wpscan 3.0.3 → 3.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4d9052417cae5d1b8c68bd2992c2e0c8ce035475
-  data.tar.gz: 0bb18cca39de608eda80347745bc5e287574a0bf
+  metadata.gz: aec6c21b96dc11fe0d1de37121edb9d4cce6580e
+  data.tar.gz: 9dfc21c798b02915e4e06815d6bc0808b0567f5a
 SHA512:
-  metadata.gz: 8246a24671367caf940874b35f4f08ce3bca6c381a857e45084630294799835d5ef9e7f425b662321aebcaaeb9c2100008707b153db071c7cc1d66a3560cfb5a
-  data.tar.gz: bbbc9906b96ff16e5a964342ff8cedab63c1b00ad25be29208bd0939df9abd53507da40b2899e474cf72f44f9d69a35af5641b6e4115888e8bedb0631dbe7883
+  metadata.gz: 7dea9f1e9a2afc8240533a355690381b33f360aa658b3fd1135b94b25ccca86bfd60585dee81110147592737c060e13f4935112d5194b19b6af06d64e8870b20
+  data.tar.gz: f79944aec35413d122216f01100e1d13e1ed3f575935bd4a4dac2331b2dc94a1fcb9dbbb4f230674ed815a5d358753c22e1cb4f5cb59eef3fe366c9ee8ba88df

data/app/controllers/core.rb

@@ -8,8 +8,8 @@ module WPScan
           super.drop(1) + # delete the --url from CMSScanner
           [
             OptChoice.new(['--server SERVER', 'Force the supplied server module to be loaded'],
-                          choices: %w(apache iis nginx),
-                          normalize: [:downcase, :to_sym]),
+                          choices: %w[apache iis nginx],
+                          normalize: %i[downcase to_sym]),
             OptBoolean.new(['--force', 'Do not check if the target is running WordPress']),
             OptBoolean.new(['--[no-]update', 'Wether or not to update the Database'], required_unless: :url)
           ]

data/app/controllers/enumeration.rb

@@ -8,7 +8,7 @@ module WPScan
       def before_scan
         # Create the Dynamic Finders
         DB::DynamicPluginFinders.db_data.each do |name, config|
-          %w(Comments).each do |klass|
+          %w[Comments].each do |klass|
             next unless config[klass] && config[klass]['version']
 
             constant_name = name.tr('-', '_').camelize
@@ -42,7 +42,7 @@ module WPScan
         enum_plugins if enum_plugins?(enum)
         enum_themes  if enum_themes?(enum)
 
-        [:timthumbs, :config_backups, :medias].each do |key|
+        %i[timthumbs config_backups medias].each do |key|
           send("enum_#{key}".to_sym) if enum.key?(key)
         end
 

data/app/controllers/enumeration/cli_options.rb

@@ -26,7 +26,7 @@ module WPScan
               m:  OptIntegerRange.new(['--medias', 'Media ids range. e.g m1-15'], value_if_empty: '1-100')
             },
             value_if_empty: 'vp,vt,tt,cb,u,m',
-            incompatible: [[:vp, :ap, :p], [:vt, :at, :t]]
+            incompatible: [%i[vp ap p], %i[vt at t]]
           ),
           OptRegexp.new(
             [
@@ -46,7 +46,7 @@ module WPScan
           OptChoice.new(
             ['--plugins-detection MODE',
              'Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive), normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym
           ),
           OptBoolean.new(['--plugins-version-all', 'Check all the plugins version locations'])
         ]
@@ -59,7 +59,7 @@ module WPScan
           OptChoice.new(
             ['--themes-detection MODE',
              'Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive), normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym
           ),
           OptBoolean.new(['--themes-version-all', 'Check all the themes version locations'])
         ]
@@ -75,7 +75,7 @@ module WPScan
           OptChoice.new(
             ['--timthumbs-detection MODE',
              'Use the supplied mode to enumerate Timthumbs, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive), normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym
           )
         ]
       end
@@ -90,7 +90,7 @@ module WPScan
           OptChoice.new(
             ['--config-backups-detection MODE',
              'Use the supplied mode to enumerate Configs, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive), normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym
           )
         ]
       end
@@ -101,7 +101,7 @@ module WPScan
           OptChoice.new(
             ['--medias-detection MODE',
              'Use the supplied mode to enumerate Medias, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive), normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym
           )
         ]
       end
@@ -117,7 +117,7 @@ module WPScan
           OptChoice.new(
             ['--users-detection MODE',
              'Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive), normalize: :to_sym
+            choices: %w[mixed passive aggressive], normalize: :to_sym
           )
         ]
       end

