Merge branch 'wpscanteam:master' into master

.codeclimate.yml

@@ -0,0 +1,7 @@
+version: "2"
+# https://docs.codeclimate.com/docs/default-analysis-configuration#sample-codeclimateyml
+checks:
+  method-complexity:
+    enabled: true
+    config:
+      threshold: 15

.dockerignore

@@ -5,17 +5,13 @@ bundle/
 cache/
 coverage/
 spec/
-dev/
 .*
 **/*.md
 *.md
+!README.md
 Dockerfile
 **/*.orig
 *.orig
-CREDITS
-data.zip
-DISCLAIMER.txt
-example.conf.json
-bin/
-log.txt
-
+bin/wpscan-*
+.wpscan/
+.github/

.github/CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Contributing to WPScan
+
+## Licensing
+
+By submitting code contributions to the WPScan development team via Github Pull Requests, or any other method, it is understood that the contributor is offering the WPScan company (company number 	83421476900012), which is registered in France, the unlimited, non-exclusive right to reuse, modify, and relicense the code.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Before submitting an issue, please make sure you fully read any potential error messages output and did some research on your own.
+
+### Subject of the issue
+Describe your issue here.
+
+### Your environment
+* Version of WPScan:
+* Version of Ruby:
+* Operating System (OS):
+
+### Steps to reproduce
+Tell us how to reproduce this issue.
+
+### Expected behavior
+Tell us what should happen.
+
+### Actual behavior
+Tell us what happens instead.
+
+### What have you already tried
+Tell us what you have already tried to do to fix the issue you are having.
+
+Things you have tried (where relevant):
+
+* Update WPScan to the latest version [ ]
+* Update Ruby to the latest version [ ]
+* Ensure you can reach the target site using cURL [ ]
+* Proxied WPScan through a HTTP proxy to view the raw traffic [ ]
+* Ensure you are using a supported Operating System (Linux and macOS) [ ]

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/other-issue.md

@@ -0,0 +1,10 @@
+---
+name: Other Issue
+about: Create a report which is not a related to a Bug or Feature
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Before submitting an issue, please make sure you fully read any potential error messages output and did some research on your own.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,3 @@
+## Licensing
+
+By submitting code contributions to the WPScan development team via Github Pull Requests, or any other method, it is understood that the contributor is offering the WPScan company (company number 	83421476900012), which is registered in France, the unlimited, non-exclusive right to reuse, modify, and relicense the code.

.github/dependabot.yml

@@ -0,0 +1,17 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every weekday
+      interval: "daily"

.github/workflows/build.yml

@@ -0,0 +1,42 @@
+name: Build
+
+on: [push, pull_request]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        ruby: [2.7, '3.0', 3.1]
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+
+    - name: Set up Ruby ${{ matrix.ruby }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+
+    - name: Install GEMs
+      run: |
+        gem install bundler
+        bundle config force_ruby_platform true
+        bundle config path vendor/bundle
+        bundle install --jobs 4 --retry 3
+
+    - name: rubocop
+      run: |
+        bundle exec rubocop
+
+    - name: rspec
+      run: |
+        bundle exec rspec
+
+    - name: Coveralls
+      uses: coverallsapp/github-action@master
+      continue-on-error: true
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docker.yml

@@ -0,0 +1,56 @@
+name: Build Docker Images
+
+on:
+  push:
+    branches:
+      - master
+  release:
+    types: [published]
+  schedule:
+    - cron: "0 7 * * *"
+
+jobs:
+  images:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: checkout sources
+        uses: actions/checkout@v3
+
+      - name: Set tag to latest
+        if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'schedule'
+        run: |
+          echo "DOCKER_TAG=latest" >> $GITHUB_ENV
+
+      - name: Set tag to release name
+        if: github.event_name == 'release' && startsWith(github.ref, 'refs/tags/')
+        run: |
+          echo "DOCKER_TAG=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+
+      - name: Check if DOCKER_TAG is set
+        if: env.DOCKER_TAG == ''
+        run: |
+          echo DOCKER_TAG is not set!
+          exit 1
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        id: buildx
+        with:
+          install: true
+
+      - name: Login to Docker Hub
+        uses: docker/[email protected]
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          push: true
+          tags: wpscanteam/wpscan:${{ env.DOCKER_TAG }}

