yawast 0.7.0.beta3 → 0.7.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +2 -1
- data/Dockerfile +42 -0
- data/README.md +2 -1
- data/lib/scanner/generic.rb +2 -0
- data/lib/scanner/plugins/applications/cms/wordpress.rb +99 -0
- data/lib/scanner/plugins/applications/generic/password_reset.rb +3 -1
- data/lib/scanner/ssl_labs.rb +1 -0
- data/lib/scanner/vuln_scan.rb +5 -0
- data/lib/shared/http.rb +2 -2
- data/lib/version.rb +1 -1
- data/test/data/wp-json-users.txt +1 -0
- data/test/data/wp-login-4.9.8.txt +61 -0
- data/test/data/wp-login-5.1.1.txt +80 -0
- data/test/test_app_cms_wp.rb +76 -0
- data/test/test_app_fw_rails.rb +1 -1
- data/test/test_ssl_sweet32.rb +21 -21
- metadata +13 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 0ae21762fe7abf26bd16283e6a104c1013c446b7
|
|
4
|
+
data.tar.gz: 31549266d294f446a7e803e77cecd0e7e2bc999b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 886b7a4bf891d77eeca0f65a50733eb43aa6414c9d4d38a52acc363c1d6184df4b02d1ebf957ffc9637cb32097b088ae95527a90dbbdad58431403d327ec63a4
|
|
7
|
+
data.tar.gz: edd06c1933bda3b8643b9e6a06a8e690fa34f8136db9de5abdc446e08cc3fc766ffe8fc6f0ea514f76527630f718e35c30b9279a5dd6a01768d444cc05646e97
|
data/CHANGELOG.md
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
## 0.7.0 -
|
|
1
|
+
## 0.7.0 - 2019-04-19
|
|
2
2
|
|
|
3
3
|
* [#38](https://github.com/adamcaudill/yawast/issues/38) - JSON Output Option via `--output=` (work in progress)
|
|
4
4
|
* [#133](https://github.com/adamcaudill/yawast/issues/133) - Include a Timestamp In Output
|
|
@@ -16,6 +16,7 @@
|
|
|
16
16
|
* [#156](https://github.com/adamcaudill/yawast/issues/156) - Check for Rails CVE-2019-5418
|
|
17
17
|
* [#157](https://github.com/adamcaudill/yawast/issues/157) - Add check for Nginx Status Page
|
|
18
18
|
* [#158](https://github.com/adamcaudill/yawast/issues/158) - Add check for Tomcat RCE CVE-2019-0232
|
|
19
|
+
* [#161](https://github.com/adamcaudill/yawast/issues/161) - Add WordPress WP-JSON User Enumeration
|
|
19
20
|
* [#130](https://github.com/adamcaudill/yawast/issues/130) - Bug: HSTS Error leads to printing HTML
|
|
20
21
|
* [#132](https://github.com/adamcaudill/yawast/issues/132) - Bug: Typo in SSL Output
|
|
21
22
|
* [#142](https://github.com/adamcaudill/yawast/issues/142) - Bug: Error In Collecting DNS Information
|
data/Dockerfile
CHANGED
|
@@ -1,8 +1,50 @@
|
|
|
1
1
|
FROM ruby:2.4-jessie
|
|
2
2
|
|
|
3
|
+
RUN apt-get update && apt-get install -y \
|
|
4
|
+
apt-transport-https \
|
|
5
|
+
ca-certificates \
|
|
6
|
+
curl \
|
|
7
|
+
wget \
|
|
8
|
+
gnupg \
|
|
9
|
+
unzip \
|
|
10
|
+
--no-install-recommends \
|
|
11
|
+
&& curl -sSL https://dl.google.com/linux/linux_signing_key.pub | apt-key add - \
|
|
12
|
+
&& echo "deb https://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list \
|
|
13
|
+
&& apt-get update && apt-get install -y google-chrome-stable \
|
|
14
|
+
fontconfig \
|
|
15
|
+
fonts-ipafont-gothic \
|
|
16
|
+
fonts-wqy-zenhei \
|
|
17
|
+
fonts-thai-tlwg \
|
|
18
|
+
fonts-kacst \
|
|
19
|
+
fonts-noto \
|
|
20
|
+
ttf-freefont \
|
|
21
|
+
--no-install-recommends \
|
|
22
|
+
&& apt-get clean \
