis, without warranty of any kind, either expressed, implied, or statutory, including, without limitation, warranties that the WPScan is free of defects, merchantable, fit for a particular purpose or non-infringing.
+WPScan is provided under this License on an "as is" basis, without warranty of any kind, either expressed, implied, or statutory, including, without limitation, warranties that the WPScan is free of defects, merchantable, fit for a particular purpose or non-infringing.

 9. Limitation of Liability

--- a/README.md
+++ b/README.md
@@ -1,29 +1,49 @@
-![alt text](https://raw.githubusercontent.com/wpscanteam/wpscan/gh-pages/wpscan_logo_407x80.png "WPScan - WordPress Security Scanner")
+<p align="center">
+  <a href="https://wpscan.org/">
+    <img src="https://raw.githubusercontent.com/wpscanteam/wpscan/gh-pages/images/wpscan_logo.png" alt="WPScan logo">
+  </a>
+</p>

-[![Gem Version](https://badge.fury.io/rb/wpscan.svg)](https://badge.fury.io/rb/wpscan)
-[![Build Status](https://travis-ci.org/wpscanteam/wpscan.svg?branch=master)](https://travis-ci.org/wpscanteam/wpscan-v3)
-[![Code Climate](https://codeclimate.com/github/wpscanteam/wpscan/badges/gpa.svg)](https://codeclimate.com/github/wpscanteam/wpscan)
-[![Patreon Donate](https://img.shields.io/badge/patreon-donate-green.svg)](https://www.patreon.com/wpscan)
+<h3 align="center">WPScan</h3>
+
+<p align="center">
+  WordPress Vulnerability Scanner
+  <br>
+  <br>
+  <a href="https://wpscan.org/" title="homepage" target="_blank">Homepage</a> - <a href="https://wpscan.io/" title="wpscan.io" target="_blank">WPScan.io</a> - <a href="https://wpvulndb.com/" title="vulnerability database" target="_blank">Vulnerability Database</a> - <a href="https://wordpress.org/plugins/wpscan/" title="wordpress plugin" target="_blank">WordPress Plugin</a>
+</p>
+
+<p align="center">
+  <a href="https://badge.fury.io/rb/wpscan" target="_blank"><img src="https://badge.fury.io/rb/wpscan.svg"></a>
+  <a href="https://travis-ci.org/wpscanteam/wpscan" target="_blank"><img src="https://travis-ci.org/wpscanteam/wpscan.svg?branch=master"></a>
+  <a href="https://codeclimate.com/github/wpscanteam/wpscan" target="_blank"><img src="https://codeclimate.com/github/wpscanteam/wpscan/badges/gpa.svg"></a>
+</p>

 # INSTALL

-## Prerequisites:
+## Prerequisites

- Ruby >= 2.2.2 - Recommended: 2.3.3
- Curl >= 7.21  - Recommended: latest - FYI the 7.29 has a segfault
+- (Optional but highly recommended: [RVM](https://rvm.io/rvm/install))
+- Ruby >= 2.3 - Recommended: latest
+  - Ruby 2.5.0 to 2.5.3 can cause an 'undefined symbol: rmpd_util_str_to_d' error in some systems, see [#1283](https://github.com/wpscanteam/wpscan/issues/1283)
+- Curl >= 7.21  - Recommended: latest
+  - The 7.29 has a segfault
 - RubyGems      - Recommended: latest
+- Nokogiri might require packages to be installed via your package manager depending on your OS, see https://nokogiri.org/tutorials/installing_nokogiri.html

-### From RubyGems:
+### From RubyGems (Recommended)

-```
+```shell
 gem install wpscan
 ```

-### From sources:
+On MacOSX, if a ```Gem::FilePermissionError``` is raised due to the Apple's System Integrity Protection (SIP), either install RVM and install wpscan again, or run ```sudo gem install -n /usr/local/bin wpscan``` (see [#1286](https://github.com/wpscanteam/wpscan/issues/1286))
+
+### From sources (NOT Recommended)

 Prerequisites: Git

-```
+```shell
 git clone https://github.com/wpscanteam/wpscan

 cd wpscan/
@@ -31,10 +51,30 @@ cd wpscan/
 bundle install && rake install
 ```

+# Updating
+
+You can update the local database by using ```wpscan --update```
+
+Updating WPScan itself is either done via ```gem update wpscan``` or the packages manager (this is quite important for distributions such as in Kali Linux: ```apt-get update && apt-get upgrade```) depending how WPScan was (pre)installed
+
 # Docker

 Pull the repo with ```docker pull wpscanteam/wpscan```

+Enumerating usernames
+
+```shell
+docker run -it --rm wpscanteam/wpscan --url https://target.tld/ --enumerate u
+```
+
+Enumerating a range of usernames
+
+```shell
+docker run -it --rm wpscanteam/wpscan --url https://target.tld/ --enumerate u1-100
+```
+
+** replace u1-100 with a range of your choice.
+
 # Usage

 ```wpscan --url blog.tld``` This will scan the blog using default options with a good compromise between speed and accuracy. For example, the plugins will be checked passively but their version with a mixed detection mode (passively + aggressively). Potential config backup files will also be checked, along with other interesting findings. If a more stealthy approach is required, then ```wpscan --stealthy --url blog.tld``` can be used.
@@ -46,42 +86,50 @@ The DB is located at ~/.wpscan/db

 WPScan can load all options (including the --url) from configuration files, the following locations are checked (order: first to last):

-* ~/.wpscan/cli_options.json
-* ~/.wpscan/cli_options.yml
-* pwd/.wpscan/cli_options.json
-* pwd/.wpscan/cli_options.yml
+- ~/.wpscan/cli_options.json
+- ~/.wpscan/cli_options.yml
+- pwd/.wpscan/cli_options.json
+- pwd/.wpscan/cli_options.yml

 If those files exist, options from them will be loaded and overridden if found twice.

 e.g:

 ~/.wpscan/cli_options.yml:
-```
+
+```yml
 proxy: 'http://127.0.0.1:8080'
 verbose: true
 ```

 pwd/.wpscan/cli_options.yml:
-```
+
+```yml
 proxy: 'socks5://127.0.0.1:9090'
 url: 'http://target.tld'
 ```

 Running ```wpscan``` in the current directory (pwd), is the same as ```wpscan -v --proxy socks5://127.0.0.1:9090 --url http://target.tld```

-# PROJECT HOME
+Enumerating usernames

-[https://wpscan.org](https://wpscan.org)
+```shell
+wpscan --url https://target.tld/ --enumerate u
+```

-# VULNERABILITY DATABASE
+Enumerating a range of usernames

-[https://wpvulndb.com](https://wpvulndb.com)
+```shell
+wpscan --url https://target.tld/ --enumerate u1-100
+```
+
+** replace u1-100 with a range of your choice.

 # LICENSE

 ## WPScan Public Source License

-The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2018 WPScan Team.
+The WPScan software (henceforth referred to simply as "WPScan") is dual-licensed - Copyright 2011-2019 WPScan Team.

 Cases that include commercialization of WPScan require a commercial, non-free license. Otherwise, WPScan can be used without charge under the terms set out below.

@@ -91,7 +139,7 @@ Cases that include commercialization of WPScan require a commercial, non-free li

 1.2 "Contributor" means each individual or legal entity that creates, contributes to the creation of, or owns WPScan.

-1.3 "WPScan Team" means WPScan’s core developers, an updated list of whom can be found within the CREDITS file.
+1.3 "WPScan Team" means WPScan’s core developers.

 ### 2. Commercialization

@@ -99,30 +147,28 @@ A commercial use is one intended for commercial advantage or monetary compensati

 Example cases of commercialization are:

- - Using WPScan to provide commercial managed/Software-as-a-Service services.
- - Distributing WPScan as a commercial product or as part of one.
- - Using WPScan as a value added service/product.
+- Using WPScan to provide commercial managed/Software-as-a-Service services.
+- Distributing WPScan as a commercial product or as part of one.
+- Using WPScan as a value added service/product.

 Example cases which do not require a commercial license, and thus fall under the terms set out below, include (but are not limited to):

- - Penetration testers (or penetration testing organizations) using WPScan as part of their assessment toolkit.
- - Penetration Testing Linux Distributions including but not limited to Kali Linux, SamuraiWTF, BackBox Linux.
- - Using WPScan to test your own systems.
- - Any non-commercial use of WPScan.
+- Penetration testers (or penetration testing organizations) using WPScan as part of their assessment toolkit.
+- Penetration Testing Linux Distributions including but not limited to Kali Linux, SamuraiWTF, BackBox Linux.
+- Using WPScan to test your own systems.
+- Any non-commercial use of WPScan.

 If you need to purchase a commercial license or are unsure whether you need to purchase a commercial license contact us - team@wpscan.org.

-We may grant commercial licenses at no monetary cost at our own discretion if the commercial usage is deemed by the WPScan Team to significantly benefit WPScan.
-
 Free-use Terms and Conditions;

 ### 3. Redistribution

 Redistribution is permitted under the following conditions:

- - Unmodified License is provided with WPScan.
- - Unmodified Copyright notices are provided with WPScan.
- - Does not conflict with the commercialization clause.
+- Unmodified License is provided with WPScan.
+- Unmodified Copyright notices are provided with WPScan.
+- Does not conflict with the commercialization clause.

 ### 4. Copying

--- a/app/app.rb
+++ b/app/app.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'models'
 require_relative 'finders'
 require_relative 'controllers'
--- a/app/controllers.rb
+++ b/app/controllers.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'controllers/core'
 require_relative 'controllers/custom_directories'
 require_relative 'controllers/wp_version'
--- a/app/controllers/aliases.rb
+++ b/app/controllers/aliases.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Controller to add the aliases in the CLI
--- a/app/controllers/core.rb
+++ b/app/controllers/core.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Specific Core controller to include WordPress checks
@@ -5,15 +7,15 @@ module WPScan
      # @return [ Array<OptParseValidator::Opt> ]
      def cli_options
        [OptURL.new(['--url URL', 'The URL of the blog to scan'],
-                    required_unless: %i[update help version], default_protocol: 'http')] +
+                    required_unless: %i[update help hh version], default_protocol: 'http')] +
          super.drop(1) + # delete the --url from CMSScanner
          [
            OptChoice.new(['--server SERVER', 'Force the supplied server module to be loaded'],
                          choices: %w[apache iis nginx],
-                          normalize: %i[downcase to_sym]),
+                          normalize: %i[downcase to_sym],
+                          advanced: true),
            OptBoolean.new(['--force', 'Do not check if the target is running WordPress']),
-            OptBoolean.new(['--[no-]update', 'Wether or not to update the Database'],
-                           required_unless: %i[url help version])
+            OptBoolean.new(['--[no-]update', 'Whether or not to update the Database'])
          ]
      end

@@ -25,53 +27,56 @@ module WPScan
      # @return [ Boolean ]
      def update_db_required?
        if local_db.missing_files?
-          raise MissingDatabaseFile if parsed_options[:update] == false
+          raise Error::MissingDatabaseFile if ParsedCli.update == false

          return true
        end

-        return parsed_options[:update] unless parsed_options[:update].nil?
+        return ParsedCli.update unless ParsedCli.update.nil?

        return false unless user_interaction? && local_db.outdated?

        output('@notice', msg: 'It seems like you have not updated the database for some time.')
        print '[?] Do you want to update now? [Y]es [N]o, default: [N]'

-        Readline.readline =~ /^y/i ? true : false
+        /^y/i.match?(Readline.readline) ? true : false
      end

      def update_db
        output('db_update_started')
-        output('db_update_finished', updated: local_db.update, verbose: parsed_options[:verbose])
+        output('db_update_finished', updated: local_db.update, verbose: ParsedCli.verbose)

-        exit(0) unless parsed_options[:url]
+        exit(0) unless ParsedCli.url
      end

      def before_scan
        @last_update = local_db.last_update

-        maybe_output_banner_help_and_version # From CMS Scanner
+        maybe_output_banner_help_and_version # From CMSScanner

        update_db if update_db_required?
        setup_cache
        check_target_availability
        load_server_module
        check_wordpress_state
+      rescue Error::NotWordPress => e
+        target.maybe_add_cookies
+        raise e unless target.wordpress?(ParsedCli.detection_mode)
      end

      # Raises errors if the target is hosted on wordpress.com or is not running WordPress
      # Also check if the homepage_url is still the install url
      def check_wordpress_state
-        raise WordPressHostedError if target.wordpress_hosted?
