dradis-wpscan 3.17.0 → 3.18.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: ecf7d2783c66e0c0a0484df51099b874a3fd0678a46212bed83fbc62dd6835d7
4
- data.tar.gz: 1ebee50a3920ee0cdaeb12c82edafe796dd3dc3b9343ca85038641682bfd2cdd
3
+ metadata.gz: d70372e9b9c470fe88b070b5702d50576d2719c3f49ccc080909c008f5879350
4
+ data.tar.gz: 28805d43efc595a284b014e6d9c510072531f1be51c0fe616993842106e1e028
5
5
  SHA512:
6
- metadata.gz: c9c4c53ac5215a4cdf6a3f14eb533637b3e865197edf631b90899c6e359eef9ad20af21a3b5d68cb982c497b3826ccf89034c210dae7026d856c8d662159aacf
7
- data.tar.gz: 27661d131e2b7893ec868167ecd6109d264a72148ca86ec802340bec56669b60b51295a85239f751b130298033f1d8f52d21347f1cf7638c6a40edf9ce3f3e45
6
+ metadata.gz: 026c535d683df1b6d7d2fa5521ef69122a54ce720fc44efdae46a1005d3280494bc0e6c44b68e0b22b1f972b5d1219f470cb160c9e3737b8025bcb50594749a7
7
+ data.tar.gz: d944e7db613e7782f67c86efe0ad40e9e6959ef3ab156d0193a68eadda671179a0a3b0d674a5ed3f6e386e598afa51792815bc19c3bfa250c095f92b87acabf6
@@ -1,3 +1,8 @@
1
+ ## Dradis Framework 3.18 (July, 2020) ##
2
+
3
+ * Fix WPScan Plugin Manager by adding an evidence.sample
4
+
5
+
1
6
  ## Dradis Framework 3.17 (May, 2020) ##
2
7
 
3
8
  * No changes.
@@ -8,7 +8,7 @@ module Dradis
8
8
 
9
9
  module VERSION
10
10
  MAJOR = 3
11
- MINOR = 17
11
+ MINOR = 18
12
12
  TINY = 0
13
13
  PRE = nil
14
14
 
@@ -0,0 +1,481 @@
1
+ {
2
+ "banner":{
3
+ "description":"WordPress Security Scanner by the WPScan Team",
4
+ "version":"3.7.5",
5
+ "authors":[
6
+ "@_WPScan_",
7
+ "@ethicalhack3r",
8
+ "@erwan_lr",
9
+ "@_FireFart_"
10
+ ],
11
+ "sponsor":"WPScan.io - Online WordPress Vulnerability Scanner"
12
+ },
13
+ "start_time":1573480650,
14
+ "start_memory":49602560,
15
+ "target_url":"http://www.redacted.com/",
16
+ "effective_url":"http://www.redacted.com/",
17
+ "interesting_findings":[
18
+ {
19
+ "url":"http://www.redacted.com/",
20
+ "to_s":"http://www.redacted.com/",
21
+ "type":"headers",
22
+ "found_by":"Headers (Passive Detection)",
23
+ "confidence":100,
24
+ "confirmed_by":{
25
+
26
+ },
27
+ "references":{
28
+
29
+ },
30
+ "interesting_entries":[
31
+ "Server: nginx"
32
+ ]
33
+ },
34
+ {
35
+ "url":"http://www.redacted.com/robots.txt",
36
+ "to_s":"http://www.redacted.com/robots.txt",
37
+ "type":"robots_txt",
38
+ "found_by":"Robots Txt (Aggressive Detection)",
39
+ "confidence":100,
40
+ "confirmed_by":{
41
+
42
+ },
43
+ "references":{
44
+
45
+ },
46
+ "interesting_entries":[
47
+ "/wp-admin/",
48
+ "/wp-admin/admin-ajax.php"
49
+ ]
50
+ },
51
+ {
52
+ "url":"http://www.redacted.com/xmlrpc.php",
53
+ "to_s":"http://www.redacted.com/xmlrpc.php",
54
+ "type":"xmlrpc",
55
+ "found_by":"Headers (Passive Detection)",
56
+ "confidence":100,
57
+ "confirmed_by":{
58
+ "Link Tag (Passive Detection)":{
59
+ "confidence":30
60
+ },
61
+ "Direct Access (Aggressive Detection)":{
62
+ "confidence":100
63
+ }
64
+ },
65
+ "references":{
66
+ "url":[
67
