wpscan 3.8.28 → 4.0.0

data/app/finders/themes/known_locations.rb

@@ -4,8 +4,8 @@ module WPScan
   module Finders
     module Themes
       # Known Locations Themes Finder
-      class KnownLocations < CMSScanner::Finders::Finder
-        include CMSScanner::Finders::Finder::Enumerator
+      class KnownLocations < WPScan::Finders::Finder
+        include WPScan::Finders::Finder::Enumerator
 
         # @return [ Array<Integer> ]
         def valid_response_codes
@@ -14,22 +14,28 @@ module WPScan
 
         # @param [ Hash ] opts
         # @option opts [ String ] :list
+        # @option opts [ Findings ] :found Shared findings collection; see
+        #   {Plugins::KnownLocations#aggressive} for the streaming rationale.
         #
         # @return [ Array<Theme> ]
         def aggressive(opts = {})
-          found = []
+          shared = opts[:found]
+          local  = shared ? nil : []
+          count  = 0
 
           enumerate(target_urls(opts), opts.merge(check_full_response: true)) do |res, slug|
             finding_opts = opts.merge(found_by: found_by,
                                       confidence: 80,
                                       interesting_entries: ["#{res.effective_url}, status: #{res.code}"])
 
-            found << Model::Theme.new(slug, target, finding_opts)
+            theme = Model::Theme.new(slug, target, finding_opts)
+            (shared || local) << theme
+            count += 1
 
-            raise Error::ThemesThresholdReached if opts[:threshold].positive? && found.size >= opts[:threshold]
+            raise Error::ThemesThresholdReached if opts[:threshold].positive? && count >= opts[:threshold]
           end
 
-          found
+          local || []
         end
 
         # @param [ Hash ] opts

data/app/finders/themes/urls_in_homepage.rb

@@ -4,20 +4,16 @@ module WPScan
   module Finders
     module Themes
       # URLs In Homepage Finder
-      class UrlsInHomepage < CMSScanner::Finders::Finder
+      class UrlsInHomepage < WPScan::Finders::Finder
         include WpItems::UrlsInPage
 
         # @param [ Hash ] opts
         #
         # @return [ Array<Theme> ]
         def passive(opts = {})
-          found = []
-
-          (items_from_links('themes') + items_from_codes('themes')).uniq.sort.each do |slug|
-            found << Model::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
+          (items_from_links('themes') + items_from_codes('themes')).uniq.sort.map do |slug|
+            Model::Theme.new(slug, target, opts.merge(found_by: found_by, confidence: 80))
           end
-
-          found
         end
 
         # @return [ Typhoeus::Response ]

data/app/finders/themes/wp_json_api.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Finders
+    module Themes
+      # Authenticated theme inventory via the WordPress REST API
+      # endpoint /wp-json/wp/v2/themes (WP >= 5.7).
+      #
+      # Requires admin credentials with the switch_themes capability.
+      class WpJsonApi < WPScan::Finders::Finder
+        FOUND_BY = 'WP REST API (Authenticated)'
+
+        # @param [ Hash ] opts
+        # @option opts [ String ] :userpwd "user:password" credentials for Basic Auth
+        #
+        # @return [ Array<Model::Theme> ]
+        def aggressive(opts = {})
+          response = Browser.get(api_url, userpwd: opts[:userpwd], headers: { 'Accept' => 'application/json' })
+
+          raise Error::WpAuthFailed.new(response.code, api_url) if [401, 403].include?(response.code)
+          raise Error::WpAuthEndpointUnavailable.new(response.code, api_url) unless response.code == 200
+
+          themes_from_response(response)
+        rescue JSON::ParserError, TypeError
+          []
+        end
+
+        # @param [ Typhoeus::Response ] response
+        #
+        # @return [ Array<Model::Theme> ]
+        def themes_from_response(response)
+          json = JSON.parse(response.body)
+          return [] unless json.is_a?(Enumerable)
+
+          json.filter_map { |entry| build_theme(entry, response.effective_url) }
+        end
+
+        # @return [ String ] The REST API URL for the themes endpoint
+        def api_url
+          @api_url ||= target.url('wp-json/wp/v2/themes')
+        end
+
+        private
+
+        # @param [ Hash ] entry
+        # @param [ String ] effective_url
+        #
+        # @return [ Model::Theme, nil ]
+        def build_theme(entry, effective_url)
+          slug = entry['stylesheet']
+          return nil if slug.nil? || slug.to_s.empty?
+
+          theme = Model::Theme.new(
+            slug,
+            target,
+            confidence: 100,
+            found_by: FOUND_BY,
+            interesting_entries: [effective_url]
+          )
+
+          version = entry['version']
+          theme.instance_variable_set(
+            :@version,
+            version && !version.to_s.empty? ? Model::Version.new(version, confidence: 100, found_by: FOUND_BY) : false
+          )
+
+          theme.instance_variable_set(:@wp_json_active, entry['status'] == 'active')
+
+          theme
+        end
+      end
+    end
+  end
+end

