wpscan --update #788

9andrea1 · 2015-03-24T12:28:10Z

root@kali:~# wpscan --update

    __          _______   _____                  
    \ \        / /  __ \ / ____|                 
     \ \  /\  / /| |__) | (___   ___  __ _ _ __  
      \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
       \  /\  /  | |     ____) | (__| (_| | | | |
        \/  \/   |_|    |_____/ \___|\__,_|_| |_|

    WordPress Security Scanner by the WPScan Team 
                   Version 2.6
      Sponsored by Sucuri - https://sucuri.net

@WPScan, @ethicalhack3r, @erwan_lr, pvdl, @FireFart

[i] Updating the Database ...

themes.txt: checksums do not match

The text was updated successfully, but these errors were encountered:

ethicalhack3r · 2015-03-24T12:38:55Z

Hmmm... works for me on a non-Kali install using latest Github code (v.2.7):

$ ./wpscan.rb --update
_______________________________________________________________
        __          _______   _____                  
        \ \        / /  __ \ / ____|                 
         \ \  /\  / /| |__) | (___   ___  __ _ _ __  
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team 
                       Version 2.7
          Sponsored by Sucuri - https://sucuri.net
   @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
_______________________________________________________________

[i] Updating the Database ...
[i] Update completed.

ethicalhack3r · 2015-03-24T12:42:22Z

Confirmed with another Kali user that they get the same error

ethicalhack3r · 2015-03-24T13:03:38Z

Apologies for the issues. Should be fixed now. Looks like the themes.txt.sha512 file did not get pushed from wpvulndb to our github repo for some reason. This hasn't happened before and the github repo is due to be deprecated but we'll keep an eye on it.

9andrea1 · 2015-03-24T13:08:33Z

got it. it works now. thank you for the quick fix

grrowl · 2015-04-01T03:27:58Z

I"m having the same issue with plugins_full.txt:

➜  wpscan git:(master) ./wpscan.rb --update
_______________________________________________________________
        __          _______   _____
        \ \        / /  __ \ / ____|
         \ \  /\  / /| |__) | (___   ___  __ _ _ __
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team
                       Version 2.7
          Sponsored by Sucuri - https://sucuri.net
   @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
_______________________________________________________________

[i] Updating the Database ...

plugins_full.txt: checksums do not match

ethicalhack3r · 2015-04-01T08:10:46Z

I can't seem to replicate this. I did a fresh git clone and then wpscan update without errors.

git clone https://github.com/wpscanteam/wpscan.git
cd wpscan
./wpscan.rb --update

SwaroopH · 2015-04-01T13:14:52Z

Can replicate it:

swap@ubuntu:~/code/wpscan$ ./wpscan.rb --update

    __          _______   _____                  
    \ \        / /  __ \ / ____|                 
     \ \  /\  / /| |__) | (___   ___  __ _ _ __  
      \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
       \  /\  /  | |     ____) | (__| (_| | | | |
        \/  \/   |_|    |_____/ \___|\__,_|_| |_|

    WordPress Security Scanner by the WPScan Team 
                   Version 2.7
      Sponsored by Sucuri - https://sucuri.net

@WPScan, @ethicalhack3r, @erwan_lr, pvdl, @FireFart

[i] Updating the Database ...

plugins_full.txt: checksums do not match
swap@ubuntu:~/code/wpscan$ git status
On branch master
Your branch is up-to-date with 'origin/master'.

ethicalhack3r · 2015-04-01T13:26:58Z

There seems to be an issue with exporting the data from wpvulndb:

Mysql2::Error: Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (utf8_general_ci,COERCIBLE) for operation

Happens with plugins/themes with names like addthischina-收藏分享按钮插件.

Looking into it now

ethicalhack3r · 2015-04-01T22:08:55Z

Is this working for you now?

grrowl · 2015-04-01T22:47:26Z

➜  wpscan git:(master) ✗ ./wpscan.rb --update --verbose
_______________________________________________________________
        __          _______   _____
        \ \        / /  __ \ / ____|
         \ \  /\  / /| |__) | (___   ___  __ _ _ __
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team
                       Version 2.7
          Sponsored by Sucuri - https://sucuri.net
   @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
_______________________________________________________________

[i] Updating the Database ...
[+] Checking local_vulnerable_files.xml
  [i] Already Up-To-Date
[+] Checking local_vulnerable_files.xsd
  [i] Already Up-To-Date
[+] Checking plugins_full.txt
  [i] Needs to be updated
  [i] Backup Created
  [i] Downloading new file
  [i] Downloaded File Checksum: fa918e51bb7f4a02ae41162ff6ba4b771718d984dfbd6597c861f83c8ce3597828f9c4fe114618079fb1dff5afe023ee19237e4fa1709a268aff418eba19cf54
  [i] Database File Checksum: c726664cf7172061a96b38c129db1d0fffa609a7003ab47dba0146bfa74c8aac5dadad3d7f6268c3498d4cd23b3e20bca5315682688aeae5418bf5ec52c37e82
  [i] Restoring Backup due to error
  [i] Deleting Backup

plugins_full.txt: checksums do not match
Trace:
/Users/tom/Documents/repos/wpscan/lib/common/db_updater.rb:105:in `block in update'
/Users/tom/Documents/repos/wpscan/lib/common/db_updater.rb:84:in `each'
/Users/tom/Documents/repos/wpscan/lib/common/db_updater.rb:84:in `update'
./wpscan.rb:50:in `main'
./wpscan.rb:416:in `<main>'