+        raise Error::WordPressHosted if target.wordpress_hosted?

-        if Addressable::URI.parse(target.homepage_url).path =~ %r{/wp-admin/install.php$}i
+        if %r{/wp-admin/install.php$}i.match?(Addressable::URI.parse(target.homepage_url).path)

          output('not_fully_configured', url: target.homepage_url)

          exit(WPScan::ExitCode::VULNERABLE)
        end

-        raise NotWordPressError unless target.wordpress? || parsed_options[:force]
+        raise Error::NotWordPress unless target.wordpress?(ParsedCli.detection_mode) || ParsedCli.force
      end

      # Loads the related server module in the target
@@ -83,7 +88,7 @@ module WPScan
        server = target.server || :Apache # Tries to auto detect the server

        # Force a specific server module to be loaded if supplied
-        case parsed_options[:server]
+        case ParsedCli.server
        when :apache
          server = :Apache
        when :iis
@@ -95,7 +100,7 @@ module WPScan
        mod = CMSScanner::Target::Server.const_get(server)

        target.extend mod
-        WPScan::WpItem.include mod
+        Model::WpItem.include mod

        server
      end
--- a/app/controllers/custom_directories.rb
+++ b/app/controllers/custom_directories.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Controller to ensure that the wp-content and wp-plugins
@@ -5,18 +7,20 @@ module WPScan
    class CustomDirectories < CMSScanner::Controller::Base
      def cli_options
        [
-          OptString.new(['--wp-content-dir DIR']),
-          OptString.new(['--wp-plugins-dir DIR'])
+          OptString.new(['--wp-content-dir DIR',
+                         'The wp-content directory if custom or not detected, such as "wp-content"']),
+          OptString.new(['--wp-plugins-dir DIR',
+                         'The plugins directory if custom or not detected, such as "wp-content/plugins"'])
        ]
      end

      def before_scan
-        target.content_dir = parsed_options[:wp_content_dir] if parsed_options[:wp_content_dir]
-        target.plugins_dir = parsed_options[:wp_plugins_dir] if parsed_options[:wp_plugins_dir]
+        target.content_dir = ParsedCli.wp_content_dir if ParsedCli.wp_content_dir
+        target.plugins_dir = ParsedCli.wp_plugins_dir if ParsedCli.wp_plugins_dir

-        return if target.content_dir
+        return if target.content_dir(ParsedCli.detection_mode)

-        raise 'Unable to identify the wp-content dir, please supply it with --wp-content-dir'
+        raise Error::WpContentDirNotDetected
      end
    end
  end
--- a/app/controllers/enumeration.rb
+++ b/app/controllers/enumeration.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'enumeration/cli_options'
 require_relative 'enumeration/enum_methods'

@@ -5,13 +7,8 @@ module WPScan
  module Controller
    # Enumeration Controller
    class Enumeration < CMSScanner::Controller::Base
-      def before_scan
-        DB::DynamicFinders::Plugin.create_versions_finders
-        DB::DynamicFinders::Theme.create_versions_finders
-      end
-
      def run
-        enum = parsed_options[:enumerate] || {}
+        enum = ParsedCli.enumerate || {}

        enum_plugins if enum_plugins?(enum)
        enum_themes  if enum_themes?(enum)
--- a/app/controllers/enumeration/cli_options.rb
+++ b/app/controllers/enumeration/cli_options.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Enumeration CLI Options
@@ -9,23 +11,25 @@ module WPScan
      end

      # @return [ Array<OptParseValidator::OptBase> ]
-      # rubocop:disable Metrics/MethodLength
      def cli_enum_choices
        [
          OptMultiChoices.new(
-            ['--enumerate [OPTS]', '-e', 'Enumeration Process'],
+            ['-e', '--enumerate [OPTS]', 'Enumeration Process'],
            choices: {
-              vp:  OptBoolean.new(['--vulnerable-plugins']),
-              ap:  OptBoolean.new(['--all-plugins']),
-              p:   OptBoolean.new(['--plugins']),
-              vt:  OptBoolean.new(['--vulnerable-themes']),
-              at:  OptBoolean.new(['--all-themes']),
-              t:   OptBoolean.new(['--themes']),
-              tt:  OptBoolean.new(['--timthumbs']),
-              cb:  OptBoolean.new(['--config-backups']),
+              vp: OptBoolean.new(['--vulnerable-plugins']),
+              ap: OptBoolean.new(['--all-plugins']),
+              p: OptBoolean.new(['--plugins']),
+              vt: OptBoolean.new(['--vulnerable-themes']),
+              at: OptBoolean.new(['--all-themes']),
+              t: OptBoolean.new(['--themes']),
+              tt: OptBoolean.new(['--timthumbs']),
+              cb: OptBoolean.new(['--config-backups']),
              dbe: OptBoolean.new(['--db-exports']),
-              u:   OptIntegerRange.new(['--users', 'User IDs range. e.g: u1-5'], value_if_empty: '1-10'),
-              m:   OptIntegerRange.new(['--medias', 'Media IDs range. e.g m1-15'], value_if_empty: '1-100')
+              u: OptIntegerRange.new(['--users', 'User IDs range. e.g: u1-5'], value_if_empty: '1-10'),
+              m: OptIntegerRange.new(['--medias',
+                                      'Media IDs range. e.g m1-15',
+                                      'Note: Permalink setting must be set to "Plain" for those to be detected'],
+                                     value_if_empty: '1-100')
            },
            value_if_empty: 'vp,vt,tt,cb,dbe,u,m',
            incompatible: [%i[vp ap p], %i[vt at t]],
@@ -40,12 +44,11 @@ module WPScan
          )
        ]
      end
-      # rubocop:enable Metrics/MethodLength

      # @return [ Array<OptParseValidator::OptBase> ]
      def cli_plugins_opts
        [
-          OptSmartList.new(['--plugins-list LIST', 'List of plugins to enumerate']),
+          OptSmartList.new(['--plugins-list LIST', 'List of plugins to enumerate'], advanced: true),
          OptChoice.new(
            ['--plugins-detection MODE',
             'Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode.'],
@@ -54,13 +57,19 @@ module WPScan
          OptBoolean.new(
            ['--plugins-version-all',
             'Check all the plugins version locations according to the choosen mode (--detection-mode, ' \
-             '--plugins-detection and --plugins-version-detection)']
+             '--plugins-detection and --plugins-version-detection)'],
+            advanced: true
          ),
          OptChoice.new(
            ['--plugins-version-detection MODE',
             'Use the supplied mode to check plugins versions instead of the --detection-mode ' \
             'or --plugins-detection modes.'],
            choices: %w[mixed passive aggressive], normalize: :to_sym, default: :mixed
+          ),
+          OptInteger.new(
+            ['--plugins-threshold THRESHOLD',
+             'Raise an error when the number of detected plugins via known locations reaches the threshold. ' \
+             'Set to 0 to ignore the threshold.'], default: 100
          )
        ]
      end
@@ -68,22 +77,28 @@ module WPScan
      # @return [ Array<OptParseValidator::OptBase> ]
      def cli_themes_opts
        [
-          OptSmartList.new(['--themes-list LIST', 'List of themes to enumerate']),
+          OptSmartList.new(['--themes-list LIST', 'List of themes to enumerate'], advanced: true),
          OptChoice.new(
            ['--themes-detection MODE',
             'Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          ),
          OptBoolean.new(
            ['--themes-version-all',
             'Check all the themes version locations according to the choosen mode (--detection-mode, ' \
-             '--themes-detection and --themes-version-detection)']
+             '--themes-detection and --themes-version-detection)'],
+            advanced: true
          ),
          OptChoice.new(
            ['--themes-version-detection MODE',
             'Use the supplied mode to check themes versions instead of the --detection-mode ' \
             'or --themes-detection modes.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
+          ),
+          OptInteger.new(
+            ['--themes-threshold THRESHOLD',
+             'Raise an error when the number of detected themes via known locations reaches the threshold. ' \
+             'Set to 0 to ignore the threshold.'], default: 20
          )
        ]
      end
@@ -93,12 +108,12 @@ module WPScan
        [
          OptFilePath.new(
            ['--timthumbs-list FILE-PATH', 'List of timthumbs\' location to use'],
-            exists: true, default: File.join(DB_DIR, 'timthumbs-v3.txt')
+            exists: true, default: DB_DIR.join('timthumbs-v3.txt').to_s, advanced: true
          ),
          OptChoice.new(
            ['--timthumbs-detection MODE',
             'Use the supplied mode to enumerate Timthumbs, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end
@@ -108,12 +123,12 @@ module WPScan
        [
          OptFilePath.new(
            ['--config-backups-list FILE-PATH', 'List of config backups\' filenames to use'],
-            exists: true, default: File.join(DB_DIR, 'config_backups.txt')
+            exists: true, default: DB_DIR.join('config_backups.txt').to_s, advanced: true
          ),
          OptChoice.new(
            ['--config-backups-detection MODE',
             'Use the supplied mode to enumerate Config Backups, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end
@@ -123,12 +138,12 @@ module WPScan
        [
          OptFilePath.new(
            ['--db-exports-list FILE-PATH', 'List of DB exports\' paths to use'],
-            exists: true, default: File.join(DB_DIR, 'db_exports.txt')
+            exists: true, default: DB_DIR.join('db_exports.txt').to_s, advanced: true
          ),
          OptChoice.new(
            ['--db-exports-detection MODE',
             'Use the supplied mode to enumerate DB Exports, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end
@@ -139,7 +154,7 @@ module WPScan
          OptChoice.new(
            ['--medias-detection MODE',
             'Use the supplied mode to enumerate Medias, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end
@@ -149,12 +164,13 @@ module WPScan
        [
          OptSmartList.new(
            ['--users-list LIST',
-             'List of users to check during the users enumeration from the Login Error Messages']
+             'List of users to check during the users enumeration from the Login Error Messages'],
+            advanced: true
          ),
          OptChoice.new(
            ['--users-detection MODE',
             'Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive], normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end
--- a/app/controllers/enumeration/enum_methods.rb
+++ b/app/controllers/enumeration/enum_methods.rb
@@ -1,37 +1,53 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Enumeration Methods
    class Enumeration < CMSScanner::Controller::Base
      # @param [ String ] type (plugins or themes)
+      # @param [ Symbol ] detection_mode
      #
-      # @return [ String ] The related enumration message depending on the parsed_options and type supplied
-      def enum_message(type)
+      # @return [ String ] The related enumration message depending on the ParsedCli and type supplied
+      def enum_message(type, detection_mode)
        return unless %w[plugins themes].include?(type)

-        details = if parsed_options[:enumerate][:"vulnerable_#{type}"]
+        details = if ParsedCli.enumerate[:"vulnerable_#{type}"]
                    'Vulnerable'
-                  elsif parsed_options[:enumerate][:"all_#{type}"]
+                  elsif ParsedCli.enumerate[:"all_#{type}"]
                    'All'
                  else
                    'Most Popular'
                  end

-        "Enumerating #{details} #{type.capitalize}"
+        "Enumerating #{details} #{type.capitalize} #{enum_detection_message(detection_mode)}"
+      end
+
+      # @param [ Symbol ] detection_mode
+      #
+      # @return [ String ]
+      def enum_detection_message(detection_mode)
+        detection_method = if detection_mode == :mixed
+                             'Passive and Aggressive'
+                           else
+                             detection_mode.to_s.capitalize
+                           end
+
+        "(via #{detection_method} Methods)"
      end

      # @param [ String ] type (plugins, themes etc)
      #
      # @return [ Hash ]
      def default_opts(type)
-        mode = parsed_options[:"#{type}_detection"] || parsed_options[:detection_mode]
+        mode = ParsedCli.options[:"#{type}_detection"] || ParsedCli.detection_mode

        {
          mode: mode,
-          exclude_content: parsed_options[:exclude_content_based],
+          exclude_content: ParsedCli.exclude_content_based,
          show_progression: user_interaction?,
          version_detection: {
-            mode: parsed_options[:"#{type}_version_detection"] || mode,
-            confidence_threshold: parsed_options[:"#{type}_version_all"] ? 0 : 100
+            mode: ParsedCli.options[:"#{type}_version_detection"] || mode,
+            confidence_threshold: ParsedCli.options[:"#{type}_version_all"] ? 0 : 100
          }
        }
      end
@@ -45,20 +61,24 @@ module WPScan

      def enum_plugins
        opts = default_opts('plugins').merge(
-          list: plugins_list_from_opts(parsed_options),
+          list: plugins_list_from_opts(ParsedCli.options),
+          threshold: ParsedCli.plugins_threshold,
          sort: true
        )

-        output('@info', msg: enum_message('plugins')) if user_interaction?
