Compare commits

..

1 Commits

Author SHA1 Message Date
dependabot[bot]
1abb98f51f Bump docker/build-push-action from 4 to 5
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4 to 5.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v4...v5)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-09-27 10:15:30 +00:00
11 changed files with 16 additions and 48 deletions

View File

@@ -9,7 +9,7 @@ jobs:
strategy: strategy:
matrix: matrix:
ruby: [2.7, '3.0', 3.1, 3.2] ruby: [2.7, '3.0', 3.1]
steps: steps:
- name: Checkout code - name: Checkout code

View File

@@ -49,7 +49,7 @@ jobs:
password: ${{ secrets.DOCKERHUB_TOKEN }} password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Build and push - name: Build and push
uses: docker/build-push-action@v4 uses: docker/build-push-action@v5
with: with:
platforms: linux/amd64,linux/arm/v7,linux/arm64 platforms: linux/amd64,linux/arm/v7,linux/arm64
push: true push: true

View File

@@ -38,9 +38,7 @@ When using a pentesting distubution (such as Kali Linux), it is recommended to i
### In macOSX via Homebrew ### In macOSX via Homebrew
```shell `brew install wpscanteam/tap/wpscan`
brew install wpscanteam/tap/wpscan
```
### From RubyGems ### From RubyGems

View File

@@ -7,10 +7,6 @@ module WPScan
class KnownLocations < CMSScanner::Finders::Finder class KnownLocations < CMSScanner::Finders::Finder
include CMSScanner::Finders::Finder::Enumerator include CMSScanner::Finders::Finder::Enumerator
def valid_response_codes
@valid_response_codes ||= [200, 206].freeze
end
SQL_PATTERN = /(?:DROP|(?:UN)?LOCK|CREATE|ALTER) (?:TABLE|DATABASE)|INSERT INTO/.freeze SQL_PATTERN = /(?:DROP|(?:UN)?LOCK|CREATE|ALTER) (?:TABLE|DATABASE)|INSERT INTO/.freeze
# @param [ Hash ] opts # @param [ Hash ] opts
@@ -21,7 +17,7 @@ module WPScan
def aggressive(opts = {}) def aggressive(opts = {})
found = [] found = []
enumerate(potential_urls(opts), opts.merge(check_full_response: valid_response_codes)) do |res| enumerate(potential_urls(opts), opts.merge(check_full_response: 200)) do |res|
if res.effective_url.end_with?('.zip') if res.effective_url.end_with?('.zip')
next unless %r{\Aapplication/zip}i.match?(res.headers['Content-Type']) next unless %r{\Aapplication/zip}i.match?(res.headers['Content-Type'])
else else

View File

@@ -36,8 +36,6 @@ module WPScan
oembed_data = oembed_data.first if oembed_data.is_a?(Array) oembed_data = oembed_data.first if oembed_data.is_a?(Array)
oembed_data = {} unless oembed_data.is_a?(Hash)
if oembed_data['author_url'] =~ %r{/author/([^/]+)/?\z} if oembed_data['author_url'] =~ %r{/author/([^/]+)/?\z}
details = [Regexp.last_match[1], 'Author URL', 90] details = [Regexp.last_match[1], 'Author URL', 90]
elsif oembed_data['author_name'] && !oembed_data['author_name'].empty? elsif oembed_data['author_name'] && !oembed_data['author_name'].empty?

View File

@@ -42,17 +42,13 @@ module WPScan
def users_from_response(response) def users_from_response(response)
found = [] found = []
json = JSON.parse(response.body) JSON.parse(response.body)&.each do |user|
if json.is_a?(Enumerable)
json.each do |user|
found << Model::User.new(user['slug'], found << Model::User.new(user['slug'],
id: user['id'], id: user['id'],
found_by: found_by, found_by: found_by,
confidence: 100, confidence: 100,
interesting_entries: [response.effective_url]) interesting_entries: [response.effective_url])
end end
end
found found
end end

View File

@@ -92,7 +92,7 @@ module WPScan
tags: 'Tags', tags: 'Tags',
text_domain: 'Text Domain' text_domain: 'Text Domain'
}.each do |attribute, tag| }.each do |attribute, tag|
instance_variable_set(:"@#{attribute}", parse_style_tag(style_body, tag)&.force_encoding('UTF-8')) instance_variable_set(:"@#{attribute}", parse_style_tag(style_body, tag))
end end
end end

View File

@@ -16,8 +16,5 @@ def classify_slug(slug)
classified = slug.to_s.gsub(/[^a-z\d\-]/i, '-').gsub(/-{1,}/, '_').camelize.to_s classified = slug.to_s.gsub(/[^a-z\d\-]/i, '-').gsub(/-{1,}/, '_').camelize.to_s
classified = "D_#{classified}" if /\d/.match?(classified[0]) classified = "D_#{classified}" if /\d/.match?(classified[0])
# Special case for slugs with all non-latin characters.
classified = "HexSlug_#{slug.bytes.map { |i| i.to_s(16) }.join}" if classified.empty?
classified.to_sym classified.to_sym
end end

View File

@@ -13,19 +13,11 @@ describe WPScan::Finders::Users::OembedApi do
end end
context 'when not a JSON response' do context 'when not a JSON response' do
context 'when empty' do
let(:body) { '' } let(:body) { '' }
its(:aggressive) { should eql([]) } its(:aggressive) { should eql([]) }
end end
context 'when a string' do
let(:body) { '404' }
its(:aggressive) { should eql([]) }
end
end
context 'when a JSON response' do context 'when a JSON response' do
let(:body) { File.read(fixture) } let(:body) { File.read(fixture) }

View File

@@ -20,19 +20,11 @@ describe WPScan::Finders::Users::WpJsonApi do
end end
context 'when not a JSON response' do context 'when not a JSON response' do
context 'when empty' do
let(:body) { '' } let(:body) { '' }
its(:aggressive) { should eql([]) } its(:aggressive) { should eql([]) }
end end
context 'when a string' do
let(:body) { '404' }
its(:aggressive) { should eql([]) }
end
end
context 'when a JSON response' do context 'when a JSON response' do
context 'when unauthorised' do context 'when unauthorised' do
let(:body) { File.read(fixtures.join('401.json')) } let(:body) { File.read(fixtures.join('401.json')) }

View File

@@ -7,8 +7,7 @@ describe '#classify_slug' do
'12-slug' => :D_12Slug, '12-slug' => :D_12Slug,
'slug.s' => :SlugS, 'slug.s' => :SlugS,
'slug yolo $' => :SlugYolo, 'slug yolo $' => :SlugYolo,
'slug $ ab.cd/12' => :SlugAbCd12, 'slug $ ab.cd/12' => :SlugAbCd12
'カスタムテーマ' => :HexSlug_e382abe382b9e382bfe383a0e38386e383bce3839e
}.each do |slug, expected_symbol| }.each do |slug, expected_symbol|
context "when #{slug}" do context "when #{slug}" do
it "returns #{expected_symbol}" do it "returns #{expected_symbol}" do