26 | --
27 | -- @output
28 | -- PORT STATE SERVICE
29 | -- 80/tcp open http
30 | -- | http-wordpress-info:
31 | -- | version: WordPress 4.0
32 | -- | theme: canvas
33 | -- | plugins:
34 | -- | w3-total-cache
35 | -- |_ simple-tooltips
36 |
37 | -- @args http-wordpress-info.path Specify the path you want to check for a generator meta tag (default to '/').
38 | -- @args http-wordpress-info.redirects Specify the maximum number of redirects to follow (defaults to 3).
39 |
40 | portrule = shortport.http
41 |
42 | local follow_redirects = function(host, port, path, n)
43 | local loc
44 | local pattern = "^[hH][tT][tT][pP]/1.[01] 30[12]"
45 | local response = http.get(host, port, path)
46 | while (response['status-line'] or ""):match(pattern) and n > 0 do
47 | n = n - 1
48 | loc = response.header['location']
49 | response = http.get_url(loc)
50 | end
51 | return response, loc
52 | end
53 |
54 | -- unique key for plugin slug
55 | -- can check multiple matches in value {}
56 | local plugin_patterns = {
57 | ["autoptimize"] = {"autoptimize/js","autoptimize/css"},
58 | ["w3-total-cache"] = {"by W3 Total Cache"},
59 | ["wp-super-cache"] = {" generated by WP-Super-Cache"},
60 | ["wordpress-seo"] = {"optimized with the Yoast SEO plugin"},
61 | ["wordpress-seo-premium"] = {"optimized with the Yoast SEO Premium plugin"},
62 | ["all-in-one-seo-pack"] = {"-- All in One SEO Pack"},
63 | ["ubermenu"] = {"UberMenu CSS"},
64 | ["hyper-cache"] = {"-- hyper cache 20"},
65 | ["cookie-notice"] = {"Cookie Notice plugin"},
66 | ["imp-download"] = {"Powered by iMP Download"},
67 | ["optinmonster"] = {"-- This site is converting visitors into subscribers and customers with OptinMonster"},
68 | ["duracelltomi-google-tag-manager"] = {"for WordPress by gtm4wp.com"},
69 | ["woocommerce"] = {"generator[\"\'] content=[\"\']WooCommerce"},
70 | ["custom-css-js"] = {"Simple Custom CSS and JS"},
71 | ["simple-social-buttons"] = {"Tags generated by Simple Social Buttons"},
72 | ["contact-form-7"] = {"var wpcf7 ="},
73 | ["jetpack"] = {"-- Jetpack Open Graph Tags --","Jetpack Site Verification Tags --","jetpack.js"},
74 | ["wp-rocket"] = {"-- This website is like a Rocket,"},
75 | ["autodescription"] = {"The SEO Framework by Sybre Waaijer --"},
76 | ["slider-revolution"] = {"-->',
122 | 'wp-includes/js/wp-embed.min.js?ver=([.0-9]+)',
123 | 'wp-includes/js/comment-reply.min.js?ver=([.0-9]+)',
124 | 'wp-emoji-release.min.js?ver=([.0-9]+)',
125 | 'wp-includes/css/dist/block-library/style.min.css?ver=([.0-9]+)'}
126 | for key, pattern in pairs(patterns) do
127 | -- make pattern case-insensitive
128 | pattern = pattern:gsub("%a", function (c)
129 | return string.format("[%s%s]", string.lower(c),
130 | string.upper(c))
131 | end)
132 | if wpver == nil then
133 | wpver = response.body:match(pattern)
134 | end
135 | end
136 | -- Find version in /feed/atom/ default XML feed if no other match in html
137 | if ( not wpver and response.body:match("wp%-")) then
138 | local feedpattern = 'generator uri="https://wordpress.org/" version="([.0-9]*)'
139 | feedpath = path .. 'feed/atom/'
140 | -- if redirect occured get feed from loc
141 | if not loc then
142 | feedresponse = http.get(host, port, feedpath)
143 | else
144 | feedresponse = http.get_url(loc)
145 | end
146 | if ( feedresponse and feedresponse.body ) then
147 | wpver = feedresponse.body:match(feedpattern)
148 | end
149 | end
150 | return wpver
151 | end
152 |
153 | -- php version from headers only
154 | -- http-php-version.nse makes additional requests
155 | function php_version_check (response)
156 | local phpmatch = 'PHP/([0-9.]+)'
157 | local phpver
158 | for name, value in pairs(response.header) do