|
|
23
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
24
|
+
|
|
25
|
+
RUN CHROME_STRING=$(/usr/bin/google-chrome-stable --version) \
|
|
26
|
+
&& CHROME_VERSION_STRING=$(echo "${CHROME_STRING}" | grep -oP "\d+\.\d+\.\d+\.\d+") \
|
|
27
|
+
&& CHROME_MAJOR_VERSION=$(echo "${CHROME_VERSION_STRING%%.*}") \
|
|
28
|
+
&& wget --no-verbose -O /tmp/LATEST_RELEASE "https://chromedriver.storage.googleapis.com/LATEST_RELEASE_${CHROME_MAJOR_VERSION}" \
|
|
29
|
+
&& CD_VERSION=$(cat "/tmp/LATEST_RELEASE") \
|
|
30
|
+
&& rm /tmp/LATEST_RELEASE \
|
|
31
|
+
&& CHROME_DRIVER_VERSION="${CD_VERSION}" \
|
|
32
|
+
&& echo "Using chromedriver version: "$CD_VERSION \
|
|
33
|
+
&& echo "Using Chrome version: "$CHROME_VERSION_STRING \
|
|
34
|
+
&& wget --no-verbose -O /tmp/chromedriver_linux64.zip https://chromedriver.storage.googleapis.com/$CD_VERSION/chromedriver_linux64.zip \
|
|
35
|
+
&& unzip /tmp/chromedriver_linux64.zip -d /usr/bin/ \
|
|
36
|
+
&& rm /tmp/chromedriver_linux64.zip \
|
|
37
|
+
&& chmod +x /usr/bin/chromedriver
|
|
38
|
+
|
|
39
|
+
RUN groupadd -r chrome && useradd -r -g chrome -G audio,video chrome \
|
|
40
|
+
&& mkdir -p /home/chrome && chown -R chrome:chrome /home/chrome \
|
|
41
|
+
&& mkdir -p /opt/google/chrome && chown -R chrome:chrome /opt/google/chrome
|
|
42
|
+
|
|
3
43
|
COPY . /data
|
|
4
44
|
WORKDIR /data
|
|
5
45
|
|
|
46
|
+
USER chrome
|
|
47
|
+
|
|
6
48
|
ENV LANG C.UTF-8
|
|
7
49
|
ENV LANGUAGE C.UTF-8
|
|
8
50
|
ENV LC_ALL C.UTF-8
|
data/README.md
CHANGED
|
@@ -75,9 +75,10 @@ The following tests are performed:
|
|
|
75
75
|
* *(ASP.NET)* Presence of Trace.axd
|
|
76
76
|
* *(ASP.NET)* Presence of Elmah.axd
|
|
77
77
|
* *(ASP.NET)* Debugging Enabled
|
|
78
|
-
* *(nginx)* Info Disclosure: Server version
|
|
79
78
|
* *(PHP)* Info Disclosure: PHP version
|
|
80
79
|
* *(Rails)* File Content Disclosure: CVE-2019-5418
|
|
80
|
+
* *(WordPress)* Version detection
|
|
81
|
+
* *(WordPress)* WP-JSON User Enumeration
|
|
81
82
|
|
|
82
83
|
CMS Detection:
|
|
83
84
|
|
data/lib/scanner/generic.rb
CHANGED
|
@@ -63,6 +63,8 @@ module Yawast
|
|
|
63
63
|
Yawast::Utilities.puts_info 'NOTE: Server appears to be Cloudflare; WAF may be in place.'
|
|
64
64
|
puts
|
|
65
65
|
end
|
|
66
|
+
|
|
67
|
+
Yawast::Shared::Output.log_value 'server', server
|
|
66
68
|
end
|
|
67
69
|
|
|
68
70
|
Yawast::Utilities.puts_warn "X-Powered-By Header Present: #{powered_by}" if powered_by != ''
|
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
module Yawast
|
|
4
|
+
module Scanner
|
|
5
|
+
module Plugins
|
|
6
|
+
module Applications
|
|
7
|
+
module CMS
|
|
8
|
+
class WordPress
|
|
9
|
+
# check to see if we can confirm the presence of WordPress
|
|
10
|
+
def self.identify(uri)
|
|
11
|
+
ret = nil
|
|
12
|
+
|
|
13
|
+
# check for wp-login.php in the current directory
|
|
14
|
+
resp = identify_by_path uri, uri.path
|
|
15
|
+
|
|
16
|
+
if resp.nil?
|
|
17
|
+
# if we don't get a hit at the current path, try under /blog/
|
|
18
|
+
resp = identify_by_path uri, uri.path + 'blog/'
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
unless resp.nil?
