Skip to content
This repository has been archived by the owner on Aug 4, 2021. It is now read-only.

Commit

Permalink
1.0.0 (#34)
Browse files Browse the repository at this point in the history
* Rename project into `wpcheck` (closes #29)
* Add ESLint `node` plugin
* Add `yarn.lock` file

##### Changes
* `.eslintrc.json`: Rename `.eslintrc`
* `.gitignore`: Remove `*.lock` and `.idea`
* `README.md`: Add `yarn add global` command
  • Loading branch information
sergejmueller authored Nov 2, 2016
1 parent de3afc0 commit 05b0f70
Show file tree
Hide file tree
Showing 18 changed files with 1,432 additions and 121 deletions.
10 changes: 0 additions & 10 deletions .eslintrc

This file was deleted.

16 changes: 16 additions & 0 deletions .eslintrc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"plugins": ["node"],
"extends": ["eslint:recommended", "plugin:node/recommended"],
"env": {
"mocha": true,
"node": true,
"es6": true
},
"parserOptions": {
"sourceType": "module"
},
"rules": {
"no-console": 0,
"no-process-exit": 0
}
}
2 changes: 0 additions & 2 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,3 @@ node_modules
.npm
logs
*.log
*.lock
.idea/
29 changes: 21 additions & 8 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,17 @@
# wpscan / CHANGELOG
# wpcheck / CHANGELOG


### 1.0.0 (2016-11-02)

##### New
* Rename project into `wpcheck` (closes #29)
* Add ESLint `node` plugin
* Add `yarn.lock` file

##### Changes
* `.eslintrc.json`: Rename `.eslintrc`
* `.gitignore`: Remove `*.lock` and `.idea`
* `README.md`: Add `yarn add global` command


### v0.7.2 (2016-10-08)
Expand Down Expand Up @@ -48,11 +61,11 @@

##### Changes
* Core: Add filter name to the log output
* Core: Add module description to `wpscan --help`
* Core: Add module description to `wpcheck --help`
* Core: Add function `fileName` to `lib/finder.js`
* Rule: Rename `file-exists.js` into `sensitive-files.js`
* Rule: Rename `finder.js` into `fs.js`
* Rule: Refactor all wpscan rules
* Rule: Refactor all wpcheck rules
* Test: Refactor some test rules
* Readme: Text changes
* Howto: Text changes
Expand Down Expand Up @@ -80,9 +93,9 @@

##### Changes
* Core: Refactor all JS files for ES6 support
* Core: Add `url.js` as a new `wpscan` module
* Core: Add `url.js` as a new `wpcheck` module
* Core: Remove `app-module-path` `npm` module
* Core: Remove `helpers.js` `wpscan` module
* Core: Remove `helpers.js` `wpcheck` module
* Core: Update `request` `npm` module to v2.74.0
* Test: Use a testcase domain
* Readme: Text changes
Expand Down Expand Up @@ -124,15 +137,15 @@
##### New
* Option: `--help` outputs supplied help text
* Core: Add timeout to initial app requests
* Test: Add `wpscan --help` case
* Test: Add `wpcheck --help` case
* Readme: Add `Default rules` part
* Readme: Add `--help` option

##### Changes
* Core: Refactor app singletons
* Example: Rename `./examples``./example`
* Example: Rename `sources.txt``sources/list.txt`
* package.json: Set `repository``sergejmueller/wpscan`
* package.json: Set `repository``sergejmueller/wpcheck`
* package.json: Set `engines.node``>=4`
* package.json: Set `files``["lib","index.js","config.json"]`

Expand All @@ -157,7 +170,7 @@
##### Changes
* Core: Refactor `index.js`
* Core: Export config data into `config.json`
* Core: Set the default User-Agent to `wpscan`
* Core: Set the default User-Agent to `wpcheck`
* Core: Split error and status code warnings
* Readme: Text changes

Expand Down
2 changes: 1 addition & 1 deletion HOWTO.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# wpscan / HOWTO
# wpcheck / HOWTO

How can you protect your WordPress installation? Here are some best practices to protect against attackers. It's no rocket science.

