Contents

# frozen_string_literal: true

module WPScan
  module Finders
    module Users
      # The YOAST SEO plugin has an author-sitemap.xml which can leak usernames
      # See https://github.com/wpscanteam/wpscan/issues/1228
      class YoastSeoAuthorSitemap < CMSScanner::Finders::Finder
        # @param [ Hash ] opts
        #
        # @return [ Array<User> ]
        def aggressive(_opts = {})
          found = []

          Browser.get(sitemap_url).html.xpath('//url/loc').each do |user_tag|
            username = user_tag.text.to_s[%r{/author/([^\/]+)/}, 1]

            next unless username && !username.strip.empty?

            found << Model::User.new(username,
                                     found_by: found_by,
                                     confidence: 100,
                                     interesting_entries: [sitemap_url])
          end

          found
        end

        # @return [ String ] The URL of the author-sitemap
        def sitemap_url
          @sitemap_url ||= target.url('author-sitemap.xml')
        end
      end
    end
  end
end

Version data entries

25 entries across 25 versions & 1 rubygems

Version	Path
wpscan-3.8.2	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.8.1	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.8.0	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.11	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.10	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.9	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.8	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.7	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.6	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.5	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.4	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.3	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.2	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.1	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.7.0	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.6.3	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.6.2	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.6.1	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.6.0	app/finders/users/yoast_seo_author_sitemap.rb
wpscan-3.5.5	app/finders/users/yoast_seo_author_sitemap.rb