Giter VIP home page Giter VIP logo

ajinabraham / cmsscan Goto Github PK

View Code? Open in Web Editor NEW
939.0 38.0 147.0 740 KB

CMS Scanner: Scan Wordpress, Drupal, Joomla, vBulletin websites for Security issues

Home Page: https://opensecurity.in

License: GNU General Public License v3.0

Dockerfile 0.48% Python 6.97% Shell 0.45% CSS 71.81% JavaScript 14.22% HTML 6.07%
wordpress drupal joomla vbulletin security automation devsecops security-dashboard

cmsscan's Introduction

CMSScan

Scan WordPress, Drupal, Joomla, vBulletin websites for Security issues.

platform License python Rawsec's CyberSecurity Inventory

Made with Love in India

CMSScan provides a centralized Security Dashboard for CMS Security scans. It is powered by wpscan, droopescan, vbscan and joomscan. It supports both on demand and scheduled scans and has the ability to sent email reports.

Install

# Requires ruby, ruby-dev, gem, libwww-perl, python3.6+ and git
git clone https://github.com/ajinabraham/CMSScan.git
cd CMSScan
./setup.sh

Run

./run.sh

Periodic Scans

You can perform periodic CMS scans with CMSScan. You must run CMSScan server separately and configure the following before running the scheduler.py script.

# SMTP SETTINGS
SMTP_SERVER = ''
FROM_EMAIL = ''
TO_EMAIL = ''

# SERVER SETTINGS
SERVER = ''

# SCAN SITES
WORDPRESS_SITES = []
DRUPAL_SITES = []
JOOMLA_SITES = []
VBULLETIN_SITES = []

Add a cronjob

crontab -e
@weekly /usr/bin/python3 scheduler.py

Basic Auth

By default there is no authentication. To enable basic auth, configure the following in app.py

app.config['BASIC_AUTH_USERNAME'] = 'admin'
app.config['BASIC_AUTH_PASSWORD'] = 'password'
app.config['BASIC_AUTH_FORCE'] = True

Docker

Local

docker build -t cmsscan .
docker run -it -p 7070:7070 cmsscan

Prebuilt Image

docker pull opensecurity/cmsscan
docker run -it -p 7070:7070 opensecurity/cmsscan

Screenshots

cmsscan's People

Contributors

adminrezo avatar ajinabraham avatar apeyrat avatar hack-tramp avatar noraj avatar paulschreiber avatar pwnfoo avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cmsscan's Issues

Joomlascan can not scan https websites

Also the joomlascan part does not work
After installing:
Installing LWP from the CPAN Shell
perl -MCPAN -eshell
cpan> install Bundle::LWP

install HTML::Tree
install HTML::Format
install LWP::Protocol::https
sudo cpan install LWP::Protocol::https
the Joomplascan works on http://Joomla site when i scan https website is see the error
(_ )( _ )( _ )( / )/ __) / ) /\ ( ( )
)( )()( )(
)( ) ( __ ( (__ /()\ ) (
_
) ()()(//_)(/ _)()(_)(_)_)
(1337.today)

--=[OWASP JoomScan
+---++---==[Version : 0.0.7
+---++---==[Update Date : [2018/09/23]
+---++---==[Authors : Mohammad Reza Espargham , Ali Razmjoo
--=[Code name : Self Challenge
@OWASP_JoomScan , @rezesp , @Ali_Razmjo0 , @OWASP

[+] Target uses HTTPS, but module LWP::Protocol::https is not available!

Current prebuilt docker image doesn't work

I've just tried (as a quick way of testing) using the prebuilt docker image and it fails when I try to scan a url. The following error is displayed in the console:

[INFO] joomscan scanning URL: http://whateversiteiwantedtotest.com/
[ERROR] 2 Can't locate LWP.pm in @INC (you may need to install the LWP module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.24.1 /usr/local/share/perl/5.24.1 /usr/lib/x86_64-linux-gnu/perl5/5.24 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.24 /usr/share/perl/5.24 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base) at plugins/joomscan/joomscan.pl line 34.
BEGIN failed--compilation aborted at plugins/joomscan/joomscan.pl line 34.

