Comments (6)
Thanks for the info.
Just to clarify. An invalid plugin redirects you back to the main site?
http://targetsite.com/wp-content/plugins/this-is-not-a-plugin/ => http://targetsite.com/
If so, this could probably be fixed by taking a hash of the index page and then comparing it against the plugin enumeration response. Like we do with the 404 hash.
from wpscan.
Yeah, that is correct.
A GET Request to: http://www.target.com/wp-content/plugins/not-a-plugin/
returns you the content of the index page. However, the URL in the browser still remains:
http://www.target.com/wp-content/plugins/not-a-plugin/
It doesn't actually redirect you to http://target.com/index.php however the content is the same as that of index.php
Probably some sort of URL rewrite done on the server side.
For a valid plugin it will return a 403 forbidden response.
I saved the index.html and then the invalid plugin response and they are the same :)
I think you are correct, if we compare the hash of the index page with that of the invalid plugin response, we can filter the false positives.
from wpscan.
Does this only happen for wp-table and wp-table-reloaded or were they just examples ?
from wpscan.
This happens for any plugin that does not exist on that wordpress.
So, as an example I took a plugin with the name - not-a-plugin to show the issue.
from wpscan.
I think Issue #24 would do the trick here. Have not had the time to implement it yet.
from wpscan.
I think @firefart's solution will fix this but might be worth to implement the 'homepage hash' check too to try and automatically prevent this particular behaviour. However, when the 'homepage hash' automated check doesn't work, then @firefart's string detection could be used by the user.
from wpscan.
Related Issues (20)
- I can't see any register form at website. HOT 4
- Scan Aborted: The number of themes detected reached the threshold of 20 which might indicate False Positive. It would be recommended to use the --exclude-content-based option to ignore the bad responses. HOT 1
- Prompt "Do you want to update now?" not printed
- JSON lines
- request time out or no response ERROR
- WordPress v6.4.3 wrongly detected as v6.4.2 resulting in a false positive alert HOT 2
- Error: Server error, try reducing the number of threads. WPSCAN
- Wpscan not following redirect when I set format to json
- False Negative HOT 4
- Using proxy to access target without internet HOT 1
- wpscan --update renders error after upgrade from Ubuntu 20.04 to Ubuntu 22.04. /usr/bin/ruby2.7: bad interpreter: No such file or directory HOT 2
- cannot load such file -- json HOT 5
- WP version detection from query parameters of upgrade.php etc.
- security
- Scan Aborted: Unable to get https://data.wpscan.org/metadata.json.sha512 (SSL peer certificate or SSH remote key was not OK) HOT 4
- марик HOT 1
- Add an option to set url for get plugins list from custom wordpress api
- Failed to build gem native extension HOT 1
- Cannot download WPScan WordPress Vulnerability Database exports as an Enterprise customer
- Scan Aborted: wrong constant name/ Version_finder_module.const_set(constant_name, Module.new) ERROR
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wpscan.