+ "http://codex.wordpress.org/XML-RPC_Pingback_API"
68
+ ],
69
+ "metasploit":[
70
+ "auxiliary/scanner/http/wordpress_ghost_scanner",
71
+ "auxiliary/dos/http/wordpress_xmlrpc_dos",
72
+ "auxiliary/scanner/http/wordpress_xmlrpc_login",
73
+ "auxiliary/scanner/http/wordpress_pingback_access"
74
+ ]
75
+ },
76
+ "interesting_entries":[
77
+
78
+ ]
79
+ },
80
+ {
81
+ "url":"http://www.redacted.com/readme.html",
82
+ "to_s":"http://www.redacted.com/readme.html",
83
+ "type":"readme",
84
+ "found_by":"Direct Access (Aggressive Detection)",
85
+ "confidence":100,
86
+ "confirmed_by":{
87
+
88
+ },
89
+ "references":{
90
+
91
+ },
92
+ "interesting_entries":[
93
+
94
+ ]
95
+ },
96
+ {
97
+ "url":"http://www.redacted.com/wp-cron.php",
98
+ "to_s":"http://www.redacted.com/wp-cron.php",
99
+ "type":"wp_cron",
100
+ "found_by":"Direct Access (Aggressive Detection)",
101
+ "confidence":60,
102
+ "confirmed_by":{
103
+
104
+ },
105
+ "references":{
106
+ "url":[
107
+ "https://www.iplocation.net/defend-wordpress-from-ddos",
108
+ "https://github.com/wpscanteam/wpscan/issues/1299"
109
+ ]
110
+ },
111
+ "interesting_entries":[
112
+
113
+ ]
114
+ }
115
+ ],
116
+ "version":{
117
+ "number":"4.7.2",
118
+ "release_date":"2017-01-26",
119
+ "status":"insecure",
120
+ "found_by":"Meta Generator (Passive Detection)",
121
+ "confidence":60,
122
+ "interesting_entries":[
123
+ "http://www.redacted.com/, Match: 'WordPress 4.7.2'"
124
+ ],
125
+ "confirmed_by":{
126
+
127
+ },
128
+ "vulnerabilities":[
129
+ {
130
+ "title":"WordPress 3.6.0-4.7.2 - Authenticated Cross-Site Scripting (XSS) via Media File Metadata",
131
+ "fixed_in":"4.7.3",
132
+ "references":{
133
+ "cve":[
134
+ "2017-6814"
135
+ ],
136
+ "url":[
137
+ "https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/",
138
+ "https://github.com/WordPress/WordPress/commit/28f838ca3ee205b6f39cd2bf23eb4e5f52796bd7",
139
+ "https://sumofpwn.nl/advisory/2016/wordpress_audio_playlist_functionality_is_affected_by_cross_site_scripting.html",
140
+ "https://seclists.org/oss-sec/2017/q1/563"
141
+ ],
142
+ "wpvulndb":[
143
+ "8765"
144
+ ]
145
+ }
146
+ },
147
+ {
148
+ "title":"WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation",
149
+ "fixed_in":"4.7.3",
150
+ "references":{
151
+ "cve":[
152
+ "2017-6815"
153
+ ],
154
+ "url":[
155
+ "https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/",
156
+ "https://github.com/WordPress/WordPress/commit/288cd469396cfe7055972b457eb589cea51ce40e"
157
+ ],
158
+ "wpvulndb":[
159
+ "8766"
160
+ ]
161
+ }
162
+ }
163
+ ]
164
+ },
165
+ "main_theme":{
166
+ "slug":"liquorice",
167
+ "location":"http://www.redacted.com/wp-content/themes/liquorice/",
168
+ "latest_version":"2.3",
169
+ "last_updated":"2013-05-30T00:00:00.000Z",
170
+ "outdated":false,
171
+ "readme_url":"http://www.redacted.com/wp-content/themes/liquorice/readme.txt",
172
+ "directory_listing":false,
173
+ "error_log_url":null,
174
