wpscan 3.8.28 → 4.0.1

data/lib/wpscan/target/server/generic.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Target < WebSite
+    module Server
+      # Generic Server methods
+      module Generic
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Symbol ] The detected remote server (:Apache, :IIS, :Nginx)
+        def server(path = nil, params = {})
+          headers = headers(path, params)
+
+          return unless headers
+
+          case headers[:server]
+          when /\Aapache/i
+            :Apache
+          when /\AMicrosoft-IIS/i
+            :IIS
+          when /\Anginx/
+            :Nginx
+          end
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Hash ] The headers
+        def headers(path = nil, params = {})
+          # The HEAD method might be rejected by some servers ... maybe switch to GET ?
+          WPScan::Browser.head(url(path), params).headers
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Boolean ] true if url(path) has the directory
+        #                          listing enabled, false otherwise
+        def directory_listing?(path = nil, params = {})
+          res = WPScan::Browser.get(url(path), params)
+
+          res.code == 200 && res.body.include?('<h1>Index of')
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        # @param [ String ] selector
+        # @param [ Regexp ] ignore
+        #
+        # @return [ Array<String> ] The first level of directories/files listed,
+        #                           or an empty array if none
+        def directory_listing_entries(path = nil, params = {}, selector = 'pre a', ignore = /parent directory/i)
+          return [] unless directory_listing?(path, params)
+
+          found = []
+
+          WPScan::Browser.get(url(path), params).html.css(selector).each do |node|
+            entry = node.text.to_s
+
+            next if entry&.match?(ignore)
+
+            found << entry
+          end
+
+          found
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/target/server/iis.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Target < WebSite
+    module Server
+      # Some IIS specific implementation
+      module IIS
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Symbol ] :IIS
+        def server(_path = nil, _params = {})
+          :IIS
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Boolean ] true if url(path) has the directory
+        #                          listing enabled, false otherwise
+        def directory_listing?(path = nil, params = {})
+          res = WPScan::Browser.get(url(path), params)
+
+          res.code == 200 && res.body =~ %r{<H1>#{uri.host} - /} ? true : false
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/target/server/nginx.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Target < WebSite
+    module Server
+      # Some Nginx specific implementation
+      module Nginx
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Symbol ] :Nginx
+        def server(_path = nil, _params = {})
+          :Nginx
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Array<String> ] The first level of directories/files listed,
+        #                           or an empty array if none
+        def directory_listing_entries(path = nil, params = {})
+          super(path, params, 'pre a', /\A\.\./i)
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/target/server.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require 'wpscan/target/server/generic'
+require 'wpscan/target/server/apache'
+require 'wpscan/target/server/iis'
+require 'wpscan/target/server/nginx'

data/lib/wpscan/target.rb

@@ -1,12 +1,28 @@
 # frozen_string_literal: true
 
+require 'wpscan/web_site'
+require 'wpscan/target/platform'
+require 'wpscan/target/server'
+require 'wpscan/target/scope'
+require 'wpscan/target/hashes'
 require 'wpscan/target/platform/wordpress'
 
 module WPScan
-  # Includes the WordPress Platform
-  class Target < CMSScanner::Target
+  # Target to Scan (WordPress).
+  class Target < WebSite
+    include Server::Generic
     include Platform::WordPress
 
+    # @param [ String ] url
+    # @param [ Hash ] opts
+    # @option opts [ Array<PublicSuffix::Domain, String> ] :scope
+    def initialize(url, opts = {})
+      super
+
+      scope << uri.host
+      Array(opts[:scope]).each { |s| scope << s }
+    end
+
     # @return [ Hash ]
     def head_or_get_request_params
       @head_or_get_request_params ||= if Browser.head(url).code == 405
@@ -30,9 +46,100 @@ module WPScan
       false
     end
 
