wpscan 3.0

data/lib/wpscan.rb

@@ -0,0 +1,44 @@
+# Gems
+require 'cms_scanner'
+require 'yajl/json_gem'
+require 'addressable/uri'
+require 'active_support/all'
+# Standard Lib
+require 'uri'
+require 'time'
+require 'readline'
+require 'securerandom'
+# Custom Libs
+require 'wpscan/helper'
+require 'wpscan/db'
+require 'wpscan/version'
+require 'wpscan/errors/wordpress'
+require 'wpscan/errors/http'
+require 'wpscan/errors/update'
+require 'wpscan/browser'
+require 'wpscan/target'
+require 'wpscan/finders'
+require 'wpscan/controller'
+require 'wpscan/controllers'
+require 'wpscan/references'
+require 'wpscan/vulnerable'
+require 'wpscan/vulnerability'
+
+Encoding.default_external = Encoding::UTF_8
+
+# WPScan
+module WPScan
+  include CMSScanner
+
+  APP_DIR = Pathname.new(__FILE__).dirname.join('..', 'app').expand_path
+  DB_DIR  = File.join(Dir.home, '.wpscan', 'db')
+
+  # Override, otherwise it would be returned as 'wp_scan'
+  #
+  # @return [ String ]
+  def self.app_name
+    'wpscan'
+  end
+end
+
+require "#{WPScan::APP_DIR}/app"

data/lib/wpscan/browser.rb

@@ -0,0 +1,16 @@
+module WPScan
+  # Custom Browser
+  class Browser < CMSScanner::Browser
+    extend Actions
+
+    # @return [ String ] The path to the user agents list
+    def user_agents_list
+      @user_agents_list ||= File.join(DB_DIR, 'user-agents.txt')
+    end
+
+    # @return [ String ]
+    def default_user_agent
+      "WPScan v#{VERSION} (http://wpscan.org/)"
+    end
+  end
+end

data/lib/wpscan/controller.rb

@@ -0,0 +1,8 @@
+module WPScan
+  # Needed to load at least the Core controller
+  # Otherwise, the following error will be raised:
+  # `initialize': uninitialized constant WPScan::Controller::Core (NameError)
+  module Controller
+    include CMSScanner::Controller
+  end
+end

data/lib/wpscan/controllers.rb

@@ -0,0 +1,8 @@
+module WPScan
+  # Override to set the OptParser's summary width to 45 (instead of 40 from the CMSScanner)
+  class Controllers < CMSScanner::Controllers
+    def initialize(option_parser = OptParseValidator::OptParser.new(nil, 45))
+      super(option_parser)
+    end
+  end
+end

data/lib/wpscan/db.rb

@@ -0,0 +1,28 @@
+require 'dm-core'
+require 'dm-migrations'
+require 'dm-constraints'
+require 'dm-sqlite-adapter'
+
+require 'wpscan/db/wp_item'
+require 'wpscan/db/schema'
+require 'wpscan/db/updater'
+require 'wpscan/db/wp_items'
+require 'wpscan/db/plugins'
+require 'wpscan/db/themes'
+require 'wpscan/db/plugin'
+require 'wpscan/db/theme'
+require 'wpscan/db/wp_version'
+require 'wpscan/db/dynamic_finders'
+
+module WPScan
+  # DB
+  module DB
+    def self.init_db
+      db_file ||= File.join(DB_DIR, 'wordpress.db')
+
+      # DataMapper::Logger.new($stdout, :debug)
+      DataMapper.setup(:default, "sqlite://#{db_file}")
+      DataMapper.auto_upgrade!
+    end
+  end
+end