+        output('@info', msg: enum_message('plugins', opts[:mode])) if user_interaction?
        # Enumerate the plugins & find their versions to avoid doing that when #version
        # is called in the view
        plugins = target.plugins(opts)

-        output('@info', msg: 'Checking Plugin Versions') if user_interaction? && !plugins.empty?
+        if user_interaction? && !plugins.empty?
+          output('@info',
+                 msg: "Checking Plugin Versions #{enum_detection_message(opts[:version_detection][:mode])}")
+        end

        plugins.each(&:version)

-        plugins.select!(&:vulnerable?) if parsed_options[:enumerate][:vulnerable_plugins]
+        plugins.select!(&:vulnerable?) if ParsedCli.enumerate[:vulnerable_plugins]

        output('plugins', plugins: plugins)
      end
@@ -88,20 +108,24 @@ module WPScan

      def enum_themes
        opts = default_opts('themes').merge(
-          list: themes_list_from_opts(parsed_options),
+          list: themes_list_from_opts(ParsedCli.options),
+          threshold: ParsedCli.themes_threshold,
          sort: true
        )

-        output('@info', msg: enum_message('themes')) if user_interaction?
+        output('@info', msg: enum_message('themes', opts[:mode])) if user_interaction?
        # Enumerate the themes & find their versions to avoid doing that when #version
        # is called in the view
        themes = target.themes(opts)

-        output('@info', msg: 'Checking Theme Versions') if user_interaction? && !themes.empty?
+        if user_interaction? && !themes.empty?
+          output('@info',
+                 msg: "Checking Theme Versions #{enum_detection_message(opts[:version_detection][:mode])}")
+        end

        themes.each(&:version)

-        themes.select!(&:vulnerable?) if parsed_options[:enumerate][:vulnerable_themes]
+        themes.select!(&:vulnerable?) if ParsedCli.enumerate[:vulnerable_themes]

        output('themes', themes: themes)
      end
@@ -123,30 +147,35 @@ module WPScan
      end

      def enum_timthumbs
-        opts = default_opts('timthumbs').merge(list: parsed_options[:timthumbs_list])
+        opts = default_opts('timthumbs').merge(list: ParsedCli.timthumbs_list)

-        output('@info', msg: 'Enumerating Timthumbs') if user_interaction?
+        output('@info', msg: "Enumerating Timthumbs #{enum_detection_message(opts[:mode])}") if user_interaction?
        output('timthumbs', timthumbs: target.timthumbs(opts))
      end

      def enum_config_backups
-        opts = default_opts('config_backups').merge(list: parsed_options[:config_backups_list])
+        opts = default_opts('config_backups').merge(list: ParsedCli.config_backups_list)

-        output('@info', msg: 'Enumerating Config Backups') if user_interaction?
+        output('@info', msg: "Enumerating Config Backups #{enum_detection_message(opts[:mode])}") if user_interaction?
        output('config_backups', config_backups: target.config_backups(opts))
      end

      def enum_db_exports
-        opts = default_opts('db_exports').merge(list: parsed_options[:db_exports_list])
+        opts = default_opts('db_exports').merge(list: ParsedCli.db_exports_list)

-        output('@info', msg: 'Enumerating DB Exports') if user_interaction?
+        output('@info', msg: "Enumerating DB Exports #{enum_detection_message(opts[:mode])}") if user_interaction?
        output('db_exports', db_exports: target.db_exports(opts))
      end

      def enum_medias
-        opts = default_opts('medias').merge(range: parsed_options[:enumerate][:medias])
+        opts = default_opts('medias').merge(range: ParsedCli.enumerate[:medias])
+
+        if user_interaction?
+          output('@info',
+                 msg: "Enumerating Medias #{enum_detection_message(opts[:mode])} "\
+                      '(Permalink setting must be set to "Plain" for those to be detected)')
+        end

-        output('@info', msg: 'Enumerating Medias') if user_interaction?
        output('medias', medias: target.medias(opts))
      end

@@ -154,16 +183,16 @@ module WPScan
      #
      # @return [ Boolean ] Wether or not to enumerate the users
      def enum_users?(opts)
-        opts[:users] || (parsed_options[:passwords] && !parsed_options[:username] && !parsed_options[:usernames])
+        opts[:users] || (ParsedCli.passwords && !ParsedCli.username && !ParsedCli.usernames)
      end

      def enum_users
        opts = default_opts('users').merge(
          range: enum_users_range,
-          list: parsed_options[:users_list]
+          list: ParsedCli.users_list
        )

-        output('@info', msg: 'Enumerating Users') if user_interaction?
+        output('@info', msg: "Enumerating Users #{enum_detection_message(opts[:mode])}") if user_interaction?
        output('users', users: target.users(opts))
      end

@@ -171,7 +200,7 @@ module WPScan
      # If the --enumerate is used, the default value is handled by the Option
      # However, when using --passwords alone, the default has to be set by the code below
      def enum_users_range
-        parsed_options[:enumerate][:users] || cli_enum_choices[0].choices[:u].validate(nil)
+        ParsedCli.enumerate[:users] || cli_enum_choices[0].choices[:u].validate(nil)
      end
    end
  end
--- a/app/controllers/main_theme.rb
+++ b/app/controllers/main_theme.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Main Theme Controller
@@ -7,8 +9,7 @@ module WPScan
          OptChoice.new(
            ['--main-theme-detection MODE',
             'Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive],
-            normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end
@@ -17,9 +18,9 @@ module WPScan
        output(
          'theme',
          theme: target.main_theme(
-            mode: parsed_options[:main_theme_detection] || parsed_options[:detection_mode]
+            mode: ParsedCli.main_theme_detection || ParsedCli.detection_mode
          ),
-          verbose: parsed_options[:verbose]
+          verbose: ParsedCli.verbose
        )
      end
    end
--- a/app/controllers/password_attack.rb
+++ b/app/controllers/password_attack.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Password Attack Controller
@@ -22,7 +24,7 @@ module WPScan
      end

      def run
-        return unless parsed_options[:passwords]
+        return unless ParsedCli.passwords

        if user_interaction?
          output('@info',
@@ -31,13 +33,13 @@ module WPScan

        attack_opts = {
          show_progression: user_interaction?,
-          multicall_max_passwords: parsed_options[:multicall_max_passwords]
+          multicall_max_passwords: ParsedCli.multicall_max_passwords
        }

        begin
          found = []

-          attacker.attack(users, passwords(parsed_options[:passwords]), attack_opts) do |user|
+          attacker.attack(users, passwords(ParsedCli.passwords), attack_opts) do |user|
            found << user

            attacker.progress_bar.log("[SUCCESS] - #{user.username} / #{user.password}")
@@ -52,46 +54,63 @@ module WPScan
        @attacker ||= attacker_from_cli_options || attacker_from_automatic_detection
      end

-      # @return [ WPScan::XMLRPC ]
+      # @return [ Model::XMLRPC ]
      def xmlrpc
        @xmlrpc ||= target.xmlrpc
      end

      # @return [ CMSScanner::Finders::Finder ]
      def attacker_from_cli_options
-        return unless parsed_options[:password_attack]
+        return unless ParsedCli.password_attack

-        case parsed_options[:password_attack]
+        case ParsedCli.password_attack
        when :wp_login
-          WPScan::Finders::Passwords::WpLogin.new(target)
+          Finders::Passwords::WpLogin.new(target)
        when :xmlrpc
-          WPScan::Finders::Passwords::XMLRPC.new(xmlrpc)
+          raise Error::XMLRPCNotDetected unless xmlrpc
+
+          Finders::Passwords::XMLRPC.new(xmlrpc)
        when :xmlrpc_multicall
-          WPScan::Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+          raise Error::XMLRPCNotDetected unless xmlrpc
+
+          Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+        end
+      end
+
+      # @return [ Boolean ]
+      def xmlrpc_get_users_blogs_enabled?
+        if xmlrpc&.enabled? &&
+           xmlrpc.available_methods.include?('wp.getUsersBlogs') &&
+           xmlrpc.method_call('wp.getUsersBlogs', [SecureRandom.hex[0, 6], SecureRandom.hex[0, 4]])
+                 .run.body !~ /XML\-RPC services are disabled/
+
+          true
+        else
+          false
        end
      end

      # @return [ CMSScanner::Finders::Finder ]
      def attacker_from_automatic_detection
-        if xmlrpc&.enabled? && xmlrpc.available_methods.include?('wp.getUsersBlogs')
+        if xmlrpc_get_users_blogs_enabled?
          wp_version = target.wp_version

          if wp_version && wp_version < '4.4'
-            WPScan::Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+            Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
          else
-            WPScan::Finders::Passwords::XMLRPC.new(xmlrpc)
+            Finders::Passwords::XMLRPC.new(xmlrpc)
          end
        else
-          WPScan::Finders::Passwords::WpLogin.new(target)
+          Finders::Passwords::WpLogin.new(target)
        end
      end

      # @return [ Array<Users> ] The users to brute force
      def users
-        return target.users unless parsed_options[:usernames]
+        return target.users unless ParsedCli.usernames

-        parsed_options[:usernames].reduce([]) do |acc, elem|
-          acc << CMSScanner::User.new(elem.chomp)
+        ParsedCli.usernames.reduce([]) do |acc, elem|
+          acc << Model::User.new(elem.chomp)
        end
      end

--- a/app/controllers/wp_version.rb
+++ b/app/controllers/wp_version.rb
@@ -1,30 +1,31 @@
+# frozen_string_literal: true
+
 module WPScan
  module Controller
    # Wp Version Controller
    class WpVersion < CMSScanner::Controller::Base
      def cli_options
        [
-          OptBoolean.new(['--wp-version-all', 'Check all the version locations']),
+          OptBoolean.new(['--wp-version-all', 'Check all the version locations'], advanced: true),
          OptChoice.new(
            ['--wp-version-detection MODE',
             'Use the supplied mode for the WordPress version detection, ' \
             'instead of the global (--detection-mode) mode.'],
-            choices: %w[mixed passive aggressive],
-            normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
          )
        ]
      end

      def before_scan
-        WPScan::DB::DynamicFinders::Wordpress.create_versions_finders
+        DB::DynamicFinders::Wordpress.create_versions_finders
      end

      def run
        output(
          'version',
          version: target.wp_version(
-            mode: parsed_options[:wp_version_detection] || parsed_options[:detection_mode],
-            confidence_threshold: parsed_options[:wp_version_all] ? 0 : 100,
+            mode: ParsedCli.wp_version_detection || ParsedCli.detection_mode,
+            confidence_threshold: ParsedCli.wp_version_all ? 0 : 100,
            show_progression: user_interaction?