I added the "Database File Checksum" myself. Commenting out the fail command at least allows it to update but I'm unsure which end is miscalculating or caching a checksum

firefart · 2015-04-02T04:57:30Z

@grrowl can you try to delete the content of your data directory and doing a fresh sync? I just checked the checksum files on the server and they should all match

grrowl · 2015-04-02T05:32:50Z

Okay, the issue seems to be resolved but not ideally: http://pastebin.com/rieNrcwJ

After deleting data, the subsequent update couldn't connect, then checksums did not match, but the last run with --verbose was successful. It seems like the server returns the wrong checksum some of the time?

firefart · 2015-04-02T05:36:26Z

@erwanlr can this be caused by typhoeus caching? Maybe typhoeus caches some old sha512 files. The server set's a high expiration date on the data files if that helps.

erwanlr · 2015-04-02T08:09:59Z

The cache dir is cleared before each scan / update, so nop it's not it (and it does not consider the expiration set by the server)

I was never able to reproduce this issue on Mac OSX nor Debian :/

firefart · 2015-04-02T08:25:35Z

@grrowl can you maybe try the failed updates with burp as a proxy?

ruby wpscan.rb --proxy http://127.0.0.1:8080 --update

I'm interested in the response when you get a checksum missmatch, and if there are any connect errors in the alert tab in burp.

SwaroopH · 2015-04-02T08:43:39Z

Tried with burp:

Unable to get https://wpvulndb.com/data/local_vulnerable_files.xml.sha512

It throws that error with/without burp.

I am able to download that file just fine with curl/firefox:

d9075b1f50ded87611d6eef70b2f08e2bdd21ef0eceaeaaff26aa23cbe00731009ccfdf1166eac4537eeb10d83050501222e6cdc3e5fc28daf430ef84156b27b

firefart · 2015-04-02T19:24:55Z

@SwaroopH @grrowl are you sitting behind a web proxy or are you connected directly(or NAT) to the internet?

grrowl · 2015-04-04T02:22:33Z

It was only a problem at work, I'll try to recreate at home via burp or Charles, otherwise will try at work on tuesday

erwanlr · 2015-04-04T08:26:28Z

Might be related to #797, i.e slow network causing the update to timeout on some files which is now fixed.

zyaboutblank · 2015-09-07T19:39:07Z

I met this question and found update my wpscan using apt-get directly is ok.

gabspecter · 2016-02-16T17:09:43Z

Someone can help me I use the Kali Linux , my WPScan Version 2.9 do not want to update the database, you are accusing an error in PLUGINS.JSON .
What should I do to update

root@root:~/wpscan# ruby wpscan.rb -u www.exemple.com -e user

    __          _______   _____                  
    \ \        / /  __ \ / ____|                 
     \ \  /\  / /| |__) | (___   ___  __ _ _ __  
      \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
       \  /\  /  | |     ____) | (__| (_| | | | |
        \/  \/   |_|    |_____/ \___|\__,_|_| |_|

    WordPress Security Scanner by the WPScan Team 
                   Version 2.9
      Sponsored by Sucuri - https://sucuri.net

@WPScan, @ethicalhack3r, @erwan_lr, pvdl, @FireFart

[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o [A]bort, default: [N]y
[i] Updating the Database ...
**
[!] Unable to get https://data.wpscan.org/plugins.json (Timeout was reached)**
root@root:~/wpscan#

firefart · 2016-02-16T20:16:47Z

@stifler171 can you please post the output of curl --version and curl -I https://data.wpscan.org/plugins.json? Also how did you get to this version? Have you cloned the github repo or installed some system package?

gabspecter · 2016-02-16T20:22:50Z

I cloned the github

firefart · 2016-02-16T20:25:12Z

@stifler171 so can you please post the output of the 2 commands above?

firefart · 2016-02-16T20:53:25Z

@stifler171 also this is my output on a freshly updated kali box:

root@kali:~# git clone https://github.com/wpscanteam/wpscan.git
Cloning into 'wpscan'...
remote: Counting objects: 15184, done.
remote: Compressing objects: 100% (7/7), done.
remote: Total 15184 (delta 0), reused 0 (delta 0), pack-reused 15177
Receiving objects: 100% (15184/15184), 12.98 MiB | 3.36 MiB/s, done.
Resolving deltas: 100% (8974/8974), done.
Checking connectivity... done.
root@kali:~# cd wpscan/
root@kali:~/wpscan# ./wpscan.rb --update
_______________________________________________________________
        __          _______   _____                  
        \ \        / /  __ \ / ____|                 
         \ \  /\  / /| |__) | (___   ___  __ _ _ __  
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team 
                       Version 2.9
          Sponsored by Sucuri - https://sucuri.net
   @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
_______________________________________________________________

[i] Updating the Database ...
[i] Update completed.
root@kali:~/wpscan#

gabspecter · 2016-02-16T23:57:45Z

@firefart Thank you for your help! But I do not know how I can get the same commands the ones you posted .