|
|
22
|
+
# confirmed hit
|
|
23
|
+
res = resp[:result]
|
|
24
|
+
ret = resp[:uri]
|
|
25
|
+
|
|
26
|
+
# strip the file name from the path
|
|
27
|
+
ret.path = ret.path.sub! 'wp-login.php', ''
|
|
28
|
+
|
|
29
|
+
css = res[:body].scan /login.min.css\?ver=\d+\.\d+\.?\d*/
|
|
30
|
+
|
|
31
|
+
ver = 'Unknown'
|
|
32
|
+
if !css.count.zero?
|
|
33
|
+
ver = css[0].to_s.split('=')[1]
|
|
34
|
+
else
|
|
35
|
+
# the current method doesn't work, fall back to an older method
|
|
36
|
+
css = res[:body].scan /load-styles.php\?[\w\,\;\=\&\%]+;ver=\d+\.\d+\.?\d*/
|
|
37
|
+
ver = css[0].to_s.split('=')[-1] unless css.count.zero?
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
Yawast::Utilities.puts_info "Found WordPress v#{ver} at #{ret}"
|
|
41
|
+
Yawast::Shared::Output.log_value 'application', 'wordpress', 'uri', ret
|
|
42
|
+
Yawast::Shared::Output.log_value 'application', 'wordpress', 'version', ver
|
|
43
|
+
Yawast::Shared::Output.log_value 'application', 'wordpress', 'login_body', res[:body]
|
|
44
|
+
end
|
|
45
|
+
|
|
46
|
+
ret
|
|
47
|
+
end
|
|
48
|
+
|
|
49
|
+
def self.identify_by_path(uri, path)
|
|
50
|
+
login_uri = uri.copy
|
|
51
|
+
login_uri.path = path + 'wp-login.php'
|
|
52
|
+
|
|
53
|
+
res = Yawast::Shared::Http.get_with_code login_uri
|
|
54
|
+
|
|
55
|
+
if res[:code] == '200' && res[:body].include?('Powered by WordPress')
|
|
56
|
+
return {result: res, uri: login_uri}
|
|
57
|
+
else
|
|
58
|
+
return nil
|
|
59
|
+
end
|
|
60
|
+
end
|
|
61
|
+
|
|
62
|
+
def self.check_json_user_enum(uri)
|
|
63
|
+
Yawast::Shared::Output.log_hash 'vulnerabilities',
|
|
64
|
+
'wordpress_json_user_enum',
|
|
65
|
+
{vulnerable: false, users: nil}
|
|
66
|
+
|
|
67
|
+
json_uri = uri.copy
|
|
68
|
+
json_uri.path = json_uri.path + 'wp-json/wp/v2/users'
|
|
69
|
+
res = Yawast::Shared::Http.get_with_code json_uri
|
|
70
|
+
|
|
71
|
+
if res[:code] == '200' && res[:body].include?('slug')
|
|
72
|
+
# we have a likely hit
|
|
73
|
+
users = nil
|
|
74
|
+
begin
|
|
75
|
+
users = JSON.parse res[:body]
|
|
76
|
+
rescue # rubocop:disable Style/RescueStandardError, Lint/HandleExceptions
|
|
77
|
+
# don't care why it failed
|
|
78
|
+
end
|
|
79
|
+
|
|
80
|
+
unless users.nil?
|
|
81
|
+
Yawast::Shared::Output.log_hash 'vulnerabilities',
|
|
82
|
+
'wordpress_json_user_enum',
|
|
83
|
+
{vulnerable: true, users: users}
|
|
84
|
+
Yawast::Utilities.puts_warn "WordPress WP-JSON User Enumeration at #{json_uri}"
|
|
85
|
+
|
|
86
|
+
users.each do |user|
|
|
87
|
+
Yawast::Utilities.puts_raw "ID: #{user['id']}\tUser Slug: '#{user['slug']}'\t\tUser Name: '#{user['name']}'"
|
|
88
|
+
end
|
|
89
|
+
|
|
90
|
+
puts
|
|
91
|
+
end
|
|
92
|
+
end
|
|
93
|
+
end
|
|
94
|
+
end
|
|
95
|
+
end
|
|
96
|
+
end
|
|
97
|
+
end
|
|
98
|
+
end
|
|
99
|
+
end
|
|
@@ -92,11 +92,13 @@ module Yawast
|
|
|
92
92
|
end
|
|
93
93
|
rescue ArgumentError => e
|
|
94
94
|
Yawast::Utilities.puts_error "Unable to find a matching element to perform the User Enumeration via Password Reset Response test (#{e.message})"
|
|
95
|
+
rescue => e # rubocop:disable Style/RescueStandardError
|
|
96
|
+
Yawast::Utilities.puts_error "Failed to execute Password Reset Page User Enumeration: Error: #{e.message}"
|
|
95
97
|
end
|
|
96
98
|
end
|
|
97
99
|
|
|
98
100
|
def self.fill_form_get_body(uri, user, valid, log_output)
|
|
99
|
-
options = Selenium::WebDriver::Chrome::Options.new({args: ['headless', 'incognito']})
|
|
101
|
+
options = Selenium::WebDriver::Chrome::Options.new({args: ['headless', 'incognito', 'disable-dev-shm-usage', 'no-sandbox']})
|
|
100
102
|
|
|
101
103
|
# if we have a proxy set, use that
|
|
102
104
|
if !Yawast.options.proxy.nil?