+ "style_url":"http://www.redacted.com/wp-content/themes/liquorice/style.css",
175
+ "style_name":"Liquorice",
176
+ "style_uri":"http://www.nudgedesign.ca/wordpress-themes/liquorice",
177
+ "description":"A simple and clean vintage looking theme for you to build on using Google's font API Lobster font. Custom background feature enabled.",
178
+ "author":"Nudge Design",
179
+ "author_uri":"http://www.nudgedesign.ca",
180
+ "template":null,
181
+ "license":"GNU General Public License v2.0",
182
+ "license_uri":"http://www.gnu.org/licenses/gpl-2.0.html",
183
+ "tags":"custom-background, two-columns, fixed-width, right-sidebar, light, brown, orange, blue",
184
+ "text_domain":null,
185
+ "found_by":"Css Style In Homepage (Passive Detection)",
186
+ "confidence":100,
187
+ "interesting_entries":[
188
+
189
+ ],
190
+ "confirmed_by":{
191
+ "Css Style In 404 Page (Passive Detection)":{
192
+ "confidence":70,
193
+ "interesting_entries":[
194
+
195
+ ]
196
+ }
197
+ },
198
+ "vulnerabilities":[
199
+
200
+ ],
201
+ "version":{
202
+ "number":"2.3",
203
+ "confidence":80,
204
+ "found_by":"Style (Passive Detection)",
205
+ "interesting_entries":[
206
+ "http://www.redacted.com/wp-content/themes/liquorice/style.css, Match: 'Version: 2.3'"
207
+ ],
208
+ "confirmed_by":{
209
+
210
+ }
211
+ },
212
+ "parents":[
213
+
214
+ ]
215
+ },
216
+ "plugins":{
217
+ "all-in-one-seo-pack":{
218
+ "slug":"all-in-one-seo-pack",
219
+ "location":"http://www.redacted.com/wp-content/plugins/all-in-one-seo-pack/",
220
+ "latest_version":"3.2.10",
221
+ "last_updated":"2019-10-17T15:07:00.000Z",
222
+ "outdated":true,
223
+ "readme_url":null,
224
+ "directory_listing":null,
225
+ "error_log_url":null,
226
+ "found_by":"Comment (Passive Detection)",
227
+ "confidence":30,
228
+ "interesting_entries":[
229
+
230
+ ],
231
+ "confirmed_by":{
232
+
233
+ },
234
+ "vulnerabilities":[
235
+ {
236
+ "title":"All In One SEO Pack < 3.2.7 - Stored Cross-Site Scripting (XSS)",
237
+ "fixed_in":"3.2.7",
238
+ "references":{
239
+ "cve":[
240
+ "2019-16520"
241
+ ],
242
+ "url":[
243
+ "https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_Pack"
244
+ ],
245
+ "wpvulndb":[
246
+ "9915"
247
+ ]
248
+ }
249
+ }
250
+ ],
251
+ "version":{
252
+ "number":"3.1",
253
+ "confidence":100,
254
+ "found_by":"Comment (Passive Detection)",
255
+ "interesting_entries":[
256
+ "http://www.redacted.com/, Match: 'All in One SEO Pack 3.1 by'"
257
+ ],
258
+ "confirmed_by":{
259
+ "Readme - Stable Tag (Aggressive Detection)":{
260
+ "confidence":80,
261
+ "interesting_entries":[
262
+ "http://www.redacted.com/wp-content/plugins/all-in-one-seo-pack/readme.txt"
263
+ ]
264
+ }
265
+ }
266
+ }
267
+ },
268
+ "qtranslate":{
269
+ "slug":"qtranslate",
270
+ "location":"http://www.redacted.com/wp-content/plugins/qtranslate/",
271
+ "latest_version":null,
272
+ "last_updated":null,
273
+ "outdated":false,
274
+ "readme_url":null,
275
+ "directory_listing":null,
276