Exception in thread Thread-12:
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/threading.py", line 917, in _bootstrap_inner
    self.run()
  File "/usr/local/lib/python3.7/threading.py", line 865, in run
    self._target(*self._args, **self._kwargs)
  File "/usr/src/app/core.py", line 58, in scan
    self.scan_joomla()
  File "/usr/src/app/core.py", line 43, in scan_joomla
    result = async_result.get()
  File "/usr/local/lib/python3.7/multiprocessing/pool.py", line 683, in get
    raise self._value
  File "/usr/local/lib/python3.7/multiprocessing/pool.py", line 121, in worker
    result = (True, func(*args, **kwds))
  File "/usr/src/app/plugins/scanners.py", line 74, in joomscan
    return cmd_runner(jm_scan)
  File "/usr/src/app/plugins/scanners.py", line 32, in cmd_runner
    return json.dumps(json.loads(exc.output.strip()))
  File "/usr/local/lib/python3.7/json/__init__.py", line 348, in loads
    return _default_decoder.decode(s)
  File "/usr/local/lib/python3.7/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/local/lib/python3.7/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Drupal 6 and 8 detection

Hi, it looks like CMSscan use droopescan for detecting Drupal CMS. Droopescan support D6 and D8.. but when testing these versions, it return "Cannot detect CMS"..

Support for phpp

Great work on CMSScan, use on a weekly basis.
Is there plans to support phpb cms forums as well?

Feature request

Not an issue but a request to this great CMS vulnerability checker Ajin.

Is it possible to have like an admin function, so for example on the "Recent scans" section only admin logged in user can remove recent scans from the list?

No WPScan API Token given, as a result vulnerability data has not been output

this is a follow on from: #23

Its been over a year now.. when are we lightly to see this supported.
As I am always hitting the limits:

"vuln_api": ⊖{
        "error": ⊖"No WPScan API Token given, as a result vulnerability data has not been output.\nYou can get a free API token with 25 daily requests by registering at https://wpscan.com/register"

and have edited the app inside the docker container by either doing:

nano ~/.wpscan/scan.yml

or

nano /usr/local/bin/scan.yml

or

find / -name "wpscan"

and add the below inside the scan.yml file:

cli_options:
  api_token: GFzzLFCsOjvaQ4lGh6TKdA(IMCOMPLETE)

Obviously have done the registration + API stuff over at https://wpscan.com/register

not able to install

./setup.sh
Fetching: mini_portile2-2.4.0.gem (100%)
Successfully installed mini_portile2-2.4.0
Fetching: nokogiri-1.10.9.gem (100%)
Building native extensions. This could take a while...
ERROR: Error installing wpscan:
ERROR: Failed to build gem native extension.

current directory: /var/lib/gems/2.5.0/gems/nokogiri-1.10.9/ext/nokogiri

/usr/bin/ruby2.5 -r ./siteconf20200704-7424-1p6wrj6.rb extconf.rb
checking if the C compiler accepts ... yes
Building nokogiri using packaged libraries.
Using mini_portile version 2.4.0
checking for gzdopen() in -lz... no
zlib is missing; necessary for building libxml2
*** extconf.rb failed ***
Could not create Makefile due to some reason, probably lack of necessary
libraries and/or headers. Check the mkmf.log file for more details. You may
need configuration options.

Provided configuration options:
--with-opt-dir
--without-opt-dir
--with-opt-include
--without-opt-include=${opt-dir}/include
--with-opt-lib
--without-opt-lib=${opt-dir}/lib
--with-make-prog
--without-make-prog
--srcdir=.
--curdir
--ruby=/usr/bin/$(RUBY_BASE_NAME)2.5
--help
--clean
--use-system-libraries
--enable-static
--disable-static
--with-zlib-dir
--without-zlib-dir
--with-zlib-include
--without-zlib-include=${zlib-dir}/include
--with-zlib-lib
--without-zlib-lib=${zlib-dir}/lib
--enable-cross-build
--disable-cross-build

To see why this extension failed to compile, please check the mkmf.log which can be found here:

/var/lib/gems/2.5.0/extensions/x86_64-linux/2.5.0/nokogiri-1.10.9/mkmf.log

extconf failed, exit code 1

Gem files will remain installed in /var/lib/gems/2.5.0/gems/nokogiri-1.10.9 for inspection.
Results logged to /var/lib/gems/2.5.0/extensions/x86_64-linux/2.5.0/nokogiri-1.10.9/gem_make.out
Traceback (most recent call last):
12: from /usr/bin/wpscan:23:in <main>' 11: from /usr/lib/ruby/2.5.0/rubygems.rb:304:in activate_bin_path'
10: from /usr/lib/ruby/2.5.0/rubygems.rb:304:in synchronize' 9: from /usr/lib/ruby/2.5.0/rubygems.rb:305:in block in activate_bin_path'
8: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1440:in activate' 7: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1458:in activate_dependencies'
6: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1458:in each' 5: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1472:in block in activate_dependencies'
4: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1440:in activate' 3: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1458:in activate_dependencies'
2: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1458:in each' 1: from /usr/lib/ruby/2.5.0/rubygems/specification.rb:1469:in block in activate_dependencies'
/usr/lib/ruby/2.5.0/rubygems/dependency.rb:312:in to_specs': Could not find 'nokogiri' (~> 1.10.8) - did find: [nokogiri-1.10.4] (Gem::MissingSpecVersionError) Checked in 'GEM_PATH=/root/.gem/ruby/2.5.0:/var/lib/gems/2.5.0:/usr/lib/ruby/gems/2.5.0:/usr/share/rubygems-integration/2.5.0:/usr/share/rubygems-integration/all:/usr/lib/x86_64-linux-gnu/rubygems-integration/2.5.0', execute gem env` for more information
/usr/bin/python3: No module named pip
./setup.sh: 9: virtualenv: not found
./setup.sh: 10: .: Can't open venv/bin/activate

Syntax errors (?)

The setup.sh exited successfully with exit code 0, Running run.sh however fails with a syntax error.
I'm not very good with Python, so I hope you can help, the log is attached:

[2018-11-19 08:51:11 +0100] [28287] [INFO] Starting gunicorn 19.9.0
[2018-11-19 08:51:11 +0100] [28287] [INFO] Listening at: http://0.0.0.0:7070 (28287)
[2018-11-19 08:51:11 +0100] [28287] [INFO] Using worker: sync
[2018-11-19 08:51:11 +0100] [28294] [INFO] Booting worker with pid: 28294
[2018-11-19 08:51:11 +0100] [28296] [INFO] Booting worker with pid: 28296
[2018-11-19 08:51:11 +0100] [28294] [ERROR] Exception in worker process
Traceback (most recent call last):
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
    worker.init_process()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 129, in init_process
    self.load_wsgi()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
    self.wsgi = self.app.wsgi()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 67, in wsgi
    self.callable = self.load()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
    return self.load_wsgiapp()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
    return util.import_app(self.app_uri)
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/util.py", line 350, in import_app
    __import__(module)
  File "/tmp/CMSScan/app.py", line 6, in <module>
    from plugins.scanners import (
  File "/tmp/CMSScan/plugins/scanners.py", line 37
    print(f"[INFO] droopescan scanning URL: {url}")
                                                 ^
SyntaxError: invalid syntax
[2018-11-19 08:51:11 +0100] [28294] [INFO] Worker exiting (pid: 28294)
[2018-11-19 08:51:11 +0100] [28297] [INFO] Booting worker with pid: 28297
[2018-11-19 08:51:11 +0100] [28296] [ERROR] Exception in worker process
Traceback (most recent call last):
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
    worker.init_process()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 129, in init_process
    self.load_wsgi()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
    self.wsgi = self.app.wsgi()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 67, in wsgi
    self.callable = self.load()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
    return self.load_wsgiapp()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
    return util.import_app(self.app_uri)
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/util.py", line 350, in import_app
    __import__(module)
  File "/tmp/CMSScan/app.py", line 6, in <module>
    from plugins.scanners import (
  File "/tmp/CMSScan/plugins/scanners.py", line 37
    print(f"[INFO] droopescan scanning URL: {url}")
                                                 ^
SyntaxError: invalid syntax
[2018-11-19 08:51:11 +0100] [28296] [INFO] Worker exiting (pid: 28296)
[2018-11-19 08:51:11 +0100] [28297] [ERROR] Exception in worker process
Traceback (most recent call last):
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
    worker.init_process()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 129, in init_process
    self.load_wsgi()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
    self.wsgi = self.app.wsgi()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 67, in wsgi
    self.callable = self.load()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
    return self.load_wsgiapp()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
    return util.import_app(self.app_uri)
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/util.py", line 350, in import_app
    __import__(module)
  File "/tmp/CMSScan/app.py", line 6, in <module>
    from plugins.scanners import (
  File "/tmp/CMSScan/plugins/scanners.py", line 37
    print(f"[INFO] droopescan scanning URL: {url}")
                                                 ^
SyntaxError: invalid syntax
[2018-11-19 08:51:11 +0100] [28297] [INFO] Worker exiting (pid: 28297)
Traceback (most recent call last):
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 203, in run
    self.manage_workers()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 545, in manage_workers
    self.spawn_workers()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 617, in spawn_workers
    time.sleep(0.1 * random.random())
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 245, in handle_chld
    self.reap_workers()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 525, in reap_workers
    raise HaltServer(reason, self.WORKER_BOOT_ERROR)
gunicorn.errors.HaltServer: <HaltServer 'Worker failed to boot.' 3>