159 | if value:match(phpmatch) then
160 | phpver = value:match(phpmatch)
161 | end
162 | end
163 | return(phpver)
164 | end
165 |
166 | -- server header only (good if not using -sV to increase speed)
167 | function server_check (headers)
168 | local servermatch = '([a-zA-Z%-%/%)%(0-9.% ]+)'
169 | local server
170 | for name, value in pairs(headers) do
171 | if value:match(servermatch) and name == "server" then
172 | server = value:match(servermatch)
173 | end
174 | end
175 | return(server)
176 | end
177 |
178 |
179 |
180 | action = function(host, port)
181 | local response, loc, generator, testcheck, plugins, themes, wpversion, phpversion, servercheck
182 | local path = stdnse.get_script_args('http-wordpress-info.path') or '/'
183 | local redirects = stdnse.get_script_args('http-wordpress-info.redirects') or 3
184 | local output_tab = stdnse.output_table()
185 |
186 | -- Find Version in "meta generator tag"
187 | local themematch = 'wp%-content/themes/([0-9a-zA-Z%-]+)'
188 |
189 | -- Get HTML to check for WordPress installation
190 | response, loc = follow_redirects( host, port, path, redirects )
191 |
192 | stdnse.debug1("HTTP Status: %s", response["status-line"])
193 | output_tab.status = response["status"]
194 | output_tab.redirect = loc
195 | if ( response and response.body ) then
196 | wpversion = wp_version_check(response, host, port, path, loc)
197 | themes = response.body:match(themematch)
198 | plugins = parse_plugins_response(response.body, plugin_patterns)
199 | phpversion = php_version_check(response)
200 | servercheck = server_check(response.header)
201 |
202 | -- Store results in output table
203 | -- output_tab.testing = feedresponse.body
204 | if wpversion then
205 | output_tab.version = 'WordPress ' .. wpversion
206 | else
207 | if (response.body:match("wp%-json") or response.body:match("wp%-admin") or response.body:match("wp%-includes") or response.body:match("wp%-content")) and not wpversion then
208 | output_tab.version = 'WordPress ???'
209 | end
210 | end
211 | if ( themes and #themes > 0 ) then
212 | output_tab.theme = themes
213 | end
214 | if ( plugins and #plugins > 0 ) then
215 | output_tab.plugins = plugins
216 | end
217 | if ( phpversion ) then
218 | output_tab.php = phpversion
219 | end
220 | if ( servercheck ) then
221 | output_tab.server = servercheck
222 | end
223 | end
224 | if ( output_tab.version or output_tab.plugins or output_tab.theme or output_tab.status ) then
225 | return output_tab
226 | end
227 | end
228 |
--------------------------------------------------------------------------------
/http-wordpress-plugins.nse:
--------------------------------------------------------------------------------
1 | local coroutine = require "coroutine"
2 | local http = require "http"
3 | local io = require "io"
4 | local nmap = require "nmap"
5 | local shortport = require "shortport"
6 | local stdnse = require "stdnse"
7 | local string = require "string"
8 | local table = require "table"
9 |
10 | description = [[
11 | Tries to obtain a list of installed WordPress plugins by brute force
12 | testing for known plugins.
13 |
14 | The script will brute force the /wp-content/plugins/ folder with a dictionary
15 | of 14K (and counting) known WP plugins. Anything but a 404 means that a given
16 | plugin directory probably exists, so the plugin probably also does.
17 |
18 | The available plugins for Wordpress is huge and despite the efforts of Nmap to
19 | parallelize the queries, a whole search could take an hour or so. That's why
20 | the plugin list is sorted by popularity and by default the script will only
21 | check the first 100 ones. Users can tweak this with an option (see below).
