wpscan 3.0.4 → 3.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: aec6c21b96dc11fe0d1de37121edb9d4cce6580e
-  data.tar.gz: 9dfc21c798b02915e4e06815d6bc0808b0567f5a
+  metadata.gz: d9fd4bc758b868aa36848d44911b54335efdaefc
+  data.tar.gz: e02f0a0f89271384cd00a1d9ab760205c5bd1837
 SHA512:
-  metadata.gz: 7dea9f1e9a2afc8240533a355690381b33f360aa658b3fd1135b94b25ccca86bfd60585dee81110147592737c060e13f4935112d5194b19b6af06d64e8870b20
-  data.tar.gz: f79944aec35413d122216f01100e1d13e1ed3f575935bd4a4dac2331b2dc94a1fcb9dbbb4f230674ed815a5d358753c22e1cb4f5cb59eef3fe366c9ee8ba88df
+  metadata.gz: 955e80f693240687635f34d3b7081a302c452511e6d4191624edae196b7395f08759206b9aefc56f95449eccd5bdb9b91e6e48b613d9a27c681e1370759ed6bd
+  data.tar.gz: 9944fa88fba74980f74df6225dd47a2cf2d419eb02da52cf844f296ab729b58a3c7d747d623614bd950832a680352d5fbd9de0c3d0eb0e8dddae3bf46c17a57f

data/app/controllers/brute_force.rb

@@ -56,7 +56,6 @@ module WPScan
       # @param [ Array<String> ] passwords
       #
       # @yield [ User ] when a valid combination is found
-      # rubocop:disable all
       def brute_force(users, passwords)
         hydra = Browser.instance.hydra
 
@@ -86,7 +85,6 @@ module WPScan
           hydra.run
         end
       end
-      # rubocop:enable all
 
       def progress_bar(size, username)
         ProgressBar.create(

data/app/controllers/enumeration.rb

@@ -6,7 +6,7 @@ module WPScan
     # Enumeration Controller
     class Enumeration < CMSScanner::Controller::Base
       def before_scan
-        # Create the Dynamic Finders
+        # Create the Dynamic PluginVersion Finders
         DB::DynamicPluginFinders.db_data.each do |name, config|
           %w[Comments].each do |klass|
             next unless config[klass] && config[klass]['version']

data/app/controllers/enumeration/cli_options.rb

@@ -48,7 +48,17 @@ module WPScan
              'Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode.'],
             choices: %w[mixed passive aggressive], normalize: :to_sym
           ),
-          OptBoolean.new(['--plugins-version-all', 'Check all the plugins version locations'])
+          OptBoolean.new(
+            ['--plugins-version-all',
+             'Check all the plugins version locations according to the choosen mode (--detection-mode, ' \
+             '--plugins-detection and --plugins-version-detection)']
+          ),
+          OptChoice.new(
+            ['--plugins-version-detection MODE',
+             'Use the supplied mode to check plugins versions instead of the --detection-mode ' \
+             'or --plugins-detection modes.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
         ]
       end
 
@@ -61,7 +71,17 @@ module WPScan
              'Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode.'],
             choices: %w[mixed passive aggressive], normalize: :to_sym
           ),
-          OptBoolean.new(['--themes-version-all', 'Check all the themes version locations'])
+          OptBoolean.new(
+            ['--themes-version-all',
+             'Check all the themes version locations according to the choosen mode (--detection-mode, ' \
+             '--themes-detection and --themes-version-detection)']
+          ),
+          OptChoice.new(
+            ['--themes-version-detection MODE',
+             'Use the supplied mode to check themes versions instead of the --detection-mode ' \
+             'or --themes-detection modes.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
         ]
       end
 

data/app/controllers/enumeration/enum_methods.rb

@@ -23,10 +23,16 @@ module WPScan
       #
       # @return [ Hash ]
       def default_opts(type)
+        mode = parsed_options[:"#{type}_detection"] || parsed_options[:detection_mode]
+
         {
-          mode: parsed_options[:"#{type}_detection"] || parsed_options[:detection_mode],
+          mode: mode,
           exclude_content: parsed_options[:exclude_content_based],
-          show_progression: user_interaction?
+          show_progression: user_interaction?,
+          version_detection: {
+            mode: parsed_options[:"#{type}_version_detection"] || mode,
+            confidence_threshold: parsed_options[:"#{type}_version_all"] ? 0 : 100
+          }
         }
       end
 
