wpscan 3.8.28 → 4.0.0

data/lib/wpscan/target/server/generic.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Target < WebSite
+    module Server
+      # Generic Server methods
+      module Generic
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Symbol ] The detected remote server (:Apache, :IIS, :Nginx)
+        def server(path = nil, params = {})
+          headers = headers(path, params)
+
+          return unless headers
+
+          case headers[:server]
+          when /\Aapache/i
+            :Apache
+          when /\AMicrosoft-IIS/i
+            :IIS
+          when /\Anginx/
+            :Nginx
+          end
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Hash ] The headers
+        def headers(path = nil, params = {})
+          # The HEAD method might be rejected by some servers ... maybe switch to GET ?
+          WPScan::Browser.head(url(path), params).headers
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Boolean ] true if url(path) has the directory
+        #                          listing enabled, false otherwise
+        def directory_listing?(path = nil, params = {})
+          res = WPScan::Browser.get(url(path), params)
+
+          res.code == 200 && res.body.include?('<h1>Index of')
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        # @param [ String ] selector
+        # @param [ Regexp ] ignore
+        #
+        # @return [ Array<String> ] The first level of directories/files listed,
+        #                           or an empty array if none
+        def directory_listing_entries(path = nil, params = {}, selector = 'pre a', ignore = /parent directory/i)
+          return [] unless directory_listing?(path, params)
+
+          found = []
+
+          WPScan::Browser.get(url(path), params).html.css(selector).each do |node|
+            entry = node.text.to_s
+
+            next if entry&.match?(ignore)
+
+            found << entry
+          end
+
+          found
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/target/server/iis.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Target < WebSite
+    module Server
+      # Some IIS specific implementation
+      module IIS
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Symbol ] :IIS
+        def server(_path = nil, _params = {})
+          :IIS
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Boolean ] true if url(path) has the directory
+        #                          listing enabled, false otherwise
+        def directory_listing?(path = nil, params = {})
+          res = WPScan::Browser.get(url(path), params)
+
+          res.code == 200 && res.body =~ %r{<H1>#{uri.host} - /} ? true : false
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/target/server/nginx.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Target < WebSite
+    module Server
+      # Some Nginx specific implementation
+      module Nginx
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Symbol ] :Nginx
+        def server(_path = nil, _params = {})
+          :Nginx
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Array<String> ] The first level of directories/files listed,
+        #                           or an empty array if none
+        def directory_listing_entries(path = nil, params = {})
+          super(path, params, 'pre a', /\A\.\./i)
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/target/server.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require 'wpscan/target/server/generic'
+require 'wpscan/target/server/apache'
+require 'wpscan/target/server/iis'
+require 'wpscan/target/server/nginx'

data/lib/wpscan/target.rb

@@ -1,12 +1,28 @@
 # frozen_string_literal: true
 
+require 'wpscan/web_site'
+require 'wpscan/target/platform'
+require 'wpscan/target/server'
+require 'wpscan/target/scope'
+require 'wpscan/target/hashes'
 require 'wpscan/target/platform/wordpress'
 
 module WPScan
-  # Includes the WordPress Platform
-  class Target < CMSScanner::Target
+  # Target to Scan (WordPress).
+  class Target < WebSite
+    include Server::Generic
     include Platform::WordPress
 
+    # @param [ String ] url
+    # @param [ Hash ] opts
+    # @option opts [ Array<PublicSuffix::Domain, String> ] :scope
+    def initialize(url, opts = {})
+      super
+
+      scope << uri.host
+      Array(opts[:scope]).each { |s| scope << s }
+    end
+
     # @return [ Hash ]
     def head_or_get_request_params
       @head_or_get_request_params ||= if Browser.head(url).code == 405
@@ -30,9 +46,100 @@ module WPScan
       false
     end
 
