wpscan 3.8.28 → 4.0.1

data/lib/wpscan/web_site.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+module WPScan
+  # WebSite Implementation
+  class WebSite
+    attr_reader :uri, :opts
+
+    # @param [ String ] site_url
+    # @param [ Hash ] opts
+    def initialize(site_url, opts = {})
+      self.url = site_url
+      @opts    = opts
+    end
+
+    def url=(site_url)
+      new_url = site_url.dup
+
+      # Add a trailing slash to the URL
+      new_url << '/' if new_url[-1, 1] != '/'
+
+      # Use the validator to ensure the URL has a correct format
+      OptParseValidator::OptURL.new([]).validate(new_url)
+
+      @uri = Addressable::URI.parse(new_url).normalize
+    end
+
+    # @param [ String ] path Optional path to merge with the uri
+    #
+    # @return [ String ]
+    def url(path = nil)
+      return @uri.to_s unless path
+
+      @uri.join(Addressable::URI.encode(path).gsub('#', '%23')).to_s
+    end
+
+    # @return [ String ] The IP address of the target
+    def ip
+      @ip ||= IPSocket.getaddress(uri.host)
+    rescue SocketError
+      'Unknown'
+    end
+
+    attr_writer :homepage_res
+
+    # @return [ Typhoeus::Response ]
+    #
+    # As webmock does not support redirects mocking, coverage is ignored
+    # :nocov:
+    def homepage_res
+      @homepage_res ||= WPScan::Browser.get_and_follow_location(url)
+    end
+    # :nocov:
+
+    # @return [ String ]
+    def homepage_url
+      @homepage_url ||= homepage_res.effective_url
+    end
+
+    # Discards the cached homepage response and URL so the next access refetches.
+    # Used after mutating cookies/auth state mid-scan.
+    def reset_homepage_cache!
+      @homepage_res = nil
+      @homepage_url = nil
+    end
+
+    # @return [ Typhoeus::Response ]
+    def error_404_res
+      @error_404_res ||= WPScan::Browser.get_and_follow_location(error_404_url)
+    end
+
+    # @return [ String ] The URL of an unlikely existant page
+    def error_404_url
+      @error_404_url ||= uri.join("#{Digest::MD5.hexdigest(rand(999_999).to_s)[0..6]}.html").to_s
+    end
+
+    # Checks if the remote website is up.
+    #
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def online?(path = nil)
+      WPScan::Browser.get(url(path)).code.nonzero? ? true : false
+    end
+
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def http_auth?(path = nil)
+      WPScan::Browser.get(url(path)).code == 401
+    end
+
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def access_forbidden?(path = nil)
+      WPScan::Browser.get(url(path)).code == 403
+    end
+
+    # @param [ String ] path
+    #
+    # @return [ Boolean ]
+    def proxy_auth?(path = nil)
+      WPScan::Browser.get(url(path)).code == 407
+    end
+
+    # @param [ String ] url
+    #
+    # @return [ String ] The redirection url or nil
+    #
+    # As webmock does not support redirects mocking, coverage is ignored
+    # :nocov:
+    def redirection(url = nil)
+      url ||= @uri.to_s
+
+      return unless [301, 302].include?(WPScan::Browser.get(url).code)
+
+      res = WPScan::Browser.get(url, followlocation: true, maxredirs: 10)
+
+      res.effective_url == url ? nil : res.effective_url
+    end
+    # :nocov:
+
+    # @return [ Hash ] The Typhoeus params to use to perform head requests
+    def head_or_get_params
+      @head_or_get_params ||= if [0, 405, 501].include?(WPScan::Browser.head(homepage_url).code)
+                                { method: :get, maxfilesize: 1 }
+                              else
+                                { method: :head }
+                              end
+    end
+
+    # Perform a HEAD request to the path provided, then if its response code
+    # is in the array of codes given, a GET is done and the response returned. Otherwise the
+    # HEAD response is returned.
+    #
+    # @param [ String ] path
+    # @param [ Array<String> ] codes
+    # @param [ Hash ] params The requests params
+    # @option params [ Hash ] :head Request params for the HEAD
+    # @option params [ hash ] :get Request params for the GET
+    #
+    # @return [ Typhoeus::Response ]
+    def head_and_get(path, codes = [200], params = {})
+      url_to_get  = url(path)
+      head_params = (params[:head] || {}).merge(head_or_get_params)
+
+      head_res = WPScan::Browser.forge_request(url_to_get, head_params).run
+
+      codes.include?(head_res.code) ? WPScan::Browser.get(url_to_get, params[:get] || {}) : head_res
+    end
+  end
+end