          )
        )
--- a/app/finders.rb
+++ b/app/finders.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'finders/interesting_findings'
 require_relative 'finders/wp_items'
 require_relative 'finders/wp_version'
--- a/app/finders/config_backups.rb
+++ b/app/finders/config_backups.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'config_backups/known_filenames'

 module WPScan
--- a/app/finders/config_backups/known_filenames.rb
+++ b/app/finders/config_backups/known_filenames.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module ConfigBackups
@@ -13,11 +15,10 @@ module WPScan
        def aggressive(opts = {})
          found = []

-          enumerate(potential_urls(opts), opts) do |res|
-            # Might need to improve that
+          enumerate(potential_urls(opts), opts.merge(check_full_response: 200)) do |res|
            next unless res.body =~ /define/i && res.body !~ /<\s?html/i

-            found << WPScan::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
+            found << Model::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
          end

          found
--- a/app/finders/db_exports.rb
+++ b/app/finders/db_exports.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'db_exports/known_locations'

 module WPScan
--- a/app/finders/db_exports/known_locations.rb
+++ b/app/finders/db_exports/known_locations.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module DbExports
@@ -6,6 +8,8 @@ module WPScan
      class KnownLocations < CMSScanner::Finders::Finder
        include CMSScanner::Finders::Finder::Enumerator

+        SQL_PATTERN = /(?:DROP|(?:UN)?LOCK|CREATE) TABLE|INSERT INTO/.freeze
+
        # @param [ Hash ] opts
        # @option opts [ String ] :list
        # @option opts [ Boolean ] :show_progression
@@ -14,15 +18,23 @@ module WPScan
        def aggressive(opts = {})
          found = []

-          enumerate(potential_urls(opts), opts) do |res|
-            next unless res.code == 200 && res.body =~ /INSERT INTO/
+          enumerate(potential_urls(opts), opts.merge(check_full_response: 200)) do |res|
+            if res.effective_url.end_with?('.zip')
+              next unless %r{\Aapplication/zip}i.match?(res.headers['Content-Type'])
+            else
+              next unless SQL_PATTERN.match?(res.body)
+            end

-            found << WPScan::DbExport.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
+            found << Model::DbExport.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
          end

          found
        end

+        def full_request_params
+          @full_request_params ||= { headers: { 'Range' => 'bytes=0-3000' } }
+        end
+
        # @param [ Hash ] opts
        # @option opts [ String ] :list Mandatory
        #
--- a/app/finders/interesting_findings.rb
+++ b/app/finders/interesting_findings.rb
@@ -1,4 +1,7 @@
+# frozen_string_literal: true
+
 require_relative 'interesting_findings/readme'
+require_relative 'interesting_findings/wp_cron'
 require_relative 'interesting_findings/multisite'
 require_relative 'interesting_findings/debug_log'
 require_relative 'interesting_findings/backup_db'
@@ -23,7 +26,7 @@ module WPScan
          %w[
            Readme DebugLog FullPathDisclosure BackupDB DuplicatorInstallerLog
            Multisite MuPlugins Registration UploadDirectoryListing TmmDbMigrate
-            UploadSQLDump EmergencyPwdResetScript
+            UploadSQLDump EmergencyPwdResetScript WPCron
          ].each do |f|
            finders << InterestingFindings.const_get(f).new(target)
          end
--- a/app/finders/interesting_findings/backup_db.rb
+++ b/app/finders/interesting_findings/backup_db.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -6,13 +8,12 @@ module WPScan
        # @return [ InterestingFinding ]
        def aggressive(_opts = {})
          path = 'wp-content/backup-db/'
-          url  = target.url(path)
-          res  = Browser.get(url)
+          res  = target.head_and_get(path, [200, 403])

          return unless [200, 403].include?(res.code) && !target.homepage_or_404?(res)

-          WPScan::InterestingFinding.new(
-            url,
+          Model::BackupDB.new(
+            target.url(path),
            confidence: 70,
            found_by: DIRECT_ACCESS,
            interesting_entries: target.directory_listing_entries(path),
--- a/app/finders/interesting_findings/debug_log.rb
+++ b/app/finders/interesting_findings/debug_log.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -9,9 +11,10 @@ module WPScan

          return unless target.debug_log?(path)

-          WPScan::InterestingFinding.new(
+          Model::DebugLog.new(
            target.url(path),
-            confidence: 100, found_by: DIRECT_ACCESS
+            confidence: 100, found_by: DIRECT_ACCESS,
+            references: { url: 'https://codex.wordpress.org/Debugging_in_WordPress' }
          )
        end
      end
--- a/app/finders/interesting_findings/duplicator_installer_log.rb
+++ b/app/finders/interesting_findings/duplicator_installer_log.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -5,13 +7,12 @@ module WPScan
      class DuplicatorInstallerLog < CMSScanner::Finders::Finder
        # @return [ InterestingFinding ]
        def aggressive(_opts = {})
-          url = target.url('installer-log.txt')
-          res = Browser.get(url)
+          path = 'installer-log.txt'

-          return unless res.body =~ /DUPLICATOR INSTALL-LOG/
+          return unless /DUPLICATOR INSTALL-LOG/.match?(target.head_and_get(path).body)

-          WPScan::InterestingFinding.new(
-            url,
+          Model::DuplicatorInstallerLog.new(
+            target.url(path),
            confidence: 100,
            found_by: DIRECT_ACCESS,
            references: { url: 'https://www.exploit-db.com/ghdb/3981/' }
--- a/app/finders/interesting_findings/emergency_pwd_reset_script.rb
+++ b/app/finders/interesting_findings/emergency_pwd_reset_script.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -5,14 +7,14 @@ module WPScan
      class EmergencyPwdResetScript < CMSScanner::Finders::Finder
        # @return [ InterestingFinding ]
        def aggressive(_opts = {})
-          url  = target.url('/emergency.php')
-          res  = Browser.get(url)
+          path = 'emergency.php'
+          res  = target.head_and_get(path)

          return unless res.code == 200 && !target.homepage_or_404?(res)

-          WPScan::InterestingFinding.new(
-            url,
-            confidence: res.body =~ /password/i ? 100 : 40,
+          Model::EmergencyPwdResetScript.new(
+            target.url(path),
+            confidence: /password/i.match?(res.body) ? 100 : 40,
            found_by: DIRECT_ACCESS,
            references: {
              url: 'https://codex.wordpress.org/Resetting_Your_Password#Using_the_Emergency_Password_Reset_Script'
--- a/app/finders/interesting_findings/full_path_disclosure.rb
+++ b/app/finders/interesting_findings/full_path_disclosure.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -10,11 +12,12 @@ module WPScan

          return if fpd_entries.empty?

-          WPScan::InterestingFinding.new(
+          Model::FullPathDisclosure.new(
            target.url(path),
            confidence: 100,
            found_by: DIRECT_ACCESS,
-            interesting_entries: fpd_entries
+            interesting_entries: fpd_entries,
+            references: { url: 'https://www.owasp.org/index.php/Full_Path_Disclosure' }
          )
        end
      end
--- a/app/finders/interesting_findings/mu_plugins.rb
+++ b/app/finders/interesting_findings/mu_plugins.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -7,12 +9,14 @@ module WPScan
        def passive(_opts = {})
          pattern = %r{#{target.content_dir}/mu\-plugins/}i

-          target.in_scope_urls(target.homepage_res) do |url|
-            next unless Addressable::URI.parse(url).path =~ pattern
+          target.in_scope_uris(target.homepage_res) do |uri|
+            next unless uri.path&.match?(pattern)

            url = target.url('wp-content/mu-plugins/')

-            return WPScan::InterestingFinding.new(
+            target.mu_plugins = true
+
+            return Model::MuPlugins.new(
              url,
              confidence: 70,
              found_by: 'URLs In Homepage (Passive Detection)',
@@ -31,11 +35,9 @@ module WPScan
          return unless [200, 401, 403].include?(res.code)
          return if target.homepage_or_404?(res)

-          # TODO: add the check for --exclude-content once implemented ?
-
          target.mu_plugins = true

-          WPScan::InterestingFinding.new(
+          Model::MuPlugins.new(
            url,
            confidence: 80,
            found_by: DIRECT_ACCESS,
--- a/app/finders/interesting_findings/multisite.rb
+++ b/app/finders/interesting_findings/multisite.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -15,7 +17,7 @@ module WPScan

          target.multisite = true

-          WPScan::InterestingFinding.new(
+          Model::Multisite.new(
            url,
            confidence: 100,
            found_by: DIRECT_ACCESS,
--- a/app/finders/interesting_findings/readme.rb
+++ b/app/finders/interesting_findings/readme.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -5,14 +7,14 @@ module WPScan
      class Readme < CMSScanner::Finders::Finder
        # @return [ InterestingFinding ]
        def aggressive(_opts = {})
-          potential_files.each do |file|
-            url = target.url(file)
-            res = Browser.get(url)
+          potential_files.each do |path|
+            res = target.head_and_get(path)

-            if res.code == 200 && res.body =~ /wordpress/i
-              return WPScan::InterestingFinding.new(url, confidence: 100, found_by: DIRECT_ACCESS)
-            end
+            next unless res.code == 200 && res.body =~ /wordpress/i
+
+            return Model::Readme.new(target.url(path), confidence: 100, found_by: DIRECT_ACCESS)
          end
+
          nil
        end

--- a/app/finders/interesting_findings/registration.rb
+++ b/app/finders/interesting_findings/registration.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -18,7 +20,7 @@ module WPScan

          target.registration_enabled = true

-          WPScan::InterestingFinding.new(
+          Model::Registration.new(
            res.effective_url,
            confidence: 100,
            found_by: DIRECT_ACCESS,
--- a/app/finders/interesting_findings/tmm_db_migrate.rb
+++ b/app/finders/interesting_findings/tmm_db_migrate.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -7,11 +9,11 @@ module WPScan
        def aggressive(_opts = {})
          path = 'wp-content/uploads/tmm_db_migrate/tmm_db_migrate.zip'
          url  = target.url(path)
-          res  = Browser.get(url)
+          res  = browser.forge_request(url, target.head_or_get_request_params).run

          return unless res.code == 200 && res.headers['Content-Type'] =~ %r{\Aapplication/zip}i

-          WPScan::InterestingFinding.new(
+          Model::TmmDbMigrate.new(
            url,
            confidence: 100,
            found_by: DIRECT_ACCESS,
--- a/app/finders/interesting_findings/upload_directory_listing.rb
+++ b/app/finders/interesting_findings/upload_directory_listing.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
@@ -11,7 +13,7 @@ module WPScan

          url = target.url(path)

-          WPScan::InterestingFinding.new(
+          Model::UploadDirectoryListing.new(
            url,
            confidence: 100,
            found_by: DIRECT_ACCESS,
--- a/app/finders/interesting_findings/upload_sql_dump.rb
+++ b/app/finders/interesting_findings/upload_sql_dump.rb
@@ -1,27 +1,25 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module InterestingFindings
      # UploadSQLDump finder
      class UploadSQLDump < CMSScanner::Finders::Finder
-        SQL_PATTERN = /(?:(?:(?:DROP|CREATE) TABLE)|INSERT INTO)/
+        SQL_PATTERN = /(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO/.freeze

        # @return [ InterestingFinding ]
        def aggressive(_opts = {})
-          url = dump_url
-          res = Browser.get(url)
+          path = 'wp-content/uploads/dump.sql'
+          res  = target.head_and_get(path, [200], get: { headers: { 'Range' => 'bytes=0-3000' } })

-          return unless res.code == 200 && res.body =~ SQL_PATTERN
+          return unless SQL_PATTERN.match?(res.body)

-          WPScan::InterestingFinding.new(
-            url,
+          Model::UploadSQLDump.new(
+            target.url(path),
            confidence: 100,
            found_by: DIRECT_ACCESS
          )
        end
-
-        def dump_url
-          target.url('wp-content/uploads/dump.sql')
-        end
      end
    end
  end
--- a/app/finders/interesting_findings/wp_cron.rb
+++ b/app/finders/interesting_findings/wp_cron.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    module InterestingFindings
+      # wp-cron.php finder
+      class WPCron < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          res = Browser.get(wp_cron_url)
+
+          return unless res.code == 200
+
+          Model::WPCron.new(
+            wp_cron_url,
+            confidence: 60,
+            found_by: DIRECT_ACCESS,
+            references: {
+              url: [
+                'https://www.iplocation.net/defend-wordpress-from-ddos',
+                'https://github.com/wpscanteam/wpscan/issues/1299'
