Locked WPScan: v3.5.0

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

WPScan 3.5.0 – New Features & Fixes

    All enumeration processes, and most other checks now use HEAD requests and then perform a GET when suitable. This reduces the data received, especially with custom 404 returning a lot of data
    Make sure files which can return a lot of data, such as SQL dumps, are checked with a Range header
    Running Stats (Requests done, Memory used and so on) are now always displayed at the end of the scan, when the scan is valid, ie not CLI errors, not WordPress Error etc (so once the URL and Started time are displayed, stats will be output at the end no matter what)
    More accurate memory usage, by getting the starting memory when a scan is initialised
    Additional detection of the WP-JSON API via the source of the homepage
    Detection of wp-content dir from RAW JavaScript
    Password Attack against the wp-login.php improved to avoid False Positive
    Minified version of static files also checked when trying to determine WP version
    Check errors 500 as well as custom 401/403 during plugin/theme enumeration

Removals

    WPScan is no longer checking for the changelog URLs when displaying plugins and themes. Versions detection from changelogs are still performed

Fixes

    Regression of the wp-content detection, when a sub-dir was present
    Empty usernames being detected from RSS feed
    BackTrace error always displayed when wp-content dir not detected

Dev Stuff

    Profiling executable added
    frozen_string_literal comment is now used everywhere, to reduce object allocations
    Better code for WpVersion#all
    Models and Errors moved into their own namespace

This is the hidden content, please

• Sign In
• or
• Sign Up