+    # @param [ Hash ] opts
+    #
+    # @return [ Findings ]
+    def interesting_findings(opts = {})
+      @interesting_findings ||= WPScan::Finders::InterestingFindings::Base.find(self, opts)
+    end
+
     # @return [ XMLRPC, nil ]
     def xmlrpc
-      @xmlrpc ||= interesting_findings&.select { |f| f.is_a?(Model::XMLRPC) }&.first
+      @xmlrpc ||= interesting_findings&.grep(Model::XMLRPC)&.first
+    end
+
+    # @return [ Regexp ] The pattern related to the target url, also matches escaped /, such as
+    #                    in JSON JS data: http:\/\/t.com\/
+    def url_pattern
+      @url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?').gsub('/', '\\\\\?/'), Regexp::IGNORECASE)
+    end
+
+    # @param [ String ] xpath
+    # @param [ Regexp ] pattern
+    # @param [ Typhoeus::Response, String ] page
+    #
+    # @return [ Array<Array<MatchData, Nokogiri::XML::Element>> ]
+    # @yield  [ MatchData, Nokogiri::XML::Element ]
+    def xpath_pattern_from_page(xpath, pattern, page = nil)
+      page    = WPScan::Browser.get(url(page)) unless page.is_a?(Typhoeus::Response)
+      matches = []
+
+      page.html.xpath(xpath).each do |node|
+        next unless node.text.strip =~ pattern
+
+        yield Regexp.last_match, node if block_given?
+
+        matches << [Regexp.last_match, node]
+      end
+
+      matches
+    end
+
+    # @param [ Regexp ] pattern
+    # @param [ Typhoeus::Response, String ] page
+    #
+    # @return [ Array<Array<MatchData, Nokogiri::XML::Comment>> ]
+    # @yield  [ MatchData, Nokogiri::XML::Comment ]
+    def comments_from_page(pattern, page = nil)
+      xpath_pattern_from_page('//comment()', pattern, page) do |match, node|
+        yield match, node if block_given?
+      end
+    end
+
+    # @param [ Regexp ] pattern
+    # @param [ Typhoeus::Response, String ] page
+    #
+    # @return [ Array<Array<MatchData, Nokogiri::XML::Element>> ]
+    # @yield  [ MatchData, Nokogiri::XML::Element ]
+    def javascripts_from_page(pattern, page = nil)
+      xpath_pattern_from_page('//script', pattern, page) do |match, node|
+        yield match, node if block_given?
+      end
+    end
+
+    # @param [ Typhoeus::Response, String ] page
+    # @param [ String ] xpath
+    #
+    # @yield [ Addressable::URI, Nokogiri::XML::Element ] The url and its associated tag
+    #
+    # @return [ Array<Addressable::URI> ] The absolute URIs detected in the response's body from the HTML tags
+    #
+    # @note It is highly recommended to use the xpath parameter to focus on the uris needed, as this method can be quite
+    #       time consuming when there are a lof of uris to check
+    def uris_from_page(page = nil, xpath = '//@href|//@src|//@data-src')
+      page  = WPScan::Browser.get(url(page)) unless page.is_a?(Typhoeus::Response)
+      found = []
+
+      page.html.xpath(xpath).each do |node|
+        attr_value = node.text.to_s
+
+        next unless attr_value && !attr_value.empty?
+
+        node_uri = begin
+          uri.join(attr_value.strip)
+        rescue StandardError
+          # Skip potential malformed URLs etc.
+          next
+        end
+
+        next unless node_uri.host
+
+        yield node_uri, node.parent if block_given? && !found.include?(node_uri)
+
+        found << node_uri
+      end
+
+      found.uniq
     end
 
     # @param [ Hash ] opts
@@ -54,17 +161,21 @@ module WPScan
     end
 
     # @param [ Hash ] opts
+    # @yield [ Plugin ] Optional block called as each plugin is first
+    #                   discovered (used to stream findings).
     #
     # @return [ Array<Plugin> ]
-    def plugins(opts = {})
-      @plugins ||= Finders::Plugins::Base.find(self, opts)
+    def plugins(opts = {}, &)
+      @plugins ||= Finders::Plugins::Base.find(self, opts, &)
     end
 
     # @param [ Hash ] opts
+    # @yield [ Theme ] Optional block called as each theme is first
+    #                  discovered (used to stream findings).
     #
     # @return [ Array<Theme> ]
-    def themes(opts = {})
-      @themes ||= Finders::Themes::Base.find(self, opts)
+    def themes(opts = {}, &)
+      @themes ||= Finders::Themes::Base.find(self, opts, &)
     end
 