+              ]
+            }
+          )
+        end
+
+        def wp_cron_url
+          @wp_cron_url ||= target.url('wp-cron.php')
+        end
+      end
+    end
+  end
+end
--- a/app/finders/main_theme.rb
+++ b/app/finders/main_theme.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'main_theme/css_style'
 require_relative 'main_theme/woo_framework_meta_generator'
 require_relative 'main_theme/urls_in_homepage'
--- a/app/finders/main_theme/css_style.rb
+++ b/app/finders/main_theme/css_style.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module MainTheme
@@ -6,7 +8,7 @@ module WPScan
        include Finders::WpItems::URLsInHomepage

        def create_theme(slug, style_url, opts)
-          WPScan::Theme.new(
+          Model::Theme.new(
            slug,
            target,
            opts.merge(found_by: found_by, confidence: 70, style_url: style_url)
@@ -18,10 +20,10 @@ module WPScan
        end

        def passive_from_css_href(res, opts)
-          target.in_scope_urls(res, '//style/@src|//link/@href') do |url|
-            next unless Addressable::URI.parse(url).path =~ %r{/themes/([^\/]+)/style.css\z}i
+          target.in_scope_uris(res, '//style/@src|//link/@href') do |uri|
+            next unless uri.path =~ %r{/themes/([^\/]+)/style.css\z}i

-            return create_theme(Regexp.last_match[1], url, opts)
+            return create_theme(Regexp.last_match[1], uri.to_s, opts)
          end
          nil
        end
--- a/app/finders/main_theme/urls_in_homepage.rb
+++ b/app/finders/main_theme/urls_in_homepage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module MainTheme
@@ -14,7 +16,7 @@ module WPScan
          slugs = items_from_links('themes', false) + items_from_codes('themes', false)

          slugs.each_with_object(Hash.new(0)) { |slug, counts| counts[slug] += 1 }.each do |slug, occurences|
-            found << WPScan::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 2 * occurences))
+            found << Model::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 2 * occurences))
          end

          found
--- a/app/finders/main_theme/woo_framework_meta_generator.rb
+++ b/app/finders/main_theme/woo_framework_meta_generator.rb
@@ -1,16 +1,18 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module MainTheme
      # From the WooFramework meta generators
      class WooFrameworkMetaGenerator < CMSScanner::Finders::Finder
-        THEME_PATTERN     = %r{<meta name="generator" content="([^\s"]+)\s?([^"]+)?"\s+/?>}
-        FRAMEWORK_PATTERN = %r{<meta name="generator" content="WooFramework\s?([^"]+)?"\s+/?>}
-        PATTERN           = /#{THEME_PATTERN}\s+#{FRAMEWORK_PATTERN}/i
+        THEME_PATTERN     = %r{<meta name="generator" content="([^\s"]+)\s?([^"]+)?"\s+/?>}.freeze
+        FRAMEWORK_PATTERN = %r{<meta name="generator" content="WooFramework\s?([^"]+)?"\s+/?>}.freeze
+        PATTERN           = /#{THEME_PATTERN}\s+#{FRAMEWORK_PATTERN}/i.freeze

        def passive(opts = {})
          return unless target.homepage_res.body =~ PATTERN

-          WPScan::Theme.new(
+          Model::Theme.new(
            Regexp.last_match[1],
            target,
            opts.merge(found_by: found_by, confidence: 80)
--- a/app/finders/medias.rb
+++ b/app/finders/medias.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'medias/attachment_brute_forcing'

 module WPScan
--- a/app/finders/medias/attachment_brute_forcing.rb
+++ b/app/finders/medias/attachment_brute_forcing.rb
@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Medias
-      # Medias Finder
+      # Medias Finder, see https://github.com/wpscanteam/wpscan/issues/172
      class AttachmentBruteForcing < CMSScanner::Finders::Finder
        include CMSScanner::Finders::Finder::Enumerator

@@ -15,7 +17,7 @@ module WPScan
          enumerate(target_urls(opts), opts) do |res|
            next unless res.code == 200

-            found << WPScan::Media.new(res.effective_url, opts.merge(found_by: found_by, confidence: 100))
+            found << Model::Media.new(res.effective_url, opts.merge(found_by: found_by, confidence: 100))
          end

          found
--- a/app/finders/passwords.rb
+++ b/app/finders/passwords.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'passwords/wp_login'
 require_relative 'passwords/xml_rpc'
 require_relative 'passwords/xml_rpc_multicall'
--- a/app/finders/passwords/wp_login.rb
+++ b/app/finders/passwords/wp_login.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Passwords
@@ -10,7 +12,8 @@ module WPScan
        end

        def valid_credentials?(response)
-          response.code == 302
+          response.code == 302 &&
+            [*response.headers['Set-Cookie']]&.any? { |cookie| cookie =~ /wordpress_logged_in_/i }
        end

        def errored_response?(response)
--- a/app/finders/passwords/xml_rpc.rb
+++ b/app/finders/passwords/xml_rpc.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Passwords
--- a/app/finders/passwords/xml_rpc_multicall.rb
+++ b/app/finders/passwords/xml_rpc_multicall.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Passwords
@@ -20,13 +22,13 @@ module WPScan
          target.multi_call(methods).run
        end

-        # @param [ Array<CMSScanner::User> ] users
+        # @param [ Array<Model::User> ] users
        # @param [ Array<String> ] passwords
        # @param [ Hash ] opts
        # @option opts [ Boolean ] :show_progression
        # @option opts [ Integer ] :multicall_max_passwords
        #
-        # @yield [ CMSScanner::User ] When a valid combination is found
+        # @yield [ Model::User ] When a valid combination is found
        #
        # TODO: Make rubocop happy about metrics etc
        #
--- a/app/finders/plugin_version.rb
+++ b/app/finders/plugin_version.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'plugin_version/readme'

 module WPScan
@@ -7,29 +9,19 @@ module WPScan
      class Base
        include CMSScanner::Finders::UniqueFinder

-        # @param [ WPScan::Plugin ] plugin
+        # @param [ Model::Plugin ] plugin
        def initialize(plugin)
          finders << PluginVersion::Readme.new(plugin)

-          load_specific_finders(plugin)
+          create_and_load_dynamic_versions_finders(plugin)
        end

-        # Load the finders associated with the plugin
+        # Create the dynamic version finders related to the plugin and register them
        #
-        # @param [ WPScan::Plugin ] plugin
-        def load_specific_finders(plugin)
-          module_name = plugin.classify
-
-          return unless Finders::PluginVersion.constants.include?(module_name)
-
-          mod = Finders::PluginVersion.const_get(module_name)
-
-          mod.constants.each do |constant|
-            c = mod.const_get(constant)
-
-            next unless c.is_a?(Class)
-
-            finders << c.new(plugin)
+        # @param [ Model::Plugin ] plugin
+        def create_and_load_dynamic_versions_finders(plugin)
+          DB::DynamicFinders::Plugin.create_versions_finders(plugin.slug).each do |finder|
+            finders << finder.new(plugin)
          end
        end
      end
--- a/app/finders/plugin_version/readme.rb
+++ b/app/finders/plugin_version/readme.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module PluginVersion
@@ -7,21 +9,23 @@ module WPScan
        def aggressive(_opts = {})
          found_by_msg = 'Readme - %s (Aggressive Detection)'

-          WPScan::WpItem::READMES.each do |file|
-            url = target.url(file)
-            res = Browser.get(url)
+          # The target(plugin)#readme_url can't be used directly here
+          # as if the --detection-mode is passive, it will always return nil
+          target.potential_readme_filenames.each do |file|
+            res = target.head_and_get(file)

            next unless res.code == 200 && !(numbers = version_numbers(res.body)).empty?

            return numbers.reduce([]) do |a, e|
-              a << WPScan::Version.new(
+              a << Model::Version.new(
                e[0],
                found_by: format(found_by_msg, e[1]),
                confidence: e[2],
-                interesting_entries: [url]
+                interesting_entries: [res.effective_url]
              )
            end
          end
+
          nil
        end

@@ -48,7 +52,7 @@ module WPScan

          number = Regexp.last_match[1]

-          number if number =~ /[0-9]+/
+          number if /[0-9]+/.match?(number)
        end

        # @param [ String ] body
--- a/app/finders/plugins.rb
+++ b/app/finders/plugins.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'plugins/urls_in_homepage'
 require_relative 'plugins/known_locations'
 # From the DynamicFinders
--- a/app/finders/plugins/body_pattern.rb
+++ b/app/finders/plugins/body_pattern.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from Dynamic Finder 'BodyPattern'
-      class BodyPattern < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class BodyPattern < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 30

        # @param [ Hash ] opts The options from the #passive, #aggressive methods
@@ -13,9 +15,9 @@ module WPScan
        #
        # @return [ Plugin ] The detected plugin in the response, related to the config
        def process_response(opts, response, slug, klass, config)
-          return unless response.body =~ config['pattern']
+          return unless response.body&.match?(config['pattern'])

-          Plugin.new(
+          Model::Plugin.new(
            slug,
            target,
            opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
--- a/app/finders/plugins/comment.rb
+++ b/app/finders/plugins/comment.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from the Dynamic Finder 'Comment'
-      class Comment < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class Comment < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 30

        # @param [ Hash ] opts The options from the #passive, #aggressive methods
@@ -16,9 +18,9 @@ module WPScan
          response.html.xpath(config['xpath'] || '//comment()').each do |node|
            comment = node.text.to_s.strip

-            next unless comment =~ config['pattern']
+            next unless comment&.match?(config['pattern'])

-            return Plugin.new(
+            return Model::Plugin.new(
              slug,
              target,
              opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
--- a/app/finders/plugins/config_parser.rb
+++ b/app/finders/plugins/config_parser.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from Dynamic Finder 'ConfigParser'
-      class ConfigParser < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class ConfigParser < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 40

        # @param [ Hash ] opts The options from the #passive, #aggressive methods
@@ -19,7 +21,7 @@ module WPScan
          # when checking for plugins
          #

-          Plugin.new(
+          Model::Plugin.new(
            slug,
            target,
            opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
--- a/app/finders/plugins/header_pattern.rb
+++ b/app/finders/plugins/header_pattern.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from Dynamic Finder 'HeaderPattern'
-      class HeaderPattern < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class HeaderPattern < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 30

        # @param [ Hash ] opts
@@ -18,7 +20,7 @@ module WPScan
            configs.each do |klass, config|
              next unless headers[config['header']] && headers[config['header']].to_s =~ config['pattern']

-              found << Plugin.new(
+              found << Model::Plugin.new(
                slug,
                target,
                opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
--- a/app/finders/plugins/javascript_var.rb
+++ b/app/finders/plugins/javascript_var.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from the Dynamic Finder 'JavascriptVar'
-      class JavascriptVar < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class JavascriptVar < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 60

        # @param [ Hash ] opts The options from the #passive, #aggressive methods
@@ -16,7 +18,7 @@ module WPScan
          response.html.xpath(config['xpath'] || '//script[not(@src)]').each do |node|
            next if config['pattern'] && !node.text.match(config['pattern'])

-            return Plugin.new(
+            return Model::Plugin.new(
              slug,
              target,
              opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
--- a/app/finders/plugins/known_locations.rb
+++ b/app/finders/plugins/known_locations.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
@@ -5,6 +7,11 @@ module WPScan
      class KnownLocations < CMSScanner::Finders::Finder
        include CMSScanner::Finders::Finder::Enumerator

+        # @return [ Array<Integer> ]
+        def valid_response_codes
+          @valid_response_codes ||= [200, 401, 403, 500].freeze
+        end
+
        # @param [ Hash ] opts
        # @option opts [ String ] :list
        #
@@ -12,12 +19,10 @@ module WPScan
        def aggressive(opts = {})
          found = []

-          enumerate(target_urls(opts), opts) do |res, slug|
-            # TODO: follow the location (from enumerate()) and remove the 301 here ?