Expand Down
58 changes: 32 additions & 26 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# wpscan
# wpcheck

[wpscan](https://www.npmjs.com/package/wpscan) is a Node.js CLI tool that allows you to quickly scan WordPress sites looking for known vulnerabilities, security issues and misconfigurations. `wpscan` helps you secure and maintain your WordPress against hackers.
`wpcheck` is a Node.js CLI tool that allows you to quickly scan WordPress sites looking for known vulnerabilities, security issues and misconfigurations. `wpcheck` helps you secure and maintain your WordPress against hackers.

[![Dependency Status](https://david-dm.org/sergejmueller/wpscan.svg)](https://david-dm.org/sergejmueller/wpscan)
[![Code Climate](https://codeclimate.com/github/sergejmueller/wpscan/badges/gpa.svg)](https://codeclimate.com/github/sergejmueller/wpscan)
[![Build Status](https://travis-ci.org/sergejmueller/wpscan.svg?branch=master)](https://travis-ci.org/sergejmueller/wpscan)
[![Known Vulnerabilities](https://snyk.io/test/github/sergejmueller/wpscan/badge.svg)](https://snyk.io/test/github/sergejmueller/wpscan)
[![Dependency Status](https://david-dm.org/sergejmueller/wpcheck.svg)](https://david-dm.org/sergejmueller/wpcheck)
[![Code Climate](https://codeclimate.com/github/sergejmueller/wpcheck/badges/gpa.svg)](https://codeclimate.com/github/sergejmueller/wpcheck)
[![Build Status](https://travis-ci.org/sergejmueller/wpcheck.svg?branch=master)](https://travis-ci.org/sergejmueller/wpcheck)
[![Known Vulnerabilities](https://snyk.io/test/github/sergejmueller/wpcheck/badge.svg)](https://snyk.io/test/github/sergejmueller/wpcheck)


### Features
Expand All @@ -27,19 +27,25 @@

### Install

```bash
npm install --global wpcheck
```
npm install --global wpscan

*or*

```bash
yarn global add wpcheck
```

##### Notes
* `wpscan` requires `Node.js >= 6` and [npm](http://blog.npmjs.org/post/85484771375/how-to-install-npm).
* `wpcheck` requires `Node.js >= 6` and [npm](http://blog.npmjs.org/post/85484771375/how-to-install-npm).
* [Fix](https://docs.npmjs.com/getting-started/fixing-npm-permissions) `npm` permissions if you get the `Permission denied` error.


### Usage

```bash
wpscan <url> [url] [options]
wpcheck <url> [url] [options]
```

`url` → WordPress site URL (e.g. `https://ma.tt`)
Expand All @@ -56,24 +62,24 @@ Option | Shortcut | Description
`--rules-dir` | `-r` | Loads additional rules from a directory (see [Custom rules](#custom-rules)).
`--bulk-file` | `-b` | Reads additional WordPress site URLs from a text file (see [Bulk scan](#bulk-scan)).
`--ignore-rule` | `-i` | Skips loading and execution of a specific rule (see [Ignore rules](#ignore-rules)).
`--user-agent` | `-u` | Defines a custom `User-Agent` string. Default is `wpscan`.
`--user-agent` | `-u` | Defines a custom `User-Agent` string. Default is `wpcheck`.