data/app/controllers/enumeration/enum_methods.rb

@@ -6,7 +6,7 @@ module WPScan
       #
       # @return [ String ] The related enumration message depending on the parsed_options and type supplied
       def enum_message(type)
-        return unless type == 'plugins' || type == 'themes'
+        return unless %w[plugins themes].include?(type)
 
         details = if parsed_options[:enumerate][:"vulnerable_#{type}"]
                     'Vulnerable'

data/app/controllers/main_theme.rb

@@ -7,7 +7,7 @@ module WPScan
           OptChoice.new(
             ['--main-theme-detection MODE',
              'Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive),
+            choices: %w[mixed passive aggressive],
             normalize: :to_sym
           )
         ]

data/app/controllers/wp_version.rb

@@ -9,7 +9,7 @@ module WPScan
             ['--wp-version-detection MODE',
              'Use the supplied mode for the WordPress version detection, ' \
              'instead of the global (--detection-mode) mode.'],
-            choices: %w(mixed passive aggressive),
+            choices: %w[mixed passive aggressive],
             normalize: :to_sym
           )
         ]

data/app/finders/interesting_findings.rb

@@ -19,11 +19,11 @@ module WPScan
         def initialize(target)
           super(target)
 
-          %w(
+          %w[
             Readme DebugLog FullPathDisclosure BackupDB DuplicatorInstallerLog
             Multisite MuPlugins Registration UploadDirectoryListing TmmDbMigrate
             UploadSQLDump
-          ).each do |f|
+          ].each do |f|
             finders << InterestingFindings.const_get(f).new(target)
           end
         end

data/app/finders/interesting_findings/readme.rb

@@ -18,7 +18,7 @@ module WPScan
 
         # @retun [ Array<String> ] The list of potential readme files
         def potential_files
-          %w(readme.html olvasdel.html lisenssi.html liesmich.html)
+          %w[readme.html olvasdel.html lisenssi.html liesmich.html]
         end
       end
     end

data/app/finders/plugin_version/layer_slider/translation_file.rb

@@ -29,7 +29,7 @@ module WPScan
           def potential_urls
             # Recent versions seem to use the 'locales' directory instead of the 'languages' one.
             # Maybe also check other locales ?
-            %w(locales languages).reduce([]) do |a, e|
+            %w[locales languages].reduce([]) do |a, e|
               a << target.url("#{e}/LayerSlider-en_US.po")
             end
           end

data/app/finders/timthumbs/known_locations.rb

@@ -43,8 +43,8 @@ module WPScan
         end
 
         def main_theme_timthumbs_paths
-          %w(timthumb.php lib/timthumb.php inc/timthumb.php includes/timthumb.php
-             scripts/timthumb.php tools/timthumb.php functions/timthumb.php)
+          %w[timthumb.php lib/timthumb.php inc/timthumb.php includes/timthumb.php
+             scripts/timthumb.php tools/timthumb.php functions/timthumb.php]
         end
 
         def create_progress_bar(opts = {})

data/app/finders/users/author_posts.rb

@@ -43,7 +43,7 @@ module WPScan
         def potential_usernames(res)
           usernames = []
 
-          target.in_scope_urls(res, '//a', %w(href)) do |url, node|
+          target.in_scope_urls(res, '//a', %w[href]) do |url, node|
             uri = Addressable::URI.parse(url)
 
             if uri.path =~ %r{/author/([^/\b]+)/?\z}i

data/app/finders/wp_version/atom_generator.rb

@@ -30,7 +30,7 @@ module WPScan
         end
 
         def aggressive_urls(_opts = {})
-          %w(feed/atom/ ?feed=atom).reduce([]) do |a, uri|
+          %w[feed/atom/ ?feed=atom].reduce([]) do |a, uri|
             a << target.url(uri)
           end
         end

data/app/finders/wp_version/rss_generator.rb

@@ -33,7 +33,7 @@ module WPScan
         end
 
         def aggressive_urls(_opts = {})
-          %w(feed/ comments/feed/ feed/rss/ feed/rss2/).reduce([]) do |a, uri|
+          %w[feed/ comments/feed/ feed/rss/ feed/rss2/].reduce([]) do |a, uri|
             a << target.url(uri)
           end
         end

data/app/models/timthumb.rb

@@ -30,8 +30,8 @@ module WPScan
     def vulnerabilities
       vulns = []
 
