Wpscan: Fingerprint not identifying wordpress 4.7.2

[Himanshu3891]

Running wpscan with an up to date database against a wordpress 4.7.2 server results in [+] WordPress version 4.7.1 identified from advanced fingerprinting. I see [+] WordPress version 4.7.2 (Released on 2017-01-26) identified from meta generator, links opml on other sites. Can please check if there is something wrong with fingerprints ?

[FireFart]

@Himanshu3891 please look at the HTML source of the start page and search for the generator meta tag as wpscan has extracted the version from there. I suggest it's a caching issue on the wordpress installation or on a proxy on your side.

[erwanlr]

No I guess it's not, as the FP for the latest WP versions are not the v2 DB ^^

[HIMANSHU-ELIGIBLE]

@FireFart Hi Christian, sorry I could not find generator meta tag on the start page of website am scanning.

[dustyfresh]

I saw similar issues this morning when I was testing a WP install. Spun up the VM where I do my WAF testing and was able to confirm that WPScan is returning the expected 4.7.2 fingerprint.

This could probably be closed 👍 ?

[HIMANSHU-ELIGIBLE]

@dustyfresh The example you gave is detecting wp version from meta generator. That's working for me too on other sites and correctly detecting 4.7.2.

However, on one of sites, it is detecting version from advanced fingerprinting and that still detects version as 4.7.1. Sorry for confusion but what I meant was that it is working on sites where getting detected from meta generator but not on one sites where it's trying to detect from fingerprinting.

cc: @FireFart

[davidfavor]

Not a caching issue.

Hard restart of Apache fails to clear this problem.

wpscan returns incorrect version as follows...

WordPress version 4.7.1 (Released on 2017-01-11) identified from advanced fingerprinting

[davidfavor]

This only seems to occur on some sites.

Site with current problem contains no generator meta tag.

[davidfavor]

Likely good to clarify identified from advanced fingerprinting by expanding this message to exactly how site version was determined.

[erwanlr]

Sometimes I wonder if people read what I write oO.

The fingerprints for the 4.7.2 ARE NOT in the v2 DB, hence the issue.

The v3 gives more information about the matching fingerprint btw, try it ;p

[ethicalhack3r]

WPScan v3 BETA can be found here https://github.com/wpscanteam/wpscan-v3

[FireFart]

@ethicalhack3r can you update the v2 database?

[erwanlr]

I am doing it now :)

[FireFart]

@erwanlr thanks! don't forget to publish it after uploading :)

[erwanlr]

Gniagniagnia :x

[erwanlr]

Done (and exported ;p). However there are no unique fingerprints for WP 4.7.1 & 4.7.2 anymore ^^

[anantshri]

why no unique fingerprint. no css or js changed?

[davidfavor]

https://github.com/wpscanteam/wpscan-v3 resolves this problem.

Thanks.

[lynt-smitka]

Maybe, you can try to implement my method of WP version detection from install/upgrade.php - https://lynt.cz/blog/wordpress-version-to-hide-or-not-to-hide

[FireFart]

@erwanlr do you think we can implement a check in v3 to check /wp-admin/install.php and /wp-admin/upgrade.php for the version number in the js url as described above?

[erwanlr]

Done in v3.0.3