     # @param [ Hash ] opts
@@ -88,6 +199,13 @@ module WPScan
       @db_exports ||= Finders::DbExports::Base.find(self, opts)
     end
 
+    # @param [ Hash ] opts
+    #
+    # @return [ Array<BackupFolder> ]
+    def backup_folders(opts = {})
+      @backup_folders ||= Finders::BackupFolders::Base.find(self, opts)
+    end
+
     # @param [ Hash ] opts
     #
     # @return [ Array<Media> ]
@@ -96,10 +214,12 @@ module WPScan
     end
 
     # @param [ Hash ] opts
+    # @yield [ User ] Optional block called as each user is first
+    #                 discovered (used to stream findings).
     #
     # @return [ Array<User> ]
-    def users(opts = {})
-      @users ||= Finders::Users::Base.find(self, opts)
+    def users(opts = {}, &)
+      @users ||= Finders::Users::Base.find(self, opts, &)
     end
   end
 end

data/lib/wpscan/typhoeus/hydra.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Typhoeus
+  # Ensure a clean abort of hydra
+  # See https://github.com/typhoeus/typhoeus/issues/439
+  class Hydra
+    def abort
+      super
+      run
+    end
+  end
+end

data/lib/wpscan/typhoeus/response.rb

@@ -3,10 +3,33 @@
 module Typhoeus
   # Custom Response class
   class Response
-    # @note: Ignores requests done to the /status endpoint of the API
+    # @return [ Nokogiri::XML ] The response's body parsed by Nokogiri::HTML
+    def html
+      @html ||= Nokogiri::HTML(body.encode('UTF-8', invalid: :replace, undef: :replace))
+    end
+
+    # @return [ Nokogiri::XML ] The response's body parsed by Nokogiri::XML
+    def xml
+      @xml ||= Nokogiri::XML(body.encode('UTF-8', invalid: :replace, undef: :replace))
+    end
+
+    # Override of the original to ensure an integer is returned
+    # @return [ Integer ]
+    def request_size
+      super || 0
+    end
+
+    # @return [ Integer ]
+    def size
+      (body.nil? ? 0 : body.size) + (response_headers.nil? ? 0 : response_headers.size)
+    end
+
+    # @note Ignores requests done to the /status endpoint of the WPScan Vuln API.
     #
     # @return [ Boolean ]
     def from_vuln_api?
+      return false unless effective_url
+
       effective_url.start_with?(WPScan::DB::VulnApi.uri.to_s) &&
         !effective_url.start_with?(WPScan::DB::VulnApi.uri.join('status').to_s)
     end

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '3.8.28'
+  VERSION = '4.0.1'
 end

data/lib/wpscan/vulnerability.rb

@@ -1,10 +1,46 @@
 # frozen_string_literal: true
 
 module WPScan
-  # Specific implementation
-  class Vulnerability < CMSScanner::Vulnerability
+  # Vulnerability model.
+  class Vulnerability
     include References
 