data/app/finders/themes.rb

@@ -3,13 +3,14 @@
 require_relative 'themes/urls_in_homepage'
 require_relative 'themes/urls_in_404_page'
 require_relative 'themes/known_locations'
+require_relative 'themes/wp_json_api' # Authenticated, used by AuthenticatedInventory controller
 
 module WPScan
   module Finders
     module Themes
       # Themes Finder
       class Base
-        include CMSScanner::Finders::SameTypeFinder
+        include WPScan::Finders::SameTypeFinder
 
         # @param [ WPScan::Target ] target
         def initialize(target)

data/app/finders/timthumb_version/bad_request.rb

@@ -5,7 +5,7 @@ module WPScan
     module TimthumbVersion
       # Timthumb Version Finder from the body of a bad request
       # See https://code.google.com/p/timthumb/source/browse/trunk/timthumb.php#435
-      class BadRequest < CMSScanner::Finders::Finder
+      class BadRequest < WPScan::Finders::Finder
         # @return [ Version ]
         def aggressive(_opts = {})
           return unless Browser.get(target.url).body =~ /(TimThumb version\s*: ([^<]+))/

data/app/finders/timthumb_version.rb

@@ -7,7 +7,7 @@ module WPScan
     module TimthumbVersion
       # Timthumb Version Finder
       class Base
-        include CMSScanner::Finders::UniqueFinder
+        include WPScan::Finders::UniqueFinder
 
         # @param [ Model::Timthumb ] target
         def initialize(target)

data/app/finders/timthumbs/known_locations.rb

@@ -6,8 +6,8 @@ module WPScan
       # Known Locations Timthumbs Finder
       # Note: A vulnerable version, 2.8.13 can be found here:
       # https://github.com/GabrielGil/TimThumb/blob/980c3d6a823477761570475e8b83d3e9fcd2d7ae/timthumb.php
-      class KnownLocations < CMSScanner::Finders::Finder
-        include CMSScanner::Finders::Finder::Enumerator
+      class KnownLocations < WPScan::Finders::Finder
+        include WPScan::Finders::Finder::Enumerator
 
         # @return [ Array<Integer> ]
         def valid_response_codes
@@ -37,8 +37,10 @@ module WPScan
         def target_urls(opts = {})
           urls = {}
 
-          File.open(opts[:list]).each_with_index do |path, index|
-            urls[target.url(path.chomp)] = index
+          File.open(opts[:list]) do |f|
+            f.each_with_index do |path, index|
+              urls[target.url(path.chomp)] = index
+            end
           end
 
           # Add potential timthumbs located in the main theme

data/app/finders/timthumbs.rb

@@ -7,7 +7,7 @@ module WPScan
     module Timthumbs
       # Timthumbs Finder
       class Base
-        include CMSScanner::Finders::SameTypeFinder
+        include WPScan::Finders::SameTypeFinder
 