-      vulns << rce_webshot_vuln if false == version || version > '1.35' && version < '2.8.14' && webshot_enabled?
-      vulns << rce_132_vuln if false == version || version < '1.33'
+      vulns << rce_webshot_vuln if version == false || version > '1.35' && version < '2.8.14' && webshot_enabled?
+      vulns << rce_132_vuln if version == false || version < '1.33'
 
       vulns
     end
@@ -68,7 +68,7 @@ module WPScan
 
     # @return [ Array<String> ] The default allowed domains (between the 2.0 and 2.8.13)
     def default_allowed_domains
-      %w(flickr.com picasa.com img.youtube.com upload.wikimedia.org)
+      %w[flickr.com picasa.com img.youtube.com upload.wikimedia.org]
     end
   end
 end

data/app/models/wp_item.rb

@@ -6,8 +6,8 @@ module WPScan
     include CMSScanner::Target::Platform::PHP
     include CMSScanner::Target::Server::Generic
 
-    READMES    = %w(readme.txt README.txt Readme.txt ReadMe.txt README.TXT readme.TXT).freeze
-    CHANGELOGS = %w(changelog.txt Changelog.txt ChangeLog.txt CHANGELOG.txt).freeze
+    READMES    = %w[readme.txt README.txt Readme.txt ReadMe.txt README.TXT readme.TXT].freeze
+    CHANGELOGS = %w[changelog.txt Changelog.txt ChangeLog.txt CHANGELOG.txt].freeze
 
     attr_reader :uri, :name, :detection_opts, :target, :db_data
 
@@ -50,7 +50,7 @@ module WPScan
     def vulnerable_to?(vuln)
       return true unless version && vuln && vuln.fixed_in && !vuln.fixed_in.empty?
 
-      version < vuln.fixed_in ? true : false
+      version < vuln.fixed_in
     end
 
     # @return [ String ]

data/app/models/wp_version.rb

@@ -2,7 +2,6 @@ module WPScan
   # WP Version
   class WpVersion < CMSScanner::Version
     include Vulnerable
-    attr_reader :db_data
 
     def initialize(number, opts = {})
       raise InvalidWordPressVersion unless WpVersion.valid?(number.to_s)

data/lib/wpscan/db/updater.rb

@@ -4,11 +4,11 @@ module WPScan
     # :nocov:
     class Updater
       # /!\ Might want to also update the Enumeration#cli_options when some filenames are changed here
-      FILES = %w(
+      FILES = %w[
         plugins.json themes.json wordpresses.json
         timthumbs-v3.txt user-agents.txt config_backups.txt
         dynamic_finders.yml wordpress.db LICENSE
-      ).freeze
+      ].freeze
 
       attr_reader :repo_directory
 

data/lib/wpscan/db/wp_items.rb

@@ -14,7 +14,7 @@ module WPScan
 
       # @return [ Array<String> ] The slug of all vulnerable items
       def self.vulnerable_slugs
-        db.select { |_key, item| !item['vulnerabilities'].empty? }.keys
+        db.reject { |_key, item| item['vulnerabilities'].empty? }.keys
       end
     end
   end

data/lib/wpscan/target/platform/wordpress.rb

@@ -1,4 +1,4 @@
-%w(custom_directories).each do |required|
+%w[custom_directories].each do |required|
   require "wpscan/target/platform/wordpress/#{required}"
 end
 

data/lib/wpscan/version.rb

@@ -1,4 +1,4 @@
 # Version
 module WPScan
-  VERSION = '3.0.3'.freeze
+  VERSION = '3.0.4'.freeze
 end

metadata

@@ -1,57 +1,57 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 3.0.3
+  version: 3.0.4
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-23 00:00:00.000000000 Z
+date: 2017-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: yajl-ruby
+  name: cms_scanner
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: 0.0.37.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: 0.0.37.10
 - !ruby/object:Gem::Dependency
-  name: cms_scanner
+  name: yajl-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.37.8
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.37.8
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.0.1.0
+        version: '5.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.0.1.0
+        version: '5.1'
 - !ruby/object:Gem::Dependency
   name: dm-core
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.5.0
+        version: 3.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.5.0
+        version: 3.6.0
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
@@ -170,14 +170,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.47.1
+        version: 0.50.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.47.1
+        version: 0.50.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -198,14 +198,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 0.14.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.14.0
+- !ruby/object:Gem::Dependency
+  name: coveralls
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 0.8.0
 description: WPScan is a black box WordPress vulnerability scanner.
 email:
 - team@wpscan.org