|
data/lib/scanner/ssl_labs.rb
CHANGED
|
@@ -391,6 +391,7 @@ module Yawast
|
|
|
391
391
|
elsif proto['name'] == 'TLS' && proto['version'] == '1.3'
|
|
392
392
|
# capture TLS 1.3 status
|
|
393
393
|
tls13_enabled = true
|
|
394
|
+
Yawast::Utilities.puts_info "\t\t\t#{proto['name']} #{proto['version']}"
|
|
394
395
|
Yawast::Shared::Output.log_hash 'vulnerabilities',
|
|
395
396
|
'tls_tls13_not_enabled',
|
|
396
397
|
{vulnerable: false}
|
data/lib/scanner/vuln_scan.rb
CHANGED
|
@@ -34,6 +34,11 @@ module Yawast
|
|
|
34
34
|
|
|
35
35
|
# check for framework specific issues
|
|
36
36
|
Yawast::Scanner::Plugins::Applications::Framework::Rails.check_all uri, links
|
|
37
|
+
|
|
38
|
+
wordpress_uri = Yawast::Scanner::Plugins::Applications::CMS::WordPress.identify uri
|
|
39
|
+
unless wordpress_uri.nil?
|
|
40
|
+
Yawast::Scanner::Plugins::Applications::CMS::WordPress.check_json_user_enum wordpress_uri
|
|
41
|
+
end
|
|
37
42
|
end
|
|
38
43
|
end
|
|
39
44
|
end
|
data/lib/shared/http.rb
CHANGED
|
@@ -45,8 +45,8 @@ module Yawast
|
|
|
45
45
|
res = req.request_get(uri, get_headers(headers))
|
|
46
46
|
body = res.read_body
|
|
47
47
|
code = res.code
|
|
48
|
-
rescue # rubocop:disable Style/RescueStandardError
|
|
49
|
-
|
|
48
|
+
rescue => e # rubocop:disable Style/RescueStandardError
|
|
49
|
+
Yawast::Utilities.puts_error "Error sending request to #{uri} - '#{e.message}'"
|
|
50
50
|
end
|
|
51
51
|
|
|
52
52
|
{body: body, code: code}
|
data/lib/version.rb
CHANGED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
[{"id":1,"name":"Adam Caudill","url":"https:\/\/adamcaudill.com","description":"","link":"https:\/\/underhandedcrypto.com\/author\/adam\/","slug":"adam","avatar_urls":{"24":"https:\/\/secure.gravatar.com\/avatar\/49e14cf9f67c48aad082dec4f106f19a?s=24&d=mm&r=g","48":"https:\/\/secure.gravatar.com\/avatar\/49e14cf9f67c48aad082dec4f106f19a?s=48&d=mm&r=g","96":"https:\/\/secure.gravatar.com\/avatar\/49e14cf9f67c48aad082dec4f106f19a?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"https:\/\/underhandedcrypto.com\/wp-json\/wp\/v2\/users\/1"}],"collection":[{"href":"https:\/\/underhandedcrypto.com\/wp-json\/wp\/v2\/users"}]}},{"id":2,"name":"Taylor Hornby","url":"https:\/\/defuse.ca\/","description":"","link":"https:\/\/underhandedcrypto.com\/author\/taylor\/","slug":"taylor","avatar_urls":{"24":"https:\/\/secure.gravatar.com\/avatar\/8b1f016c79a6b82740427da6fff77de2?s=24&d=mm&r=g","48":"https:\/\/secure.gravatar.com\/avatar\/8b1f016c79a6b82740427da6fff77de2?s=48&d=mm&r=g","96":"https:\/\/secure.gravatar.com\/avatar\/8b1f016c79a6b82740427da6fff77de2?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"https:\/\/underhandedcrypto.com\/wp-json\/wp\/v2\/users\/2"}],"collection":[{"href":"https:\/\/underhandedcrypto.com\/wp-json\/wp\/v2\/users"}]}}]
|
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
|
|
2
|
+
<!DOCTYPE html>
|
|
3
|
+
<!--[if IE 8]>
|
|
4
|
+
<html xmlns="http://www.w3.org/1999/xhtml" class="ie8" lang="en-US">
|
|
5
|
+
<![endif]-->
|
|
6
|
+
<!--[if !(IE 8) ]><!-->
|
|
7
|
+
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
|
|
8
|
+
<!--<![endif]-->
|
|
9
|
+
<head>
|
|
10
|
+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
|
11
|
+
<title>Log In ‹ Underhanded Crypto Contest — WordPress</title>
|
|
12
|
+
<link rel='dns-prefetch' href='//s.w.org' />
|
|
13
|