         # @param [ WPScan::Target ] target
         def initialize(target)

data/app/finders/users/author_id_brute_forcing.rb

@@ -4,8 +4,8 @@ module WPScan
   module Finders
     module Users
       # Author Id Brute Forcing
-      class AuthorIdBruteForcing < CMSScanner::Finders::Finder
-        include CMSScanner::Finders::Finder::Enumerator
+      class AuthorIdBruteForcing < WPScan::Finders::Finder
+        include WPScan::Finders::Finder::Enumerator
 
         # @return [ Array<Integer> ]
         def valid_response_codes
@@ -14,10 +14,13 @@ module WPScan
 
         # @param [ Hash ] opts
         # @option opts [ Range ] :range Mandatory
+        # @option opts [ Findings ] :found Shared findings collection; see
+        #   {Plugins::KnownLocations#aggressive} for the streaming rationale.
         #
         # @return [ Array<User> ]
         def aggressive(opts = {})
-          found = []
+          shared       = opts[:found]
+          local        = shared ? nil : []
           found_by_msg = 'Author Id Brute Forcing - %s (Aggressive Detection)'
 
           enumerate(target_urls(opts), opts.merge(check_full_response: true)) do |res, id|
@@ -25,15 +28,16 @@ module WPScan
 
             next unless username
 
-            found << Model::User.new(
+            user = Model::User.new(
               username,
               id: id,
               found_by: format(found_by_msg, found_by),
               confidence: confidence
             )
+            (shared || local) << user
           end
 
-          found
+          local || []
         end
 
         # @param [ Hash ] opts
@@ -55,7 +59,7 @@ module WPScan
         end
 
         def full_request_params
-          { followlocation: true }
+          { followlocation: true, maxredirs: 10 }
         end
 
         # @param [ Typhoeus::Response ] res
@@ -68,7 +72,7 @@ module WPScan
 
           username = display_name_from_body(res.body)
 
-          return username, 'Display Name', 50 if username
+          [username, 'Display Name', 50] if username
         end
 
         # @param [ String, Addressable::URI ] uri

data/app/finders/users/author_posts.rb

@@ -4,7 +4,7 @@ module WPScan
   module Finders
     module Users
       # Author Posts
-      class AuthorPosts < CMSScanner::Finders::Finder
+      class AuthorPosts < WPScan::Finders::Finder
         # @param [ Hash ] opts
         #
         # @return [ Array<User> ]

data/app/finders/users/author_sitemap.rb

@@ -5,7 +5,7 @@ module WPScan
     module Users
       # Since WP 5.5, /wp-sitemap-users-1.xml is generated and contains
       # the usernames of accounts who made a post
-      class AuthorSitemap < CMSScanner::Finders::Finder
+      class AuthorSitemap < WPScan::Finders::Finder
         # @param [ Hash ] opts
         #
         # @return [ Array<User> ]

data/app/finders/users/login_error_messages.rb

@@ -10,7 +10,7 @@ module WPScan
       #   WP >= 3.1 - The password you entered for the username admin is incorrect.
       # Non existent username: Invalid username.
       #
-      class LoginErrorMessages < CMSScanner::Finders::Finder
+      class LoginErrorMessages < WPScan::Finders::Finder
         # @param [ Hash ] opts
         # @option opts [ String ] :list
         #

data/app/finders/users/oembed_api.rb

@@ -5,7 +5,7 @@ module WPScan
     module Users
       # Since WP 4.4, the oembed API can disclose a user
       # https://github.com/wpscanteam/wpscan/issues/1049
-      class OembedApi < CMSScanner::Finders::Finder
+      class OembedApi < WPScan::Finders::Finder
         # @param [ Hash ] opts
         #
         # @return [ Array<User> ]
@@ -36,6 +36,8 @@ module WPScan
 
           oembed_data = oembed_data.first if oembed_data.is_a?(Array)
 
+          oembed_data = {} unless oembed_data.is_a?(Hash)
+
           if oembed_data['author_url'] =~ %r{/author/([^/]+)/?\z}
             details = [Regexp.last_match[1], 'Author URL', 90]
           elsif oembed_data['author_name'] && !oembed_data['author_name'].empty?