data/lib/wpscan.rb

@@ -5,62 +5,159 @@
 # otherwise encoding issues can happen when using JSON format.
 # Not kidding.
 require 'active_support/all'
-require 'cms_scanner'
+require 'typhoeus'
+require 'nokogiri'
 require 'yajl/json_gem'
+require 'public_suffix'
 require 'addressable/uri'
-# Standard Lib
+require 'get_process_mem'
+require 'ruby-progressbar'
+require 'opt_parse_validator'
+# Standard Libs
+require 'erb'
 require 'uri'
 require 'time'
-require 'readline'
 require 'securerandom'
 require 'resolv'
-# Monkey Patches/Fixes/Override
-require 'wpscan/typhoeus/response' # Adds a from_vuln_api? method
+require 'fileutils'
+require 'pathname'
+require 'socket'
+require 'timeout'
+require 'xmlrpc/client'
+# Monkey Patches/Fixes
+require 'wpscan/typhoeus/response' # Adds Response#html and from_vuln_api?
+require 'wpscan/typhoeus/hydra'    # https://github.com/typhoeus/typhoeus/issues/439
+require 'wpscan/public_suffix/domain' # Adds Domain#match
+require 'wpscan/numeric' # Adds Numeric#bytes_to_human
 # Custom Libs
+require 'wpscan/scan'
+require 'wpscan/parsed_cli'
 require 'wpscan/helper'
-require 'wpscan/db'
-require 'wpscan/version'
+require 'wpscan/exit_code'
 require 'wpscan/errors'
-require 'wpscan/parsed_cli'
-require 'wpscan/browser'
+require 'wpscan/cache/typhoeus'
 require 'wpscan/target'
-require 'wpscan/finders'
+require 'wpscan/browser'
+require 'wpscan/version'
 require 'wpscan/controller'
 require 'wpscan/controllers'
+require 'wpscan/formatter'
 require 'wpscan/references'
-require 'wpscan/vulnerable'
+require 'wpscan/finders'
 require 'wpscan/vulnerability'
+require 'wpscan/vulnerability_filter'
+require 'wpscan/progressbar_null_output'
+require 'wpscan/db'
+require 'wpscan/vulnerable'
+require 'wpscan/http_status_tracking'
+require 'wpscan/browser_authenticator'
 
 Encoding.default_external = Encoding::UTF_8
 
-# WPScan
 module WPScan
-  include CMSScanner
+  class << self
+    # The lowercase name of the scanner.
+    # Mainly used in directory paths like the default cookie-jar file and
+    # path to load the cli options from files.
+    def app_name
+      'wpscan'
+    end
+  end
+
+  extend HttpStatusTracking
 
   APP_DIR = Pathname.new(__FILE__).dirname.join('..', 'app').expand_path
-  DB_DIR  = Pathname.new(Dir.home).join('.wpscan', 'db')
+
+  # Avoid memory leak when using Hydra, see https://github.com/typhoeus/typhoeus/issues/562
+  # Requests are still cached via the provided Cache system
+  Typhoeus::Config.memoize = false
+
+  # XDG support for DB_DIR
+  # If the legacy path exists, it will be used. Otherwise, we'll use
+  # $XDG_CACHE_HOME/wpscan/db or ~/.cache/wpscan/db when XDG_CACHE_HOME is unset.
+  legacy_path = Pathname.new(Dir.home).join(".#{WPScan.app_name}", 'db')
+  xdg_path = Pathname.new(ENV['XDG_CACHE_HOME'] || Pathname.new(Dir.home).join('.cache')).join(WPScan.app_name, 'db')
+  DB_DIR = legacy_path.exist? ? legacy_path : xdg_path
 
   Typhoeus.on_complete do |response|
-    next if response.cached? || !response.from_vuln_api?
+    self.cached_requests += 1 if response.cached?
 
-    self.api_requests += 1
-  end
+    next if response.cached?
 
-  # Override, otherwise it would be returned as 'wp_scan'
-  #
-  # @return [ String ]
-  def self.app_name
-    'wpscan'
-  end
+    self.total_requests += 1
+    self.total_data_sent += response.request_size
+    self.total_data_received += response.size
+
+    # Track HTTP status codes
+    increment_status_code(response.code)
+
+    self.api_requests += 1 if response.respond_to?(:from_vuln_api?) && response.from_vuln_api?
 
-  # @return [ Integer ]
-  def self.api_requests
-    @@api_requests ||= 0
+    WPScan::Browser.instance.trottle!
   end
 
-  # @param [ Integer ] value
-  def self.api_requests=(value)
-    @@api_requests = value
+  class << self
+    def user_cache_dir
+      Pathname.new(ENV['XDG_CACHE_HOME'] || Pathname.new(Dir.home).join('.cache')).join(app_name)
+    end
+
+    def cached_requests
+      @@cached_requests ||= 0
+    end
+
+    def cached_requests=(value)
+      @@cached_requests = value
+    end
+
+    def total_requests
+      @@total_requests ||= 0
+    end
+
+    def total_requests=(value)
+      @@total_requests = value
+    end
+
+    def total_data_sent
+      @@total_data_sent ||= 0
+    end
+
+    def total_data_sent=(value)
+      @@total_data_sent = value
+    end
+
+    def total_data_received
+      @@total_data_received ||= 0
+    end
+
+    def total_data_received=(value)
+      @@total_data_received = value
+    end
+
+    # Memory at the start of the scan (when Scan.new), in bytes.
+    def start_memory
+      @@start_memory ||= 0
+    end
+
+    def start_memory=(value)
+      @@start_memory = value
+    end
+
+    def api_requests
+      @@api_requests ||= 0
+    end
+
+    def api_requests=(value)
+      @@api_requests = value
+    end
+
+    # Command line arguments used to start the scan
+    def command_line
+      @@command_line ||= ''
+    end
+
+    def command_line=(value)
+      @@command_line = value
+    end
   end
 end