### Quick examples

```bash
wpscan https://ma.tt
wpscan https://ma.tt --silent
wpscan https://ma.tt --rules-dir ~/path/to/custom/rules
wpscan https://ma.tt --bulk-file ~/path/to/sources.txt
wpscan https://ma.tt --user-agent "Netscape Gold"
wpscan https://ma.tt --ignore-rule wp-login.js
wpcheck https://ma.tt
wpcheck https://ma.tt --silent
wpcheck https://ma.tt --rules-dir ~/path/to/custom/rules
wpcheck https://ma.tt --bulk-file ~/path/to/sources.txt
wpcheck https://ma.tt --user-agent "Netscape Gold"
wpcheck https://ma.tt --ignore-rule wp-login.js
```


### Default rules

`wpscan` has a few rules that are enabled by default. Follow also our [WordPress security best practices](HOWTO.md) to fix vulnerabilities detected by `wpscan` default rules.
`wpcheck` has a few rules that are enabled by default. Follow also our [WordPress security best practices](HOWTO.md) to fix vulnerabilities detected by `wpcheck` default rules.

##### 1. Checks sensitive WordPress/Apache/Dot files for their availability
- `/wp-config.php`
Expand All @@ -98,10 +104,10 @@ wpscan https://ma.tt --ignore-rule wp-login.js

### Custom rules

The power of `wpscan` is the flexibility: You can expand the tool functionality by building their own rules, scans and checks. The option `--rules-dir` allows loading of user-defined rules from a custom directory.
The power of `wpcheck` is the flexibility: You can expand the tool functionality by building their own rules, scans and checks. The option `--rules-dir` allows loading of user-defined rules from a custom directory.

- The directory path
- can be absolute or relative to the `wpscan` folder
- can be absolute or relative to the `wpcheck` folder
- The custom rules
- must be stored as `.js` files
- can be a `Node.js` script
Expand All @@ -115,21 +121,21 @@ exports.fire = ( data ) => {
}
```

`wpscan` will run (technically `require`) every custom rule file. The file naming does not matter, short and unique names are welcome. Feel free to create your own rules, enjoy!
`wpcheck` will run (technically `require`) every custom rule file. The file naming does not matter, short and unique names are welcome. Feel free to create your own rules, enjoy!

##### Get inspired
- [example custom rules](example/rules)
- [wpscan default rules](lib/rules)
- [wpcheck default rules](lib/rules)


### Ignore rule(s)

`wpscan` can skip certain [default](lib/rules) and custom rules. The CLI option `--ignore-rule` takes a rule name, the rule name is the JavaScript file name of the rule without path. Multiple rule filtering is possible by a multiple use of the CLI option.
`wpcheck` can skip certain [default](lib/rules) and custom rules. The CLI option `--ignore-rule` takes a rule name, the rule name is the JavaScript file name of the rule without path. Multiple rule filtering is possible by a multiple use of the CLI option.

```bash
wpscan ma.tt --ignore-rule wp-login.js
wpscan ma.tt --ignore-rule wp-login.js --ignore-rule sensitive-files.js
wpscan ma.tt --rules-dir ./example/rules --ignore-rule custom-rule.js
wpcheck ma.tt --ignore-rule wp-login.js
wpcheck ma.tt --ignore-rule wp-login.js --ignore-rule sensitive-files.js
wpcheck ma.tt --rules-dir ./example/rules --ignore-rule custom-rule.js
```


Expand All @@ -138,7 +144,7 @@ wpscan ma.tt --rules-dir ./example/rules --ignore-rule custom-rule.js
Multiple WordPress site URLs can be imported from a single file. This is a simple text file with one URL per line.