+
<link rel='stylesheet' href='https://underhandedcrypto.com/wp-admin/load-styles.php?c=0&dir=ltr&load%5B%5D=dashicons,buttons,forms,l10n,login&ver=4.9.8' type='text/css' media='all' />
|
|
14
|
+
<meta name='robots' content='noindex,follow' />
|
|
15
|
+
<meta name="viewport" content="width=device-width" />
|
|
16
|
+
<link rel="icon" href="https://underhandedcrypto.com/wp-content/uploads/2014/09/cropped-logo1-32x32.png" sizes="32x32" />
|
|
17
|
+
<link rel="icon" href="https://underhandedcrypto.com/wp-content/uploads/2014/09/cropped-logo1-192x192.png" sizes="192x192" />
|
|
18
|
+
<link rel="apple-touch-icon-precomposed" href="https://underhandedcrypto.com/wp-content/uploads/2014/09/cropped-logo1-180x180.png" />
|
|
19
|
+
<meta name="msapplication-TileImage" content="https://underhandedcrypto.com/wp-content/uploads/2014/09/cropped-logo1-270x270.png" />
|
|
20
|
+
</head>
|
|
21
|
+
<body class="login login-action-login wp-core-ui locale-en-us">
|
|
22
|
+
<div id="login">
|
|
23
|
+
<h1><a href="https://wordpress.org/" title="Powered by WordPress" tabindex="-1">Powered by WordPress</a></h1>
|
|
24
|
+
<form name="loginform" id="loginform" action="https://underhandedcrypto.com/wp-login.php" method="post">
|
|
25
|
+
<p>
|
|
26
|
+
<label for="user_login">Username or Email Address<br />
|
|
27
|
+
<input type="text" name="log" id="user_login" class="input" value="" size="20" /></label>
|
|
28
|
+
</p>
|
|
29
|
+
<p>
|
|
30
|
+
<label for="user_pass">Password<br />
|
|
31
|
+
<input type="password" name="pwd" id="user_pass" class="input" value="" size="20" /></label>
|
|
32
|
+
</p>
|
|
33
|
+
<p class="forgetmenot"><label for="rememberme"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> Remember Me</label></p>
|
|
34
|
+
<p class="submit">
|
|
35
|
+
<input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="Log In" />
|
|
36
|
+
<input type="hidden" name="redirect_to" value="https://underhandedcrypto.com/wp-admin/" />
|
|
37
|
+
<input type="hidden" name="testcookie" value="1" />
|
|
38
|
+
</p>
|
|
39
|
+
</form>
|
|
40
|
+
<p id="nav">
|
|
41
|
+
<a href="https://underhandedcrypto.com/wp-login.php?action=lostpassword">Lost your password?</a>
|
|
42
|
+
</p>
|
|
43
|
+
<script type="text/javascript">
|
|
44
|
+
function wp_attempt_focus(){
|
|
45
|
+
setTimeout( function(){ try{
|
|
46
|
+
d = document.getElementById('user_login');
|
|
47
|
+
d.focus();
|
|
48
|
+
d.select();
|
|
49
|
+
} catch(e){}
|
|
50
|
+
}, 200);
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
wp_attempt_focus();
|
|
54
|
+
if(typeof wpOnload=='function')wpOnload();
|
|
55
|
+
</script>
|
|
56
|
+
<p id="backtoblog"><a href="https://underhandedcrypto.com/">← Back to Underhanded Crypto Contest</a></p>
|
|
57
|
+
</div>
|
|
58
|
+
<link rel='stylesheet' id='jetpack_css-css' href='https://underhandedcrypto.com/wp-content/plugins/jetpack/css/jetpack.css?ver=6.4.2' type='text/css' media='all' />
|
|
59
|
+
<div class="clear"></div>
|
|
60
|
+
</body>
|
|
61
|
+
</html>
|
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
|
|
2
|
+
<!DOCTYPE html>
|
|
3
|
+
<!--[if IE 8]>
|
|
4
|
+
<html xmlns="http://www.w3.org/1999/xhtml" class="ie8" lang="en-US">
|
|
5
|
+
<![endif]-->
|
|
6
|
+
<!--[if !(IE 8) ]><!-->
|
|
7
|
+
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
|
|
8
|
+
<!--<![endif]-->
|
|
9
|
+
<head>
|
|
10
|