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/CMSScan/venv/bin/gunicorn", line 11, in <module>
    sys.exit(run())
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 61, in run
    WSGIApplication("%(prog)s [OPTIONS] [APP_MODULE]").run()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 223, in run
    super(Application, self).run()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 72, in run
    Arbiter(self).run()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 232, in run
    self.halt(reason=inst.reason, exit_status=inst.exit_status)
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 345, in halt
    self.stop()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 393, in stop
    time.sleep(0.1)
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 245, in handle_chld
    self.reap_workers()
  File "/tmp/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 525, in reap_workers
    raise HaltServer(reason, self.WORKER_BOOT_ERROR)
gunicorn.errors.HaltServer: <HaltServer 'Worker failed to boot.' 3>

[ERROR] Exception in worker process

Hello,
I cannot run CMSScan because of an exception when running :

./run.sh
[2018-11-22 09:59:02 +0100] [15988] [INFO] Starting gunicorn 19.9.0
[2018-11-22 09:59:02 +0100] [15988] [INFO] Listening at: http://0.0.0.0:7070 (15988)
[2018-11-22 09:59:02 +0100] [15988] [INFO] Using worker: sync
[2018-11-22 09:59:02 +0100] [15991] [INFO] Booting worker with pid: 15991
[2018-11-22 09:59:02 +0100] [15992] [INFO] Booting worker with pid: 15992
[2018-11-22 09:59:02 +0100] [15993] [INFO] Booting worker with pid: 15993
[2018-11-22 09:59:02 +0100] [15991] [ERROR] Exception in worker process
Traceback (most recent call last):
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
worker.init_process()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 129, in init_process
self.load_wsgi()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
self.wsgi = self.app.wsgi()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 67, in wsgi
self.callable = self.load()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
return self.load_wsgiapp()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
return util.import_app(self.app_uri)
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/util.py", line 350, in import_app
import(module)
File "/root/CMSScan/app.py", line 6, in
from plugins.scanners import (
File "/root/CMSScan/plugins/scanners.py", line 37
print(f"[INFO] droopescan scanning URL: {url}")
^
SyntaxError: invalid syntax
[2018-11-22 09:59:02 +0100] [15991] [INFO] Worker exiting (pid: 15991)
[2018-11-22 09:59:02 +0100] [15992] [ERROR] Exception in worker process
Traceback (most recent call last):
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
worker.init_process()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 129, in init_process
self.load_wsgi()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
self.wsgi = self.app.wsgi()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 67, in wsgi
self.callable = self.load()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
return self.load_wsgiapp()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
return util.import_app(self.app_uri)
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/util.py", line 350, in import_app
import(module)
File "/root/CMSScan/app.py", line 6, in
from plugins.scanners import (
File "/root/CMSScan/plugins/scanners.py", line 37
print(f"[INFO] droopescan scanning URL: {url}")
^
SyntaxError: invalid syntax
[2018-11-22 09:59:02 +0100] [15992] [INFO] Worker exiting (pid: 15992)
[2018-11-22 09:59:02 +0100] [15993] [ERROR] Exception in worker process
Traceback (most recent call last):
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
worker.init_process()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 129, in init_process
self.load_wsgi()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
self.wsgi = self.app.wsgi()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/base.py", line 67, in wsgi
self.callable = self.load()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
return self.load_wsgiapp()
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
return util.import_app(self.app_uri)
File "/root/CMSScan/venv/lib/python3.5/site-packages/gunicorn/util.py", line 350, in import_app
import(module)
File "/root/CMSScan/app.py", line 6, in
from plugins.scanners import (
File "/root/CMSScan/plugins/scanners.py", line 37
print(f"[INFO] droopescan scanning URL: {url}")
^
SyntaxError: invalid syntax
[2018-11-22 09:59:02 +0100] [15993] [INFO] Worker exiting (pid: 15993)
[2018-11-22 09:59:02 +0100] [15988] [INFO] Shutting down: Master
[2018-11-22 09:59:02 +0100] [15988] [INFO] Reason: Worker failed to boot.

