wpscan 3.0.8 → 3.1.0

data/app/finders/plugin_version/layer_slider/translation_file.rb

@@ -1,40 +0,0 @@
-module WPScan
-  module Finders
-    module PluginVersion
-      module LayerSlider
-        # Version from a Translation file
-        #
-        # See https://github.com/wpscanteam/wpscan/issues/765
-        class TranslationFile < CMSScanner::Finders::Finder
-          # @param [ Hash ] opts
-          #
-          # @return [ Version ]
-          def aggressive(_opts = {})
-            potential_urls.each do |url|
-              res = Browser.get(url)
-
-              next unless res.code == 200 && res.body =~ /Project-Id-Version: LayerSlider WP v?([0-9\.][^\\\s]+)/
-
-              return WPScan::Version.new(
-                Regexp.last_match[1],
-                found_by: 'Translation File (Aggressive Detection)',
-                confidence: 90,
-                interesting_entries: ["#{url}, Match: '#{Regexp.last_match}'"]
-              )
-            end
-            nil
-          end
-
-          # @return [ Array<String> ] The potential URLs where the version is disclosed
-          def potential_urls
-            # Recent versions seem to use the 'locales' directory instead of the 'languages' one.
-            # Maybe also check other locales ?
-            %w[locales languages].reduce([]) do |a, e|
-              a << target.url("#{e}/LayerSlider-en_US.po")
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/app/finders/plugin_version/revslider/release_log.rb

@@ -1,35 +0,0 @@
-module WPScan
-  module Finders
-    module PluginVersion
-      module Revslider
-        # Version from the release_log.html
-        #
-        # See https://github.com/wpscanteam/wpscan/issues/817
-        class ReleaseLog < CMSScanner::Finders::Finder
-          # @param [ Hash ] opts
-          #
-          # @return [ Version ]
-          def aggressive(_opts = {})
-            res = Browser.get(release_log_url)
-
-            res.html.css('h3.version-number:first').each do |node|
-              next unless node.text =~ /\AVersion ([0-9\.]+).*\z/i
-
-              return WPScan::Version.new(
-                Regexp.last_match[1],
-                found_by: found_by,
-                confidence: 90,
-                interesting_entries: ["#{release_log_url}, Match: '#{Regexp.last_match}'"]
-              )
-            end
-            nil
-          end
-
-          def release_log_url
-            target.url('release_log.html')
-          end
-        end
-      end
-    end
-  end
-end

data/app/finders/plugin_version/shareaholic/meta_tag.rb

@@ -1,27 +0,0 @@
-module WPScan
-  module Finders
-    module PluginVersion
-      module Shareaholic
-        # Version from the meta
-        class MetaTag < CMSScanner::Finders::Finder
-          # @param [ Hash ] opts
-          #
-          # @return [ Version ]
-          def passive(_opts = {})
-            target.target.homepage_res.html.css('meta[name="shareaholic:wp_version"]').each do |node|
-              next unless node['content'] =~ /\A([0-9\.]+)/i
-
-              return WPScan::Version.new(
-                Regexp.last_match(1),
-                found_by: found_by,
-                confidence: 50,
-                interesting_entries: ["#{target.target.url}, Match: '#{node.to_s.strip}'"]
-              )
-            end
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/app/finders/plugin_version/sitepress_multilingual_cms/meta_generator.rb

@@ -1,27 +0,0 @@
-module WPScan
-  module Finders
-    module PluginVersion
-      module SitepressMultilingualCms
-        # Version from the meta generator
-        class MetaGenerator < CMSScanner::Finders::Finder
-          # @param [ Hash ] opts
-          #
-          # @return [ Version ]
-          def passive(_opts = {})
-            target.target.homepage_res.html.css('meta[name="generator"]').each do |node|
-              next unless node['content'] =~ /\AWPML\sver:([0-9\.]+)\sstt/i
-
-              return WPScan::Version.new(
-                Regexp.last_match(1),
-                found_by: 'Meta Generator (Passive detection)',
-                confidence: 50,
-                interesting_entries: ["#{target.target.url}, Match: '#{node}'"]
-              )
-            end
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/app/finders/plugin_version/sitepress_multilingual_cms/version_parameter.rb

@@ -1,31 +0,0 @@
-module WPScan
-  module Finders
-    module PluginVersion
-      module SitepressMultilingualCms
-        # Version from the v parameter in href / src of stylesheets / scripts
-        class VersionParameter < CMSScanner::Finders::Finder
-          # @param [ Hash ] opts
-          #
-          # @return [ Version ]
-          def passive(_opts = {})
-            pattern = %r{#{Regexp.escape(target.target.plugins_dir)}/sitepress-multilingual-cms/}i
-
-            target.target.in_scope_urls(target.target.homepage_res, '//link|//script') do |url|
-              uri = Addressable::URI.parse(url)
-
-              next unless uri.path =~ pattern && uri.query =~ /v=([0-9\.]+)/
-
-              return WPScan::Version.new(
-                Regexp.last_match[1],
-                found_by: found_by,
-                confidence: 50,
-                interesting_entries: [url]
-              )
-            end
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/app/finders/plugin_version/w3_total_cache/headers.rb