22 | ]]
23 |
24 | ---
25 | -- @args http-wordpress-plugins.root If set, points to the blog root directory on the website. If not, the script will try to find a WP directory installation or fall back to root.
26 | -- @args http-wordpress-plugins.search As the plugins list contains tens of thousand of plugins, this script will only search the 100 most popular ones by default.
27 | -- Use this option with a number or "all" as an argument for a more comprehensive brute force.
28 | -- @args http-wordpress-plugins.apicheck Set to true or false to enable the API latest version check. The check gets the latest version of the plugin from the wordpress.org plugin API. Default is true.
29 | --
30 | -- @usage
31 | -- nmap --script=http-wordpress-plugins --script-args http-wordpress-plugins.root="/blog/",http-wordpress-plugins.search=500
32 | --
33 | --@output
34 | -- Interesting ports on my.woot.blog (123.123.123.123):
35 | -- PORT STATE SERVICE REASON
36 | -- 80/tcp open http syn-ack
37 | -- | http-wordpress-plugins:
38 | -- | search amongst the 500 most popular plugins
39 | -- | akismet 3.0.4 (latest version: 3.0.4)
40 | -- | wordpress-seo 1.7 (latest version: 1.7.1)
41 | -- | disqus-comment-system 2.83 (latest version: 2.84)
42 | -- |_ wp-to-twitter 1.2 (latest version: 1.45)
43 |
44 | author = "Ange Gutek"
45 |
46 | license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
47 |
48 | categories = {"discovery", "intrusive"}
49 |
50 |
51 | local DEFAULT_PLUGINS_SEARCH = 100
52 |
53 |
54 | portrule = shortport.service("http")
55 |
56 | local function read_data_file(file)
57 | return coroutine.wrap(function()
58 | for line in file:lines() do
59 | if not line:match("^%s*#") and not line:match("^%s*$") then
60 | coroutine.yield(line)
61 | end
62 | end
63 | end)
64 | end
65 |
66 | action = function(host, port)
67 |
68 | local result = {}
69 | local all = {}
70 | local bfqueries = {}
71 |
72 | --Check if the wp plugins list exists
73 | local wp_plugins_file = nmap.fetchfile("nselib/data/wp-plugins.lst")
74 | if not wp_plugins_file then
75 | return false, "Couldn't find wp-plugins.lst (should be in nselib/data)"
76 | end
77 |
78 | local file = io.open(wp_plugins_file, "r")
79 | if not file then
80 | return false, "Couldn't find wp-plugins.lst (should be in nselib/data)"
81 | end
82 |
83 | local wp_autoroot
84 | local wp_root = stdnse.get_script_args("http-wordpress-plugins.root")
85 | local plugins_search = DEFAULT_PLUGINS_SEARCH
86 | local plugins_search_arg = stdnse.get_script_args("http-wordpress-plugins.search")
87 | local apicheck = stdnse.get_script_args("http-wordpress-plugins.apicheck") or "true"
88 |
89 | if plugins_search_arg == "all" then
90 | plugins_search = nil
91 | elseif plugins_search_arg then
92 | plugins_search = tonumber(plugins_search_arg)
93 | end
94 |
95 | stdnse.print_debug(1, "%s plugins search range: %s", SCRIPT_NAME, plugins_search or "unlimited")
96 |
97 |
98 | -- search the website root for evidences of a Wordpress path
99 | if not wp_root then
100 | local target_index = http.get(host,port, "/")
101 |
102 | if target_index.status and target_index.body then
103 | wp_autoroot = string.match(target_index.body, "http://[%w%-%.]-/([%w%-%./]-)wp%-content")
104 | if wp_autoroot then
105 | wp_autoroot = "/" .. wp_autoroot
106 | stdnse.print_debug(1, "%s WP root directory: %s", SCRIPT_NAME, wp_autoroot)
107 | else
108 | stdnse.print_debug(1, "%s WP root directory: wp_autoroot was unable to find a WP content dir (root page returns %d).", SCRIPT_NAME, target_index.status)
109 | end
110 | end
111 | end
112 |
113 |
114 | --identify the 404
115 | local status_404, result_404, body_404 = http.identify_404(host, port)
116 | if not status_404 then
117 | return stdnse.format_output(false, SCRIPT_NAME .. " unable to handle 404 pages (" .. result_404 .. ")")
118 | end
119 |
120 |
