wordstress 0.40.0 → 0.50.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8d1d25228ca184bd9640ee87d516d4f5ab6b4c73
-  data.tar.gz: cbeb681f9ddf891f3a67f34b03960a49c63b9e57
+  metadata.gz: b0aa61cebd1eb419b6a984c3b7dfd1beda4d952f
+  data.tar.gz: 81fd3b8759deaddab58bd678c8b75b273c3ace22
 SHA512:
-  metadata.gz: b7163eef62c310c477d7d247446ab7484ecda6e45543d3fc7d2a5c678d11e758aec38f039ebfdfe57cbfb15242522d71ea70c3687dd33da79da06bdc83522e77
-  data.tar.gz: 8dfceb6b7446fbb0282ddf24fc42ff6640df1238fb13971d65c3d7a4f855b41ca872d6a05f65e471e1953cbe687316e509bd9768ee6ea06c56643e582ec3ae66
+  metadata.gz: c188252811ed425f272b9faa410386abf65f29674e87c96898e0f4f783240cbf93dd8741c2597e80a9dc943954afedf502e489bef057daf4e0c136a2302569a7
+  data.tar.gz: 58f698450f1ae8d0981f017f77cc0b4d3ca01955d920b2672d4c092af0ddc895999f250b3bc40f0d36fdf848c2e7dd92811883a71dccea782148431ee80288d6

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2014 Paolo Perego
+Copyright (c) 2014, 2015 Paolo Perego
 
 MIT License
 

data/README.md

@@ -3,6 +3,71 @@
 wordstress is a application security tool specific for wordpress powered
 websites, inspired by [wpscan](https://github.com/wpscanteam/wpscan) tool.
 
+
+## Description
+
+[wordstress](https://rubygems.org/gems/wordstress) is a whitebox
+security scanner for wordpress powered websites.
+
+Site owners don't want to spend time in reading complex blackbox security scan
+reports trying to remove false positives. A useful security tool must give them
+only vulnerabilities really affecting installed plugins or themes.
+
+Let's assume, plugin `foobar_plugin` version 3.4.3 has a sever SQL Injection
+vulnerability. In one of several wordpress powered website, you installed
+version 3.2.1 version that **is not vulnerable**.
+
+A blackbox security scanner will try to enumerate installed plugins but it
+can't tell the exact installed version. So, using a blackbox approach you'll
+have a alleged SQL Injection vulnerability you must validate and mitigate.
+Unfortunately, you will lose precious time to spot a false positive since your
+plugin is safe.
+
+With wordstress plugin, you'll give [the security
+tool](https://rubygems.org/gems/wordstress) the exact `foobar_plugin` version
+installed on the system, 3.2.1. The tool will scan the knowledge base and
+report 0 vulnerabilities. You save time and you can be focused only on stuff
+really need your attention.
+
+Of course you may argue that giving on the Internet a place where all your
+website third parties plugins and themes name with version is not a wise
+decision. This is correct, that's why wordstress plugin creates a secure access
+key the scanner must use in order to access /wordstress virtual page.
+
+People without the correct key can't access your website information. The key
+is unique per server and created with hashing functions so to be resilient to
+guessing account. Bruteforcing the key will lead to an unsuccessful attempt,
+and you'll be busted. For sure.
+
+You must pass the correct key value to wordstress ruby gem in order to perform
+the whitebox scan. If you provide the wrong key or you won't provide a key at
+all, the wordstress plugin will give no information as output and then no
+whitebox scan will be possible.
+
+You don't like the key? Just reload the page a couple of times since you're
+comfortable about the generated entropy and then save the settings.
+
+## Installation
+
+wordstress scanner, this ruby gem is very easy to install.  You need a working
+ruby environment, please ask your preferred search engine if you need
+instructions on how to setup ruby on your operating system.  Just issue the
+`gem install wordstress` command and you're almost ready to start.
+
+To install the [wordstress plugin for
+wordpress](https://wordpress.org/plugins/wordstress/) you may must:
+
+* download wordstress.zip and unpack the content to your `/wp-content/plugins/` directory
+* activate the plugin through the 'Plugins' menu in WordPress
+* navigate the Settings->Wordstress admin page
+* every time you enter wordstress setting page, a new key is automagically
+  generated, to increase entropy you may want to reload the page a couple of
+  times. When you're comfortable with the generated key, press the "Save Changes"
+  button.
+  The virtual page is now available at the url http://youblogurl/wordstress?worstress-key=the_key
+* from the command line, use wordstress security scanner this way: `worstress -u http://yourblogurl/wordstress -k the_key`
+* enjoy results
+
 ## Why another tool?
 
