Class: Yawast::Scanner::Plugins::Applications::CMS::WordPress

Inherits:
Object
  • Object
show all
Defined in:
lib/scanner/plugins/applications/cms/wordpress.rb

Class Method Summary collapse

Class Method Details

.check_json_user_enum(uri) ⇒ Object 



62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
 
# File 'lib/scanner/plugins/applications/cms/wordpress.rb', line 62

def self.check_json_user_enum(uri)
  Yawast::Shared::Output.log_hash 'vulnerabilities',
                                  'wordpress_json_user_enum',
                                  {vulnerable: false, users: nil}

  json_uri = uri.copy
  json_uri.path = json_uri.path + 'wp-json/wp/v2/users'
  res = Yawast::Shared::Http.get_with_code json_uri

  if res[:code] == '200' && res[:body].include?('slug')
    # we have a likely hit
    users = nil
    begin
      users = JSON.parse res[:body]
    rescue # rubocop:disable Style/RescueStandardError, Lint/HandleExceptions
      # don't care why it failed
    end

    unless users.nil?
      Yawast::Shared::Output.log_hash 'vulnerabilities',
                                      'wordpress_json_user_enum',
                                      {vulnerable: true, users: users}
      Yawast::Utilities.puts_warn "WordPress WP-JSON User Enumeration at #{json_uri}"

      users.each do |user|
        Yawast::Utilities.puts_raw "ID: #{user['id']}\tUser Slug: '#{user['slug']}'\t\tUser Name: '#{user['name']}'"
      end

      puts
    end
  end
end

.identify(uri) ⇒ Object

check to see if we can confirm the presence of WordPress



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/scanner/plugins/applications/cms/wordpress.rb', line 10

def self.identify(uri)
  ret = nil

  # check for wp-login.php in the current directory
  resp = identify_by_path uri, uri.path

  if resp.nil?
    # if we don't get a hit at the current path, try under /blog/
    resp = identify_by_path uri, uri.path + 'blog/'
  end

  unless resp.nil?
    # confirmed hit
    res = resp[:result]
    ret = resp[:uri]

    # strip the file name from the path
    ret.path = ret.path.sub! 'wp-login.php', ''

    css = res[:body].scan /login.min.css\?ver=\d+\.\d+\.?\d*/

    ver = 'Unknown'
    if !css.count.zero?
      ver = css[0].to_s.split('=')[1]
    else
      # the current method doesn't work, fall back to an older method
      css = res[:body].scan /load-styles.php\?[\w\,\;\=\&\%]+;ver=\d+\.\d+\.?\d*/
      ver = css[0].to_s.split('=')[-1] unless css.count.zero?
    end

    Yawast::Utilities.puts_info "Found WordPress v#{ver} at #{ret}"
    Yawast::Shared::Output.log_value 'application', 'wordpress', 'uri', ret
    Yawast::Shared::Output.log_value 'application', 'wordpress', 'version', ver
    Yawast::Shared::Output.log_value 'application', 'wordpress', 'login_body', res[:body]
  end

  ret
end

.identify_by_path(uri, path) ⇒ Object 



49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/scanner/plugins/applications/cms/wordpress.rb', line 49

def self.identify_by_path(uri, path)
   = uri.copy
  .path = path + 'wp-login.php'

  res = Yawast::Shared::Http.get_with_code 

  if res[:code] == '200' && res[:body].include?('Powered by WordPress')
    return {result: res, uri: }
  else
    return nil
  end
end