-            # As a result, it might remove false positive due to redirection to the homepage
-            next unless [200, 401, 403, 301].include?(res.code)
+          enumerate(target_urls(opts), opts.merge(check_full_response: true)) do |_res, slug|
+            found << Model::Plugin.new(slug, target, opts.merge(found_by: found_by, confidence: 80))

-            found << WPScan::Plugin.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+            raise Error::PluginsThresholdReached if opts[:threshold].positive? && found.size >= opts[:threshold]
          end

          found
@@ -30,10 +35,9 @@ module WPScan
        def target_urls(opts = {})
          slugs       = opts[:list] || DB::Plugins.vulnerable_slugs
          urls        = {}
-          plugins_url = target.plugins_url

          slugs.each do |slug|
-            urls["#{plugins_url}#{URI.encode(slug)}/"] = slug
+            urls[target.plugin_url(slug)] = slug
          end

          urls
--- a/app/finders/plugins/query_parameter.rb
+++ b/app/finders/plugins/query_parameter.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from Dynamic Finder 'QueryParameter'
-      class QueryParameter < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class QueryParameter < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 10

        def passive(_opts = {})
--- a/app/finders/plugins/urls_in_homepage.rb
+++ b/app/finders/plugins/urls_in_homepage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
@@ -14,7 +16,7 @@ module WPScan
          found = []

          (items_from_links('plugins') + items_from_codes('plugins')).uniq.sort.each do |slug|
-            found << Plugin.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+            found << Model::Plugin.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
          end

          found
--- a/app/finders/plugins/xpath.rb
+++ b/app/finders/plugins/xpath.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Plugins
      # Plugins finder from the Dynamic Finder 'Xpath'
-      class Xpath < WPScan::Finders::DynamicFinder::WpItems::Finder
+      class Xpath < Finders::DynamicFinder::WpItems::Finder
        DEFAULT_CONFIDENCE = 40

        # @param [ Hash ] opts The options from the #passive, #aggressive methods
@@ -16,7 +18,7 @@ module WPScan
          response.html.xpath(config['xpath']).each do |node|
            next if config['pattern'] && !node.text.match(config['pattern'])

-            return Plugin.new(
+            return Model::Plugin.new(
              slug,
              target,
              opts.merge(found_by: found_by(klass), confidence: config['confidence'] || DEFAULT_CONFIDENCE)
--- a/app/finders/theme_version.rb
+++ b/app/finders/theme_version.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'theme_version/style'
 require_relative 'theme_version/woo_framework_meta_generator'

@@ -8,31 +10,21 @@ module WPScan
      class Base
        include CMSScanner::Finders::UniqueFinder

-        # @param [ WPScan::Theme ] theme
+        # @param [ Model::Theme ] theme
        def initialize(theme)
          finders <<
            ThemeVersion::Style.new(theme) <<
            ThemeVersion::WooFrameworkMetaGenerator.new(theme)

-          load_specific_finders(theme)
+          create_and_load_dynamic_versions_finders(theme)
        end

-        # Load the finders associated with the theme
+        # Create the dynamic version finders related to the theme and register them
        #
-        # @param [ WPScan::Theme ] theme
-        def load_specific_finders(theme)
-          module_name = theme.classify
-
-          return unless Finders::ThemeVersion.constants.include?(module_name)
-
-          mod = Finders::ThemeVersion.const_get(module_name)
-
-          mod.constants.each do |constant|
-            c = mod.const_get(constant)
-
-            next unless c.is_a?(Class)
-
-            finders << c.new(theme)
+        # @param [ Model::Theme ] theme
+        def create_and_load_dynamic_versions_finders(theme)
+          DB::DynamicFinders::Theme.create_versions_finders(theme.slug).each do |finder|
+            finders << finder.new(theme)
          end
        end
      end
--- a/app/finders/theme_version/style.rb
+++ b/app/finders/theme_version/style.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module ThemeVersion
@@ -30,7 +32,7 @@ module WPScan
        def style_version
          return unless Browser.get(target.style_url).body =~ /Version:[\t ]*(?!trunk)([0-9a-z\.-]+)/i

-          WPScan::Version.new(
+          Model::Version.new(
            Regexp.last_match[1],
            found_by: found_by,
            confidence: 80,
--- a/app/finders/theme_version/woo_framework_meta_generator.rb
+++ b/app/finders/theme_version/woo_framework_meta_generator.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module ThemeVersion
@@ -11,7 +13,7 @@ module WPScan

          return unless Regexp.last_match[1] == target.slug

-          WPScan::Version.new(Regexp.last_match[2], found_by: found_by, confidence: 80)
+          Model::Version.new(Regexp.last_match[2], found_by: found_by, confidence: 80)
        end
      end
    end
--- a/app/finders/themes.rb
+++ b/app/finders/themes.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'themes/urls_in_homepage'
 require_relative 'themes/known_locations'

--- a/app/finders/themes/known_locations.rb
+++ b/app/finders/themes/known_locations.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Themes
@@ -5,6 +7,11 @@ module WPScan
      class KnownLocations < CMSScanner::Finders::Finder
        include CMSScanner::Finders::Finder::Enumerator

+        # @return [ Array<Integer> ]
+        def valid_response_codes
+          @valid_response_codes ||= [200, 401, 403, 500].freeze
+        end
+
        # @param [ Hash ] opts
        # @option opts [ String ] :list
        #
@@ -12,12 +19,10 @@ module WPScan
        def aggressive(opts = {})
          found = []

-          enumerate(target_urls(opts), opts) do |res, slug|
-            # TODO: follow the location (from enumerate()) and remove the 301 here ?
-            # As a result, it might remove false positive due to redirection to the homepage
-            next unless [200, 401, 403, 301].include?(res.code)
+          enumerate(target_urls(opts), opts.merge(check_full_response: true)) do |_res, slug|
+            found << Model::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))

-            found << WPScan::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+            raise Error::ThemesThresholdReached if opts[:threshold].positive? && found.size >= opts[:threshold]
          end

          found
@@ -28,12 +33,11 @@ module WPScan
        #
        # @return [ Hash ]
        def target_urls(opts = {})
-          slugs       = opts[:list] || DB::Themes.vulnerable_slugs
-          urls        = {}
-          themes_url  = target.url('wp-content/themes/')
+          slugs = opts[:list] || DB::Themes.vulnerable_slugs
+          urls  = {}

          slugs.each do |slug|
-            urls["#{themes_url}#{URI.encode(slug)}/"] = slug
+            urls[target.theme_url(slug)] = slug
          end

          urls
--- a/app/finders/themes/urls_in_homepage.rb
+++ b/app/finders/themes/urls_in_homepage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Themes
@@ -12,7 +14,7 @@ module WPScan
          found = []

          (items_from_links('themes') + items_from_codes('themes')).uniq.sort.each do |slug|
-            found << WPScan::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+            found << Model::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
          end

          found
--- a/app/finders/timthumb_version.rb
+++ b/app/finders/timthumb_version.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'timthumb_version/bad_request'

 module WPScan
@@ -7,7 +9,7 @@ module WPScan
      class Base
        include CMSScanner::Finders::UniqueFinder

-        # @param [ WPScan::Timthumb ] target
+        # @param [ Model::Timthumb ] target
        def initialize(target)
          finders << TimthumbVersion::BadRequest.new(target)
        end
--- a/app/finders/timthumb_version/bad_request.rb
+++ b/app/finders/timthumb_version/bad_request.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module TimthumbVersion
@@ -8,7 +10,7 @@ module WPScan
        def aggressive(_opts = {})
          return unless Browser.get(target.url).body =~ /(TimThumb version\s*: ([^<]+))/

-          WPScan::Version.new(
+          Model::Version.new(
            Regexp.last_match[2],
            found_by: 'Bad Request (Aggressive Detection)',
            confidence: 90,
--- a/app/finders/timthumbs.rb
+++ b/app/finders/timthumbs.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'timthumbs/known_locations'

 module WPScan
--- a/app/finders/timthumbs/known_locations.rb
+++ b/app/finders/timthumbs/known_locations.rb
@@ -1,10 +1,19 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Timthumbs
      # Known Locations Timthumbs Finder
+      # Note: A vulnerable version, 2.8.13 can be found here:
+      # https://github.com/GabrielGil/TimThumb/blob/980c3d6a823477761570475e8b83d3e9fcd2d7ae/timthumb.php
      class KnownLocations < CMSScanner::Finders::Finder
        include CMSScanner::Finders::Finder::Enumerator

+        # @return [ Array<Integer> ]
+        def valid_response_codes
+          @valid_response_codes ||= [400]
+        end
+
        # @param [ Hash ] opts
        # @option opts [ String ] :list Mandatory
        #
@@ -12,10 +21,10 @@ module WPScan
        def aggressive(opts = {})
          found = []

-          enumerate(target_urls(opts), opts) do |res|
-            next unless res.code == 400 && res.body =~ /no image specified/i
+          enumerate(target_urls(opts), opts.merge(check_full_response: 400)) do |res|
+            next unless /no image specified/i.match?(res.body)

-            found << WPScan::Timthumb.new(res.request.url, opts.merge(found_by: found_by, confidence: 100))
+            found << Model::Timthumb.new(res.request.url, opts.merge(found_by: found_by, confidence: 100))
          end

          found
--- a/app/finders/users.rb
+++ b/app/finders/users.rb
@@ -1,9 +1,12 @@
+# frozen_string_literal: true
+
 require_relative 'users/author_posts'
 require_relative 'users/wp_json_api'
 require_relative 'users/oembed_api'
 require_relative 'users/rss_generator'
 require_relative 'users/author_id_brute_forcing'
 require_relative 'users/login_error_messages'
+require_relative 'users/yoast_seo_author_sitemap.rb'

 module WPScan
  module Finders
@@ -19,6 +22,7 @@ module WPScan
            Users::WpJsonApi.new(target) <<
            Users::OembedApi.new(target) <<
            Users::RSSGenerator.new(target) <<
+            Users::YoastSeoAuthorSitemap.new(target) <<
            Users::AuthorIdBruteForcing.new(target) <<
            Users::LoginErrorMessages.new(target)
        end
--- a/app/finders/users/author_id_brute_forcing.rb
+++ b/app/finders/users/author_id_brute_forcing.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Users
@@ -5,6 +7,11 @@ module WPScan
      class AuthorIdBruteForcing < CMSScanner::Finders::Finder
        include CMSScanner::Finders::Finder::Enumerator

+        # @return [ Array<Integer> ]
+        def valid_response_codes
+          @valid_response_codes ||= [200, 301, 302]
+        end
+
        # @param [ Hash ] opts
        # @option opts [ Range ] :range Mandatory
        #
@@ -13,12 +20,12 @@ module WPScan
          found = []
          found_by_msg = 'Author Id Brute Forcing - %s (Aggressive Detection)'

-          enumerate(target_urls(opts), opts) do |res, id|
+          enumerate(target_urls(opts), opts.merge(check_full_response: true)) do |res, id|
            username, found_by, confidence = potential_username(res)

            next unless username

-            found << CMSScanner::User.new(
+            found << Model::User.new(
              username,
              id: id,
              found_by: format(found_by_msg, found_by),
@@ -47,7 +54,7 @@ module WPScan
          super(opts.merge(title: ' Brute Forcing Author IDs -'))
        end

-        def request_params
+        def full_request_params
          { followlocation: true }
        end

@@ -76,8 +83,8 @@ module WPScan
        # @return [ String, nil ] The username found
        def username_from_response(res)
          # Permalink enabled
-          target.in_scope_urls(res, '//link/@href|//a/@href') do |url|
-            username = username_from_author_url(url)
+          target.in_scope_uris(res, '//link/@href|//a/@href') do |uri|
+            username = username_from_author_url(uri.to_s)
            return username if username
          end

--- a/app/finders/users/author_posts.rb
+++ b/app/finders/users/author_posts.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Users
@@ -10,7 +12,7 @@ module WPScan
          found_by_msg = 'Author Posts - %s (Passive Detection)'

          usernames(opts).reduce([]) do |a, e|
-            a << CMSScanner::User.new(
+            a << Model::User.new(
              e[0],
              found_by: format(found_by_msg, e[1]),
              confidence: e[2]
@@ -43,12 +45,10 @@ module WPScan
        def potential_usernames(res)
          usernames = []

-          target.in_scope_urls(res, '//a/@href') do |url, node|
-            uri = Addressable::URI.parse(url)
-
+          target.in_scope_uris(res, '//a/@href') do |uri, node|
            if uri.path =~ %r{/author/([^/\b]+)/?\z}i
              usernames << [Regexp.last_match[1], 'Author Pattern', 100]
-            elsif uri.query =~ /author=[0-9]+/
+            elsif /author=[0-9]+/.match?(uri.query)
              usernames << [node.text.to_s.strip, 'Display Name', 30]
            end
          end
--- a/app/finders/users/login_error_messages.rb
+++ b/app/finders/users/login_error_messages.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Users
@@ -22,9 +24,9 @@ module WPScan

            return found if error.empty? # Protection plugin / error disabled

-            next unless error =~ /The password you entered for the username|Incorrect Password/i
+            next unless /The password you entered for the username|Incorrect Password/i.match?(error)

-            found << CMSScanner::User.new(username, found_by: found_by, confidence: 100)
+            found << Model::User.new(username, found_by: found_by, confidence: 100)
          end

          found
--- a/app/finders/users/oembed_api.rb
+++ b/app/finders/users/oembed_api.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Users
@@ -14,29 +16,35 @@ module WPScan

        # @param [ Hash ] opts
        #
-        # TODO: make this code pretty :x
-        #
        # @return [ Array<User> ]
        def aggressive(_opts = {})
-          found        = []
-          found_by_msg = 'Oembed API - %s (Aggressive Detection)'
-
          oembed_data = JSON.parse(Browser.get(api_url).body)
+          details     = user_details_from_oembed_data(oembed_data)
+
+          return [] unless details
+
+          [Model::User.new(details[0],
+                           found_by: format(found_by_msg, details[1]),
+                           confidence: details[2],
+                           interesting_entries: [api_url])]
+        rescue JSON::ParserError
+          []
+        end
+
+        def user_details_from_oembed_data(oembed_data)
+          return unless oembed_data

          if oembed_data['author_url'] =~ %r{/author/([^/]+)/?\z}
            details = [Regexp.last_match[1], 'Author URL', 90]
          elsif oembed_data['author_name'] && !oembed_data['author_name'].empty?