+ "error_log_url":null,
277
+ "found_by":"Urls In Homepage (Passive Detection)",
278
+ "confidence":100,
279
+ "interesting_entries":[
280
+
281
+ ],
282
+ "confirmed_by":{
283
+ "Urls In 404 Page (Passive Detection)":{
284
+ "confidence":80,
285
+ "interesting_entries":[
286
+
287
+ ]
288
+ }
289
+ },
290
+ "vulnerabilities":[
291
+ {
292
+ "title":"qTranslate 2.5.34 - Setting Manipulation CSRF",
293
+ "fixed_in":null,
294
+ "references":{
295
+ "cve":[
296
+ "2013-3251"
297
+ ],
298
+ "wpvulndb":[
299
+ "6846"
300
+ ]
301
+ }
302
+ },
303
+ {
304
+ "title":"qTranslate <= 2.5.39 - Cross-Site Scripting (XSS)",
305
+ "fixed_in":null,
306
+ "references":{
307
+ "cve":[
308
+ "2015-5535"
309
+ ],
310
+ "url":[
311
+ "https://seclists.org/bugtraq/2015/Jul/139",
312
+ "https://www.immuniweb.com/advisory/HTB23265"
313
+ ],
314
+ "wpvulndb":[
315
+ "8120"
316
+ ]
317
+ }
318
+ }
319
+ ],
320
+ "version":null
321
+ }
322
+ },
323
+ "db_exports":{
324
+ "http://www.redacted.com/redacted.sql":{
325
+ "found_by":"Direct Access (Aggressive Detection)",
326
+ "confidence":100,
327
+ "interesting_entries":[
328
+
329
+ ],
330
+ "confirmed_by":{
331
+
332
+ }
333
+ },
334
+ "http://www.redacted.com/dump.sql":{
335
+ "found_by":"Direct Access (Aggressive Detection)",
336
+ "confidence":100,
337
+ "interesting_entries":[
338
+
339
+ ],
340
+ "confirmed_by":{
341
+
342
+ }
343
+ }
344
+ },
345
+ "timthumbs":{
346
+ "http://www.redacted.com/wordpress-5.2.4/timthumb.php":{
347
+ "confirmed_by":{
348
+
349
+ },
350
+ "confidence":100,
351
+ "interesting_entries":[
352
+
353
+ ],
354
+ "version":{
355
+ "found_by":"Bad Request (Aggressive Detection)",
356
+ "interesting_entries":[
357
+ "http://www.redacted.com/wordpress-5.2.4/timthumb.php, Match: 'TimThumb version : 2.8.13'"
358
+ ],
359
+ "number":"2.8.13",
360
+ "confirmed_by":{
361
+
362
+ },
363
+ "confidence":90
364
+ },
365
+ "vulnerabilities":[
366
+
367
+ ],
368
+ "found_by":"Known Locations (Aggressive Detection)"
369
+ },
370
+ "http://www.redacted.com/wordpress-5.2.4/thumb.php":{
371
+ "interesting_entries":[
372
+
373
+ ],
374
+ "confidence":100,
375
+ "confirmed_by":{
376
+
377
+ },
378
+ "vulnerabilities":[
379
+ {
380
+ "title":"Timthumb <= 2.8.13 WebShot Remote Code Execution",
381
+ "fixed_in":"2.8.14",
382
+ "references":{
383
+ "cve":[
384
+ "2014-4663"
385
+ ],
386
+ "url":[
387
+ "http://seclists.org/fulldisclosure/2014/Jun/117",
388
+ "https://github.com/wpscanteam/wpscan/issues/519"
389
+ ]
390
+ }
391
+ }
392
+ ],
393
+ "found_by":"Known Locations (Aggressive Detection)",
394
+ "version":{
395
+ "confirmed_by":{
396
+
397
+ },
398
+ "confidence":90,
399
+ "number":"2.8.13",
400
+ "interesting_entries":[
401
+ "http://www.redacted.com/wordpress-5.2.4/thumb.php, Match: 'TimThumb version : 2.8.13'"
402
+ ],
403
+ "found_by":"Bad Request (Aggressive Detection)"
404
+ }
405
+ }
406
+ },
407
+ "config_backups":{
408
+ "http://www.redacted.com/wp-config.txt":{
