wpscan 3.8.28 → 4.0.0

data/lib/wpscan/finders/independent_finders.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    # This class is designed to handle independent results
+    # which are not related with each others
+    # e.g: interesting files
+    class IndependentFinders < BaseFinders
+      # @param [ Hash ] opts
+      # @option opts [ Symbol ] mode :mixed, :passive or :aggressive
+      #
+      # @return [ Findings ]
+      def run(opts = {})
+        methods = symbols_from_mode(opts[:mode])
+
+        each do |finder|
+          methods.each do |symbol|
+            run_finder(finder, symbol, opts)
+          end
+        end
+
+        filter_findings
+      end
+    end
+  end
+end

data/lib/wpscan/finders/same_type_finder.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    # Same Type Finder
+    module SameTypeFinder
+      def self.included(klass)
+        klass.class_eval do
+          include IndependentFinder
+
+          # @return [ Array ]
+          def finders
+            @finders ||= WPScan::Finders::SameTypeFinders.new
+          end
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/finders/same_type_finders.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    # This class is designed to handle same type results, such as enumeration of plugins,
+    # themes etc.
+    class SameTypeFinders < BaseFinders
+      # @param [ Hash ] opts
+      # @option opts [ Symbol ] :mode :mixed, :passive or :aggressive
+      # @option opts [ Boolean ] :sort Wether or not to sort the findings
+      #
+      # @return [ Findings ]
+      def run(opts = {}, &block)
+        findings.on_append = block if block
+
+        symbols_from_mode(opts[:mode]).each do |symbol|
+          each do |finder|
+            run_finder(finder, symbol, opts)
+          end
+        end
+
+        findings.sort! if opts[:sort]
+
+        filter_findings
+      end
+    end
+  end
+end

data/lib/wpscan/finders/unique_finder.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    # Unique Finder
+    module UniqueFinder
+      def self.included(klass)
+        klass.class_eval do
+          include IndependentFinder
+
+          # @return [ Array ]
+          def finders
+            @finders ||= WPScan::Finders::UniqueFinders.new
+          end
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/finders/unique_finders.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    # This class is designed to return a unique result such as a version
+    # Note: Finders contained can return multiple results but the #run will only
+    # returned the best finding
+    class UniqueFinders < BaseFinders
+      # @param [ Hash ] opts
+      # @option opts [ Symbol ] :mode :mixed, :passive or :aggressive
+      # @option opts [ Int ] :confidence_threshold  If a finding's confidence reaches this value,
+      #                                             it will be returned as the best finding.
+      #                                             Default is 100.
+      #                                             If <= 0, all finders will be ran.
+      #
+      # @return [ Object, false ] The best finding or false if none
+      def run(opts = {})
+        opts[:confidence_threshold] ||= 100
+
+        symbols_from_mode(opts[:mode]).each do |symbol|
+          each do |finder|
+            run_finder(finder, symbol, opts)
+
+            next if opts[:confidence_threshold] <= 0
+
+            findings.each { |f| return f if f.confidence >= opts[:confidence_threshold] }
+          end
+        end
+
+        filter_findings
+      end
+
+      protected
+
+      # @return [ Object, false ] The best finding or false if none
+      def filter_findings
+        # results are sorted by confidence ASC
+        findings.sort_by!(&:confidence)
+
+        # If all findings have the same confidence, false is returned
+        return false if findings.size > 1 && findings.first.confidence == findings.last.confidence
+
+        findings.last || false
+      end
+    end
+  end
+end

data/lib/wpscan/finders.rb

@@ -1,5 +1,16 @@
 # frozen_string_literal: true
 
+require 'wpscan/finders/finder'
+require 'wpscan/finders/finding'
+require 'wpscan/finders/findings'
+require 'wpscan/finders/base_finders'
+require 'wpscan/finders/independent_finders'
+require 'wpscan/finders/independent_finder'
+require 'wpscan/finders/unique_finders'
+require 'wpscan/finders/unique_finder'
+require 'wpscan/finders/same_type_finders'
+require 'wpscan/finders/same_type_finder'
+
 require 'wpscan/finders/finder/wp_version/smart_url_checker'
 
 require 'wpscan/finders/dynamic_finder/finder'
@@ -14,15 +25,3 @@ require 'wpscan/finders/dynamic_finder/version/query_parameter'
 require 'wpscan/finders/dynamic_finder/version/config_parser'
 require 'wpscan/finders/dynamic_finder/wp_item_version'
 require 'wpscan/finders/dynamic_finder/wp_version'
-
-module WPScan
-  # Custom Finders
-  module Finders
-    include CMSScanner::Finders
-
-    # Custom InterestingFindings
-    module InterestingFindings
-      include CMSScanner::Finders::InterestingFindings
-    end
-  end
-end