@@ -40,7 +46,6 @@ module WPScan
       def enum_plugins
         opts = default_opts('plugins').merge(
           list: plugins_list_from_opts(parsed_options),
-          version_all: parsed_options[:plugins_version_all],
           sort: true
         )
 
@@ -79,7 +84,6 @@ module WPScan
       def enum_themes
         opts = default_opts('themes').merge(
           list: themes_list_from_opts(parsed_options),
-          version_all: parsed_options[:themes_version_all],
           sort: true
         )
 
@@ -116,7 +120,7 @@ module WPScan
       end
 
       def enum_config_backups
-        opts = default_opts('config_baclups').merge(list: parsed_options[:config_backups_list])
+        opts = default_opts('config_backups').merge(list: parsed_options[:config_backups_list])
 
         output('@info', msg: 'Enumerating Config Backups') if user_interaction?
         output('config_backups', config_backups: target.config_backups(opts))

data/app/finders/interesting_findings.rb

@@ -9,6 +9,7 @@ require_relative 'interesting_findings/upload_sql_dump'
 require_relative 'interesting_findings/full_path_disclosure'
 require_relative 'interesting_findings/duplicator_installer_log'
 require_relative 'interesting_findings/upload_directory_listing'
+require_relative 'interesting_findings/emergency_pwd_reset_script'
 
 module WPScan
   module Finders
@@ -22,7 +23,7 @@ module WPScan
           %w[
             Readme DebugLog FullPathDisclosure BackupDB DuplicatorInstallerLog
             Multisite MuPlugins Registration UploadDirectoryListing TmmDbMigrate
-            UploadSQLDump
+            UploadSQLDump EmergencyPwdResetScript
           ].each do |f|
             finders << InterestingFindings.const_get(f).new(target)
           end

data/app/finders/interesting_findings/emergency_pwd_reset_script.rb

@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Emergency Password Reset Script finder
+      class EmergencyPwdResetScript < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url  = target.url('/emergency.php')
+          res  = Browser.get(url)
+
+          return unless res.code == 200 && !target.homepage_or_404?(res)
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: res.body =~ /password/i ? 100 : 40,
+            found_by: DIRECT_ACCESS,
+            references: {
+              url: 'https://codex.wordpress.org/Resetting_Your_Password#Using_the_Emergency_Password_Reset_Script'
+            }
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/plugin.rb

@@ -17,7 +17,7 @@ module WPScan
     #
     # @return [ WPScan::Version, false ]
     def version(opts = {})
-      @version = Finders::PluginVersion::Base.find(self, detection_opts.merge(opts)) if @version.nil?
+      @version = Finders::PluginVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?
 
       @version
     end

data/app/models/theme.rb

@@ -23,7 +23,7 @@ module WPScan
     #
     # @return [ WPScan::Version, false ]
     def version(opts = {})
-      @version = Finders::ThemeVersion::Base.find(self, detection_opts.merge(opts)) if @version.nil?
+      @version = Finders::ThemeVersion::Base.find(self, version_detection_opts.merge(opts)) if @version.nil?
 
       @version
     end
@@ -37,7 +37,7 @@ module WPScan
         style_url: url(Regexp.last_match[1]),
         found_by: 'Parent Themes (Passive Detection)',
         confidence: 100
-      )
+      ).merge(version_detection: version_detection_opts)
 
       self.class.new(template, target, opts)
     end

data/app/models/timthumb.rb

@@ -3,16 +3,15 @@ module WPScan
   class Timthumb < InterestingFinding
     include Vulnerable
 
-    # Opts used to detect the version
-    attr_reader :detection_opts
+    attr_reader :version_detection_opts
 