data/app/finders/users/wp_json_api.rb

@@ -8,7 +8,7 @@ module WPScan
       # Since 4.7 - Need more investigation as it seems WP 4.7.1 reduces the exposure, see https://github.com/wpscanteam/wpscan/issues/1038)
       # For the pagination, see https://github.com/wpscanteam/wpscan/issues/1285
       #
-      class WpJsonApi < CMSScanner::Finders::Finder
+      class WpJsonApi < WPScan::Finders::Finder
         MAX_PER_PAGE = 100 # See https://developer.wordpress.org/rest-api/using-the-rest-api/pagination/
 
         # @param [ Hash ] opts
@@ -42,12 +42,16 @@ module WPScan
         def users_from_response(response)
           found = []
 
-          JSON.parse(response.body)&.each do |user|
-            found << Model::User.new(user['slug'],
-                                     id: user['id'],
-                                     found_by: found_by,
-                                     confidence: 100,
-                                     interesting_entries: [response.effective_url])
+          json = JSON.parse(response.body)
+
+          if json.is_a?(Enumerable)
+            json.each do |user|
+              found << Model::User.new(user['slug'],
+                                       id: user['id'],
+                                       found_by: found_by,
+                                       confidence: 100,
+                                       interesting_entries: [response.effective_url])
+            end
           end
 
           found

data/app/finders/users.rb

@@ -24,7 +24,7 @@ module WPScan
     module Users
       # Users Finder
       class Base
-        include CMSScanner::Finders::SameTypeFinder
+        include WPScan::Finders::SameTypeFinder
 
         # @param [ WPScan::Target ] target
         def initialize(target)

data/app/finders/wp_version/atom_generator.rb

@@ -4,7 +4,7 @@ module WPScan
   module Finders
     module WpVersion
       # Atom Generator Version Finder
-      class AtomGenerator < CMSScanner::Finders::Finder
+      class AtomGenerator < WPScan::Finders::Finder
         include Finder::WpVersion::SmartURLChecker
 
         def process_urls(urls, _opts = {})

data/app/finders/wp_version/rdf_generator.rb

@@ -4,7 +4,7 @@ module WPScan
   module Finders
     module WpVersion
       # RDF Generator Version Finder
-      class RDFGenerator < CMSScanner::Finders::Finder
+      class RDFGenerator < WPScan::Finders::Finder
         include Finder::WpVersion::SmartURLChecker
 
         def process_urls(urls, _opts = {})

data/app/finders/wp_version/readme.rb

@@ -4,7 +4,7 @@ module WPScan
   module Finders
     module WpVersion
       # Readme Version Finder
-      class Readme < CMSScanner::Finders::Finder
+      class Readme < WPScan::Finders::Finder
         # @return [ WpVersion ]
         def aggressive(_opts = {})
           readme_url = target.url('readme.html') # Maybe move this into the Target ?

data/app/finders/wp_version/rss_generator.rb

@@ -4,7 +4,7 @@ module WPScan
   module Finders
     module WpVersion
       # RSS Generator Version Finder
-      class RSSGenerator < CMSScanner::Finders::Finder
+      class RSSGenerator < WPScan::Finders::Finder
         include Finder::WpVersion::SmartURLChecker
 
         def process_urls(urls, _opts = {})

data/app/finders/wp_version/unique_fingerprinting.rb

@@ -4,8 +4,8 @@ module WPScan
   module Finders
     module WpVersion
       # Unique Fingerprinting Version Finder
-      class UniqueFingerprinting < CMSScanner::Finders::Finder
-        include CMSScanner::Finders::Finder::Fingerprinter
+      class UniqueFingerprinting < WPScan::Finders::Finder
+        include WPScan::Finders::Finder::Fingerprinter
 
         # @return [ WpVersion ]
         def aggressive(opts = {})

data/app/finders/wp_version.rb

@@ -23,7 +23,7 @@ module WPScan
     module WpVersion
       # Wp Version Finder
       class Base
-        include CMSScanner::Finders::UniqueFinder
+        include WPScan::Finders::UniqueFinder
 