data/lib/wpscan/formatter/buffer.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Formatter
+    # Module used to output the rendered views into a buffer
+    # and beautify it a the end of the scan
+    module Buffer
+      def output(tpl, vars = {}, controller_name = nil)
+        buffer << render(tpl, vars, controller_name).encode('UTF-8', invalid: :replace, undef: :replace)
+      end
+
+      def buffer
+        @buffer ||= +''
+      end
+    end
+  end
+end

data/lib/wpscan/formatter.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require 'wpscan/formatter/buffer'
+
+module WPScan
+  # Formatter
+  module Formatter
+    # Module to be able to do Formatter.load() & Formatter.availables
+    # and do that as well when the Formatter is included in another module
+    module ClassMethods
+      # @param [ String ] format
+      # @param [ Array<String> ] custom_views
+      #
+      # @return [ Formatter::Base ]
+      def load(format = nil, custom_views = nil)
+        format ||= 'cli'
+        custom_views ||= []
+
+        f = const_get(format.tr('-', '_').camelize).new
+        custom_views.each { |v| f.views_directories << v }
+        f
+      end
+
+      # @return [ Array<String> ] The list of the available formatters (except the Base one)
+      # @note: the #load method above should then be used to create the associated formatter
+      def availables
+        formatters = WPScan::Formatter.constants.select do |const|
+          name = WPScan::Formatter.const_get(const)
+          name.is_a?(Class) && name != WPScan::Formatter::Base
+        end
+
+        formatters.map { |sym| sym.to_s.underscore.dasherize }
+      end
+    end
+
+    extend ClassMethods
+
+    def self.included(base)
+      base.extend(ClassMethods)
+    end
+
+    # This module should be implemented in the code which uses this Framework to
+    # be able to override/implements instance methods for all the Formatters
+    # w/o having to include/write the methods in each formatters.
+    #
+    # Example: to override the #views_directories (see the wpscan-v3/lib/wpscan/formatter.rb)
+    module InstanceMethods
+    end
+
+    # Base Formatter
+    class Base
+      attr_reader :controller_name
+
+      def initialize
+        # Can't put this at the top level of the class, due to the WPScan::
+        extend WPScan::Formatter::InstanceMethods
+      end
+
+      # @return [ String ] The underscored name of the class
+      def format
+        self.class.name.demodulize.underscore
+      end
+
+      # @return [ Boolean ]
+      def user_interaction?
+        format == 'cli'
+      end
+
+      # @return [ Boolean ]
+      # Whether this formatter can render findings incrementally as they
+      # arrive (cli, jsonl), or needs to receive the full result set first
+      # (json, sarif — they emit a single well-formed document at end-of-scan).
+      def streams?
+        false
+      end
+
+      # @return [ String ] The underscored format to use as a base
+      def base_format; end
+
+      # @return [ Array<String> ]
+      def formats
+        [format, base_format].compact
+      end
+
+      # This is called after the scan
+      # and used in some formatters (e.g JSON)
+      # to indent results
+      def beautify; end
+
+      # @see #render
+      def output(tpl, vars = {}, controller_name = nil)
+        puts render(tpl, vars, controller_name)
+      end
+
+      ERB_SUPPORTS_KVARGS = ::ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
+
+      # @param [ String ] tpl
+      # @param [ Hash ] vars
+      # @param [ String ] controller_name
+      def render(tpl, vars = {}, controller_name = nil)
+        template_vars(vars)
+        @controller_name = controller_name if controller_name
+
+        # '-' disables new lines when -%> is used.
+        # See http://www.ruby-doc.org/stdlib/libdoc/erb/rdoc/ERB.html
+        ERB.new(File.read(view_path(tpl)), trim_mode: '-').result(binding)
+      end
+
+      # @param [ Hash ] vars
+      #
+      # @return [ Void ]
+      def template_vars(vars)
+        vars.each do |key, value|
+          instance_variable_set("@#{key}", value) unless key == :views_directories
+        end
+      end
+
+      # @param [ String ] tpl
+      #
+      # @return [ String ] The path of the view
+      def view_path(tpl)
+        if tpl[0, 1] == '@' # Global Template
+          tpl = tpl.delete('@')
+        else
+          raise 'The controller_name can not be nil' unless controller_name
+
+          tpl = "#{controller_name}/#{tpl}"
+        end
+
+        raise "Wrong tpl format: '#{tpl}'" unless %r{\A[\w/_]+\z}.match?(tpl)
+
+        views_directories.reverse_each do |dir|
+          formats.each do |format|
+            potential_file = File.join(dir, format, "#{tpl}.erb")
+
+            return potential_file if File.exist?(potential_file)
+          end
+        end
+
+        raise "View not found for #{format}/#{tpl}"
+      end
+
+      # @return [ Array<String> ] The directories to look into for views
+      def views_directories
+        @views_directories ||= [
+          APP_DIR, WPScan::APP_DIR,
+          File.join(Dir.home, ".#{WPScan.app_name}"), File.join(Dir.pwd, ".#{WPScan.app_name}")
+        ].uniq.reduce([]) { |acc, elem| acc << Pathname.new(elem).join('views').to_s }
+      end
+    end
+  end
+end