@@ -1,28 +0,0 @@
-module WPScan
-  module Finders
-    module PluginVersion
-      module W3TotalCache
-        # Version from Headers
-        class Headers < CMSScanner::Finders::Finder
-          PATTERN = %r{W3 Total Cache/([0-9.]+)}i
-
-          # @param [ Hash ] opts
-          #
-          # @return [ Version ]
-          def passive(_opts = {})
-            headers = target.target.headers
-
-            return unless headers && headers['X-Powered-By'].to_s =~ PATTERN
-
-            WPScan::Version.new(
-              Regexp.last_match[1],
-              found_by: found_by,
-              confidence: 80,
-              interesting_entries: ["#{target.target.url}, Match: '#{Regexp.last_match}'"]
-            )
-          end
-        end
-      end
-    end
-  end
-end

data/app/finders/plugins/comments.rb

@@ -1,31 +0,0 @@
-module WPScan
-  module Finders
-    module Plugins
-      # Plugins from Comments Finder
-      class Comments < CMSScanner::Finders::Finder
-        # @param [ Hash ] opts
-        # @option opts [ Boolean ] :unique Default: true
-        #
-        # @return [ Array<Plugin> ]
-        def passive(opts = {})
-          found         = []
-          opts[:unique] = true unless opts.key?(:unique)
-
-          target.homepage_res.html.xpath('//comment()').each do |node|
-            comment = node.text.to_s.strip
-
-            DB::DynamicPluginFinders.comments.each do |name, config|
-              next unless comment =~ config['pattern']
-
-              plugin = WPScan::Plugin.new(name, target, opts.merge(found_by: found_by, confidence: 70))
-
-              found << plugin unless opts[:unique] && found.include?(plugin)
-            end
-          end
-
-          found
-        end
-      end
-    end
-  end
-end

data/app/finders/plugins/headers.rb

@@ -1,36 +0,0 @@
-module WPScan
-  module Finders
-    module Plugins
-      # Plugins from Headers Finder
-      class Headers < CMSScanner::Finders::Finder
-        # @param [ Hash ] opts
-        #
-        # @return [ Array<Plugin> ]
-        def passive(opts = {})
-          plugin_names_from_headers(opts).reduce([]) do |a, e|
-            a << WPScan::Plugin.new(e, target, opts.merge(found_by: found_by, confidence: 60))
-          end
-        end
-
-        # X-Powered-By: W3 Total Cache/0.9.2.5
-        # WP-Super-Cache: Served supercache file from PHP
-        #
-        # @return [ Array<String> ]
-        def plugin_names_from_headers(_opts = {})
-          found   = []
-          headers = target.homepage_res.headers
-
-          if headers
-            powered_by     = headers['X-Powered-By'].to_s
-            wp_super_cache = headers['wp-super-cache'].to_s
-
-            found << 'w3-total-cache' if powered_by =~ Finders::PluginVersion::W3TotalCache::Headers::PATTERN
-            found << 'wp-super-cache' if wp_super_cache =~ /supercache/i
-          end
-
-          found
-        end
-      end
-    end
-  end
-end

data/app/finders/wp_version/homepage_stylesheet_numbers.rb

@@ -1,59 +0,0 @@
-module WPScan
-  module Finders
-    module WpVersion
-      # Stylesheets Version Finder from Homepage
-      #
-      # TODO: Maybe put such methods in the CMSScanner to have a generic
-      # way of getting those versions, and allow the confidence to be
-      # customised
-      class HomepageStylesheetNumbers < CMSScanner::Finders::Finder
-        # @return [ Array<WpVersion> ]
-        def passive(_opts = {})
-          wp_versions(target.homepage_url)
-        end
-
-        protected
-
-        # @param [ String ] url
-        #
-        # @return [ Array<WpVersion> ]
-        def wp_versions(url)
-          found = []
-
-          scan_page(url).each do |version_number, occurences|
-            next unless WPScan::WpVersion.valid?(version_number) # Skip invalid versions
-
-            found << WPScan::WpVersion.new(
-              version_number,
-              found_by: found_by,
-              confidence: 5 * occurences.count,
-              interesting_entries: occurences
-            )
-          end
-
-          found
-        end
-
-        # @param [ String ] url
-        #
-        # @return [ Hash ]
-        def scan_page(url)
-          found   = {}
-          pattern = /\bver=([0-9\.]+)/i
-
-          target.in_scope_urls(Browser.get(url), '//link|//script') do |stylesheet_url, _tag|
-            uri = Addressable::URI.parse(stylesheet_url)
-            next unless uri.query&.match(pattern)
-
-            version = Regexp.last_match[1].to_s
-
-            found[version] ||= []
-            found[version] << stylesheet_url
-          end
-
-          found
-        end
-      end
-    end
-  end
-end

