Wpscan: Passive plugin detection does not detect urls with "//" scheme

[cgsmith]

The passive way of detecting plugins seems flaky to me. For example, when running the scanner without any options it finds no plugins even though inspecting the element and looking under the wp-content/plugins folder it shows six installed plugins.

The scanner should at least detect the plugins as they are loaded at runtime.

[ethicalhack3r]

I'm not sure what you mean by 'inspecting the element', what element are you inspecting? How are you looking under the wp-content/plugins folder? Server side? Or does the web server have directory listing enabled?

We detect plugins passively from the index page's HTML source code. If the plugins are not mentioned there then we will not detect them passively. If they are there and we are not detecting them, can you provide the HTML where they are mentioned and we can investigate?

[cgsmith]

I can see them in the browser by inspecting element > sources. I can also see them by greping for plugin after a curl:

<!-- This site is optimized with the Yoast SEO plugin v3.4.2 - https://yoast.com/wordpress/plugins/seo/ -->
<!-- / Yoast SEO plugin. -->
<link rel='stylesheet' id='ai1ec_style-css'  href='//www..com/wp-content/plugins/all-in-one-event-calendar/cache/e20167cf_ai1ec_parsed_css.css' type='text/css' media='all' />
<link rel='stylesheet' id='cookie-notice-front-css'  href='http://www..com/wp-content/plugins/cookie-notice/css/front.css' type='text/css' media='all' />
<link rel='stylesheet' id='easy_testimonial_style-css'  href='http://www..com/wp-content/plugins/easy-testimonials/include/assets/css/style.css' type='text/css' media='all' />
<link rel='stylesheet' id='sm-style-css'  href='http://www..com/wp-content/plugins/wp-show-more/wpsm-style.css' type='text/css' media='all' />
<link rel='stylesheet' id='cart66-wp-css'  href='http://www..com/wp-content/plugins/cart66-cloud/resources/css/cart66-wp.css' type='text/css' media='all' />
<link rel='stylesheet' id='cart66-templates-css'  href='http://www..com/wp-content/plugins/cart66-cloud/templates/css/cart66-templates.css' type='text/css' media='all' />
<link rel='stylesheet' id='cm-logged-out-css'  href='http://www..com/wp-content/plugins/cart66-cloud-members/resources/css/logged-out.css' type='text/css' media='al

[FireFart]

@cgsmith could you please report this url in private to team [at] wpscan [dot] org so we can investigate? The patterns you posted should be detected by the passive detection

[cgsmith]

Sent off @FireFart

[FireFart]

@cgsmith awesome thx!

[ethicalhack3r]

The Yoast SEO plugin should now be detected.

The bigger issue is that URLs with the "//" scheme like the one below are ignored:

//www.example.com/wp-content/plugins/all-in-one-event-calendar/cache/e20167cf_ai1ec_parsed_css.css

The problem is due to the regex in this method:

https://github.com/wpscanteam/wpscan/blob/c291022753339c67034b01cdbc4d3cac055f0cbb/lib/common/collections/wp_items/detectable.rb#L118

I have been able to reproduce the issue in the specs but have not been able to find a solution as yet. Maybe @erwanlr can have a look if he has time? :)

[FireFart]

@cgsmith thanks for the link! The latest version (currently only available on github) now detects 8 plugins found from passive detection