data/lib/wpscan/helper.rb

@@ -1,5 +1,11 @@
 # frozen_string_literal: true
 
+# @param [ String ] file The file path
+def redirect_output_to_file(file)
+  $stdout.reopen(file, 'w')
+  $stdout.sync = true
+end
+
 def read_json_file(file)
   JSON.parse(File.read(file))
 rescue StandardError => e
@@ -13,7 +19,7 @@ end
 #
 # @return [ Symbol ]
 def classify_slug(slug)
-  classified = slug.to_s.gsub(/[^a-z\d\-]/i, '-').gsub(/-{1,}/, '_').camelize.to_s
+  classified = slug.to_s.gsub(/[^a-z\d-]/i, '-').gsub(/-{1,}/, '_').camelize.to_s
   classified = "D_#{classified}" if /\d/.match?(classified[0])
 
   # Special case for slugs with all non-latin characters.

data/lib/wpscan/http_status_tracking.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module WPScan
+  # Module for HTTP status code tracking and error detection
+  module HttpStatusTracking
+    # Tracking for HTTP status codes
+    def status_codes
+      @@status_codes_mutex ||= Mutex.new
+      @@status_codes ||= Hash.new(0)
+    end
+
+    # Reset status codes (mainly for testing)
+    def reset_status_codes
+      @@status_codes_mutex ||= Mutex.new
+      @@status_codes_mutex.synchronize do
+        @@status_codes = Hash.new(0)
+      end
+    end
+
+    # Thread-safe increment of status code count
+    def increment_status_code(code)
+      @@status_codes_mutex ||= Mutex.new
+      @@status_codes_mutex.synchronize do
+        status_codes[code] += 1
+      end
+    end
+
+    # Thread-safe set of status code count (mainly for testing)
+    def set_status_code(code, count)
+      @@status_codes_mutex ||= Mutex.new
+      @@status_codes_mutex.synchronize do
+        status_codes[code] = count
+      end
+    end
+
+    # Get top N status codes by frequency
+    def top_status_codes(limit = 5)
+      @@status_codes_mutex ||= Mutex.new
+      @@status_codes_mutex.synchronize do
+        return {} if status_codes.empty?
+
+        status_codes.sort_by { |_code, count| -count }.first(limit).to_h
+      end
+    end
+
+    # Helper to count specific error types
+    def error_counts
+      @@status_codes_mutex ||= Mutex.new
+      @@status_codes_mutex.synchronize do
+        {
+          failed: status_codes[0] || 0,
+          rate_limit: status_codes[429] || 0,
+          server_errors: status_codes.select { |code, _| code >= 500 }.values.sum,
+          client_errors: status_codes.select { |code, _count| code >= 400 && code < 500 && code != 404 }.values.sum
+        }
+      end
+    end
+
+    # Format status codes for display (converts code 0 to "failed")
+    def format_status_codes(codes_hash)
+      codes_hash.to_h do |code, count|
+        label = code.zero? ? 'failed' : code.to_s
+        [label, count]
+      end
+    end
+
+    # Get all applicable warning messages based on error types
+    def error_warning_messages
+      return [] if total_requests.zero?
+
+      messages = []
+      counts = error_counts
+
+      check_specific_error_conditions(messages, counts)
+      check_generic_error_rate(messages, counts)
+
+      messages
+    end
+
+    # Determine if warning should be shown for concerning error codes
+    def concerning_error_codes?
+      return false if total_requests.zero?
+
+      counts = error_counts
+      # Total errors excluding 404s but including failed requests (code 0)
+      total_errors = counts[:client_errors] + counts[:server_errors] + counts[:failed]
+      error_percentage = total_errors.to_f / total_requests
+
+      # Warning conditions
+      error_percentage > 0.2 ||
+        counts[:rate_limit] > 10 ||
+        counts[:server_errors] > 10 ||
+        counts[:failed] > 10
+    end
+
+    private
+
+    def check_specific_error_conditions(messages, counts)
+      if counts[:failed] > 10
+        messages << 'Too many failed requests (no response) could indicate network issues, ' \
+                    'WAF/IPS blocking, or an unavailable target'
+      end
+
+      if counts[:rate_limit] > 10
+        messages << 'Rate limiting detected (429 responses). Consider using --throttle or reducing --max-threads'
+      end
+
+      if counts[:server_errors] > 10
+        messages << 'Too many server errors (5xx). The target may be experiencing issues or blocking requests'
+      end
+
+      # Check for other 4xx client errors (excluding 404 and 429 which are handled separately)
+      other_client_errors = counts[:client_errors] - counts[:rate_limit]
+      return unless other_client_errors > 10
+
+      messages << 'Too many client errors (4xx). This could indicate access restrictions, ' \
+                  'authentication issues, or WAF blocking'
+    end
+
+    def check_generic_error_rate(messages, counts)
+      error_percentage = (counts[:client_errors] + counts[:server_errors] + counts[:failed]).to_f / total_requests
+      return unless error_percentage > 0.2 && messages.empty?
+
+      messages << 'Too many errors detected. This could indicate network issues, rate limiting, ' \
+                  'or security protection (e.g. WAF)'
+    end
+  end
+end