+    # @param [ Hash ] opts
+    #
+    # @return [ Findings ]
+    def interesting_findings(opts = {})
+      @interesting_findings ||= WPScan::Finders::InterestingFindings::Base.find(self, opts)
+    end
+
     # @return [ XMLRPC, nil ]
     def xmlrpc
-      @xmlrpc ||= interesting_findings&.select { |f| f.is_a?(Model::XMLRPC) }&.first
+      @xmlrpc ||= interesting_findings&.grep(Model::XMLRPC)&.first
+    end
+
+    # @return [ Regexp ] The pattern related to the target url, also matches escaped /, such as
+    #                    in JSON JS data: http:\/\/t.com\/
+    def url_pattern
+      @url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?').gsub('/', '\\\\\?/'), Regexp::IGNORECASE)
+    end
+
+    # @param [ String ] xpath
+    # @param [ Regexp ] pattern
+    # @param [ Typhoeus::Response, String ] page
+    #
+    # @return [ Array<Array<MatchData, Nokogiri::XML::Element>> ]
+    # @yield  [ MatchData, Nokogiri::XML::Element ]
+    def xpath_pattern_from_page(xpath, pattern, page = nil)
+      page    = WPScan::Browser.get(url(page)) unless page.is_a?(Typhoeus::Response)
+      matches = []
+
+      page.html.xpath(xpath).each do |node|
+        next unless node.text.strip =~ pattern
+
+        yield Regexp.last_match, node if block_given?
+
+        matches << [Regexp.last_match, node]
+      end
+
+      matches
+    end
+
+    # @param [ Regexp ] pattern
+    # @param [ Typhoeus::Response, String ] page
+    #
+    # @return [ Array<Array<MatchData, Nokogiri::XML::Comment>> ]
+    # @yield  [ MatchData, Nokogiri::XML::Comment ]
+    def comments_from_page(pattern, page = nil)
+      xpath_pattern_from_page('//comment()', pattern, page) do |match, node|
+        yield match, node if block_given?
+      end
+    end
+
+    # @param [ Regexp ] pattern
+    # @param [ Typhoeus::Response, String ] page
+    #
+    # @return [ Array<Array<MatchData, Nokogiri::XML::Element>> ]
+    # @yield  [ MatchData, Nokogiri::XML::Element ]
+    def javascripts_from_page(pattern, page = nil)
+      xpath_pattern_from_page('//script', pattern, page) do |match, node|
+        yield match, node if block_given?
+      end
+    end
+
+    # @param [ Typhoeus::Response, String ] page
+    # @param [ String ] xpath
+    #
+    # @yield [ Addressable::URI, Nokogiri::XML::Element ] The url and its associated tag
+    #
+    # @return [ Array<Addressable::URI> ] The absolute URIs detected in the response's body from the HTML tags
+    #
+    # @note It is highly recommended to use the xpath parameter to focus on the uris needed, as this method can be quite
+    #       time consuming when there are a lof of uris to check
+    def uris_from_page(page = nil, xpath = '//@href|//@src|//@data-src')
+      page  = WPScan::Browser.get(url(page)) unless page.is_a?(Typhoeus::Response)
+      found = []
+
+      page.html.xpath(xpath).each do |node|
+        attr_value = node.text.to_s
+
+        next unless attr_value && !attr_value.empty?
+
+        node_uri = begin
+          uri.join(attr_value.strip)
+        rescue StandardError
+          # Skip potential malformed URLs etc.
+          next
+        end
+
+        next unless node_uri.host
+
+        yield node_uri, node.parent if block_given? && !found.include?(node_uri)
+
+        found << node_uri
+      end
+
+      found.uniq
     end
 
     # @param [ Hash ] opts
@@ -54,17 +161,21 @@ module WPScan
     end
 
     # @param [ Hash ] opts
+    # @yield [ Plugin ] Optional block called as each plugin is first
+    #                   discovered (used to stream findings).
     #
     # @return [ Array<Plugin> ]
-    def plugins(opts = {})
-      @plugins ||= Finders::Plugins::Base.find(self, opts)
+    def plugins(opts = {}, &)
+      @plugins ||= Finders::Plugins::Base.find(self, opts, &)
     end
 
     # @param [ Hash ] opts
+    # @yield [ Theme ] Optional block called as each theme is first
+    #                  discovered (used to stream findings).
     #
     # @return [ Array<Theme> ]
-    def themes(opts = {})
-      @themes ||= Finders::Themes::Base.find(self, opts)
+    def themes(opts = {}, &)
+      @themes ||= Finders::Themes::Base.find(self, opts, &)
     end
 
     # @param [ Hash ] opts
@@ -88,6 +199,13 @@ module WPScan
       @db_exports ||= Finders::DbExports::Base.find(self, opts)
     end
 
