wpscan 3.0

data/app/finders/interesting_findings/upload_sql_dump.rb

@@ -0,0 +1,28 @@
+module WPScan
+  module Finders
+    module InterestingFindings
+      # UploadSQLDump finder
+      class UploadSQLDump < CMSScanner::Finders::Finder
+        SQL_PATTERN = /(?:(?:(?:DROP|CREATE) TABLE)|INSERT INTO)/
+
+        # @return [ InterestingFinding ]
+        def aggressive(_opts = {})
+          url = dump_url
+          res = Browser.get(url)
+
+          return unless res.code == 200 && res.body =~ SQL_PATTERN
+
+          WPScan::InterestingFinding.new(
+            url,
+            confidence: 100,
+            found_by: DIRECT_ACCESS
+          )
+        end
+
+        def dump_url
+          target.url('wp-content/uploads/dump.sql')
+        end
+      end
+    end
+  end
+end

data/app/finders/main_theme.rb

@@ -0,0 +1,22 @@
+require_relative 'main_theme/css_style'
+require_relative 'main_theme/woo_framework_meta_generator'
+require_relative 'main_theme/urls_in_homepage'
+
+module WPScan
+  module Finders
+    module MainTheme
+      # Main Theme Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders <<
+            MainTheme::CssStyle.new(target) <<
+            MainTheme::WooFrameworkMetaGenerator.new(target) <<
+            MainTheme::UrlsInHomepage.new(target)
+        end
+      end
+    end
+  end
+end

data/app/finders/main_theme/css_style.rb

@@ -0,0 +1,43 @@
+module WPScan
+  module Finders
+    module MainTheme
+      # From the css style
+      class CssStyle < CMSScanner::Finders::Finder
+        include Finders::WpItems::URLsInHomepage
+
+        def create_theme(name, style_url, opts)
+          WPScan::Theme.new(
+            name,
+            target,
+            opts.merge(found_by: found_by, confidence: 70, style_url: style_url)
+          )
+        end
+
+        def passive(opts = {})
+          passive_from_css_href(target.homepage_res, opts) || passive_from_style_code(target.homepage_res, opts)
+        end
+
+        def passive_from_css_href(res, opts)
+          target.in_scope_urls(res, '//style|//link') do |url|
+            next unless Addressable::URI.parse(url).path =~ %r{/themes/([^\/]+)/style.css\z}i
+
+            return create_theme(Regexp.last_match[1], url, opts)
+          end
+          nil
+        end
+
+        def passive_from_style_code(res, opts)
+          res.html.css('style').each do |tag|
+            code = tag.text.to_s
+            next if code.empty?
+
+            next unless code =~ %r{#{item_code_pattern('themes')}\\?/style\.css[^"'\( ]*}i
+
+            return create_theme(Regexp.last_match[1], Regexp.last_match[0].strip, opts)
+          end
+          nil
+        end
+      end
+    end
+  end
+end

data/app/finders/main_theme/urls_in_homepage.rb

@@ -0,0 +1,25 @@
+module WPScan
+  module Finders
+    module MainTheme
+      # URLs In Homepage Finder
+      class UrlsInHomepage < CMSScanner::Finders::Finder
+        include WpItems::URLsInHomepage
+
+        # @param [ Hash ] opts
+        #
+        # @return [ Array<Theme> ]
+        def passive(opts = {})
+          found = []
+
+          names = items_from_links('themes', false) + items_from_codes('themes', false)
+
+          names.each_with_object(Hash.new(0)) { |name, counts| counts[name] += 1 }.each do |name, occurences|
+            found << WPScan::Theme.new(name, target, opts.merge(found_by: found_by, confidence: 2 * occurences))
+          end
+
+          found
+        end
+      end
+    end
+  end
+end

data/app/finders/main_theme/woo_framework_meta_generator.rb

@@ -0,0 +1,22 @@
+module WPScan
+  module Finders
+    module MainTheme
+      # From the WooFramework meta generators
+      class WooFrameworkMetaGenerator < CMSScanner::Finders::Finder
+        THEME_PATTERN     = %r{<meta name="generator" content="([^\s"]+)\s?([^"]+)?"\s+/?>}
+        FRAMEWORK_PATTERN = %r{<meta name="generator" content="WooFramework\s?([^"]+)?"\s+/?>}
+        PATTERN           = /#{THEME_PATTERN}\s+#{FRAMEWORK_PATTERN}/i
+
+        def passive(opts = {})
+          return unless target.homepage_res.body =~ PATTERN
+
+          WPScan::Theme.new(
+            Regexp.last_match[1],
+            target,
+            opts.merge(found_by: found_by, confidence: 80)
+          )
+        end
+      end
+    end
+  end
+end