.github/workflows/gempush.yml

@@ -0,0 +1,40 @@
+name: Ruby Gem
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build + Publish
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Ruby 2.6
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 2.6
+
+    #- name: Publish to GPR
+    #  run: |
+    #    mkdir -p $HOME/.gem
+    #    touch $HOME/.gem/credentials
+    #    chmod 0600 $HOME/.gem/credentials
+    #    printf -- "---\n:github: Bearer ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
+    #    gem build *.gemspec
+    #    gem push --KEY github --host https://rubygems.pkg.github.com/${OWNER} *.gem
+    #  env:
+    #    GEM_HOST_API_KEY: ${{secrets.GITHUB_TOKEN}}
+    #    OWNER: wpscanteam
+
+    - name: Publish to RubyGems
+      run: |
+        mkdir -p $HOME/.gem
+        touch $HOME/.gem/credentials
+        chmod 0600 $HOME/.gem/credentials
+        printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
+        gem build *.gemspec
+        gem push *.gem
+      env:
+        GEM_HOST_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}}

.gitignore

@@ -1,16 +1,26 @@
-.ash_history
-cache
-coverage
+*.gem
+*.rbc
 .bundle
+.config
+coverage
+pkg
+rdoc
+Gemfile.lock
+
+# YARD artifacts
+.yardoc
+_yardoc
+doc/
+.wpscan/
+
+.ash_history
 .DS_Store
 .DS_Store?
-*.sublime-*
-.idea
-.*.swp
-log.txt
-.yardoc
-debug.log
-wordlist.txt
-rspec_results.html
+.idea/
+
+# Old files from v2
+cache/
 data/
-vendor/
+
+# Profiling reports
+bin/memprof*.report

.rspec

@@ -1,2 +1,2 @@
---color
---fail-fast
+--require spec_helper
+--color

.rubocop.yml

@@ -0,0 +1,42 @@
+require: rubocop-performance
+AllCops:
+  NewCops: enable
+  SuggestExtensions: false
+  TargetRubyVersion: 2.5
+  Exclude:
+  - '*.gemspec'
+  - 'vendor/**/*'
+Layout/LineLength:
+  Max: 120
+Lint/ConstantDefinitionInBlock:
+  Enabled: false
+Lint/MissingSuper:
+  Enabled: false
+Lint/UriEscapeUnescape:
+  Enabled: false
+Metrics/AbcSize:
+  Max: 27
+Metrics/BlockLength:
+  Exclude:
+  - 'spec/**/*'
+Metrics/ClassLength:
+  Max: 150
+  Exclude:
+  - 'app/controllers/enumeration/cli_options.rb'
+Metrics/CyclomaticComplexity:
+  Max: 10
+Metrics/MethodLength:
+  Max: 20
+  Exclude:
+  - 'app/controllers/enumeration/cli_options.rb'
+Metrics/PerceivedComplexity:
+  Max: 11
+Style/ClassVars:
+  Enabled: false
+Style/Documentation:
+  Enabled: false
+Style/FormatStringToken:
+  Enabled: false
+Style/NumericPredicate:
+  Exclude:
+  - 'app/controllers/vuln_api.rb'

.ruby-gemset

@@ -1 +1 @@
-wpscan
+wpscanv3

.ruby-version

@@ -1 +1 @@
-2.4.1
+3.0.2

.simplecov

@@ -1,8 +1,19 @@
+# frozen_string_literal: true
+
+if ENV['GITHUB_ACTION']
+  require 'simplecov-lcov'
+
+  SimpleCov::Formatter::LcovFormatter.config do |c|
+    c.single_report_path = 'coverage/lcov.info'
+    c.report_with_single_file = true
+  end
+
+  SimpleCov.formatter = SimpleCov::Formatter::LcovFormatter
+end
+
 SimpleCov.start do
-  add_filter "/spec/"
-  add_filter "_helper.rb"
-  add_filter "environment.rb"
-  add_filter "_plugin.rb"
-  add_filter "hacks.rb"
-  add_filter "output.rb"
+  enable_coverage :branch # Only supported for Ruby >= 2.5
+
+  add_filter '/spec/'
+  add_filter 'helper'
 end