+    # @param [ Hash ] opts
+    #
+    # @return [ Array<BackupFolder> ]
+    def backup_folders(opts = {})
+      @backup_folders ||= Finders::BackupFolders::Base.find(self, opts)
+    end
+
     # @param [ Hash ] opts
     #
     # @return [ Array<Media> ]
@@ -96,10 +214,12 @@ module WPScan
     end
 
     # @param [ Hash ] opts
+    # @yield [ User ] Optional block called as each user is first
+    #                 discovered (used to stream findings).
     #
     # @return [ Array<User> ]
-    def users(opts = {})
-      @users ||= Finders::Users::Base.find(self, opts)
+    def users(opts = {}, &)
+      @users ||= Finders::Users::Base.find(self, opts, &)
     end
   end
 end

data/lib/wpscan/typhoeus/hydra.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Typhoeus
+  # Ensure a clean abort of hydra
+  # See https://github.com/typhoeus/typhoeus/issues/439
+  class Hydra
+    def abort
+      super
+      run
+    end
+  end
+end

data/lib/wpscan/typhoeus/response.rb

@@ -3,10 +3,33 @@
 module Typhoeus
   # Custom Response class
   class Response
-    # @note: Ignores requests done to the /status endpoint of the API
+    # @return [ Nokogiri::XML ] The response's body parsed by Nokogiri::HTML
+    def html
+      @html ||= Nokogiri::HTML(body.encode('UTF-8', invalid: :replace, undef: :replace))
+    end
+
+    # @return [ Nokogiri::XML ] The response's body parsed by Nokogiri::XML
+    def xml
+      @xml ||= Nokogiri::XML(body.encode('UTF-8', invalid: :replace, undef: :replace))
+    end
+
+    # Override of the original to ensure an integer is returned
+    # @return [ Integer ]
+    def request_size
+      super || 0
+    end
+
+    # @return [ Integer ]
+    def size
+      (body.nil? ? 0 : body.size) + (response_headers.nil? ? 0 : response_headers.size)
+    end
+
+    # @note Ignores requests done to the /status endpoint of the WPScan Vuln API.
     #
     # @return [ Boolean ]
     def from_vuln_api?
+      return false unless effective_url
+
       effective_url.start_with?(WPScan::DB::VulnApi.uri.to_s) &&
         !effective_url.start_with?(WPScan::DB::VulnApi.uri.join('status').to_s)
     end

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '3.8.28'
+  VERSION = '4.0.0'
 end

data/lib/wpscan/vulnerability.rb

@@ -1,10 +1,41 @@
 # frozen_string_literal: true
 
 module WPScan
-  # Specific implementation
-  class Vulnerability < CMSScanner::Vulnerability
+  # Vulnerability model.
+  class Vulnerability
     include References
 
+    attr_reader :title, :type, :fixed_in, :introduced_in, :cvss, :poc, :uuid
+
+    # @param [ String ] title
+    # @param [ Hash ] references
+    # @option references [ Array<String>, String ] :cve
+    # @option references [ Array<String>, String ] :secunia
+    # @option references [ Array<String>, String ] :osvdb
+    # @option references [ Array<String>, String ] :exploitdb
+    # @option references [ Array<String> ] :url URL(s) to related advisories etc
+    # @option references [ Array<String>, String ] :metasploit The related metasploit module(s)
+    # @option references [ Array<String> ] :youtube
+    # @param [ String ] type
+    # @param [ String ] fixed_in
+    # @param [ String ] introduced_in
+    # @param [ HashSymbol ] cvss
+    # @option cvss [ String ] :score
+    # @option cvss [ String ] :vector
+    # rubocop:disable Metrics/ParameterLists
+    def initialize(title, references: {}, type: nil, fixed_in: nil, introduced_in: nil, cvss: nil, poc: nil, uuid: nil)
+      # rubocop:enable Metrics/ParameterLists
+      @title         = title
+      @type          = type
+      @fixed_in      = fixed_in
+      @introduced_in = introduced_in
+      @cvss          = { score: cvss[:score], vector: cvss[:vector] } if cvss
+      @poc           = poc
+      @uuid          = uuid
+
+      self.references = references
+    end
+
     # @param [ Hash ] json_data
     # @return [ Vulnerability ]
     def self.load_from_json(json_data)
@@ -22,8 +53,23 @@ module WPScan
         type: json_data['vuln_type'],
         fixed_in: json_data['fixed_in'],
         introduced_in: json_data['introduced_in'],
-        cvss: json_data['cvss']&.symbolize_keys
+        cvss: json_data['cvss']&.symbolize_keys,
+        poc: json_data['poc'],
+        uuid: json_data['id'].to_s # The 'id' field IS the UUID in WPScan API
       )
     end
+
+    # @param [ Vulnerability ] other
+    #
+    # @return [ Boolean ]
+    def ==(other)
+      title == other.title &&
+        type == other.type &&
+        references == other.references &&
+        fixed_in == other.fixed_in &&
+        cvss == other.cvss &&
+        poc == other.poc &&
+        uuid == other.uuid
+    end
   end
 end