121 | --build a table of both directories to brute force and the corresponding WP plugins' name
122 | local plugin_count = 0
123 | for line in read_data_file(file) do
124 | if plugins_search and plugin_count >= plugins_search then
125 | break
126 | end
127 |
128 | local target
129 | if wp_root then
130 | -- Give user-supplied argument the priority
131 | target = wp_root .. "/wp-content/plugins/" .. line .. "/"
132 | elseif wp_autoroot then
133 | -- Maybe the script has discovered another Wordpress content directory
134 | target = wp_autoroot .. "wp-content/plugins/" .. line .. "/"
135 | else
136 | -- Default WP directory is root
137 | target = "/wp-content/plugins/" .. line .. "/"
138 | end
139 |
140 |
141 | target = string.gsub(target, "//", "/")
142 | table.insert(bfqueries, {target, line})
143 | all = http.pipeline_add(target, nil, all, "GET")
144 | plugin_count = plugin_count + 1
145 |
146 | end
147 |
148 | -- release hell...
149 | local pipeline_returns = http.pipeline_go(host, port, all)
150 | if not pipeline_returns then
151 | stdnse.print_debug(1, "%s : got no answers from pipelined queries", SCRIPT_NAME)
152 | end
153 |
154 | for i, data in pairs(pipeline_returns) do
155 | -- if it's not a four-'o-four, it probably means that the plugin is present
156 | if http.page_exists(data, result_404, body_404, bfqueries[i][1], true) then
157 | stdnse.print_debug(1, "http-wordpress-plugins.nse: Found a plugin: %s", bfqueries[i][2])
158 |
159 | -- now try and get the version of the plugin from readme.txt
160 | readmepath = bfqueries[i][1] .. "readme.txt"
161 | local pluginversion = nil
162 | local latestpluginapi = nil
163 | pluginfound = nil
164 | stdnse.print_debug(1, "http-wordpress-plugins.nse: Readme path: %s", readmepath)
165 | local readmecheck = http.get(host, port, readmepath)
166 | local readmepattern = 'Stable tag: ([.0-9]*)'
167 | local pluginversion = readmecheck.body:match(readmepattern)
168 | if pluginversion then
169 | if apicheck == "true" then
170 | local apiurl = "http://api.wordpress.org/plugins/info/1.0/" .. bfqueries[i][2] .. ".json"
171 | local latestpluginapi = http.get('api.wordpress.org', '80', apiurl)
172 | local latestpluginpattern = '","version":"([.0-9]*)'
173 | local latestpluginversion = latestpluginapi.body:match(latestpluginpattern)
174 | stdnse.print_debug(1, "http-wordpress-plugins.nse: latest version check : %s", latestpluginversion)
175 | if latestpluginversion then
176 | pluginversion = pluginversion .. " (latest version: " .. latestpluginversion .. ")"
177 | end
178 | end
179 | pluginfound = bfqueries[i][2] .. " " .. pluginversion
180 | else
181 | pluginfound = bfqueries[i][2]
182 | end
183 |
184 | table.insert(result, pluginfound)
185 | end
186 | end
187 |
188 |
189 | if #result > 0 then
190 | result.name = "search amongst the " .. plugin_count .. " most popular plugins"
191 | return stdnse.format_output(true, result)
192 | else
193 | return "nothing found amongst the " .. plugin_count .. " most popular plugins, use --script-args http-wordpress-plugins.search= for deeper analysis)\n"
194 | end
195 |
196 | end
197 |
198 |
--------------------------------------------------------------------------------
/http-wordpress-themes.nse:
--------------------------------------------------------------------------------
1 | local coroutine = require "coroutine"
2 | local http = require "http"
3 | local io = require "io"
4 | local nmap = require "nmap"
5 | local shortport = require "shortport"
6 | local stdnse = require "stdnse"
7 | local string = require "string"
8 | local table = require "table"
9 |
10 | description = [[
11 | Discover a list of installed WordPress themes. Brute force of the theme path
12 | /wp-content/themes/$themename/ testing for known themes. As seen in the widespread
13 | timthumb vulnerability themes installed but not activated can still be exploited.