data/app/finders/wp_version/install_stylesheet_numbers.rb

@@ -1,16 +0,0 @@
-module WPScan
-  module Finders
-    module WpVersion
-      # Stylesheets Version Finder from Install page
-      class InstallStylesheetNumbers < HomepageStylesheetNumbers
-        # Overrides the parent
-        def passive(_ops = {}); end
-
-        # @return [ Array<WpVersion> ]
-        def aggressive(_opts = {})
-          wp_versions(target.url('wp-admin/install.php'))
-        end
-      end
-    end
-  end
-end

data/app/finders/wp_version/meta_generator.rb

@@ -1,27 +0,0 @@
-module WPScan
-  module Finders
-    module WpVersion
-      # Meta Generator Version Finder
-      class MetaGenerator < CMSScanner::Finders::Finder
-        # @return [ WpVersion ]
-        def passive(_opts = {})
-          target.homepage_res.html.css('meta[name="generator"]').each do |node|
-            next unless node.attribute('content').to_s =~ /wordpress ([0-9\.]+)/i
-
-            number = Regexp.last_match(1)
-
-            next unless WPScan::WpVersion.valid?(number)
-
-            return WPScan::WpVersion.new(
-              number,
-              found_by: 'Meta Generator (Passive detection)',
-              confidence: 80,
-              interesting_entries: ["#{target.url}, Match: '#{node.to_s.strip}'"]
-            )
-          end
-          nil
-        end
-      end
-    end
-  end
-end

data/app/finders/wp_version/opml_generator.rb

@@ -1,23 +0,0 @@
-module WPScan
-  module Finders
-    module WpVersion
-      # Sitemap Generator Version Finder
-      class OpmlGenerator < CMSScanner::Finders::Finder
-        # @return [ WpVersion ]
-        def aggressive(_opts = {})
-          target.comments_from_page(%r{\Agenerator="wordpress/([^"]+)"\z}i, 'wp-links-opml.php') do |match, node|
-            next unless WPScan::WpVersion.valid?(match[1])
-
-            return WPScan::WpVersion.new(
-              match[1],
-              found_by: 'OPML Generator (Aggressive Detection)',
-              confidence: 80,
-              interesting_entries: ["#{target.url('wp-links-opml.php')}, Match: '#{node.to_s.strip}'"]
-            )
-          end
-          nil
-        end
-      end
-    end
-  end
-end

data/app/finders/wp_version/sitemap_generator.rb

@@ -1,23 +0,0 @@
-module WPScan
-  module Finders
-    module WpVersion
-      # Sitemap Generator Version Finder
-      class SitemapGenerator < CMSScanner::Finders::Finder
-        # @return [ WpVersion ]
-        def aggressive(_opts = {})
-          target.comments_from_page(%r{\Agenerator="wordpress/([^"]+)"\z}i, 'sitemap.xml') do |match, node|
-            next unless WPScan::WpVersion.valid?(match[1])
-
-            return WPScan::WpVersion.new(
-              match[1],
-              found_by: 'Sitemap Generator (Aggressive Detection)',
-              confidence: 80,
-              interesting_entries: ["#{target.url('sitemap.xml')}, #{node.to_s.strip}"]
-            )
-          end
-          nil
-        end
-      end
-    end
-  end
-end

data/app/finders/wp_version/upgrade_stylesheet_numbers.rb

@@ -1,13 +0,0 @@
-module WPScan
-  module Finders
-    module WpVersion
-      # Stylesheets Version Finder from Upgrade page
-      class UpgradeStylesheetNumbers < InstallStylesheetNumbers
-        # @return [ Array<WpVersion> ]
-        def aggressive(_opts = {})
-          wp_versions(target.url('wp-admin/upgrade.php'))
-        end
-      end
-    end
-  end
-end

data/lib/wpscan/db/dynamic_finders.rb

@@ -1,55 +0,0 @@
-module WPScan
-  module DB
-    # Dynamic Finders
-    class DynamicFinders
-      # @return [ String ]
-      def self.db_file
-        @db_file ||= File.join(DB_DIR, 'dynamic_finders_01.yml')
-      end
-
-      # @return [ Hash ]
-      def self.db_data
-        @db_data ||= YAML.safe_load(File.read(db_file), [Regexp])
-      end
-
-      # @return [ Hash ]
-      def self.finder_configs(finder_klass)
-        configs = {}
-
-        db_data.each do |slug, config|
-          next unless config[finder_klass]
-
-          configs[slug] = config[finder_klass].dup
-        end
-
-        configs
-      end
-    end
-
-    # Dynamic Plugin Finders
-    class DynamicPluginFinders < DynamicFinders
-      # @return [ Hash ]
-      def self.db_data
-        @db_data ||= super['plugins'] || {}
-      end
-
-      # @return [ Hash ]
-      def self.comments
-        @comments ||= finder_configs('Comments')
-      end
-
-      # @return [ Hash ]
-      def self.urls_in_page
-        @urls_in_page ||= finder_configs('UrlsInPage')
-      end
-    end
-
-    # Dynamic Theme Finders (none ATM)
-    class DynamicThemeFinders < DynamicFinders
-      # @return [ Hash ]
-      def self.db_data
-        @db_data ||= super['themes'] || {}
-      end
-    end
-  end
-end