         # @param [ WPScan::Target ] target
         def initialize(target)

data/app/finders.rb

@@ -8,6 +8,7 @@ require_relative 'finders/timthumb_version'
 require_relative 'finders/timthumbs'
 require_relative 'finders/config_backups'
 require_relative 'finders/db_exports'
+require_relative 'finders/backup_folders'
 require_relative 'finders/medias'
 require_relative 'finders/users'
 require_relative 'finders/plugins'

data/app/formatters/cli.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Formatter
+    # CLI Formatter
+    class Cli < Base
+      def streams?
+        true
+      end
+
+      # ANSI sequence to clear the current line and return to column 0.
+      # Emitted at the start of each streamed enumeration finding so the
+      # ruby-progressbar line (which redraws via \r and leaves its previous
+      # render visible when interleaved with foreign output) gets wiped
+      # before the finding prints. No-op on non-TTY stdout so file/pipe
+      # output stays clean.
+      def bar_clear
+        $stdout.tty? ? "\e[2K\r" : ''
+      end
+
+      # @return [ String ]
+      def info_icon
+        green('[+]')
+      end
+
+      # @return [ String ]
+      def notice_icon
+        blue('[i]')
+      end
+
+      # @return [ String ]
+      def warning_icon
+        amber('[!]')
+      end
+
+      # @return [ String ]
+      def critical_icon
+        red('[!]')
+      end
+
+      # @param [ String ] text
+      # @return [ String ]
+      def bold(text)
+        colorize(text, 1)
+      end
+
+      # @param [ String ] text
+      # @return [ String ]
+      def red(text)
+        colorize(text, 31)
+      end
+
+      # @param [ String ] text
+      # @return [ String ]
+      def green(text)
+        colorize(text, 32)
+      end
+
+      # @param [ String ] text
+      # @return [ String ]
+      def amber(text)
+        colorize(text, 33)
+      end
+
+      # @param [ String ] text
+      # @return [ String ]
+      def blue(text)
+        colorize(text, 34)
+      end
+
+      # @param [ String ] text
+      # @param [ Integer ] color_code
+      # @return [ String ]
+      def colorize(text, color_code)
+        "\e[#{color_code}m#{text}\e[0m"
+      end
+    end
+  end
+end

data/app/formatters/cli_no_color.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Formatter
+    # Because Reason https://github.com/wpscanteam/WPScan/issues/56
+    class CliNoColor < CliNoColour
+    end
+  end
+end

data/app/formatters/cli_no_colour.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Formatter
+    # CLI No Colour Formatter
+    class CliNoColour < Cli
+      # Override to get the cli views
+      def format
+        'cli'
+      end
+
+      def colorize(text, _color_code)
+        text
+      end
+    end
+  end
+end

data/app/formatters/json.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Formatter
+    # JSON Formatter
+    class Json < Base
+      include Buffer
+
+      def beautify
+        puts JSON.pretty_generate(JSON.parse("{#{buffer.chomp.chomp(',')}}"))
+      end
+    end
+  end
+end

data/app/formatters/jsonl.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Formatter
+    # JSON Lines formatter — streams one self-contained JSON object per
+    # template render as the scan progresses. Reuses every app/views/json/*.erb
+    # template via base_format, so output content matches `-f json` but is
+    # emitted incrementally and can be piped directly into tools like `jq`.
+    class Jsonl < Base
+      def base_format
+        'json'
+      end
+
+      def streams?
+        true
+      end
+
+      def output(tpl, vars = {}, controller_name = nil)
+        rendered = render(tpl, vars, controller_name)
+                   .encode('UTF-8', invalid: :replace, undef: :replace)
+        fragment = rendered.strip.chomp(',')
+        return if fragment.empty?
+
+        $stdout.puts JSON.generate(JSON.parse("{#{fragment}}"))
+        $stdout.flush
+      end
+    end
+  end
+end