+    attr_reader :title, :type, :affected_versions, :cvss, :poc, :uuid
+
+    # Version of the scanned item (plugin/theme/WordPress), used to resolve
+    # which backported range to surface as the scalar fixed_in / introduced_in.
+    # Left nil/false when the version could not be detected.
+    attr_accessor :detected_version
+
+    # @param [ String ] title
+    # @param [ Hash ] references
+    # @option references [ Array<String>, String ] :cve
+    # @option references [ Array<String>, String ] :secunia
+    # @option references [ Array<String>, String ] :osvdb
+    # @option references [ Array<String>, String ] :exploitdb
+    # @option references [ Array<String> ] :url URL(s) to related advisories etc
+    # @option references [ Array<String>, String ] :metasploit The related metasploit module(s)
+    # @option references [ Array<String> ] :youtube
+    # @param [ String ] type
+    # @param [ Array<Hash> ] affected_versions One entry per backported fix range,
+    #   each with :fixed_in and :introduced_in keys (either may be nil).
+    # @param [ HashSymbol ] cvss
+    # @option cvss [ String ] :score
+    # @option cvss [ String ] :vector
+    # rubocop:disable Metrics/ParameterLists
+    def initialize(title, references: {}, type: nil, affected_versions: nil, cvss: nil, poc: nil, uuid: nil)
+      # rubocop:enable Metrics/ParameterLists
+      @title             = title
+      @type              = type
+      @affected_versions = normalize_affected_versions(affected_versions)
+      @cvss              = { score: cvss[:score], vector: cvss[:vector] } if cvss
+      @poc               = poc
+      @uuid              = uuid
+      @detected_version  = nil
+
+      self.references = references
+    end
+
     # @param [ Hash ] json_data
     # @return [ Vulnerability ]
     def self.load_from_json(json_data)
@@ -20,10 +56,126 @@ module WPScan
         json_data['title'],
         references: references,
         type: json_data['vuln_type'],
-        fixed_in: json_data['fixed_in'],
-        introduced_in: json_data['introduced_in'],
-        cvss: json_data['cvss']&.symbolize_keys
+        affected_versions: json_data['affected_versions'],
+        cvss: json_data['cvss']&.symbolize_keys,
+        poc: json_data['poc'],
+        uuid: json_data['id'].to_s # The 'id' field IS the UUID in WPScan API
       )
     end
+
+    # Whether this vulnerability covers a given version. True when no
+    # affected_versions are declared (advisory with no fix metadata) or when at
+    # least one backported range covers the version.
+    #
+    # @param [ #< ] version
+    #
+    # @return [ Boolean ]
+    def affects?(version)
+      return true if affected_versions.empty?
+
+      affected_versions.any? { |range| self.class.range_covers?(range, version) }
+    end
+
+    # Backward-compatible scalar: the fixed_in of the range relevant to the
+    # detected version (the branch the scanned site is actually on). nil when
+    # there is no fix metadata.
+    #
+    # @return [ String, nil ]
+    def fixed_in
+      relevant_range && relevant_range[:fixed_in]
+    end
+
+    # Backward-compatible scalar counterpart of {#fixed_in}.
+    #
+    # @return [ String, nil ]
+    def introduced_in
+      relevant_range && relevant_range[:introduced_in]
+    end
+
+    # The single affected-version range whose fixed_in / introduced_in we
+    # surface in the output. Picks the range covering the detected version so a
+    # site on an older but still-supported branch is matched against the right
+    # fix. Falls back to the highest (most recent) range when the version is
+    # unknown or no range covers it, mirroring the pre-v4 single-value output.
+    #
+    # @return [ Hash{Symbol => String, nil}, nil ]
+    def relevant_range
+      return nil if affected_versions.empty?
+
+      if detected_version
+        covering = affected_versions.find { |range| self.class.range_covers?(range, detected_version) }
+        return covering if covering
+      end
+
+      highest_range
+    end
+
+    # Whether a single range covers the version. A range matches when
+    # introduced_in is missing or <= version AND fixed_in is missing or >
+    # version.
+    #
+    # @param [ Hash{Symbol => String, nil} ] range
+    # @param [ #< ] version
+    #
+    # @return [ Boolean ]
+    def self.range_covers?(range, version)
+      introduced = range[:introduced_in]
+      fixed      = range[:fixed_in]
+
+      return false if introduced && !introduced.to_s.empty? && version < introduced
+      return true if fixed.nil? || fixed.to_s.empty?
+
+      version < fixed
+    end
+
+    # @param [ Vulnerability ] other
+    #
+    # @return [ Boolean ]
+    def ==(other)
+      title == other.title &&
+        type == other.type &&
+        references == other.references &&
+        affected_versions == other.affected_versions &&
+        cvss == other.cvss &&
+        poc == other.poc &&
+        uuid == other.uuid
+    end
+
+    private
+
+    # The range with the greatest fixed_in. An unpatched range (no fixed_in)
+    # outranks every patched one. Used as the fallback for {#relevant_range}.
+    #
+    # @return [ Hash{Symbol => String, nil} ]
+    def highest_range
+      affected_versions.max_by { |range| version_key(range[:fixed_in]) }
+    end
+
+    # Comparable sort key for a fixed_in value. Returns a [tier, Gem::Version]
+    # tuple so a missing fixed_in (unpatched) always sorts highest, and patched
+    # ranges sort by their numeric version.
+    #
+    # @return [ Array ]
+    def version_key(fixed_in)
+      return [1, Gem::Version.new('0')] if fixed_in.nil? || fixed_in.to_s.empty?
+
+      [0, Gem::Version.new(fixed_in.to_s[/\A[\d.]+/] || '0')]
+    rescue ArgumentError
+      [0, Gem::Version.new('0')]
+    end
+
+    # Coerces the v4 affected_versions payload into an array of symbolised range
+    # hashes. Accepts either an array of hashes (with string or symbol keys) or
+    # nil; anything else is dropped so a malformed entry can't break parsing.
+    #
+    # @return [ Array<Hash{Symbol => String, nil}> ]
+    def normalize_affected_versions(value)
+      Array(value).filter_map do |range|
+        next unless range.is_a?(Hash)
+
+        range = range.transform_keys(&:to_sym)
+        { fixed_in: range[:fixed_in], introduced_in: range[:introduced_in] }
+      end
+    end
   end
 end