14 |
15 | After detection of a valid theme path, the script will attempt to GET the style.css
16 | of the theme. This is a standard file in WordPress themes that contains the theme
17 | version, if found the version will be included in the output.
18 |
19 | The theme list has been created and sorted by theme popularity after crawling the
20 | top 1 million sites. Also includes themes from wordpress.org. Anything but a 404
21 | means that a given theme directory probably exists, so the theme probably also does.
22 |
23 | The available themes for Wordpress is huge and despite the efforts of Nmap to
24 | parallelize the queries, a whole search could take an hour or so. That's why
25 | the theme list is sorted by popularity and by default the script will only
26 | check the first 100 ones. Users can tweak this with an option (see below).
27 |
28 | NSE Script is a clone of the http-wordpress-plugins.nse script by Ange Gutek.
29 | ]]
30 |
31 | ---
32 | -- @args http-wordpress-themes.root If set, points to the blog root directory on the website. If not, the script will try to find a WP directory installation or fall back to root.
33 | -- @args http-wordpress-themes.search As the themes list contains about 3000 themes, this script will only search the 100 most popular ones by default.
34 | -- Use this option with a number or "all" as an argument for a more comprehensive brute force.
35 | --
36 | -- @usage
37 | -- nmap --script=http-wordpress-themes --script-args http-wordpress-themes.root="/blog/",http-wordpress-themes.search=500
38 | --
39 | --@output
40 | -- Interesting ports on my.woot.blog (123.123.123.123):
41 | -- PORT STATE SERVICE REASON
42 | -- 80/tcp open http syn-ack
43 | -- | http-wordpress-themes:
44 | -- | search amongst the 500 most popular themes
45 | -- | twentyfourteen 1.3
46 | -- | canvas 5.8.7
47 | -- |_ twentytwelve 1.5
48 | --
49 | -- Created 18/10/2014 - v0.1 - created (and themes crawled) by Peter Hill
50 |
51 | author = "Peter Hill "
52 |
53 | license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
54 |
55 | categories = {"discovery", "intrusive"}
56 |
57 |
58 | local DEFAULT_THEME_SEARCH = 100
59 |
60 |
61 | portrule = shortport.service("http")
62 |
63 | local function read_data_file(file)
64 | return coroutine.wrap(function()
65 | for line in file:lines() do
66 | if not line:match("^%s*#") and not line:match("^%s*$") then
67 | coroutine.yield(line)
68 | end
69 | end
70 | end)
71 | end
72 |
73 | action = function(host, port)
74 |
75 | local result = {}
76 | local all = {}
77 | local bfqueries = {}
78 |
79 | --Check if the wp themes list exists
80 | local wp_themes_file = nmap.fetchfile("nselib/data/wp-themes.lst")
81 | if not wp_themes_file then
82 | return false, "Couldn't find wp-themes.lst (should be in nselib/data)"
83 | end
84 |
85 | local file = io.open(wp_themes_file, "r")
86 | if not file then
87 | return false, "Couldn't find wp-themes.lst (should be in nselib/data)"
88 | end
89 |
90 | local wp_autoroot
91 | local wp_root = stdnse.get_script_args("http-wordpress-themes.root")
92 | local themes_search = DEFAULT_THEME_SEARCH
93 | local themes_search_arg = stdnse.get_script_args("http-wordpress-themes.search")
94 |
95 | if themes_search_arg == "all" then
96 | themes_search = nil
97 | elseif themes_search_arg then
98 | themes_search = tonumber(themes_search_arg)
99 | end
100 |
101 | stdnse.print_debug(1, "%s themes search range: %s", SCRIPT_NAME, themes_search or "unlimited")
102 |
103 |