-            details = [oembed_data['author_name'].delete(' '), 'Author Name', 70]
+            details = [oembed_data['author_name'], 'Author Name', 70]
          end

-          return unless details
+          details
+        end

-          found << CMSScanner::User.new(details[0],
-                                        found_by: format(found_by_msg, details[1]),
-                                        confidence: details[2],
-                                        interesting_entries: [api_url])
-        rescue JSON::ParserError
-          found
+        def found_by_msg
+          'Oembed API - %s (Aggressive Detection)'
        end

        # @return [ String ] The URL of the API listing the Users
--- a/app/finders/users/rss_generator.rb
+++ b/app/finders/users/rss_generator.rb
@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Users
      # Users disclosed from the dc:creator field in the RSS
      # The names disclosed are display names, however depending on the configuration of the blog,
      # they can be the same than usernames
-      class RSSGenerator < WPScan::Finders::WpVersion::RSSGenerator
+      class RSSGenerator < Finders::WpVersion::RSSGenerator
        def process_urls(urls, _opts = {})
          found = []

@@ -17,14 +19,20 @@ module WPScan

            begin
              res.xml.xpath('//item/dc:creator').each do |node|
-                potential_usernames << node.text.to_s unless node.text.to_s.length > 40
+                username = node.text.to_s
+
+                # Ignoring potential username longer than 60 characters and containing accents
+                # as they are considered invalid. See https://github.com/wpscanteam/wpscan/issues/1215
+                next if username.strip.empty? || username.length > 60 || username =~ /[^\x00-\x7F]/
+
+                potential_usernames << username
              end
            rescue Nokogiri::XML::XPath::SyntaxError
              next
            end

-            potential_usernames.uniq.each do |potential_username|
-              found << CMSScanner::User.new(potential_username, found_by: found_by, confidence: 50)
+            potential_usernames.uniq.each do |username|
+              found << Model::User.new(username, found_by: found_by, confidence: 50)
            end

            break
--- a/app/finders/users/wp_json_api.rb
+++ b/app/finders/users/wp_json_api.rb
@@ -1,23 +1,34 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module Users
      # WP JSON API
      #
      # Since 4.7 - Need more investigation as it seems WP 4.7.1 reduces the exposure, see https://github.com/wpscanteam/wpscan/issues/1038)
+      # For the pagination, see https://github.com/wpscanteam/wpscan/issues/1285
      #
      class WpJsonApi < CMSScanner::Finders::Finder
+        MAX_PER_PAGE = 100 # See https://developer.wordpress.org/rest-api/using-the-rest-api/pagination/
+
        # @param [ Hash ] opts
        #
        # @return [ Array<User> ]
        def aggressive(_opts = {})
-          found = []
+          found        = []
+          current_page = 0

-          JSON.parse(Browser.get(api_url).body)&.each do |user|
-            found << CMSScanner::User.new(user['slug'],
-                                          id: user['id'],
-                                          found_by: found_by,
-                                          confidence: 100,
-                                          interesting_entries: [api_url])
+          loop do
+            current_page += 1
+
+            res = Typhoeus.get(api_url, params: { per_page: MAX_PER_PAGE, page: current_page })
+
+            total_pages ||= res.headers['X-WP-TotalPages'].to_i
+
+            users_in_page = users_from_response(res)
+            found        += users_in_page
+
+            break if current_page >= total_pages || users_in_page.empty?
          end

          found
@@ -25,9 +36,32 @@ module WPScan
          found
        end

+        # @param [ Typhoeus::Response ] response
+        #
+        # @return [ Array<User> ] The users from the response
+        def users_from_response(response)
+          found = []
+
+          JSON.parse(response.body)&.each do |user|
+            found << Model::User.new(user['slug'],
+                                     id: user['id'],
+                                     found_by: found_by,
+                                     confidence: 100,
+                                     interesting_entries: [response.effective_url])
+          end
+
+          found
+        end
+
        # @return [ String ] The URL of the API listing the Users
        def api_url
-          @api_url ||= target.url('wp-json/wp/v2/users/')
+          return @api_url if @api_url
+
+          target.in_scope_uris(target.homepage_res, "//link[@rel='https://api.w.org/']/@href").each do |uri|
+            return @api_url = uri.join('wp/v2/users/').to_s if uri.path.include?('wp-json')
+          end
+
+          @api_url = target.url('wp-json/wp/v2/users/')
        end
      end
    end
--- a/app/finders/users/yoast_seo_author_sitemap.rb
+++ b/app/finders/users/yoast_seo_author_sitemap.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    module Users
+      # The YOAST SEO plugin has an author-sitemap.xml which can leak usernames
+      # See https://github.com/wpscanteam/wpscan/issues/1228
+      class YoastSeoAuthorSitemap < CMSScanner::Finders::Finder
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<User> ]
+        def aggressive(_opts = {})
+          found = []
+
+          Browser.get(sitemap_url).html.xpath('//url/loc').each do |user_tag|
+            username = user_tag.text.to_s[%r{/author/([^\/]+)/}, 1]
+
+            next unless username && !username.strip.empty?
+
+            found << Model::User.new(username,
+                                     found_by: found_by,
+                                     confidence: 100,
+                                     interesting_entries: [sitemap_url])
+          end
+
+          found
+        end
+
+        # @return [ String ] The URL of the author-sitemap
+        def sitemap_url
+          @sitemap_url ||= target.url('author-sitemap.xml')
+        end
+      end
+    end
+  end
+end
--- a/app/finders/wp_items.rb
+++ b/app/finders/wp_items.rb
@@ -1 +1,3 @@
+# frozen_string_literal: true
+
 require_relative 'wp_items/urls_in_homepage'
--- a/app/finders/wp_items/urls_in_homepage.rb
+++ b/app/finders/wp_items/urls_in_homepage.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module WpItems
@@ -10,8 +12,8 @@ module WPScan
        def items_from_links(type, uniq = true)
          found = []

-          target.in_scope_urls(target.homepage_res) do |url|
-            next unless url =~ item_attribute_pattern(type)
+          target.in_scope_uris(target.homepage_res) do |uri|
+            next unless uri.to_s =~ item_attribute_pattern(type)

            found << Regexp.last_match[1]
          end
--- a/app/finders/wp_version.rb
+++ b/app/finders/wp_version.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'wp_version/rss_generator'
 require_relative 'wp_version/atom_generator'
 require_relative 'wp_version/rdf_generator'
@@ -26,7 +28,7 @@ module WPScan
        # @param [ WPScan::Target ] target
        def initialize(target)
          (%w[RSSGenerator AtomGenerator RDFGenerator] +
-           WPScan::DB::DynamicFinders::Wordpress.versions_finders_configs.keys +
+           DB::DynamicFinders::Wordpress.versions_finders_configs.keys +
           %w[Readme UniqueFingerprinting]
          ).each do |finder_name|
            finders << WpVersion.const_get(finder_name.to_sym).new(target)
--- a/app/finders/wp_version/atom_generator.rb
+++ b/app/finders/wp_version/atom_generator.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module WpVersion
--- a/app/finders/wp_version/rdf_generator.rb
+++ b/app/finders/wp_version/rdf_generator.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module WpVersion
--- a/app/finders/wp_version/readme.rb
+++ b/app/finders/wp_version/readme.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module WpVersion
@@ -13,9 +15,9 @@ module WPScan

          number = Regexp.last_match(1)

-          return unless WPScan::WpVersion.valid?(number)
+          return unless Model::WpVersion.valid?(number)

-          WPScan::WpVersion.new(
+          Model::WpVersion.new(
            number,
            found_by: 'Readme (Aggressive Detection)',
            # Since WP 4.7, the Readme only contains the major version (ie 4.7, 4.8 etc)
--- a/app/finders/wp_version/rss_generator.rb
+++ b/app/finders/wp_version/rss_generator.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module WpVersion
--- a/app/finders/wp_version/unique_fingerprinting.rb
+++ b/app/finders/wp_version/unique_fingerprinting.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module WPScan
  module Finders
    module WpVersion
@@ -11,7 +13,7 @@ module WPScan
            hydra.abort
            progress_bar.finish

-            return WPScan::WpVersion.new(
+            return Model::WpVersion.new(
              version_number,
              found_by: 'Unique Fingerprinting (Aggressive Detection)',
              confidence: 100,
--- a/app/models.rb
+++ b/app/models.rb
@@ -1,3 +1,11 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Model
+    include CMSScanner::Model
+  end
+end
+
 require_relative 'models/interesting_finding'
 require_relative 'models/wp_version'
 require_relative 'models/xml_rpc'
--- a/app/models/config_backup.rb
+++ b/app/models/config_backup.rb
@@ -1,5 +1,9 @@
+# frozen_string_literal: true
+
 module WPScan
-  # Config Backup
-  class ConfigBackup < InterestingFinding
+  module Model
+    # Config Backup
+    class ConfigBackup < InterestingFinding
+    end
  end
 end
--- a/app/models/db_export.rb
+++ b/app/models/db_export.rb
@@ -1,5 +1,9 @@
+# frozen_string_literal: true
+
 module WPScan
-  # DB Export
-  class DbExport < InterestingFinding
+  module Model
+    # DB Export
+    class DbExport < InterestingFinding
+    end
  end
 end
--- a/app/models/interesting_finding.rb
+++ b/app/models/interesting_finding.rb
@@ -1,6 +1,52 @@
+# frozen_string_literal: true
+
 module WPScan
-  # Custom class to include the WPScan::References module
-  class InterestingFinding < CMSScanner::InterestingFinding
-    include References
+  module Model
+    # Custom class to include the WPScan::References module
+    class InterestingFinding < CMSScanner::Model::InterestingFinding
+      include References
+    end
+
+    #
+    # Empty classes for the #type to be correctly displayed (as taken from the self.class from the parent)
+    #
+    class BackupDB < InterestingFinding
+    end
+
+    class DebugLog < InterestingFinding
+    end
+
+    class DuplicatorInstallerLog < InterestingFinding
+    end
+
+    class EmergencyPwdResetScript < InterestingFinding
+    end
+
+    class FullPathDisclosure < InterestingFinding
+    end
+
+    class MuPlugins < InterestingFinding
+    end
+
+    class Multisite < InterestingFinding
+    end
+
+    class Readme < InterestingFinding
+    end
+
+    class Registration < InterestingFinding
+    end
+
+    class TmmDbMigrate < InterestingFinding
+    end
+
+    class UploadDirectoryListing < InterestingFinding
+    end
+
+    class UploadSQLDump < InterestingFinding
+    end
+
+    class WPCron < InterestingFinding
+    end
  end
 end
--- a/app/models/media.rb
+++ b/app/models/media.rb
@@ -1,5 +1,9 @@
+# frozen_string_literal: true
+
 module WPScan
-  # Media
-  class Media < InterestingFinding
+  module Model
+    # Media
+    class Media < InterestingFinding
+    end
  end
 end
--- a/app/models/plugin.rb
+++ b/app/models/plugin.rb
@@ -1,25 +1,38 @@
+# frozen_string_literal: true
+
 module WPScan
-  # WordPress Plugin
-  class Plugin < WpItem
-    # See WpItem
-    def initialize(slug, blog, opts = {})
-      super(slug, blog, opts)
+  module Model
+    # WordPress Plugin
+    class Plugin < WpItem
+      # See WpItem
+      def initialize(slug, blog, opts = {})
+        super(slug, blog, opts)

-      @uri = Addressable::URI.parse(blog.url("wp-content/plugins/#{slug}/"))
-    end
+        # To be used by #head_and_get
+        # If custom wp-content, it will be replaced by blog#url
+        @path_from_blog = "wp-content/plugins/#{slug}/"

-    # @return [ JSON ]
-    def db_data
-      DB::Plugin.db_data(slug)
-    end
+        @uri = Addressable::URI.parse(blog.url(path_from_blog))
+      end

-    # @param [ Hash ] opts
-    #
-    # @return [ WPScan::Version, false ]
-    def version(opts = {})
-      @version = Finders::PluginVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?