data/app/finders/medias.rb

@@ -0,0 +1,17 @@
+require_relative 'medias/attachment_brute_forcing'
+
+module WPScan
+  module Finders
+    module Medias
+      # Medias Finder
+      class Base
+        include CMSScanner::Finders::SameTypeFinder
+
+        # @param [ WPScan::Target ] target
+        def initialize(target)
+          finders << Medias::AttachmentBruteForcing.new(target)
+        end
+      end
+    end
+  end
+end

data/app/finders/medias/attachment_brute_forcing.rb

@@ -0,0 +1,44 @@
+module WPScan
+  module Finders
+    module Medias
+      # Medias Finder
+      class AttachmentBruteForcing < CMSScanner::Finders::Finder
+        include CMSScanner::Finders::Finder::Enumerator
+
+        # @param [ Hash ] opts
+        # @option opts [ Range ] :range Mandatory
+        #
+        # @return [ Array<Media> ]
+        def aggressive(opts = {})
+          found = []
+
+          enumerate(target_urls(opts), opts) do |res|
+            next unless res.code == 200
+
+            found << WPScan::Media.new(res.effective_url, opts.merge(found_by: found_by, confidence: 100))
+          end
+
+          found
+        end
+
+        # @param [ Hash ] opts
+        # @option opts [ Range ] :range Mandatory
+        #
+        # @return [ Hash ]
+        def target_urls(opts = {})
+          urls = {}
+
+          opts[:range].each do |id|
+            urls[target.uri.join("?attachment_id=#{id}").to_s] = id
+          end
+
+          urls
+        end
+
+        def create_progress_bar(opts = {})
+          super(opts.merge(title: ' Brute Forcing Attachment Ids -'))
+        end
+      end
+    end
+  end
+end

data/app/finders/plugin_version.rb

@@ -0,0 +1,44 @@
+require_relative 'plugin_version/readme'
+# Plugins Specific
+require_relative 'plugin_version/layer_slider/translation_file'
+require_relative 'plugin_version/revslider/release_log'
+require_relative 'plugin_version/sitepress_multilingual_cms/version_parameter'
+require_relative 'plugin_version/sitepress_multilingual_cms/meta_generator'
+require_relative 'plugin_version/w3_total_cache/headers'
+
+module WPScan
+  module Finders
+    module PluginVersion
+      # Plugin Version Finder
+      class Base
+        include CMSScanner::Finders::UniqueFinder
+
+        # @param [ WPScan::Plugin ] plugin
+        def initialize(plugin)
+          finders << PluginVersion::Readme.new(plugin)
+
+          load_specific_finders(plugin)
+        end
+
+        # Load the finders associated with the plugin
+        #
+        # @param [ WPScan::Plugin ] plugin
+        def load_specific_finders(plugin)
+          module_name = plugin.classify_name.to_sym
+
+          return unless Finders::PluginVersion.constants.include?(module_name)
+
+          mod = Finders::PluginVersion.const_get(module_name)
+
+          mod.constants.each do |constant|
+            c = mod.const_get(constant)
+
+            next unless c.is_a?(Class)
+
+            finders << c.new(plugin)
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/plugin_version/layer_slider/translation_file.rb

@@ -0,0 +1,40 @@
+module WPScan
+  module Finders
+    module PluginVersion
+      module LayerSlider
+        # Version from a Translation file
+        #
+        # See https://github.com/wpscanteam/wpscan/issues/765
+        class TranslationFile < CMSScanner::Finders::Finder
+          # @param [ Hash ] opts
+          #
+          # @return [ Version ]
+          def aggressive(_opts = {})
+            potential_urls.each do |url|
+              res = Browser.get(url)
+
+              next unless res.code == 200 && res.body =~ /Project-Id-Version: LayerSlider WP v?([0-9\.][^\\\s]+)/
+
+              return WPScan::Version.new(
+                Regexp.last_match[1],
+                found_by: 'Translation File (Aggressive Detection)',
+                confidence: 90,
+                interesting_entries: ["#{url}, Match: '#{Regexp.last_match}'"]
+              )
+            end
+            nil
+          end
+
+          # @return [ Array<String> ] The potential URLs where the version is disclosed
+          def potential_urls
+            # Recent versions seem to use the 'locales' directory instead of the 'languages' one.
+            # Maybe also check other locales ?
+            %w(locales languages).reduce([]) do |a, e|
+              a << target.url("#{e}/LayerSlider-en_US.po")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/plugin_version/readme.rb