I had run setup.sh, and seems working fine :

./setup.sh
Successfully installed wpscan-3.4.0
Parsing documentation for wpscan-3.4.0
Done installing documentation for wpscan after 0 seconds
1 gem installed


    __          _______   _____
    \ \        / /  __ \ / ____|
     \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
      \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
       \  /\  /  | |     ____) | (__| (_| | | | |
        \/  \/   |_|    |_____/ \___|\__,_|_| |_|

    WordPress Security Scanner by the WPScan Team
                   Version 3.4.0
      Sponsored by Sucuri - https://sucuri.net
  @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_

[i] Updating the Database ...
[i] Update completed.

Requirement already satisfied: virtualenv in /usr/local/lib/python3.5/dist-packages
Already using interpreter /usr/bin/python3
Using base prefix '/usr'
New python executable in /root/CMSScan/venv/bin/python3
Not overwriting existing python script /root/CMSScan/venv/bin/python (you must use /root/CMSScan/venv/bin/python3)
Installing setuptools, pip, wheel...
done.
Requirement already satisfied: Flask in ./venv/lib/python3.5/site-packages (from -r requirements.txt (line 1)) (1.0.2)
Requirement already satisfied: requests in ./venv/lib/python3.5/site-packages (from -r requirements.txt (line 2)) (2.20.1)
Requirement already satisfied: gunicorn in ./venv/lib/python3.5/site-packages (from -r requirements.txt (line 3)) (19.9.0)
Requirement already satisfied: fake_useragent in ./venv/lib/python3.5/site-packages (from -r requirements.txt (line 4)) (0.1.11)
Requirement already satisfied: droopescan in ./venv/lib/python3.5/site-packages (from -r requirements.txt (line 5)) (1.41.1)
Requirement already satisfied: itsdangerous>=0.24 in ./venv/lib/python3.5/site-packages (from Flask->-r requirements.txt (line 1)) (1.1.0)
Requirement already satisfied: click>=5.1 in ./venv/lib/python3.5/site-packages (from Flask->-r requirements.txt (line 1)) (7.0)
Requirement already satisfied: Jinja2>=2.10 in ./venv/lib/python3.5/site-packages (from Flask->-r requirements.txt (line 1)) (2.10)
Requirement already satisfied: Werkzeug>=0.14 in ./venv/lib/python3.5/site-packages (from Flask->-r requirements.txt (line 1)) (0.14.1)
Requirement already satisfied: certifi>=2017.4.17 in ./venv/lib/python3.5/site-packages (from requests->-r requirements.txt (line 2)) (2018.10.15)
Requirement already satisfied: urllib3<1.25,>=1.21.1 in ./venv/lib/python3.5/site-packages (from requests->-r requirements.txt (line 2)) (1.24.1)
Requirement already satisfied: chardet<3.1.0,>=3.0.2 in ./venv/lib/python3.5/site-packages (from requests->-r requirements.txt (line 2)) (3.0.4)
Requirement already satisfied: idna<2.8,>=2.5 in ./venv/lib/python3.5/site-packages (from requests->-r requirements.txt (line 2)) (2.7)
Requirement already satisfied: cement<2.6.99,>=2.6 in ./venv/lib/python3.5/site-packages (from droopescan->-r requirements.txt (line 5)) (2.6.2)
Requirement already satisfied: pystache in ./venv/lib/python3.5/site-packages (from droopescan->-r requirements.txt (line 5)) (0.5.4)
Requirement already satisfied: futures in ./venv/lib/python3.5/site-packages (from droopescan->-r requirements.txt (line 5)) (3.1.1)
Requirement already satisfied: MarkupSafe>=0.23 in ./venv/lib/python3.5/site-packages (from Jinja2>=2.10->Flask->-r requirements.txt (line 1)) (1.1.0)
Depuis https://github.com/rezasp/vbscan

[Feature Request] Manual CMS selection

Hi there,

first of all - really great tool! Love it!
It would be nice if we could select the targeted CMS manually in case CMSScan doesn't recognize it.