I just installed WpScan the command that GitHub offers

more when I ultilizo the camando

wpscan --url www.exemple.com --enumerate -u

well it works, no more calls to make UPDATE he does direct varedura .

gabspecter · 2016-02-17T00:14:32Z

@firefart root@root:~/wpscan# ./wpscan.rb --update --verbose

    __          _______   _____                  
    \ \        / /  __ \ / ____|                 
     \ \  /\  / /| |__) | (___   ___  __ _ _ __  
      \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
       \  /\  /  | |     ____) | (__| (_| | | | |
        \/  \/   |_|    |_____/ \___|\__,_|_| |_|

    WordPress Security Scanner by the WPScan Team 
                   Version 2.9
      Sponsored by Sucuri - https://sucuri.net

@WPScan, @ethicalhack3r, @erwan_lr, pvdl, @FireFart

[i] Updating the Database ...
[+] Checking local_vulnerable_files.xml
[i] Already Up-To-Date
[+] Checking local_vulnerable_files.xsd
[i] Already Up-To-Date
[+] Checking timthumbs.txt
[i] Already Up-To-Date
[+] Checking user-agents.txt
[i] Already Up-To-Date
[+] Checking wp_versions.xml
[i] Already Up-To-Date
[+] Checking wp_versions.xsd
[i] Already Up-To-Date
[+] Checking wordpresses.json
[i] Already Up-To-Date
[+] Checking plugins.json
[i] Needs to be updated
[i] Backup Created
[i] Downloading new file
[i] Restoring Backup due to error

[!] Unable to get https://data.wpscan.org/plugins.json (Timeout was reached)
[!] Trace:
[!] /root/wpscan/lib/common/db_updater.rb:75:in download' /root/wpscan/lib/common/db_updater.rb:97:inblock in update'
/root/wpscan/lib/common/db_updater.rb:82:in each' /root/wpscan/lib/common/db_updater.rb:82:inupdate'
./wpscan.rb:73:in main' ./wpscan.rb:470:in

'
root@root:~/wpscan#

firefart · 2016-02-17T05:39:41Z

@stifler171 as said before, please post the output of curl --version and curl -I https://data.wpscan.org/plugins.json

ethicalhack3r closed this as completed Mar 24, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

wpscan --update #788

wpscan --update #788

9andrea1 commented Mar 24, 2015

ethicalhack3r commented Mar 24, 2015

ethicalhack3r commented Mar 24, 2015

ethicalhack3r commented Mar 24, 2015

9andrea1 commented Mar 24, 2015

grrowl commented Apr 1, 2015

ethicalhack3r commented Apr 1, 2015

SwaroopH commented Apr 1, 2015

ethicalhack3r commented Apr 1, 2015

ethicalhack3r commented Apr 1, 2015

grrowl commented Apr 1, 2015

firefart commented Apr 2, 2015

grrowl commented Apr 2, 2015

firefart commented Apr 2, 2015

erwanlr commented Apr 2, 2015

firefart commented Apr 2, 2015

SwaroopH commented Apr 2, 2015

firefart commented Apr 2, 2015

grrowl commented Apr 4, 2015

erwanlr commented Apr 4, 2015

zyaboutblank commented Sep 7, 2015

gabspecter commented Feb 16, 2016

firefart commented Feb 16, 2016

gabspecter commented Feb 16, 2016

firefart commented Feb 16, 2016

firefart commented Feb 16, 2016

gabspecter commented Feb 16, 2016

gabspecter commented Feb 17, 2016

firefart commented Feb 17, 2016

wpscan --update #788

wpscan --update #788

Comments

9andrea1 commented Mar 24, 2015

ethicalhack3r commented Mar 24, 2015

ethicalhack3r commented Mar 24, 2015

ethicalhack3r commented Mar 24, 2015

9andrea1 commented Mar 24, 2015

grrowl commented Apr 1, 2015

ethicalhack3r commented Apr 1, 2015

SwaroopH commented Apr 1, 2015

ethicalhack3r commented Apr 1, 2015

ethicalhack3r commented Apr 1, 2015

grrowl commented Apr 1, 2015

firefart commented Apr 2, 2015

grrowl commented Apr 2, 2015

firefart commented Apr 2, 2015

erwanlr commented Apr 2, 2015

firefart commented Apr 2, 2015

SwaroopH commented Apr 2, 2015

firefart commented Apr 2, 2015

grrowl commented Apr 4, 2015

erwanlr commented Apr 4, 2015

zyaboutblank commented Sep 7, 2015

gabspecter commented Feb 16, 2016

firefart commented Feb 16, 2016

gabspecter commented Feb 16, 2016

firefart commented Feb 16, 2016

firefart commented Feb 16, 2016

gabspecter commented Feb 16, 2016

gabspecter commented Feb 17, 2016

firefart commented Feb 17, 2016