data/lib/wpscan/vulnerability_filter.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module WPScan
+  # Filter for excluding specific vulnerabilities by UUID
+  class VulnerabilityFilter
+    attr_reader :excluded_uuids, :excluded_count
+
+    # @param [ Array<String>, String, nil ] uuids UUID identifiers to exclude
+    def initialize(uuids = nil)
+      @excluded_uuids = normalize_uuids(uuids)
+      @excluded_count = 0
+    end
+
+    # Filter vulnerabilities, removing those with excluded UUIDs
+    #
+    # @param [ Array<Vulnerability> ] vulnerabilities
+    # @return [ Array<Vulnerability> ] Filtered vulnerabilities
+    def filter(vulnerabilities)
+      return vulnerabilities if excluded_uuids.empty?
+
+      vulnerabilities.reject do |vuln|
+        should_exclude?(vuln).tap do |excluded|
+          @excluded_count += 1 if excluded
+        end
+      end
+    end
+
+    # Check if a vulnerability should be excluded
+    #
+    # @param [ Vulnerability ] vulnerability
+    # @return [ Boolean ]
+    def should_exclude?(vulnerability)
+      return false if excluded_uuids.empty?
+      return false unless vulnerability.uuid
+
+      # Check UUID match (case-insensitive)
+      excluded_uuids.include?(vulnerability.uuid.downcase)
+    end
+
+    # Reset the excluded count
+    def reset_count!
+      @excluded_count = 0
+    end
+
+    # Check if any UUIDs are being excluded
+    #
+    # @return [ Boolean ]
+    def excluding?
+      !excluded_uuids.empty?
+    end
+
+    private
+
+    # Normalize UUIDs
+    #
+    # @param [ Array<String>, String, nil ] uuids
+    # @return [ Array<String> ] Normalized UUIDs
+    def normalize_uuids(uuids)
+      return [] if uuids.nil?
+
+      # Convert string to array if needed
+      uuids = uuids.is_a?(String) ? uuids.split(',') : Array(uuids)
+
+      # Normalize each UUID (trim whitespace, lowercase, remove duplicates)
+      uuids.map { |u| u.to_s.strip.downcase }.reject(&:empty?).uniq
+    end
+  end
+end

data/lib/wpscan/vulnerable.rb

@@ -4,9 +4,21 @@ module WPScan
   # Module to include in vulnerable WP item such as WpVersion.
   # the vulnerabilities method should be implemented
   module Vulnerable
+    # @return [ VulnerabilityFilter, nil ]
+    def vulnerability_filter
+      @vulnerability_filter ||= VulnerabilityFilter.new(ParsedCli.exclude_vulns) if ParsedCli.exclude_vulns
+    end
+
+    # @return [ Array<Vulnerability> ] Filtered vulnerabilities
+    def filtered_vulnerabilities
+      return vulnerabilities unless vulnerability_filter
+
+      vulnerability_filter.filter(vulnerabilities)
+    end
+
     # @return [ Boolean ]
     def vulnerable?
-      !vulnerabilities.empty?
+      !filtered_vulnerabilities.empty?
     end
   end
 end