From 49b39942ef0cf4e2a6a82cd11aee60a826c3e643 Mon Sep 17 00:00:00 2001 From: Anonymous Date: Thu, 1 Jan 1970 00:00:00 +0000 Subject: [PATCH] Added template for wordpress-ultimate-rest-api --- wordpress-ultimate-rest-api.yaml | 228 +++++++++++++++++++++++++++++++ 1 file changed, 228 insertions(+) create mode 100644 wordpress-ultimate-rest-api.yaml diff --git a/wordpress-ultimate-rest-api.yaml b/wordpress-ultimate-rest-api.yaml new file mode 100644 index 00000000000..af03b7bd8f7 --- /dev/null +++ b/wordpress-ultimate-rest-api.yaml @@ -0,0 +1,228 @@ +id: wordpress-ultimate-rest-api + +info: + name: WordPress ULTIMATE REST API, Sensitive Files, Backup, Plugin & Recon Scanner + author: Ashwin MV + ProjectDiscoveryAI + severity: medium + description: | + Complete WordPress bug-bounty scanner for 2025. + Covers REST APIs, sensitive files, backups, plugins, themes, debug logs, WooCommerce, + Elementor, ACF, SEO plugins, and more. + tags: wordpress,bugbounty,scanner,rest-api,wp,mega,recon + +http: + - method: GET + redirects: true + max-redirects: 3 + threads: 20 + stop-at-first-match: false + + path: + + ########################## + # CORE WORDPRESS ENDPOINTS + ########################## + - "{{BaseURL}}/xmlrpc.php" + - "{{BaseURL}}/wp-login.php" + - "{{BaseURL}}/wp-signup.php" + - "{{BaseURL}}/wp-admin/" + - "{{BaseURL}}/wp-admin/admin-ajax.php" + - "{{BaseURL}}/wp-admin/admin-post.php" + - "{{BaseURL}}/wp-cron.php" + - "{{BaseURL}}/wp-comments-post.php" + - "{{BaseURL}}/readme.html" + - "{{BaseURL}}/license.txt" + - "{{BaseURL}}/robots.txt" + - "{{BaseURL}}/sitemap.xml" + - "{{BaseURL}}/sitemap_index.xml" + - "{{BaseURL}}/feed" + - "{{BaseURL}}/rss" + + ########################## + # SENSITIVE / LEAKED FILES + ########################## + - "{{BaseURL}}/.env" + - "{{BaseURL}}/.git/config" + - "{{BaseURL}}/.svn/entries" + - "{{BaseURL}}/.DS_Store" + - "{{BaseURL}}/backup.zip" + - "{{BaseURL}}/backup.sql" + - "{{BaseURL}}/db.sql" + - "{{BaseURL}}/database.sql" + - "{{BaseURL}}/wp-config.php.bak" + - "{{BaseURL}}/wp-config.php~" + - "{{BaseURL}}/wp-config.old" + - "{{BaseURL}}/wp-config.php.save" + - "{{BaseURL}}/debug.log" + - "{{BaseURL}}/error_log" + - "{{BaseURL}}/phpinfo.php" + + ############################ + # BACKUP / MISCONFIG FILES + ############################ + - "{{BaseURL}}/wp-config.php.swp" + - "{{BaseURL}}/wp-config.php_orig" + - "{{BaseURL}}/wp-config.php-backup" + - "{{BaseURL}}/wp-admin/setup-config.php" + - "{{BaseURL}}/wp-content/debug.log" + - "{{BaseURL}}/wp-content/error_log" + - "{{BaseURL}}/wp-content/*.sql" + - "{{BaseURL}}/wp-content/uploads/*.zip" + + ############################ + # COMMON DIRECTORIES + ############################ + - "{{BaseURL}}/wp-content/" + - "{{BaseURL}}/wp-includes/" + - "{{BaseURL}}/wp-admin/css/" + - "{{BaseURL}}/wp-content/plugins/" + - "{{BaseURL}}/wp-content/themes/" + - "{{BaseURL}}/wp-content/uploads/" + + ############################ + # VULNERABLE PLUGIN ENDPOINTS + ############################ + - "{{BaseURL}}/wp-content/plugins/revslider/admin-ajax.php" + - "{{BaseURL}}/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" + - "{{BaseURL}}/wp-content/plugins/elementor/readme.txt" + - "{{BaseURL}}/wp-content/plugins/backupbuddy/readme.txt" + - "{{BaseURL}}/wp-content/plugins/wpdiscuz/assets/js/wpdiscuz.js" + + ############################ + # WORDPRESS REST API + ############################ + - "{{BaseURL}}/wp-json/" + - "{{BaseURL}}/wp-json/wp/v2/users" + - "{{BaseURL}}/wp-json/wp/v2/users?roles=administrator" + - "{{BaseURL}}/wp-json/wp/v2/posts" + - "{{BaseURL}}/wp-json/wp/v2/pages" + - "{{BaseURL}}/wp-json/wp/v2/media" + - "{{BaseURL}}/wp-json/wp/v2/comments" + - "{{BaseURL}}/wp-json/wp/v2/settings" + - "{{BaseURL}}/wp-json/wp/v2/themes" + - "{{BaseURL}}/wp-json/wp/v2/plugins" + + ############################ + # WOO COMMERCE + ############################ + - "{{BaseURL}}/wp-json/wc/v3/products" + - "{{BaseURL}}/wp-json/wc/v3/orders" + - "{{BaseURL}}/wp-json/woo-gutenberg-products-block/v1/products" + + ############################ + # ACF + ############################ + - "{{BaseURL}}/wp-json/acf/v3/options/options" + - "{{BaseURL}}/wp-json/acf/v3/posts" + - "{{BaseURL}}/wp-json/acf/v3/pages" + + ############################ + # ELEMENTOR + ############################ + - "{{BaseURL}}/wp-json/elementor/v1/globals" + + ############################ + # SEO (Yoast / RankMath) + ############################ + - "{{BaseURL}}/wp-json/yoast/v1/configurator" + - "{{BaseURL}}/wp-json/wpseo/v1" + - "{{BaseURL}}/wp-json/rankmath/v1" + + ############################ + # SECURITY PLUGINS + ############################ + - "{{BaseURL}}/wp-json/itsec/v1" + + ############################ + # WPML / MULTI-LANG + ############################ + - "{{BaseURL}}/wp-json/wpml/v1/config" + + ############################ + # COMMENT PLUGINS + ############################ + - "{{BaseURL}}/wp-json/wpdiscuz/v1" + + ############################ + # NEWSLETTER + ############################ + - "{{BaseURL}}/wp-json/mailpoet/v1" + + ############################ + # MARKETPLACE + ############################ + - "{{BaseURL}}/wp-json/dokan/v1/stores" + + ############################ + # JOB MANAGER + ############################ + - "{{BaseURL}}/wp-json/job-manager/v1/listings" + + ############################ + # GUTENBERG BLOCKS + ############################ + - "{{BaseURL}}/wp-json/wp/v2/block-types" + - "{{BaseURL}}/wp-json/wp/v2/blocks" + - "{{BaseURL}}/wp-json/wp/v2/block-renderer/core/paragraph" + + ############################ + # CUSTOMIZER + ############################ + - "{{BaseURL}}/wp-json/wp/v2/customizer/settings" + + ############################ + # DEBUG / CUSTOM ENDPOINTS + ############################ + - "{{BaseURL}}/wp-json/debug_log/v1/logs" + - "{{BaseURL}}/wp-json/custom/v1/config" + + matchers-condition: or + matchers: + + - type: status + status: + - 200 + - 201 + - 401 + - 403 + + - type: regex + part: header + regex: + - "application/json" + + - type: word + part: body + words: + - "Powered by WordPress" + - "\"namespace\":\"wp/v2\"" + - "\"name\":\"WordPress\"" + + - type: regex + part: body + regex: + - "(?i)(fatal error|stack trace|debug|warning|exception|deprecated)" + + - type: regex + part: body + regex: + - "(?i)(DB_PASSWORD|DB_USER|DB_NAME|APP_KEY|DB_HOST|APP_ENV|\\[core\\])" + + - type: regex + part: body + regex: + - "(?i)(index of /wp-content|index of /plugins|index of /uploads)" + + extractors: + + - type: regex + part: body + group: 1 + regex: + - "\"version\":\"([0-9.]+)\"" + + - type: regex + part: body + group: 1 + regex: + - "\"plugin\":\"([^\"]+)\"" \ No newline at end of file