data/lib/wpscan/db/dynamic_finders.rb

@@ -0,0 +1,63 @@
+module WPScan
+  module DB
+    # Dynamic Finders
+    class DynamicFinders
+      # @return [ String ]
+      def self.db_file
+        @db_file ||= File.join(DB_DIR, 'dynamic_finders.yml')
+      end
+
+      # @return [ Hash ]
+      def self.db_data
+        @db_data ||= YAML.load_file(db_file)
+      end
+
+      # @return [ Hash ]
+      def self.finder_configs(finder_klass)
+        configs = {}
+
+        db_data.each do |slug, config|
+          next unless config[finder_klass]
+
+          configs[slug] = config[finder_klass].dup
+        end
+
+        configs
+      end
+    end
+
+    # Dynamic Plugin Finders
+    class DynamicPluginFinders < DynamicFinders
+      # @return [ Hash ]
+      def self.db_data
+        @db_data ||= super['plugins'] || {}
+      end
+
+      # @return [ Hash ]
+      def self.comments
+        unless @comments
+          @comments = finder_configs('Comments')
+
+          @comments.each do |slug, config|
+            @comments[slug]['pattern'] = Regexp.new(config['pattern'], Regexp::IGNORECASE)
+          end
+        end
+
+        @comments
+      end
+
+      # @return [ Hash ]
+      def self.urls_in_page
+        @urls_in_page ||= finder_configs('UrlsInPage')
+      end
+    end
+
+    # Dynamic Theme Finders (none ATM)
+    class DynamicThemeFinders < DynamicFinders
+      # @return [ Hash ]
+      def self.db_data
+        @db_data ||= super['themes'] || {}
+      end
+    end
+  end
+end

data/lib/wpscan/db/plugin.rb

@@ -0,0 +1,11 @@
+module WPScan
+  module DB
+    # Plugin DB
+    class Plugin < WpItem
+      # @return [ String ]
+      def self.db_file
+        @db_file ||= File.join(DB_DIR, 'plugins.json')
+      end
+    end
+  end
+end

data/lib/wpscan/db/plugins.rb

@@ -0,0 +1,11 @@
+module WPScan
+  module DB
+    # WP Plugins
+    class Plugins < WpItems
+      # @return [ JSON ]
+      def self.db
+        Plugin.db
+      end
+    end
+  end
+end

data/lib/wpscan/db/schema.rb

@@ -0,0 +1,39 @@
+module WPScan
+  module DB
+    # WP Version
+    class Version < WpItem
+      include DataMapper::Resource
+
+      storage_names[:default] = 'versions'
+
+      has n, :fingerprints, constraint: :destroy
+
+      property :id, Serial
+      property :number, String, required: true, unique: true
+    end
+
+    # Path
+    class Path
+      include DataMapper::Resource
+
+      storage_names[:default] = 'paths'
+
+      has n, :fingerprints, constraint: :destroy
+
+      property :id, Serial
+      property :value, String, required: true, unique: true
+    end
+
+    # Fingerprint
+    class Fingerprint
+      include DataMapper::Resource
+
+      storage_names[:default] = 'fingerprints'
+
+      belongs_to :version, key: true
+      belongs_to :path, key: true
+
+      property :md5_hash, String, required: true, length: 32
+    end
+  end
+end

data/lib/wpscan/db/theme.rb

@@ -0,0 +1,11 @@
+module WPScan
+  module DB
+    # Theme DB
+    class Theme < WpItem
+      # @return [ String ]
+      def self.db_file
+        @db_file ||= File.join(DB_DIR, 'themes.json')
+      end
+    end
+  end
+end

data/lib/wpscan/db/themes.rb

@@ -0,0 +1,11 @@
+module WPScan
+  module DB
+    # WP Themes
+    class Themes < WpItems
+      # @return [ JSON ]
+      def self.db
+        Theme.db
+      end
+    end
+  end
+end