data/lib/wpscan/vulnerability_filter.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module WPScan
+  # Filter for excluding specific vulnerabilities by UUID
+  class VulnerabilityFilter
+    attr_reader :excluded_uuids, :excluded_count
+
+    # @param [ Array<String>, String, nil ] uuids UUID identifiers to exclude
+    def initialize(uuids = nil)
+      @excluded_uuids = normalize_uuids(uuids)
+      @excluded_count = 0
+    end
+
+    # Filter vulnerabilities, removing those with excluded UUIDs
+    #
+    # @param [ Array<Vulnerability> ] vulnerabilities
+    # @return [ Array<Vulnerability> ] Filtered vulnerabilities
+    def filter(vulnerabilities)
+      return vulnerabilities if excluded_uuids.empty?
+
+      vulnerabilities.reject do |vuln|
+        should_exclude?(vuln).tap do |excluded|
+          @excluded_count += 1 if excluded
+        end
+      end
+    end
+
+    # Check if a vulnerability should be excluded
+    #
+    # @param [ Vulnerability ] vulnerability
+    # @return [ Boolean ]
+    def should_exclude?(vulnerability)
+      return false if excluded_uuids.empty?
+      return false unless vulnerability.uuid
+
+      # Check UUID match (case-insensitive)
+      excluded_uuids.include?(vulnerability.uuid.downcase)
+    end
+
+    # Reset the excluded count
+    def reset_count!
+      @excluded_count = 0
+    end
+
+    # Check if any UUIDs are being excluded
+    #
+    # @return [ Boolean ]
+    def excluding?
+      !excluded_uuids.empty?
+    end
+
+    private
+
+    # Normalize UUIDs
+    #
+    # @param [ Array<String>, String, nil ] uuids
+    # @return [ Array<String> ] Normalized UUIDs
+    def normalize_uuids(uuids)
+      return [] if uuids.nil?
+
+      # Convert string to array if needed
+      uuids = uuids.is_a?(String) ? uuids.split(',') : Array(uuids)
+
+      # Normalize each UUID (trim whitespace, lowercase, remove duplicates)
+      uuids.map { |u| u.to_s.strip.downcase }.reject(&:empty?).uniq
+    end
+  end
+end

data/lib/wpscan/vulnerable.rb

@@ -4,9 +4,21 @@ module WPScan
   # Module to include in vulnerable WP item such as WpVersion.
   # the vulnerabilities method should be implemented
   module Vulnerable
+    # @return [ VulnerabilityFilter, nil ]
+    def vulnerability_filter
+      @vulnerability_filter ||= VulnerabilityFilter.new(ParsedCli.exclude_vulns) if ParsedCli.exclude_vulns
+    end
+
+    # @return [ Array<Vulnerability> ] Filtered vulnerabilities
+    def filtered_vulnerabilities
+      return vulnerabilities unless vulnerability_filter
+
+      vulnerability_filter.filter(vulnerabilities)
+    end
+
     # @return [ Boolean ]
     def vulnerable?
-      !vulnerabilities.empty?
+      !filtered_vulnerabilities.empty?
     end
   end
 end

