wp-plugins.lst update

[David Fifield <david () bamsoftware com>]

On Sat, Mar 03, 2012 at 01:57:16PM +0100, Gutek wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Le 29/02/2012 05:55, David Arrington a écrit :
> > Hi,
> >
> > I just ran a test to a server trying to find the plugins that a wordpress
> > site is using.  I did this searching for the top 100 plugins only.  When I
> > did this the output showed all 100 plugins.  I know that not all of these
> > plugins are installed, so I must be using this script incorrectly.  Can
> > someone familiar with this script give me an example of how to use it to
> > find the plugins?  Is there something else I need to do to see which of
> > those 100 plugins are actually installed?
> >
> > Thank you!
> I've tried to reproduce this against a bunch of websites but with no
> success. My guess is that you have found a special case that I didn't
> test when writing this script. I also think that it has something to do
> with the way your target handles 404 conditions, probably with some
> custom page showing like a 200 (thereby fooling the script). That would
> be interesting to investigate because this particular case should be
> covered.
> With the --script-trace that David has suggested, I'm also curious about
> your target : I'd be glad if you reveal it (even privately, feel free to
> mail me apart on that point) so I can figure it out on my own.
>
> That said, please find attached an update for the Wordpress plugins
> database. It has grown from some 14K plugins to 18.5K to date. There are
> also numerous changes in the top 100.
>
> Before it's included in the official Nmap release, users can simply
> untar in their /nmap/nselib/data/ directory.

I have committed your new list. Can you share the procedure you use to
generate the list by popularity so we may document it?

I noticed while looking at the diff that the plugin "gtranslate" was
removed but a new one "gtrans" took its place. I'm assuming the plugin
just changed its name. Does this mean that sites using the older name
will not be detected?

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/