+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
|
11
|
+
<title>Log In ‹ Adam Caudill — WordPress</title>
|
|
12
|
+
<link rel='dns-prefetch' href='//s.w.org' />
|
|
13
|
+
<link rel='stylesheet' id='dashicons-css' href='https://adamcaudill.com/wp-includes/css/dashicons.min.css?ver=5.1.1' type='text/css' media='all' />
|
|
14
|
+
<link rel='stylesheet' id='buttons-css' href='https://adamcaudill.com/wp-includes/css/buttons.min.css?ver=5.1.1' type='text/css' media='all' />
|
|
15
|
+
<link rel='stylesheet' id='forms-css' href='https://adamcaudill.com/wp-admin/css/forms.min.css?ver=5.1.1' type='text/css' media='all' />
|
|
16
|
+
<link rel='stylesheet' id='l10n-css' href='https://adamcaudill.com/wp-admin/css/l10n.min.css?ver=5.1.1' type='text/css' media='all' />
|
|
17
|
+
<link rel='stylesheet' id='login-css' href='https://adamcaudill.com/wp-admin/css/login.min.css?ver=5.1.1' type='text/css' media='all' />
|
|
18
|
+
<meta name='robots' content='noindex,noarchive' />
|
|
19
|
+
<meta name='referrer' content='strict-origin-when-cross-origin' />
|
|
20
|
+
<meta name="viewport" content="width=device-width" />
|
|
21
|
+
</head>
|
|
22
|
+
<body class="login login-action-login wp-core-ui locale-en-us">
|
|
23
|
+
<div id="login">
|
|
24
|
+
<h1><a href="https://wordpress.org/" title="Powered by WordPress">Powered by WordPress</a></h1>
|
|
25
|
+
|
|
26
|
+
<form name="loginform" id="loginform" action="https://adamcaudill.com/wp-login.php" method="post">
|
|
27
|
+
<p>
|
|
28
|
+
<label for="user_login">Username or Email Address<br />
|
|
29
|
+
<input type="text" name="log" id="user_login" class="input" value="" size="20" autocapitalize="off" /></label>
|
|
30
|
+
</p>
|
|
31
|
+
<p>
|
|
32
|
+
<label for="user_pass">Password<br />
|
|
33
|
+
<input type="password" name="pwd" id="user_pass" class="input" value="" size="20" /></label>
|
|
34
|
+
</p>
|
|
35
|
+
<p>
|
|
36
|
+
<label title="If you don't have Google Authenticator enabled for your WordPress account, leave this field empty.">Google Authenticator code<span id="google-auth-info"></span><br />
|
|
37
|
+
<input type="text" name="googleotp" id="user_email" class="input" value="" size="20" style="ime-mode: inactive;" /></label>
|
|
38
|
+
</p>
|
|
39
|
+
<p class="forgetmenot"><label for="rememberme"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> Remember Me</label></p>
|
|
40
|
+
<p class="submit">
|
|
41
|
+
<input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="Log In" />
|
|
42
|
+
<input type="hidden" name="redirect_to" value="https://adamcaudill.com/wp-admin/" />
|
|
43
|
+
<input type="hidden" name="testcookie" value="1" />
|
|
44
|
+
</p>
|
|
45
|
+
</form>
|
|
46
|
+
|
|
47
|
+
<p id="nav">
|
|
48
|
+
<a href="https://adamcaudill.com/wp-login.php?action=lostpassword">Lost your password?</a>
|
|
49
|
+
</p>
|
|
50
|
+
|
|
51
|
+
<script type="text/javascript">
|
|
52
|
+
function wp_attempt_focus(){
|
|
53
|
+
setTimeout( function(){ try{
|
|
54
|
+
d = document.getElementById('user_login');
|
|
55
|
+
d.focus();
|
|
56
|
+
d.select();
|
|
57
|
+
} catch(e){}
|
|
58
|
+
}, 200);
|
|
59
|
+
}
|
|
60
|
+
|
|
61
|
+
wp_attempt_focus();
|
|
62
|
+
if(typeof wpOnload=='function')wpOnload();
|
|
63
|
+
</script>
|
|
64
|
+
|
|
65
|
+
<p id="backtoblog"><a href="https://adamcaudill.com/">
|
|
66
|
+
← Back to Adam Caudill </a></p>
|
|
67
|