409
+ "found_by":"Direct Access (Aggressive Detection)",
410
+ "confidence":100,
411
+ "interesting_entries":[
412
+
413
+ ],
414
+ "confirmed_by":{
415
+
416
+ }
417
+ }
418
+ },
419
+ "users": {
420
+ "marie": {
421
+ "id": null,
422
+ "found_by": "Rss Generator (Passive Detection)",
423
+ "confidence": 100,
424
+ "interesting_entries": [
425
+
426
+ ],
427
+ "confirmed_by": {
428
+ "Wp Json Api (Aggressive Detection)": {
429
+ "confidence": 100,
430
+ "interesting_entries": [
431
+ "http://www.lagardelanguages.com/wp-json/wp/v2/users/?per_page=100&page=1"
432
+ ]
433
+ },
434
+ "Oembed API - Author URL (Aggressive Detection)": {
435
+ "confidence": 90,
436
+ "interesting_entries": [
437
+ "http://www.lagardelanguages.com/wp-json/oembed/1.0/embed?url=http://www.lagardelanguages.com/&format=json"
438
+ ]
439
+ },
440
+ "Rss Generator (Aggressive Detection)": {
441
+ "confidence": 50,
442
+ "interesting_entries": [
443
+
444
+ ]
445
+ },
446
+ "Author Id Brute Forcing - Author Pattern (Aggressive Detection)": {
447
+ "confidence": 100,
448
+ "interesting_entries": [
449
+
450
+ ]
451
+ },
452
+ "Login Error Messages (Aggressive Detection)": {
453
+ "confidence": 100,
454
+ "interesting_entries": [
455
+
456
+ ]
457
+ }
458
+ }
459
+ }
460
+ },
461
+ "password_attack": {
462
+ "marie": {
463
+ "password": "your-password"
464
+ }
465
+ },
466
+ "vuln_api":{
467
+ "plan":"enterprise",
468
+ "requests_done_during_scan":2,
469
+ "requests_remaining":"Unlimited"
470
+ },
471
+ "stop_time":1573480662,
472
+ "elapsed":12,
473
+ "requests_done":456,
474
+ "cached_requests":8,
475
+ "data_sent":96169,
476
+ "data_sent_humanised":"93.915 KB",
477
+ "data_received":479810,
478
+ "data_received_humanised":"468.564 KB",
479
+ "used_memory":212566016,
480
+ "used_memory_humanised":"202.719 MB"
481
+ }
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dradis-wpscan
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.17.0
4
+ version: 3.18.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Christian Mehlmauer
@@ -11,7 +11,7 @@ authors:
11
11
  autorequire:
12
12
  bindir: bin
13
13
  cert_chain: []
14
- date: 2020-06-02 00:00:00.000000000 Z
14
+ date: 2020-07-22 00:00:00.000000000 Z
15
15
  dependencies:
16
16
  - !ruby/object:Gem::Dependency
17
17
  name: dradis-plugins
@@ -130,6 +130,7 @@ files:
130
130
  - spec/spec_helper.rb
131
131
  - spec/wpscan_upload_spec.rb
132
132
  - templates/evidence.fields
133
+ - templates/evidence.sample
133
134
  - templates/evidence.template
134
135
  - templates/scan_info.fields
135
136
  - templates/scan_info.sample
@@ -156,7 +157,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
156
157
  - !ruby/object:Gem::Version
157
158
  version: '0'
158
159
  requirements: []
159
- rubygems_version: 3.0.1
160
+ rubygems_version: 3.1.2
160
161
  signing_key:
161
162
  specification_version: 4
162
163
  summary: WPScan add-on for the Dradis Framework.