data/lib/wpscan/db/updater.rb

@@ -0,0 +1,148 @@
+module WPScan
+  module DB
+    # Class used to perform DB updates
+    # :nocov:
+    class Updater
+      # /!\ Might want to also update the Enumeration#cli_options when some filenames are changed here
+      FILES = %w(
+        plugins.json themes.json wordpresses.json
+        timthumbs-v3.txt user-agents.txt config_backups.txt
+        dynamic_finders.yml wordpress.db LICENSE
+      ).freeze
+
+      attr_reader :repo_directory
+
+      def initialize(repo_directory)
+        @repo_directory = repo_directory
+
+        FileUtils.mkdir_p(repo_directory) unless Dir.exist?(repo_directory)
+
+        raise "#{repo_directory} is not writable" unless Pathname.new(repo_directory).writable?
+      end
+
+      # @return [ Time, nil ]
+      def last_update
+        Time.parse(File.read(last_update_file))
+      rescue ArgumentError, Errno::ENOENT
+        nil # returns nil if the file does not exist or contains invalid time data
+      end
+
+      # @return [ String ]
+      def last_update_file
+        @last_update_file ||= File.join(repo_directory, '.last_update')
+      end
+
+      # @return [ Boolean ]
+      def outdated?
+        date = last_update
+
+        date.nil? || date < 5.days.ago
+      end
+
+      # @return [ Boolean ]
+      def missing_files?
+        FILES.each do |file|
+          return true unless File.exist?(File.join(repo_directory, file))
+        end
+        false
+      end
+
+      # @return [ Hash ] The params for Typhoeus::Request
+      def request_params
+        {
+          ssl_verifyhost: 2,
+          ssl_verifypeer: true,
+          timeout: 300,
+          connecttimeout: 120,
+          accept_encoding: 'gzip, deflate',
+          cache_ttl: 0
+        }
+      end
+
+      # @return [ String ] The raw file URL associated with the given filename
+      def remote_file_url(filename)
+        "https://data.wpscan.org/#{filename}"
+      end
+
+      # @return [ String ] The checksum of the associated remote filename
+      def remote_file_checksum(filename)
+        url = "#{remote_file_url(filename)}.sha512"
+
+        res = Browser.get(url, request_params)
+        raise DownloadError, res if res.timed_out? || res.code != 200
+        res.body.chomp
+      end
+
+      def local_file_path(filename)
+        File.join(repo_directory, filename.to_s)
+      end
+
+      def local_file_checksum(filename)
+        Digest::SHA512.file(local_file_path(filename)).hexdigest
+      end
+
+      def backup_file_path(filename)
+        File.join(repo_directory, "#{filename}.back")
+      end
+
+      def create_backup(filename)
+        return unless File.exist?(local_file_path(filename))
+        FileUtils.cp(local_file_path(filename), backup_file_path(filename))
+      end
+
+      def restore_backup(filename)
+        return unless File.exist?(backup_file_path(filename))
+        FileUtils.cp(backup_file_path(filename), local_file_path(filename))
+      end
+
+      def delete_backup(filename)
+        FileUtils.rm(backup_file_path(filename))
+      end
+
+      # @return [ String ] The checksum of the downloaded file
+      def download(filename)
+        file_path = local_file_path(filename)
+        file_url  = remote_file_url(filename)
+
+        res = Browser.get(file_url, request_params)
+        raise DownloadError, res if res.timed_out? || res.code != 200
+
+        File.open(file_path, 'wb') { |f| f.write(res.body) }
+
+        local_file_checksum(filename)
+      end
+
+      # rubocop:disable MethodLength
+      # @return [ Array<String> ] The filenames updated
+      def update
+        updated = []
+
+        FILES.each do |filename|
+          begin
+            db_checksum = remote_file_checksum(filename)
+
+            # Checking if the file needs to be updated
+            next if File.exist?(local_file_path(filename)) && db_checksum == local_file_checksum(filename)
+
+            create_backup(filename)
+            dl_checksum = download(filename)
+
+            raise "#{filename}: checksums do not match" unless dl_checksum == db_checksum
+            updated << filename
+          rescue => e
+            restore_backup(filename)
+            raise e
+          ensure
+            delete_backup(filename) if File.exist?(backup_file_path(filename))
+          end
+        end
+
+        File.write(last_update_file, Time.now)
+
+        updated
+      end
+      # rubocop:enable MethodLength
+    end
+  end
+  # :nocov:
+end

data/lib/wpscan/db/wp_item.rb

@@ -0,0 +1,18 @@
+module WPScan
+  module DB
+    # WpItem - super DB class for Plugin, Theme and Version
+    class WpItem
+      # @param [ String ] identifier The plugin/theme slug or version number
+      #
+      # @return [ Hash ] The JSON data from the DB associated to the identifier
+      def self.db_data(identifier)
+        db[identifier] || {}
+      end
+
+      # @return [ JSON ]
+      def self.db
+        @db ||= read_json_file(db_file)
+      end
+    end
+  end
+end

data/lib/wpscan/db/wp_items.rb

@@ -0,0 +1,21 @@
+module WPScan
+  module DB
+    # WP Items
+    class WpItems
+      # @return [ Array<String> ] The slug of all items
+      def self.all_slugs
+        db.keys
+      end
+
+      # @return [ Array<String> ] The slug of all popular items
+      def self.popular_slugs
+        db.select { |_key, item| item['popular'] == true }.keys
+      end
+
+      # @return [ Array<String> ] The slug of all vulnerable items
+      def self.vulnerable_slugs
+        db.select { |_key, item| !item['vulnerabilities'].empty? }.keys
+      end
+    end
+  end
+end