+
|
|
68
|
+
</div>
|
|
69
|
+
|
|
70
|
+
|
|
71
|
+
|
|
72
|
+
<script type="text/javascript">
|
|
73
|
+
try{
|
|
74
|
+
document.getElementById('user_email').setAttribute('autocomplete','off');
|
|
75
|
+
} catch(e){}
|
|
76
|
+
</script>
|
|
77
|
+
<link rel='stylesheet' id='jetpack_css-css' href='https://adamcaudill.com/wp-content/plugins/jetpack/css/jetpack.css?ver=7.1.1' type='text/css' media='all' />
|
|
78
|
+
<div class="clear"></div>
|
|
79
|
+
</body>
|
|
80
|
+
</html>
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
require 'webrick'
|
|
2
|
+
require File.dirname(__FILE__) + '/../lib/yawast'
|
|
3
|
+
require File.dirname(__FILE__) + '/base'
|
|
4
|
+
|
|
5
|
+
class TestAppCMSWordPress < Minitest::Test
|
|
6
|
+
include TestBase
|
|
7
|
+
|
|
8
|
+
def test_identify_wp_551
|
|
9
|
+
override_stdout
|
|
10
|
+
|
|
11
|
+
port = rand(60000) + 1024 # pick a random port number
|
|
12
|
+
server = start_web_server File.dirname(__FILE__) + '/data/wp-login-5.1.1.txt', '', port
|
|
13
|
+
uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
|
|
14
|
+
|
|
15
|
+
error = nil
|
|
16
|
+
begin
|
|
17
|
+
Yawast::Shared::Http.setup nil, nil
|
|
18
|
+
Yawast::Scanner::Plugins::Applications::CMS::WordPress.identify uri
|
|
19
|
+
rescue => e
|
|
20
|
+
error = e.message
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
assert stdout_value.include?('Found WordPress v5.1.1'), "WordPress version not found: #{stdout_value}"
|
|
24
|
+
assert error == nil, "Unexpected error: #{error}"
|
|
25
|
+
|
|
26
|
+
restore_stdout
|
|
27
|
+
|
|
28
|
+
server.exit
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
def test_identify_wp_498
|
|
32
|
+
override_stdout
|
|
33
|
+
|
|
34
|
+
port = rand(60000) + 1024 # pick a random port number
|
|
35
|
+
server = start_web_server File.dirname(__FILE__) + '/data/wp-login-4.9.8.txt', '', port
|
|
36
|
+
uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
|
|
37
|
+
|
|
38
|
+
error = nil
|
|
39
|
+
begin
|
|
40
|
+
Yawast::Shared::Http.setup nil, nil
|
|
41
|
+
Yawast::Scanner::Plugins::Applications::CMS::WordPress.identify uri
|
|
42
|
+
rescue => e
|
|
43
|
+
error = e.message
|
|
44
|
+
end
|
|
45
|
+
|
|
46
|
+
assert stdout_value.include?('Found WordPress v4.9.8'), "WordPress version not found: #{stdout_value}"
|
|
47
|
+
assert error == nil, "Unexpected error: #{error}"
|
|
48
|
+
|
|
49
|
+
restore_stdout
|
|
50
|
+
|
|
51
|
+
server.exit
|
|
52
|
+
end
|
|
53
|
+
|
|
54
|
+
def test_wp_json_enum
|
|
55
|
+
override_stdout
|
|
56
|
+
|
|
57
|
+
port = rand(60000) + 1024 # pick a random port number
|
|
58
|
+
server = start_web_server File.dirname(__FILE__) + '/data/wp-json-users.txt', '', port
|
|
59
|
+
uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
|
|
60
|
+
|
|
61
|
+
error = nil
|
|
62
|
+
begin
|
|
63
|
+
Yawast::Shared::Http.setup nil, nil
|
|
64
|
+
Yawast::Scanner::Plugins::Applications::CMS::WordPress.check_json_user_enum uri
|
|
65
|
+
rescue => e
|
|
66
|
+
error = e.message
|
|
67
|
+
end
|
|
68
|
+
|
|
69
|
+
assert stdout_value.include?('WordPress WP-JSON User Enumeration at'), "WordPress WP-JSON User Enum not found: #{stdout_value}"
|
|
70
|
+
assert error == nil, "Unexpected error: #{error}"
|
|
71
|
+
|
|
72
|
+
restore_stdout
|
|
73
|
+
|
|
74
|
+
server.exit
|
|
75
|
+
end
|
|
76
|
+
end
|
data/test/test_app_fw_rails.rb
CHANGED
