wpscan 3.0

data/app/controllers/main_theme.rb

@@ -0,0 +1,27 @@
+module WPScan
+  module Controller
+    # Main Theme Controller
+    class MainTheme < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptChoice.new(
+            ['--main-theme-detection MODE',
+             'Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode.'],
+            choices: %w(mixed passive aggressive),
+            normalize: :to_sym
+          )
+        ]
+      end
+
+      def run
+        output(
+          'theme',
+          theme: target.main_theme(
+            mode: parsed_options[:main_theme_detection] || parsed_options[:detection_mode]
+          ),
+          verbose: parsed_options[:verbose]
+        )
+      end
+    end
+  end
+end

data/app/controllers/wp_version.rb

@@ -0,0 +1,30 @@
+module WPScan
+  module Controller
+    # Wp Version Controller
+    class WpVersion < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptBoolean.new(['--wp-version-all', 'Check all the version locations']),
+          OptChoice.new(
+            ['--wp-version-detection MODE',
+             'Use the supplied mode for the WordPress version detection, ' \
+             'instead of the global (--detection-mode) mode.'],
+            choices: %w(mixed passive aggressive),
+            normalize: :to_sym
+          )
+        ]
+      end
+
+      def run
+        output(
+          'version',
+          version: target.wp_version(
+            mode: parsed_options[:wp_version_detection] || parsed_options[:detection_mode],
+            confidence_threshold: parsed_options[:wp_version_all] ? 0 : 100,
+            show_progression: user_interaction?
+          )
+        )
+      end
+    end
+  end
+end

data/app/finders.rb

@@ -0,0 +1,13 @@
+require_relative 'finders/interesting_findings'
+require_relative 'finders/wp_items'
+require_relative 'finders/wp_version'
+require_relative 'finders/main_theme'
+require_relative 'finders/timthumb_version'
+require_relative 'finders/timthumbs'
+require_relative 'finders/config_backups'
+require_relative 'finders/medias'
+require_relative 'finders/users'
+require_relative 'finders/plugins'
+require_relative 'finders/plugin_version'
+require_relative 'finders/theme_version'
+require_relative 'finders/themes'

data/app/finders/config_backups.rb

@@ -0,0 +1,17 @@
+require_relative 'config_backups/known_filenames'
+
+module WPScan
+  module Finders
+    module ConfigBackups
+      # Config Backup Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders << ConfigBackups::KnownFilenames.new(target)
+        end
+      end
+    end
+  end
+end

data/app/finders/config_backups/known_filenames.rb

@@ -0,0 +1,46 @@
+module WPScan
+  module Finders
+    module ConfigBackups
+      # Config Backup finder
+      class KnownFilenames < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list
+        # @option opts [ Boolean ] :show_progression
+        #
+        # @return [ Array<InterestingFinding> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(potential_urls(opts), opts) do |res|
+            # Might need to improve that
+            next unless res.body =~ /define/i && res.body !~ /<\s?html/i
+
+            found << WPScan::ConfigBackup.new(res.request.url, found_by: DIRECT_ACCESS, confidence: 100)
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :list Mandatory
+        #
+        # @return [ Hash ]
+        def potential_urls(opts = {})
+          urls = {}
+
+          File.open(opts[:list]).each_with_index do |file, index|
+            urls[target.url(file.chomp)] = index
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Checking Config Backups -'))
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings.rb

@@ -0,0 +1,33 @@
+require_relative 'interesting_findings/readme'
+require_relative 'interesting_findings/multisite'
+require_relative 'interesting_findings/debug_log'
+require_relative 'interesting_findings/backup_db'
+require_relative 'interesting_findings/mu_plugins'
+require_relative 'interesting_findings/registration'
+require_relative 'interesting_findings/tmm_db_migrate'
+require_relative 'interesting_findings/upload_sql_dump'
+require_relative 'interesting_findings/full_path_disclosure'
+require_relative 'interesting_findings/duplicator_installer_log'
+require_relative 'interesting_findings/upload_directory_listing'
+
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Interesting Files Finder
+      class Base < CMSScanner::Finders::InterestingFindings::Base
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          super(target)
+
+          %w(
+            Readme DebugLog FullPathDisclosure BackupDB DuplicatorInstallerLog
+            Multisite MuPlugins Registration UploadDirectoryListing TmmDbMigrate
+            UploadSQLDump
+          ).each do |f|
+            finders << InterestingFindings.const_get(f).new(target)
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/backup_db.rb

@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # BackupDB finder
+      class BackupDB < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/backup-db/'
+          url  = target.url(path)
+          res  = Browser.get(url)
+
+          return unless [200, 403].include?(res.code) && !target.homepage_or_404?(res)
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 70,
+            found_by: DIRECT_ACCESS,
+            interesting_entries: target.directory_listing_entries(path),
+            references: { url: 'https://github.com/wpscanteam/wpscan/issues/422' }
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/debug_log.rb