 [wpscan](https://github.com/wpscanteam/wpscan) is a great tool and wordstress
@@ -27,47 +92,23 @@ During those years I was very upset as pentester with false positives about
 themes and plugins and their version. Since an authenticated check is necessary
 to match scan results with installed plugin (or theme) version, I tought it was
 a better idea to start authenticated from the beginning.
-** UPDATE ** - this can be very tricky to accomplish
-
-Of course, wordstress will perform blackbox testing, trying to guess the
-installed wordpress version and listing vulnerabilities taken from
-[wpvulndb](https://wpvulndb.com).
 
 ## Online resource
 
+[Wordstress homepage](http://wordstress.org)
+[Wordstress plugin](http://wordpress.org/plugins/wordstress/)
 [Attacking Wordpress](http://hackertarget.com/attacking-wordpress/)
 
+
 ## Killing features
 
 * A great knowledge base powered by [wpvulndb API](https://wpvulndb.com)
-* Information gathering from robots.txt file
 * Standard rubygem distribution
-* SQL and CSV output. Suitable for script integration
-* Massive websites scan from text file
-* SSL server rating using [Qualys SSL Labs rating guide](https://www.ssllabs.com/projects/rating-guide/)
-* Whitebox testing using existing wordpress user for template and themes
-  vulnerabilities.
-
-
-## Installation
-
-Add this line to your application's Gemfile:
-
-```ruby
-gem 'wordstress'
-```
-
-And then execute:
-
-    $ bundle
-
-Or install it yourself as:
-
-    $ gem install wordstress
-
-## Usage
-
-TODO: Write usage instructions here
+* Whitebox testing using existing wordpress user for template and themes vulnerabilities.
+* Information gathering from robots.txt file _(planned)_
+* SQL and CSV output. Suitable for script integration _(planned)_
+* Massive websites scan from text file _(planned)_
+* SSL server rating using [Qualys SSL Labs rating guide](https://www.ssllabs.com/projects/rating-guide/) _(planned)_
 
 ## Contributing
 

data/lib/wordstress/version.rb

@@ -1,3 +1,3 @@
 module Wordstress
-  VERSION = "0.40.0"
+  VERSION = "0.50.0"
 end

data/wordstress.gemspec

@@ -9,7 +9,8 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Paolo Perego"]
   spec.email         = ["paolo@wordstress.org"]
   spec.summary       = %q{wordstress is a security scanner for wordpress powered websites}
-  spec.description   = %q{wordstress is a security scanner for wordpress powered websites}
+  spec.description   = %q{wordstress is a security scanner for wordpress powered websites. Site owners don't want to spend time in reading complex blackbox security scan
+  reports trying to remove false positives. A useful security tool must give them only vulnerabilities really affecting installed plugins or themes. Please refere to the README file for further informations.}
   spec.homepage      = "http://wordstress.org"
   spec.license       = "MIT"
 
@@ -21,6 +22,8 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler", "~> 1.7"
   spec.add_development_dependency "rake", "~> 10.0"
 
+  spec.required_ruby_version = '>= 2.0.0'
+
   spec.add_dependency 'codesake-commons'
   spec.add_dependency 'json'
   spec.add_dependency 'ciphersurfer'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: wordstress
 version: !ruby/object:Gem::Version
-  version: 0.40.0
+  version: 0.50.0
 platform: ruby
 authors:
 - Paolo Perego
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-25 00:00:00.000000000 Z
+date: 2015-02-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -94,7 +94,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: wordstress is a security scanner for wordpress powered websites
+description: |-
+  wordstress is a security scanner for wordpress powered websites. Site owners don't want to spend time in reading complex blackbox security scan
+    reports trying to remove false positives. A useful security tool must give them only vulnerabilities really affecting installed plugins or themes. Please refere to the README file for further informations.
 email:
 - paolo@wordstress.org
 executables:
@@ -127,7 +129,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="