# File lib/wpscan/wp_item.rb, line 25 def initialize(options) @type = options[:type] @wp_content_dir = options[:wp_content_dir] ? options[:wp_content_dir].sub(%r^\//, "").sub(%r\/$/, "") : "wp-content" @wp_plugins_dir = options[:wp_plugins_dir] || "#@wp_content_dir/plugins" @base_url = options[:base_url] @path = options[:path] @name = options[:name] || extract_name_from_url @vulns_file = options[:vulns_file] @vulns_xpath = options[:vulns_xpath].sub(%r\$name\$/, @name) unless options[:vulns_xpath] == nil raise("base_url not set") unless @base_url raise("path not set") unless @path raise("wp_content_dir not set") unless @wp_content_dir raise("name not set") unless @name raise("vulns_file not set") unless @vulns_file raise("type not set") unless @type end
Compare
# File lib/wpscan/wp_item.rb, line 128 def <=>(other) other.name <=> self.name end
Compare
# File lib/wpscan/wp_item.rb, line 118 def ==(other) other.name == self.name end
Compare
# File lib/wpscan/wp_item.rb, line 123 def ===(other) other.name == self.name end
Url for changelog.txt
# File lib/wpscan/wp_item.rb, line 138 def changelog_url get_url_without_filename.merge("changelog.txt") end
Is directory listing enabled?
# File lib/wpscan/wp_item.rb, line 101 def directory_listing? # Need to remove to file part from the url Browser.instance.get(get_url_without_filename).body[%r{<title>Index of}] ? true : false end
Extract item name from a url
# File lib/wpscan/wp_item.rb, line 107 def extract_name_from_url get_full_url.to_s[%r{^(https?://.*/([^/]+)/)}, 2] end
Get the full url for this item
# File lib/wpscan/wp_item.rb, line 63 def get_full_url url = @base_url.to_s.end_with?("/") ? @base_url.to_s : "#@base_url/" # remove first and last / wp_content_dir = @wp_content_dir.sub(%r^\//, "").sub(%r\/$/, "") # remove first / path = @path.sub(%r^\//, "") if type =="plugins" # plugins can be outside of wp-content. wp_content_dir included in wp_plugins_dir ret = URI.parse(URI.encode("#{url}#@wp_plugins_dir/#{path}")) elsif type == "timthumbs" # timthumbs have folder in path variable ret = URI.parse(URI.encode("#{url}#{wp_content_dir}/#{path}")) else ret = URI.parse(URI.encode("#{url}#{wp_content_dir}/#{get_sub_folder}/#{path}")) end ret end
# File lib/wpscan/wp_item.rb, line 49 def get_sub_folder case @type when "themes" folder = "themes" when "timthumbs" # not needed folder = nil else raise("unknown type #@type") end folder end
Gets the full url for this item without filenames
# File lib/wpscan/wp_item.rb, line 82 def get_url_without_filename location_url = get_full_url.to_s valid_location_url = location_url[%r{^(https?://.*/)[^.]+\.[^/]+$}, 1] unless valid_location_url valid_location_url = add_trailing_slash(location_url) end URI.parse(URI.encode(valid_location_url)) end
changelog.txt present?
# File lib/wpscan/wp_item.rb, line 152 def has_changelog? unless @changelog status = Browser.instance.get(changelog_url).code @changelog = status == 200 ? true : false end @changelog end
readme.txt present?
# File lib/wpscan/wp_item.rb, line 143 def has_readme? unless @readme status = Browser.instance.get(readme_url).code @readme = status == 200 ? true : false end @readme end
Url for readme.txt
# File lib/wpscan/wp_item.rb, line 133 def readme_url get_url_without_filename.merge("readme.txt") end
To string. Adds a version number if detected
# File lib/wpscan/wp_item.rb, line 112 def to_s item_version = version "#@name#{' v' + item_version.strip if item_version}" end
Returns version number from readme.txt if it exists
# File lib/wpscan/wp_item.rb, line 92 def version unless @version response = Browser.instance.get(get_full_url.merge("readme.txt").to_s) @version = response.body[%r{stable tag: #{WpVersion.version_pattern}}, 1] end @version end
The wordpress.org plugins directory URL See: github.com/wpscanteam/wpscan/issues/100
# File lib/wpscan/wp_item.rb, line 45 def wp_org_url URI('http://wordpress.org/extend/plugins/').merge("#@name/") end