@@ -0,0 +1,20 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # debug.log finder
+      class DebugLog < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/debug.log'
+
+          return unless target.debug_log?(path)
+
+          WPScan::InterestingFinding.new(
+            target.url(path),
+            confidence: 100, found_by: DIRECT_ACCESS
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/duplicator_installer_log.rb

@@ -0,0 +1,23 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # DuplicatorInstallerLog finder
+      class DuplicatorInstallerLog < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url = target.url('installer-log.txt')
+          res = Browser.get(url)
+
+          return unless res.body =~ /DUPLICATOR INSTALL-LOG/
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            references: { url: 'https://www.exploit-db.com/ghdb/3981/' }
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/full_path_disclosure.rb

@@ -0,0 +1,23 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Full Path Disclosure finder
+      class FullPathDisclosure < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path        = 'wp-includes/rss-functions.php'
+          fpd_entries = target.full_path_disclosure_entries(path)
+
+          return if fpd_entries.empty?
+
+          WPScan::InterestingFinding.new(
+            target.url(path),
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            interesting_entries: fpd_entries
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/mu_plugins.rb

@@ -0,0 +1,48 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Must Use Plugins Directory checker
+      class MuPlugins < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def passive(_opts = {})
+          pattern = %r{#{target.content_dir}/mu\-plugins/}i
+
+          target.in_scope_urls(target.homepage_res) do |url|
+            next unless Addressable::URI.parse(url).path =~ pattern
+
+            url = target.url('wp-content/mu-plugins/')
+
+            return WPScan::InterestingFinding.new(
+              url,
+              confidence: 70,
+              found_by: 'URLs In Homepage (Passive Detection)',
+              to_s: "This site has 'Must Use Plugins': #{url}",
+              references: { url: 'http://codex.wordpress.org/Must_Use_Plugins' }
+            )
+          end
+          nil
+        end
+
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url = target.url('wp-content/mu-plugins/')
+          res = Browser.get_and_follow_location(url)
+
+          return unless [200, 401, 403].include?(res.code)
+          return if target.homepage_or_404?(res)
+          # TODO: add the check for --exclude-content once implemented ?
+
+          target.mu_plugins = true
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 80,
+            found_by: DIRECT_ACCESS,
+            to_s: "This site has 'Must Use Plugins': #{url}",
+            references: { url: 'http://codex.wordpress.org/Must_Use_Plugins' }
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/multisite.rb

@@ -0,0 +1,29 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Multisite checker
+      class Multisite < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url      = target.url('wp-signup.php')
+          res      = Browser.get(url)
+          location = res.headers_hash['location']
+
+          return unless [200, 302].include?(res.code)
+          return if res.code == 302 && location =~ /wp-login\.php\?action=register/
+          return unless res.code == 200 || res.code == 302 && location =~ /wp-signup\.php/
+
+          target.multisite = true
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            to_s: 'This site seems to be a multisite',
+            references: { url: 'http://codex.wordpress.org/Glossary#Multisite' }
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/readme.rb

@@ -0,0 +1,26 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Readme.html finder
+      class Readme < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          potential_files.each do |file|
+            url = target.url(file)
+            res = Browser.get(url)
+
+            if res.code == 200 && res.body =~ /wordpress/i
+              return WPScan::InterestingFinding.new(url, confidence: 100, found_by: DIRECT_ACCESS)
+            end
+          end
+          nil
+        end
+
+        # @retun [ Array<String> ] The list of potential readme files
+        def potential_files
+          %w(readme.html olvasdel.html lisenssi.html liesmich.html)
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/registration.rb

@@ -0,0 +1,31 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Registration Enabled checker
+      class Registration < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def passive(_opts = {})
+          # Maybe check in the homepage if there is the registration url ?
+        end
+
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          res = Browser.get_and_follow_location(target.registration_url)
+
+          return unless res.code == 200
+          return if res.html.css('form#setupform').empty? &&
+                    res.html.css('form#registerform').empty?
+
+          target.registration_enabled = true
+
+          WPScan::InterestingFinding.new(
+            res.effective_url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            to_s: "Registration is enabled: #{res.effective_url}"
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/tmm_db_migrate.rb

@@ -0,0 +1,24 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # Tmm DB Migrate finder
+      class TmmDbMigrate < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/uploads/tmm_db_migrate/tmm_db_migrate.zip'
+          url  = target.url(path)
+          res  = Browser.get(url)
+
+          return unless res.code == 200 && res.headers['Content-Type'] =~ %r{\Aapplication/zip}i
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            references: { packetstorm: 131_957 }
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/interesting_findings/upload_directory_listing.rb

@@ -0,0 +1,24 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # UploadDirectoryListing finder
+      class UploadDirectoryListing < CMSScanner::Finders::Finder
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          path = 'wp-content/uploads/'
+
+          return unless target.directory_listing?(path)
+
+          url = target.url(path)
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS,
+            to_s: "Upload directory has listing enabled: #{url}"
+          )
+        end
+      end
+    end
+  end
+end