wordstress 0.10.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 95999506c82f7c592ba1519d3135c0e374bb7d7d
-  data.tar.gz: d98e8756e937c3ff926036ea34ab8111be6b030d
+  metadata.gz: fca228d6b31e82ce2fcbb2aabc92f8eabdcec8e0
+  data.tar.gz: b8b73ea2d080055c5bbe4f6db344d862897d173d
 SHA512:
-  metadata.gz: d0e4d4519077f8a3beb10db5733d4ac98e68cc74a0eae589c4ae69fad7767233013f573d9ffdefeed2bd0b46b8a45d683aed1c5dc4b834ac6403702908e80d13
-  data.tar.gz: 189f863ab0ced45cef88ca6c87eed227d59d376db85a57d158cc88e2f428a774a7dc9040536169e687d1e64c622a8c787d69ef5069643911cb462b39f22c88c4
+  metadata.gz: cc948a3e1e29d6be48b94e9ad5388aab286a088eed454ff0e30541a85e16dabe07dcf4cee90cae74d3a6ea9c4f5da88f4911292c100a7fc98be250b9f43df605
+  data.tar.gz: d448841ddd551e57d9f33ea141ad04d527261f307d05a9b54e3a4f33354b4576d1ebc5092808a99b7c795b82c542ab5925e68812d1c50bbea1d8c80e8bc4b05c

data/README.md

@@ -22,6 +22,16 @@ smaller project.
 Another thing I don't like about wpscan is that isn't distributed as ruby gem.
 I want a security tool that follows 'the ruby way'.
 
+Furthermore, wordstress is designed to be more accurate in whitebox testing.
+During those years I was very upset as pentester with false positives about
+themes and plugins and their version. Since an authenticated check is necessary
+to match scan results with installed plugin (or theme) version, I tought it was
+a better idea to start authenticated from the beginning.
+
+Of course, wordstress will perform blackbox testing, trying to guess the
+installed wordpress version and listing vulnerabilities taken from
+[wpvulndb](https://wpvulndb.com).
+
 ## Killing features
 
 * A great knowledge base powered by [wpvulndb API](https://wpvulndb.com)
@@ -30,7 +40,8 @@ I want a security tool that follows 'the ruby way'.
 * SQL and CSV output. Suitable for script integration
 * Massive websites scan from text file
 * SSL server rating using [Qualys SSL Labs rating guide](https://www.ssllabs.com/projects/rating-guide/)
-* Whitebox testing using existing wordpress user
+* Whitebox testing using existing wordpress user for template and themes
+  vulnerabilities.
 
 
 ## Installation

data/bin/wordstress

@@ -9,10 +9,12 @@ require 'wordstress'
 APPNAME = File.basename($0)
 
 $logger  = Codesake::Commons::Logging.instance
+@output_root = Dir.home + '/wordstress'
 
 opts    = GetoptLong.new(
-  [ '--version',                '-v',   GetoptLong::NO_ARGUMENT],
-  [ '--help',                   '-h',   GetoptLong::NO_ARGUMENT]
+  [ '--csv',      '-C',   GetoptLong::NO_ARGUMENT],
+  [ '--version',  '-v',   GetoptLong::NO_ARGUMENT],
+  [ '--help',     '-h',   GetoptLong::NO_ARGUMENT]
 )
 
 opts.quiet=true
@@ -36,16 +38,31 @@ end
 target=ARGV.shift
 $logger.helo APPNAME, Wordstress::VERSION
 $logger.toggle_syslog
+@output_dir = @output_root + target_to_dirname(target)
+
+unless Dir.exists?(@output_root)
+  $logger.ok "creating output dir #{@output_root}"
+  Dir.mkdir @output_root
+end
+
+unless Dir.exists?(@output_dir)
+  $logger.ok "
+end
 
 trap("INT")   { $logger.die('[INTERRUPTED]') }
 $logger.die("missing target") if target.nil?
 
 $logger.log "scanning #{target}"
 site = Wordstress::Site.new(target)
+
+if site.version[:version] == "0.0.0"
+  $logger.err "can't detect wordpress version running on #{target}. Giving up!"
+  Kernel.exit(-2)
+end
+
 $logger.ok "wordpress version #{site.version[:version]} detected"
 wp_vuln_hash = JSON.parse(site.wp_vuln_json)
 $logger.ok "#{wp_vuln_hash["wordpress"]["vulnerabilities"].size} vulnerabilities found due wordpress version"
 wp_vuln_hash["wordpress"]["vulnerabilities"].each do |v|
   $logger.log "#{v["id"]} - #{v["title"]}"
-
 end

data/lib/wordstress/site.rb

@@ -18,8 +18,8 @@ module Wordstress
       @homepage     = get(@raw_name)
       @version      = detect_version
 
-      @wp_vuln_json = get_wp_vulnerabilities
-
+      @wp_vuln_json = get_wp_vulnerabilities  unless @version[:version] == "0.0.0"
+      @wp_vuln_json = Hash.new.to_json        if @version[:version] == "0.0.0"
     end
 
     def get_wp_vulnerabilities
@@ -61,6 +61,9 @@ module Wordstress
 
       return {:version => v_meta, :accuracy => 1.0} if v_meta == v_readme && v_meta == v_rss
       return {:version => v_meta, :accuracy => 0.8} if v_meta == v_readme || v_meta == v_rss
+
+      # we failed detecting wordpress version
+      return {:version => "0.0.0", :accuracy => 0}
     end
 
     def get(page)

data/lib/wordstress/utils.rb

@@ -0,0 +1,10 @@
+module Wordstress
+  class Utils
+
+    # Transform a given URL into a directory name to be used to store data
+    def target_to_dirname(target)
+      target.split("://")[1].gsub('.','_').gsub('/', '')
+    end
+
+  end
+end

data/lib/wordstress/version.rb

@@ -1,3 +1,3 @@
 module Wordstress
-  VERSION = "0.10.0"
+  VERSION = "0.10.1"
 end

data/lib/wordstress.rb

@@ -1,2 +1,3 @@
+require "wordstress/utils"
 require "wordstress/site"
 require "wordstress/version"

data/wordstress.gemspec

@@ -23,4 +23,6 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'codesake-commons'
   spec.add_dependency 'json'
+  spec.add_dependency 'ciphersurfer'
+
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: wordstress
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Paolo Perego
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-04 00:00:00.000000000 Z
+date: 2014-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -66,6 +66,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ciphersurfer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: wordstress is a security scanner for wordpress powered websites
 email:
 - thesp0nge@gmail.com
@@ -82,6 +96,7 @@ files:
 - bin/wordstress
 - lib/wordstress.rb
 - lib/wordstress/site.rb
+- lib/wordstress/utils.rb
 - lib/wordstress/version.rb
 - wordstress.gemspec
 homepage: https://github.com/thesp0nge/wordstress