+      # @return [ JSON ]
+      def db_data
+        @db_data ||= DB::Plugin.db_data(slug)
+      end

-      @version
+      # @param [ Hash ] opts
+      #
+      # @return [ Model::Version, false ]
+      def version(opts = {})
+        @version = Finders::PluginVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?
+
+        @version
+      end
+
+      # @return [ Array<String> ]
+      def potential_readme_filenames
+        @potential_readme_filenames ||= [*(DB::DynamicFinders::Plugin.df_data.dig(slug, 'Readme', 'path') || super)]
+      end
    end
  end
 end
--- a/app/models/theme.rb
+++ b/app/models/theme.rb
@@ -1,99 +1,107 @@
+# frozen_string_literal: true
+
 module WPScan
-  # WordPress Theme
-  class Theme < WpItem
-    attr_reader :style_url, :style_name, :style_uri, :author, :author_uri, :template, :description,
-                :license, :license_uri, :tags, :text_domain
+  module Model
+    # WordPress Theme
+    class Theme < WpItem
+      attr_reader :style_url, :style_name, :style_uri, :author, :author_uri, :template, :description,
+                  :license, :license_uri, :tags, :text_domain

-    # See WpItem
-    def initialize(slug, blog, opts = {})
-      super(slug, blog, opts)
+      # See WpItem
+      def initialize(slug, blog, opts = {})
+        super(slug, blog, opts)

-      @uri       = Addressable::URI.parse(blog.url("wp-content/themes/#{slug}/"))
-      @style_url = opts[:style_url] || url('style.css')
+        # To be used by #head_and_get
+        # If custom wp-content, it will be replaced by blog#url
+        @path_from_blog = "wp-content/themes/#{slug}/"

-      parse_style
-    end
+        @uri       = Addressable::URI.parse(blog.url(path_from_blog))
+        @style_url = opts[:style_url] || url('style.css')

-    # @return [ JSON ]
-    def db_data
-      DB::Theme.db_data(slug)
-    end
-
-    # @param [ Hash ] opts
-    #
-    # @return [ WPScan::Version, false ]
-    def version(opts = {})
-      @version = Finders::ThemeVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?
-
-      @version
-    end
-
-    # @return [ Theme ]
-    def parent_theme
-      return unless template
-      return unless style_body =~ /^@import\surl\(["']?([^"'\)]+)["']?\);\s*$/i
-
-      opts = detection_opts.merge(
-        style_url: url(Regexp.last_match[1]),
-        found_by: 'Parent Themes (Passive Detection)',
-        confidence: 100
-      ).merge(version_detection: version_detection_opts)
-
-      self.class.new(template, blog, opts)
-    end
-
-    # @param [ Integer ] depth
-    #
-    # @retun [ Array<Theme> ]
-    def parent_themes(depth = 3)
-      theme  = self
-      found  = []
-
-      (1..depth).each do |_|
-        parent = theme.parent_theme
-
-        break unless parent
-
-        found << parent
-        theme = parent
+        parse_style
      end

-      found
-    end
-
-    def style_body
-      @style_body ||= Browser.get(style_url).body
-    end
-
-    def parse_style
-      {
-        style_name: 'Theme Name',
-        style_uri: 'Theme URI',
-        author: 'Author',
-        author_uri: 'Author URI',
-        template: 'Template',
-        description: 'Description',
-        license: 'License',
-        license_uri: 'License URI',
-        tags: 'Tags',
-        text_domain: 'Text Domain'
-      }.each do |attribute, tag|
-        instance_variable_set(:"@#{attribute}", parse_style_tag(style_body, tag))
+      # @return [ JSON ]
+      def db_data
+        @db_data ||= DB::Theme.db_data(slug)
      end
-    end

-    # @param [ String ] bofy
-    # @param [ String ] tag
-    #
-    # @return [ String ]
-    def parse_style_tag(body, tag)
-      value = body[/^\s*#{Regexp.escape(tag)}:[\t ]*([^\r\n]+)/i, 1]
+      # @param [ Hash ] opts
+      #
+      # @return [ Model::Version, false ]
+      def version(opts = {})
+        @version = Finders::ThemeVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?

-      value && !value.strip.empty? ? value.strip : nil
-    end
+        @version
+      end

-    def ==(other)
-      super(other) && style_url == other.style_url
+      # @return [ Theme ]
+      def parent_theme
+        return unless template
+        return unless style_body =~ /^@import\surl\(["']?([^"'\)]+)["']?\);\s*$/i
+
+        opts = detection_opts.merge(
+          style_url: url(Regexp.last_match[1]),
+          found_by: 'Parent Themes (Passive Detection)',
+          confidence: 100
+        ).merge(version_detection: version_detection_opts)
+
+        self.class.new(template, blog, opts)
+      end
+
+      # @param [ Integer ] depth
+      #
+      # @retun [ Array<Theme> ]
+      def parent_themes(depth = 3)
+        theme  = self
+        found  = []
+
+        (1..depth).each do |_|
+          parent = theme.parent_theme
+
+          break unless parent
+
+          found << parent
+          theme = parent
+        end
+
+        found
+      end
+
+      def style_body
+        @style_body ||= Browser.get(style_url).body
+      end
+
+      def parse_style
+        {
+          style_name: 'Theme Name',
+          style_uri: 'Theme URI',
+          author: 'Author',
+          author_uri: 'Author URI',
+          template: 'Template',
+          description: 'Description',
+          license: 'License',
+          license_uri: 'License URI',
+          tags: 'Tags',
+          text_domain: 'Text Domain'
+        }.each do |attribute, tag|
+          instance_variable_set(:"@#{attribute}", parse_style_tag(style_body, tag))
+        end
+      end
+
+      # @param [ String ] bofy
+      # @param [ String ] tag
+      #
+      # @return [ String ]
+      def parse_style_tag(body, tag)
+        value = body[/^\s*#{Regexp.escape(tag)}:[\t ]*([^\r\n]+)/i, 1]
+
+        value && !value.strip.empty? ? value.strip : nil
+      end
+
+      def ==(other)
+        super(other) && style_url == other.style_url
+      end
    end
  end
 end
--- a/app/models/timthumb.rb
+++ b/app/models/timthumb.rb
@@ -1,71 +1,75 @@
+# frozen_string_literal: true
+
 module WPScan
-  # Timthumb
-  class Timthumb < InterestingFinding
-    include Vulnerable
+  module Model
+    # Timthumb
+    class Timthumb < InterestingFinding
+      include Vulnerable

-    attr_reader :version_detection_opts
+      attr_reader :version_detection_opts

-    # @param [ String ] url
-    # @param [ Hash ] opts
-    # @option opts [ Symbol ] :mode The mode to use to detect the version
-    def initialize(url, opts = {})
-      super(url, opts)
+      # @param [ String ] url
+      # @param [ Hash ] opts
+      # @option opts [ Symbol ] :mode The mode to use to detect the version
+      def initialize(url, opts = {})
+        super(url, opts)

-      @version_detection_opts = opts[:version_detection] || {}
-    end
+        @version_detection_opts = opts[:version_detection] || {}
+      end

-    # @param [ Hash ] opts
-    #
-    # @return [ WPScan::Version, false ]
-    def version(opts = {})
-      @version = Finders::TimthumbVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?
+      # @param [ Hash ] opts
+      #
+      # @return [ Model::Version, false ]
+      def version(opts = {})
+        @version = Finders::TimthumbVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?

-      @version
-    end
+        @version
+      end

-    # @return [ Array<Vulnerability> ]
-    def vulnerabilities
-      vulns = []
+      # @return [ Array<Vulnerability> ]
+      def vulnerabilities
+        vulns = []

-      vulns << rce_webshot_vuln if version == false || version > '1.35' && version < '2.8.14' && webshot_enabled?
-      vulns << rce_132_vuln if version == false || version < '1.33'
+        vulns << rce_webshot_vuln if version == false || version > '1.35' && version < '2.8.14' && webshot_enabled?
+        vulns << rce_132_vuln if version == false || version < '1.33'

-      vulns
-    end
+        vulns
+      end

-    # @return [ Vulnerability ] The RCE in the <= 1.32
-    def rce_132_vuln
-      Vulnerability.new(
-        'Timthumb <= 1.32 Remote Code Execution',
-        { exploitdb: ['17602'] },
-        'RCE',
-        '1.33'
-      )
-    end
+      # @return [ Vulnerability ] The RCE in the <= 1.32
+      def rce_132_vuln
+        Vulnerability.new(
+          'Timthumb <= 1.32 Remote Code Execution',
+          { exploitdb: ['17602'] },
+          'RCE',
+          '1.33'
+        )
+      end

-    # @return [ Vulnerability ] The RCE due to the WebShot in the > 1.35 (or >= 2.0) and <= 2.8.13
-    def rce_webshot_vuln
-      Vulnerability.new(
-        'Timthumb <= 2.8.13 WebShot Remote Code Execution',
-        {
-          url: ['http://seclists.org/fulldisclosure/2014/Jun/117', 'https://github.com/wpscanteam/wpscan/issues/519'],
-          cve: '2014-4663'
-        },
-        'RCE',
-        '2.8.14'
-      )
-    end
+      # @return [ Vulnerability ] The RCE due to the WebShot in the > 1.35 (or >= 2.0) and <= 2.8.13
+      def rce_webshot_vuln
+        Vulnerability.new(
+          'Timthumb <= 2.8.13 WebShot Remote Code Execution',
+          {
+            url: ['http://seclists.org/fulldisclosure/2014/Jun/117', 'https://github.com/wpscanteam/wpscan/issues/519'],
+            cve: '2014-4663'
+          },
+          'RCE',
+          '2.8.14'
+        )
+      end

-    # @return [ Boolean ]
-    def webshot_enabled?
-      res = Browser.get(url, params: { webshot: 1, src: "http://#{default_allowed_domains.sample}" })
+      # @return [ Boolean ]
+      def webshot_enabled?
+        res = Browser.get(url, params: { webshot: 1, src: "http://#{default_allowed_domains.sample}" })

-      res.body =~ /WEBSHOT_ENABLED == true/ ? false : true
-    end
+        /WEBSHOT_ENABLED == true/.match?(res.body) ? false : true
+      end

-    # @return [ Array<String> ] The default allowed domains (between the 2.0 and 2.8.13)
-    def default_allowed_domains
-      %w[flickr.com picasa.com img.youtube.com upload.wikimedia.org]
+      # @return [ Array<String> ] The default allowed domains (between the 2.0 and 2.8.13)
+      def default_allowed_domains
+        %w[flickr.com picasa.com img.youtube.com upload.wikimedia.org]
+      end
    end
  end
 end
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .5.0
 .6.2