data/test/test_ssl_sweet32.rb
CHANGED
|
@@ -4,26 +4,26 @@ require File.dirname(__FILE__) + '/base'
|
|
|
4
4
|
class TestSharedHttp < Minitest::Test
|
|
5
5
|
include TestBase
|
|
6
6
|
|
|
7
|
-
def test_check_tdes
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
end
|
|
17
|
-
|
|
18
|
-
def test_session_count
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
end
|
|
7
|
+
# def test_check_tdes
|
|
8
|
+
# override_stdout
|
|
9
|
+
#
|
|
10
|
+
# res = Yawast::Scanner::Plugins::SSL::Sweet32.check_tdes
|
|
11
|
+
#
|
|
12
|
+
# assert stdout_value.include?('OpenSSL supports 3DES'), "Header line not found in #{stdout_value}"
|
|
13
|
+
# assert res, '3DES support check failed'
|
|
14
|
+
#
|
|
15
|
+
# restore_stdout
|
|
16
|
+
# end
|
|
17
|
+
#
|
|
18
|
+
# def test_session_count
|
|
19
|
+
# override_stdout
|
|
20
|
+
#
|
|
21
|
+
# uri = URI::Parser.new.parse 'https://3des.badssl.com/'
|
|
22
|
+
# Yawast::Scanner::Plugins::SSL::Sweet32.get_tdes_session_msg_count uri, 1
|
|
23
|
+
#
|
|
24
|
+
# assert stdout_value.include?('Connection not terminated after'), "SWEET32 warning not found in #{stdout_value}"
|
|
25
|
+
#
|
|
26
|
+
# restore_stdout
|
|
27
|
+
# end
|
|
28
28
|
|
|
29
29
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: yawast
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.7.0
|
|
4
|
+
version: 0.7.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Adam Caudill
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-04-
|
|
11
|
+
date: 2019-04-19 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|
|
@@ -225,6 +225,7 @@ files:
|
|
|
225
225
|
- lib/scanner/core.rb
|
|
226
226
|
- lib/scanner/generic.rb
|
|
227
227
|
- lib/scanner/plugins/applications/cms/generic.rb
|
|
228
|
+
- lib/scanner/plugins/applications/cms/wordpress.rb
|
|
228
229
|
- lib/scanner/plugins/applications/framework/rails.rb
|
|
229
230
|
- lib/scanner/plugins/applications/generic/password_reset.rb
|
|
230
231
|
- lib/scanner/plugins/dns/caa.rb
|
|
@@ -274,6 +275,10 @@ files:
|
|
|
274
275
|
- test/data/ssl_labs_info.json
|
|
275
276
|
- test/data/tomcat_release_notes.txt
|
|
276
277
|
- test/data/wordpress_readme_html.txt
|
|
278
|
+
- test/data/wp-json-users.txt
|
|
279
|
+
- test/data/wp-login-4.9.8.txt
|
|
280
|
+
- test/data/wp-login-5.1.1.txt
|
|
281
|
+
- test/test_app_cms_wp.rb
|
|
277
282
|
- test/test_app_fw_rails.rb
|
|
278
283
|
- test/test_cmd_util.rb
|
|
279
284
|
- test/test_directory_search.rb
|
|
@@ -312,9 +317,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
312
317
|
version: '0'
|
|
313
318
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
314
319
|
requirements:
|
|
315
|
-
- - "
|
|
320
|
+
- - ">="
|
|
316
321
|
- !ruby/object:Gem::Version
|
|
317
|
-
version:
|
|
322
|
+
version: '0'
|
|
318
323
|
requirements: []
|
|
319
324
|
rubyforge_project: yawast
|
|
320
325
|
rubygems_version: 2.6.14
|
|
@@ -343,6 +348,10 @@ test_files:
|
|
|
343
348
|
- test/data/ssl_labs_info.json
|
|
344
349
|
- test/data/tomcat_release_notes.txt
|
|
345
350
|
- test/data/wordpress_readme_html.txt
|
|
351
|
+
- test/data/wp-json-users.txt
|
|
352
|
+
- test/data/wp-login-4.9.8.txt
|
|
353
|
+
- test/data/wp-login-5.1.1.txt
|
|
354
|
+
- test/test_app_cms_wp.rb
|
|
346
355
|
- test/test_app_fw_rails.rb
|
|
347
356
|
- test/test_cmd_util.rb
|
|
348
357
|
- test/test_directory_search.rb
|