Wpscan: enumerate all plugins is not working

[FireFart]

docker run --rm -it wpscanteam/wpscan:latest -e ap,at,tt,cb,dbe,u1-20,m --url xxxxxxx

It says:

[+] Enumerating All Plugins
[+] Checking Plugin Versions

[i] Plugin(s) Identified:

[+] all-in-one-seo-pack

but it does not enumerate all plugins. Enumerating all themes works fine. The plugin enumeration takes 2 seconds, theme enumeration one hour so I think this is a bug @erwanlr

[FireFart]

Looks like this depends on the detection mode. It's not intuitive if you need a parameter to make another one work. Can we just set detection mode to aggressive if ap is specified? (also theme enumeration at should behave the same, but it currently ignores the detection mode)

[ethicalhack3r]

Not very intuitive but you have to also supply --plugins-detection aggressive

--plugins-detection MODE                  Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode.
                                                  Default: passive

I spoke to @erwanlr about this last week, but can't remember why it was like it is.

[erwanlr]

It was made like this so users have a good deal between speed and accuracy when just supplying --url. Then for more stuff, see the options (and yes, --plugins-detection will have to be set to mixed).

I won't change a detection mode magically depending on the enumeration mode chosen. That's up to the users to set that stuff the way they want.

[FireFart]

So what do you think is the best way to handle it? I think from a user perspective there are only two options:

• on ap parameter set the plugins-detection to aggressive (same on themes)
• implement an option validator so that you can't supply the ap parameter without a valid detection mode

If there is a dependecy between the two parameters, we should check them or act on it. Also the behaviour is not consitent across themes and plugins (which are technically the same)

[erwanlr]

With your first option, that would make impossible to enumerate all plugins with passive detection (which is useful along with --plugins-list for example). Also, magically changing an option is not something I will go for. The current --help list all default values so it's pretty clear about what is set to what.

Your second option is already done, however, as there are default detection modes set, you don't see it.

Maybe something in the --help is not clear enough ?

I can set the --themes-detection to passive by default for consistency. For the rest, its up to users to set their options accordingly IMO. There is even the possibility to set option values in config files (either home or current directory) in case you want to override default values (and then override then again via cli option/s)

[FireFart]

Jeah I get your point but I think no one wants to read a big help screen. I'm thinking of the casual user (not the advanced one) that just wants to scan a site like with v2 and enumerate all plugins. The user specifies the enumerate all plugins parameter but wpscan doesn't do it so this might be confusing. IMHO a tool should not support false input from the user and notify in whatever way.
I stumbled across this when testing v3 and was enumerating all themes and plugins when I recognized after half an hour of theme enumeration that the plugins were missing but wpscan was printing smth. about plugins.
So in my opinion it's good to have an advanced tool so users can tune every setting, but we also need to take casual users into account and for this the options should be not prone to usage errors.

[sullo]

FWIW, I hadn't used wpscan in a few months and this tripped me up as well. I didn't read the help as I assumed this was a bug... and I couldn't deal right then.

Perhaps a warning/msg if 'aggressive' mode is enabled? IMO, I'd rather see 'aggressive' be the default.

[djcater]

I would agree that it's not currently intuitive.

If you specify --detection-mode mixed --enumerate ap you would probably expect it to use both passive and aggressive techniques to enumerate all plugins. But actually the default value of --plugins-detection is "passive", and overrides the other options.

I would suggest printing a warning in this case, and also making plugins and themes consistent (either both mixed by default, or both passive by default).