     # @param [ String ] url
     # @param [ Hash ] opts
-    # @option opts [ String ] :detection_mode
+    # @option opts [ Symbol ] :mode The mode to use to detect the version
     def initialize(url, opts = {})
       super(url, opts)
 
-      @detection_opts = { mode: opts[:mode] }
+      @version_detection_opts = opts[:version_detection] || {}
     end
 
     # @param [ Hash ] opts
@@ -20,7 +19,7 @@ module WPScan
     # @return [ WPScan::Version, false ]
     def version(opts = {})
       if @version.nil?
-        @version = Finders::TimthumbVersion::Base.find(self, detection_opts.merge(opts))
+        @version = Finders::TimthumbVersion::Base.find(self, version_detection_opts.merge(opts))
       end
 
       @version

data/app/models/wp_item.rb

@@ -9,21 +9,21 @@ module WPScan
     READMES    = %w[readme.txt README.txt Readme.txt ReadMe.txt README.TXT readme.TXT].freeze
     CHANGELOGS = %w[changelog.txt Changelog.txt ChangeLog.txt CHANGELOG.txt].freeze
 
-    attr_reader :uri, :name, :detection_opts, :target, :db_data
+    attr_reader :uri, :name, :detection_opts, :version_detection_opts, :target, :db_data
 
     # @param [ String ] name The plugin/theme name
     # @param [ Target ] target The targeted blog
     # @param [ Hash ] opts
-    # @option opts [ String ] :detection_mode
-    # @option opts [ Boolean ] :version_all Wether or not to
+    # @option opts [ Symbol ] :mode The detection mode to use
+    # @option opts [ Hash ]   :version_detection The options to use when looking for the version
     # @option opts [ String ] :url The URL of the item
     def initialize(name, target, opts = {})
       @name           = URI.decode(name)
       @target         = target
       @uri            = Addressable::URI.parse(opts[:url]) if opts[:url]
 
-      # Options used to detect the version
-      @detection_opts = { mode: opts[:mode], confidence_threshold: opts[:version_all] ? 0 : 100 }
+      @detection_opts = { mode: opts[:mode] }
+      @version_detection_opts = opts[:version_detection] || {}
 
       parse_finding_options(opts)
     end

data/app/views/cli/enumeration/config_backups.erb

@@ -1,8 +1,8 @@
 
 <% if @config_backups.empty? -%>
-<%= notice_icon %> No Backups Found.
+<%= notice_icon %> No Config Backups Found.
 <% else -%>
-<%= notice_icon %> Backup(s) Identified:
+<%= notice_icon %> Config Backup(s) Identified:
 <% @config_backups.each do |config_backup| -%>
 
 <%= info_icon %> <%= config_backup %>

data/lib/wpscan/db/updater.rb

@@ -112,7 +112,6 @@ module WPScan
         local_file_checksum(filename)
       end
 
-      # rubocop:disable MethodLength
       # @return [ Array<String> ] The filenames updated
       def update
         updated = []
@@ -141,7 +140,6 @@ module WPScan
 
         updated
       end
-      # rubocop:enable MethodLength
     end
   end
   # :nocov:

data/lib/wpscan/version.rb

@@ -1,4 +1,4 @@
 # Version
 module WPScan
-  VERSION = '3.0.4'.freeze
+  VERSION = '3.0.5'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 3.0.4
+  version: 3.0.5
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-09-26 00:00:00.000000000 Z
+date: 2017-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cms_scanner
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.37.10
+        version: 0.0.37.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.37.10
+        version: 0.0.37.11
 - !ruby/object:Gem::Dependency
   name: yajl-ruby
   requirement: !ruby/object:Gem::Requirement
@@ -247,6 +247,7 @@ files:
 - app/finders/interesting_findings/backup_db.rb
 - app/finders/interesting_findings/debug_log.rb
 - app/finders/interesting_findings/duplicator_installer_log.rb
+- app/finders/interesting_findings/emergency_pwd_reset_script.rb
 - app/finders/interesting_findings/full_path_disclosure.rb
 - app/finders/interesting_findings/mu_plugins.rb
 - app/finders/interesting_findings/multisite.rb