WordPress Wordfence - WAF Logs and Data Disclosure Detection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""The Wordfence Security plugin creates various log and data files in the wflogs directory."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Scanner, Http_client):
    __info__ = {
        'name': 'WordPress Wordfence - WAF Logs and Data Disclosure Detection',
        'description': 'The Wordfence Security plugin creates various log and data files in the wflogs directory. If directory listing is enabled or files are directly accessible, sensitive information about blocked attacks, IP addresses, and firewall configuration may be exposed.',
        'author': ['KittySploit Team'],
        'severity': 'low',
        'tags': ['web', 'scanner', 'misconfiguration', 'wordpress', 'wp', 'wp-plugin', 'wordfence', 'logs', 'exposure'],
        'agent': {
            'risk': 'active',
            'effects': ['network_probe'],
            'expected_requests': 4,
            'reversible': True,
            'approval_required': False,
            'produces': ['tech_hints', 'risk_signals', 'endpoints'],
            'cost': 1.0,
            'noise': 0.3,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {
                        'capability': 'admin_surface',
                        'from_detail': '',
                    },
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': ['auxiliary/scanner/http/login_page_detector'],
            },
        },
        'references': [
            'https://wordpress.org/support/topic/detect-suspicious-content-in-word-fence-wflogs-in-my-site/',
            'https://wordpress.org/support/topic/syn_sent-in-wflogs-filename-php/',
        ],
    }

    def run(self):
        for path in ('/', '/wp-content/wflogs/', '/wp-content/plugins/wordfence/lib/wflogs/', '/wp-content/plugins/wordfence/tmp/'):
            r = self.http_request(method="GET", path=path, allow_redirects=True)
            if not r or r.status_code != 200:
                continue
            body = r.text or ""
            body_any = ('plugins/wordfence', 'Index of', '/wp-content/wflogs', '/wp-content/plugins/wordfence',)
            if (any(m in body for m in body_any)):
                self.set_info(
                    severity='low',
                    reason="WordPress Wordfence - WAF Logs and Data Disclosure detected",
                    path=path,
                )
                return True
        return False