data/lib/wpscan/web_site.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+module WPScan
+  # WebSite Implementation
+  class WebSite
+    attr_reader :uri, :opts
+
+    # @param [ String ] site_url
+    # @param [ Hash ] opts
+    def initialize(site_url, opts = {})
+      self.url = site_url
+      @opts    = opts
+    end
+
+    def url=(site_url)
+      new_url = site_url.dup
+
+      # Add a trailing slash to the URL
+      new_url << '/' if new_url[-1, 1] != '/'
+
+      # Use the validator to ensure the URL has a correct format
+      OptParseValidator::OptURL.new([]).validate(new_url)
+
+      @uri = Addressable::URI.parse(new_url).normalize
+    end
+
+    # @param [ String ] path Optional path to merge with the uri
+    #
+    # @return [ String ]
+    def url(path = nil)
+      return @uri.to_s unless path
+
+      @uri.join(Addressable::URI.encode(path).gsub('#', '%23')).to_s
+    end
+
+    # @return [ String ] The IP address of the target
+    def ip
+      @ip ||= IPSocket.getaddress(uri.host)
+    rescue SocketError
+      'Unknown'
+    end
+
+    attr_writer :homepage_res
+
+    # @return [ Typhoeus::Response ]
+    #
+    # As webmock does not support redirects mocking, coverage is ignored
+    # :nocov:
+    def homepage_res
+      @homepage_res ||= WPScan::Browser.get_and_follow_location(url)
+    end
+    # :nocov:
+
+    # @return [ String ]
+    def homepage_url
+      @homepage_url ||= homepage_res.effective_url
+    end
+
+    # Discards the cached homepage response and URL so the next access refetches.
+    # Used after mutating cookies/auth state mid-scan.
+    def reset_homepage_cache!
+      @homepage_res = nil
+      @homepage_url = nil
+    end
+
+    # @return [ Typhoeus::Response ]
+    def error_404_res
+      @error_404_res ||= WPScan::Browser.get_and_follow_location(error_404_url)
+    end
+
+    # @return [ String ] The URL of an unlikely existant page
+    def error_404_url
+      @error_404_url ||= uri.join("#{Digest::MD5.hexdigest(rand(999_999).to_s)[0..6]}.html").to_s
+    end
+
+    # Checks if the remote website is up.
+    #
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def online?(path = nil)
+      WPScan::Browser.get(url(path)).code.nonzero? ? true : false
+    end
+
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def http_auth?(path = nil)
+      WPScan::Browser.get(url(path)).code == 401
+    end
+
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def access_forbidden?(path = nil)
+      WPScan::Browser.get(url(path)).code == 403
+    end
+
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def proxy_auth?(path = nil)
+      WPScan::Browser.get(url(path)).code == 407
+    end
+
+    # @param [ String ] url
+    #
+    # @return [ String ] The redirection url or nil
+    #
+    # As webmock does not support redirects mocking, coverage is ignored
+    # :nocov:
+    def redirection(url = nil)
+      url ||= @uri.to_s
+
+      return unless [301, 302].include?(WPScan::Browser.get(url).code)
+
+      res = WPScan::Browser.get(url, followlocation: true, maxredirs: 10)
+
+      res.effective_url == url ? nil : res.effective_url
+    end
+    # :nocov:
+
+    # @return [ Hash ] The Typhoeus params to use to perform head requests
+    def head_or_get_params
+      @head_or_get_params ||= if [0, 405, 501].include?(WPScan::Browser.head(homepage_url).code)
+                                { method: :get, maxfilesize: 1 }
+                              else
+                                { method: :head }
+                              end
+    end
+
+    # Perform a HEAD request to the path provided, then if its response code
+    # is in the array of codes given, a GET is done and the response returned. Otherwise the
+    # HEAD response is returned.
+    #
+    # @param [ String ] path
+    # @param [ Array<String> ] codes
+    # @param [ Hash ] params The requests params
+    # @option params [ Hash ] :head Request params for the HEAD
+    # @option params [ hash ] :get Request params for the GET
+    #
+    # @return [ Typhoeus::Response ]
+    def head_and_get(path, codes = [200], params = {})
+      url_to_get  = url(path)
+      head_params = (params[:head] || {}).merge(head_or_get_params)
+
+      head_res = WPScan::Browser.forge_request(url_to_get, head_params).run
+
+      codes.include?(head_res.code) ? WPScan::Browser.get(url_to_get, params[:get] || {}) : head_res
+    end
+  end
+end