Have a nice day,
Neo

False Positive 2

I have tested against a specific site, the results are a bit strange and I am pretty confused by it.

Per the results, the site I scanned contains a Wordpress Plugin called Tweet Blender, and is on a vulnerable version of it.

I can confirm, that, that plugin does not exist on their site, nor has it ever existed on their site. On top of this the host would not allow it

"plugins": {
"tweet-blender": {
"slug": "tweet-blender",
"location": "https://www.mysite.com/wp-content/plugins/tweet-blender/",
"latest_version": "4.0.2",
"last_updated": "2013-11-13T08:18:00.000Z",
"outdated": false,
"readme_url": null,
"changelog_url": null,
"directory_listing": false,
"error_log_url": null,
"found_by": "Known Locations (Aggressive Detection)",
"confidence": 80,
"interesting_entries": [

  ],
  "confirmed_by": {

  },
  "vulnerabilities": [
	{
	  "title": "Tweet Blender 4.0.1 - Unspecified XSS",
	  "fixed_in": "4.0.2",
	  "references": {
		"cve": [
		  "2013-6342"
		],
		"secunia": [
		  "55780"
		],
		"url": [
		  "http://packetstormsecurity.com/files/124047/"
		],
		"wpvulndb": [
		  "6981"
		]
	  }
	}
  ],
  "version": null
}

},

Please advise

You closed my other Issue Request stating I need to check with another developer with a separate piece of software, however, this issue was not caused by using there's... it was caused by using this one, and yours

False Positive

I have tested against a specific site, the results are a bit strange and I am pretty confused by it.

Per the results, the site I scanned contains a Wordpress Plugin called Tweet Blender, and is on a vulnerable version of it.

I can confirm, that, that plugin does not exist on their site, nor has it ever existed on their site. On top of this the host would not allow it

"plugins": {
	"tweet-blender": {
	  "slug": "tweet-blender",
	  "location": "https://www.mysite.com/wp-content/plugins/tweet-blender/",
	  "latest_version": "4.0.2",
	  "last_updated": "2013-11-13T08:18:00.000Z",
	  "outdated": false,
	  "readme_url": null,
	  "changelog_url": null,
	  "directory_listing": false,
	  "error_log_url": null,
	  "found_by": "Known Locations (Aggressive Detection)",
	  "confidence": 80,
	  "interesting_entries": [

	  ],
	  "confirmed_by": {

	  },
	  "vulnerabilities": [
		{
		  "title": "Tweet Blender 4.0.1 - Unspecified XSS",
		  "fixed_in": "4.0.2",
		  "references": {
			"cve": [
			  "2013-6342"
			],
			"secunia": [
			  "55780"
			],
			"url": [
			  "http://packetstormsecurity.com/files/124047/"
			],
			"wpvulndb": [
			  "6981"
			]
		  }
		}
	  ],
	  "version": null
	}
  },

Please advise

errors no report

We got the Webgui running and we can scan with WPSscan by CLI but when we use WPSscan
When we us the GUI this error is shown

Exception in thread Thread-2:
Traceback (most recent call last):
File "/usr/lib/python3.6/threading.py", line 916, in _bootstrap_inner
self.run()
File "/usr/lib/python3.6/threading.py", line 864, in run
self._target(*self._args, **self._kwargs)
File "/home/CMSScan/core.py", line 54, in scan
self.scan_wp()
File "/home/CMSScan/core.py", line 32, in scan_wp
self.write_to_db(result)
File "/home/CMSScan/core.py", line 23, in write_to_db
dbo = get_db()
File "/home/CMSScan/db.py", line 10, in get_db
dbo = g._database = sqlite3.connect(DATABASE)
sqlite3.OperationalError: unable to open database file

Setup.sh give errors

aftr running setup.sh i get these errors
/usr/bin/python3: No module named pip
./setup.sh: 9: ./setup.sh: virtualenv: not found
./setup.sh: 10: .: Can't open venv/bin/activate

Also I can find any info to make this run as daemon so it runs all the time (also when i restart)
if i type http://IP_of _mymachine No page?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.