```bash
wpscan -b ~/path/to/sources.txt
wpcheck -b ~/path/to/sources.txt
```


Expand Down
4 changes: 2 additions & 2 deletions config/help.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
"format": "\nName\n\t%s\n\nUsage\n\t%s\n\nOptions\n\t%s\n",
"name": [
"Vulnerability scanner for WordPress",
"https://github.com/sergejmueller/wpscan"
"https://github.com/sergejmueller/wpcheck"
],
"usage": "wpscan <url> [url] [options]",
"usage": "wpcheck <url> [url] [options]",
"options": [
"-s, --silent Disable success and info messages",
"-r, --rules-dir Load and execute additional rules from any directory",
Expand Down
2 changes: 1 addition & 1 deletion config/minimist.json
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"silent": false,
"rules-dir": null,
"bulk-file": null,
"user-agent": "wpscan",
"user-agent": "wpcheck",
"ignore-rule": []
},
"string": [
Expand Down
6 changes: 3 additions & 3 deletions example/rules/custom-rule.js
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@

/**
* wpscan module custom-rule.js
* Example custom wpscan module
* wpcheck module custom-rule.js
* Example custom wpcheck module
*/


Expand All @@ -14,7 +14,7 @@

exports.fire = ( data ) => {

console.log( 'Custom wpscan rule is fired' )
console.log( 'Custom wpcheck rule is fired' )

console.log( data )

Expand Down
2 changes: 1 addition & 1 deletion index.js
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ if ( ! require( 'semver' ).satisfies(
}


require( './lib/app' ).wpscan(
require( './lib/app' ).wpcheck(
require( 'minimist' )(
process.argv.slice( 2 ),
require( './config/minimist.json' )
Expand Down
2 changes: 1 addition & 1 deletion lib/app.js
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ const config = require( '../config/app.json' )
* @return void
*/

module.exports.wpscan = ( data ) => {
module.exports.wpcheck = ( data ) => {

// App help
if ( data.h ) {
Expand Down
2 changes: 1 addition & 1 deletion lib/rules/directory-listing.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@

/**
* wpscan module directory-listings.js
* wpcheck module directory-listings.js
* Scan /wp-includes for Apache directory listing
*/

Expand Down
2 changes: 1 addition & 1 deletion lib/rules/fpd-vulnerability.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@

/**
* wpscan module fpd-vulnerability.js
* wpcheck module fpd-vulnerability.js
* Scan a PHP file for Full Path Disclosure
*/

Expand Down
2 changes: 1 addition & 1 deletion lib/rules/sensitive-files.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@

/**
* wpscan module sensitive-files.js
* wpcheck module sensitive-files.js
* Check WordPress/Apache/Dot files for their availability
*/

Expand Down
2 changes: 1 addition & 1 deletion lib/rules/wp-login.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@

/**
* wpscan module wp-login.js
* wpcheck module wp-login.js
* Scan WordPress login page for mistakes
*/

Expand Down
19 changes: 10 additions & 9 deletions package.json
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{
"name": "wpscan",
"version": "0.7.2",
"name": "wpcheck",
"version": "1.0.0",
"description": "Vulnerability scanner for WordPress",
"preferGlobal": true,
"main": "index.js",
"bin": {
"wpscan": "./index.js"
"wpcheck": "./index.js"
},
"files": [
"lib",
Expand All @@ -23,24 +23,25 @@
"name": "Sergej Müller",
"url": "https://sergejmueller.github.io"
},
"homepage": "https://github.com/sergejmueller/wpscan",
"repository": "sergejmueller/wpscan",
"homepage": "https://github.com/sergejmueller/wpcheck",
"repository": "sergejmueller/wpcheck",
"license": "MIT",
"dependencies": {
"colors": "^1.1.2",
"minimist": "^1.2.0",
"pad-end": "^1.0.2",
"prepend-http": "^1.0.4",
"request": "^2.75.0",
"rtrim": "^0.0.3",
"rtrim": "^1.0.0",
"semver": "^5.3.0",
"valid-url": "^1.0.9"
},
"devDependencies": {
"eslint": "^3.7.1",
"must": "^0.13.2",
"child-process-promise": "^2.1.3",
"eslint": "^3.8.1",
"eslint-plugin-node": "^3.0.0",
"mocha": "^3.1.0",
"child-process-promise": "^2.1.3"
"must": "^0.13.2"
},
"scripts": {
"lint": "eslint .",
Expand Down
Loading

0 comments on commit 05b0f70

Please sign in to comment.