data/lib/wpscan/numeric.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# Hack of the Numeric class
+class Numeric
+  # @return [ String ] A human readable string of the value
+  def bytes_to_human
+    units = %w[B KB MB GB TB]
+    e     = abs.zero? ? abs : (Math.log(abs) / Math.log(1024)).floor
+    s     = format('%<s>.3f', s: (abs.to_f / (1024**e)))
+
+    s.sub(/\.?0*$/, " #{units[e]}")
+  end
+end

data/lib/wpscan/parsed_cli.rb

@@ -1,7 +1,36 @@
 # frozen_string_literal: true
 
 module WPScan
-  # To be able to use ParsedCli directly, rather than having to access it via WPscan::ParsedCli
-  class ParsedCli < CMSScanner::ParsedCli
+  # Holds the parsed CLI options and exposes them via class methods (e.g. #verbose?)
+  # rather than from the raw hash. Similar to an OpenStruct but class-wise, with extra
+  # logic to push browser-relevant options into the Browser singleton.
+  class ParsedCli
+    # @return [ Hash ]
+    def self.options
+      @options ||= {}
+    end
+
+    # Sets the CLI options and propagates them to the Browser.
+    # @param [ Hash ] options
+    def self.options=(options)
+      @options = options.dup || {}
+
+      WPScan::Browser.reset
+      WPScan::Browser.instance(@options)
+    end
+
+    # @return [ Boolean ]
+    def self.verbose?
+      options[:verbose] ? true : false
+    end
+
+    # Unknown methods return nil — expected behaviour for option lookups.
+    # rubocop:disable Style/MissingRespondToMissing
+    def self.method_missing(method_name, *_args, &)
+      super if method_name == :new
+
+      options[method_name.to_sym]
+    end
+    # rubocop:enable Style/MissingRespondToMissing
   end
 end

data/lib/wpscan/progressbar_null_output.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'ruby-progressbar/outputs/null'
+
+module WPScan
+  # Adds the feature to log message sent to #log
+  # So they can be retrieved at some point, like after a password attack with a JSON output
+  # which won't display the progressbar but still call #log for errors etc
+  class ProgressBarNullOutput < ::ProgressBar::Outputs::Null
+    # @retutn [ Array<String> ]
+    def logs
+      @logs ||= []
+    end
+
+    # Override of parent method
+    # @return [ Array<String> ] return the logs when no string provided
+    def log(string = nil)
+      return logs if string.nil?
+
+      logs << string unless logs.include?(string)
+    end
+  end
+end

data/lib/wpscan/public_suffix/domain.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module PublicSuffix
+  # Monkey Patch to include the match logic
+  class Domain
+    # For Sanity
+    def ==(other)
+      name == other.name
+    end
+
+    # @return [ Boolean ]
+    #
+    # rubocop:disable Naming/PredicateMethod
+    def match(pattern)
+      pattern = PublicSuffix.parse(pattern) unless pattern.is_a?(PublicSuffix::Domain)
+
+      return name == pattern.name unless pattern.trd
+      return false unless tld == pattern.tld && sld == pattern.sld
+
+      matching_pattern?(pattern)
+    end
+    # rubocop:enable Naming/PredicateMethod
+
+    protected
+
+    # @rturn [ Boolean ]
+    def matching_pattern?(pattern)
+      pattern_trds = pattern.trd.split('.')
+      domain_trds  = trd.split('.')
+
+      case pattern_trds.first
+      when '*'
+        pattern_trds[1..] == domain_trds[1..]
+      when '**'
+        pa = pattern_trds[1..]
+        pa_size = pa.size
+
+        domain_trds[domain_trds.size - pa_size, pa_size] == pa
+      else
+        name == pattern.name
+      end
+    end
+  end
+end