import shutil
import asyncio
import json
async def scan_cms(url: str, cms: str = "wordpress") -> dict:
"""
Scan CMS using wpscan (WordPress) or others
"""
if cms.lower() == "wordpress":
if not shutil.which("wpscan"):
return {"error": "wpscan not installed"}
try:
# wpscan --url <url> --format json
cmd = ["wpscan", "--url", url, "--format", "json", "--disable-tls-checks"]
process = await asyncio.create_subprocess_exec(
*cmd,
stdout=asyncio.subprocess.PIPE,
stderr=asyncio.subprocess.PIPE
)
stdout, stderr = await process.communicate()
if process.returncode != 0 and process.returncode != 5: # wpscan returns 5 on vuln found
# It might still output json
pass
output = stdout.decode()
try:
return json.loads(output)
except:
return {"raw_output": output, "error": stderr.decode()}
except Exception as e:
return {"error": str(e)}
else:
return {"error": f"CMS {cms} not supported yet"}