@@ -0,0 +1,79 @@
+module WPScan
+  module Finders
+    module PluginVersion
+      # Plugin Version Finder from the readme.txt file
+      class Readme < CMSScanner::Finders::Finder
+        # @return [ Version ]
+        def aggressive(_opts = {})
+          found_by_msg = 'Readme - %s (Aggressive Detection)'
+
+          WPScan::WpItem::READMES.each do |file|
+            url = target.url(file)
+            res = Browser.get(url)
+
+            next unless res.code == 200 && !(numbers = version_numbers(res.body)).empty?
+
+            return numbers.reduce([]) do |a, e|
+              a << WPScan::Version.new(
+                e[0],
+                found_by: format(found_by_msg, e[1]),
+                confidence: e[2],
+                interesting_entries: [url]
+              )
+            end
+          end
+          nil
+        end
+
+        # @return [ Array<String, String, Integer> ] number, found_by, confidence
+        def version_numbers(body)
+          numbers = []
+
+          if (number = from_stable_tag(body))
+            numbers << [number, 'Stable Tag', 80]
+          end
+
+          if (number = from_changelog_section(body))
+            numbers << [number, 'ChangeLog Section', 50]
+          end
+
+          numbers
+        end
+
+        # @param [ String ] body
+        #
+        # @return [ String, nil ] The version number detected from the stable tag
+        def from_stable_tag(body)
+          return unless body =~ /\b(?:stable tag|version):\s*(?!trunk)([0-9a-z\.-]+)/i
+
+          number = Regexp.last_match[1]
+
+          number if number =~ /[0-9]+/
+        end
+
+        # @param [ String ] body
+        #
+        # @return [ String, nil ] The best version number detected from the changelog section
+        def from_changelog_section(body)
+          extracted_versions = body.scan(%r{[=]+\s+(?:v(?:ersion)?\s*)?([0-9\.-]+)[ \ta-z0-9\(\)\.\-\/]*[=]+}i)
+
+          return if extracted_versions.nil? || extracted_versions.empty?
+
+          extracted_versions.flatten!
+          # must contain at least one number
+          extracted_versions = extracted_versions.select { |x| x =~ /[0-9]+/ }
+
+          sorted = extracted_versions.sort do |x, y|
+            begin
+              Gem::Version.new(x) <=> Gem::Version.new(y)
+            rescue
+              0
+            end
+          end
+
+          sorted.last
+        end
+      end
+    end
+  end
+end

data/app/finders/plugin_version/revslider/release_log.rb

@@ -0,0 +1,35 @@
+module WPScan
+  module Finders
+    module PluginVersion
+      module Revslider
+        # Version from the release_log.html
+        #
+        # See https://github.com/wpscanteam/wpscan/issues/817
+        class ReleaseLog < CMSScanner::Finders::Finder
+          # @param [ Hash ] opts
+          #
+          # @return [ Version ]
+          def aggressive(_opts = {})
+            res = Browser.get(release_log_url)
+
+            res.html.css('h3.version-number:first').each do |node|
+              next unless node.text =~ /\AVersion ([0-9\.]+).*\z/i
+
+              return WPScan::Version.new(
+                Regexp.last_match[1],
+                found_by: found_by,
+                confidence: 90,
+                interesting_entries: ["#{release_log_url}, Match: '#{Regexp.last_match}'"]
+              )
+            end
+            nil
+          end
+
+          def release_log_url
+            target.url('release_log.html')
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/plugin_version/sitepress_multilingual_cms/meta_generator.rb

@@ -0,0 +1,27 @@
+module WPScan
+  module Finders
+    module PluginVersion
+      module SitepressMultilingualCms
+        # Version from the meta generator
+        class MetaGenerator < CMSScanner::Finders::Finder
+          # @param [ Hash ] opts
+          #
+          # @return [ Version ]
+          def passive(_opts = {})
+            target.target.homepage_res.html.css('meta[name="generator"]').each do |node|
+              next unless node['content'] =~ /\AWPML\sver:([0-9\.]+)\sstt/i
+
+              return WPScan::Version.new(
+                Regexp.last_match(1),
+                found_by: 'Meta Generator (Passive detection)',
+                confidence: 50,
+                interesting_entries: ["#{target.target.url}, Match: '#{node}'"]
+              )
+            end
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/plugin_version/sitepress_multilingual_cms/version_parameter.rb

@@ -0,0 +1,31 @@
+module WPScan
+  module Finders
+    module PluginVersion
+      module SitepressMultilingualCms
+        # Version from the v parameter in href / src of stylesheets / scripts
+        class VersionParameter < CMSScanner::Finders::Finder
+          # @param [ Hash ] opts
+          #
+          # @return [ Version ]
+          def passive(_opts = {})
+            pattern = %r{#{Regexp.escape(target.target.plugins_dir)}/sitepress-multilingual-cms/}i
+
+            target.target.in_scope_urls(target.target.homepage_res, '//link|//script') do |url|
+              uri = Addressable::URI.parse(url)
+
+              next unless uri.path =~ pattern && uri.query =~ /v=([0-9\.]+)/
+
+              return WPScan::Version.new(
+                Regexp.last_match[1],
+                found_by: found_by,
+                confidence: 50,
+                interesting_entries: [url]
+              )
+            end
+            nil
+          end
+        end
+      end
+    end
+  end
+end