104 | -- search the website root for evidences of a Wordpress path
105 | if not wp_root then
106 | local target_index = http.get(host,port, "/")
107 |
108 | if target_index.status and target_index.body then
109 | wp_autoroot = string.match(target_index.body, "http://[%w%-%.]-/([%w%-%./]-)wp%-content")
110 | if wp_autoroot then
111 | wp_autoroot = "/" .. wp_autoroot
112 | stdnse.print_debug(1, "%s WP root directory: %s", SCRIPT_NAME, wp_autoroot)
113 | else
114 | stdnse.print_debug(1, "%s WP root directory: wp_autoroot was unable to find a WP content dir (root page returns %d).", SCRIPT_NAME, target_index.status)
115 | end
116 | end
117 | end
118 |
119 |
120 | --identify the 404
121 | local status_404, result_404, body_404 = http.identify_404(host, port)
122 | if not status_404 then
123 | return stdnse.format_output(false, SCRIPT_NAME .. " unable to handle 404 pages (" .. result_404 .. ")")
124 | end
125 |
126 |
127 | --build a table of both directories to brute force and the corresponding WP themes' name
128 | local theme_count = 0
129 | for line in read_data_file(file) do
130 | if themes_search and theme_count >= themes_search then
131 | break
132 | end
133 |
134 | local target
135 | if wp_root then
136 | -- Give user-supplied argument the priority
137 | target = wp_root .. "/wp-content/themes/" .. line .. "/"
138 | elseif wp_autoroot then
139 | -- Maybe the script has discovered another Wordpress content directory
140 | target = wp_autoroot .. "wp-content/themes/" .. line .. "/"
141 | else
142 | -- Default WP directory is root
143 | target = "/wp-content/themes/" .. line .. "/"
144 | end
145 |
146 |
147 | target = string.gsub(target, "//", "/")
148 | table.insert(bfqueries, {target, line})
149 | all = http.pipeline_add(target, nil, all, "GET")
150 | theme_count = theme_count + 1
151 |
152 | end
153 |
154 | -- release hell...
155 | local pipeline_returns = http.pipeline_go(host, port, all)
156 | if not pipeline_returns then
157 | stdnse.print_debug(1, "%s : got no answers from pipelined queries", SCRIPT_NAME)
158 | end
159 |
160 | for i, data in pairs(pipeline_returns) do
161 | -- if it's not a four-'o-four, it probably means that the theme is present
162 | if http.page_exists(data, result_404, body_404, bfqueries[i][1], true) then
163 | stdnse.print_debug(1, "http-wordpress-themes.nse: Found a theme: %s", bfqueries[i][2])
164 |
165 | -- now try and get the version of the plugin from readme.txt
166 | stylecsspath = bfqueries[i][1] .. "style.css"
167 | local themeversion = nil
168 | themefound = nil
169 | stdnse.print_debug(1, "http-wordpress-plugins.nse: Style CSS path: %s", stylecsspath)
170 | local themeversioncheck = http.get(host, port, stylecsspath)
171 | local versionpattern = 'Version: ([.0-9]*)'
172 | local themeversion = themeversioncheck.body:match(versionpattern)
173 | if themeversion then
174 | themefound = bfqueries[i][2] .. " " .. themeversion
175 | else
176 | themefound = bfqueries[i][2]
177 | end
178 |
179 | table.insert(result, themefound)
180 | end
181 | end
182 |
183 |
184 | if #result > 0 then
185 | result.name = "search amongst the " .. theme_count .. " most popular themes"
186 | return stdnse.format_output(true, result)
187 | else
188 | return "nothing found amongst the " .. theme_count .. " most popular themes, use --script-args http-wordpress-themes.search= for deeper analysis)\n"
189 | end
190 |
191 | end
192 |
193 |
--------------------------------------------------------------------------------