<filename>tests/test_wpexploiter.py
import pytest

from wordpress import WPDatabaseResetExploiter,WPTimeCapsuleExploiter, WPEnumerator
from tests.test_data import protocols, params


params[2] = ("elro-sec.com/dev2", False)
params[3] = ("elro-sec.com/dev3", False)

login_data = {
    "username": "elro_attck_337",
    "password": "<PASSWORD>",
    "action": "login"
}

# ----------------------------WP Database Reset plugin Tests---------------------------- #


@pytest.mark.parametrize("url, result", params)
def test_database_exploiter_is_vulnerable(url, result):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPDatabaseResetExploiter(target)
        is_vulnerable = exploiter.is_vulnerable()
        assert type(is_vulnerable) is bool
        assert is_vulnerable == result


@pytest.mark.parametrize("url, result", params)
def test_database_exploiter_exploite_via_register_no_data(url, result):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPDatabaseResetExploiter(target)
        is_success = exploiter.exploit()
        assert type(is_success) is bool
        assert is_success == result


@pytest.mark.parametrize("url, result", params)
def test_database_exploiter_exploit_via_login(url, result):
    for protocol in protocols:
        data = login_data
        if 'dev1' in url:
            # find the username (changed at the register attack)
            enumerator = WPEnumerator("http://elro-sec.com/dev1")
            users = enumerator.enumerate(min_id=1, max_id=10)
            data['username'] = list(users.keys())[0]
        target = "{}{}".format(protocol, url)
        login_data['login_page'] = "{}/wp-login.php".format(target.strip('/'))
        exploiter = WPDatabaseResetExploiter(target)
        is_success = exploiter.exploit()
        assert type(is_success) is bool
        assert is_success == result


# ----------------------------WP Time Capsule plugin Tests---------------------------- #


@pytest.mark.parametrize("url, result", params)
def test_time_capsule_exploiter_is_vulnerable(url, result):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPTimeCapsuleExploiter(target)
        is_vulnerable = exploiter.is_vulnerable()
        assert type(is_vulnerable) is bool
        assert is_vulnerable == result


@pytest.mark.parametrize("url, result", params)
def test_time_capsule_exploiter_exploit(url, result, capsys):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPTimeCapsuleExploiter(target)
        is_success = exploiter.exploit()
        captured = capsys.readouterr()
        assert type(is_success) is bool
        assert is_success == result
        if result is False:  # assert that failed because the plugin is
            # not installed/the url is not valid(max retries) or because the plugin is not active (unable to detect)
            assert "Max retries exceeded" or "Unfortunately we were unable to detect" in str(captured.out)

<filename>tests/test_wpexploiter.py
import pytest

from wordpress import WPDatabaseResetExploiter,WPTimeCapsuleExploiter, WPEnumerator
from tests.test_data import protocols, params


params[2] = ("elro-sec.com/dev2", False)
params[3] = ("elro-sec.com/dev3", False)

login_data = {
    "username": "elro_attck_337",
    "password": "<PASSWORD>",
    "action": "login"
}

# ----------------------------WP Database Reset plugin Tests---------------------------- #


@pytest.mark.parametrize("url, result", params)
def test_database_exploiter_is_vulnerable(url, result):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPDatabaseResetExploiter(target)
        is_vulnerable = exploiter.is_vulnerable()
        assert type(is_vulnerable) is bool
        assert is_vulnerable == result


@pytest.mark.parametrize("url, result", params)
def test_database_exploiter_exploite_via_register_no_data(url, result):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPDatabaseResetExploiter(target)
        is_success = exploiter.exploit()
        assert type(is_success) is bool
        assert is_success == result


@pytest.mark.parametrize("url, result", params)
def test_database_exploiter_exploit_via_login(url, result):
    for protocol in protocols:
        data = login_data
        if 'dev1' in url:
            # find the username (changed at the register attack)
            enumerator = WPEnumerator("http://elro-sec.com/dev1")
            users = enumerator.enumerate(min_id=1, max_id=10)
            data['username'] = list(users.keys())[0]
        target = "{}{}".format(protocol, url)
        login_data['login_page'] = "{}/wp-login.php".format(target.strip('/'))
        exploiter = WPDatabaseResetExploiter(target)
        is_success = exploiter.exploit()
        assert type(is_success) is bool
        assert is_success == result


# ----------------------------WP Time Capsule plugin Tests---------------------------- #


@pytest.mark.parametrize("url, result", params)
def test_time_capsule_exploiter_is_vulnerable(url, result):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPTimeCapsuleExploiter(target)
        is_vulnerable = exploiter.is_vulnerable()
        assert type(is_vulnerable) is bool
        assert is_vulnerable == result


@pytest.mark.parametrize("url, result", params)
def test_time_capsule_exploiter_exploit(url, result, capsys):
    for protocol in protocols:
        target = "{}{}".format(protocol, url)
        exploiter = WPTimeCapsuleExploiter(target)
        is_success = exploiter.exploit()
        captured = capsys.readouterr()
        assert type(is_success) is bool
        assert is_success == result
        if result is False:  # assert that failed because the plugin is
            # not installed/the url is not valid(max retries) or because the plugin is not active (unable to detect)
            assert "Max retries exceeded" or "Unfortunately we were unable to detect" in str(captured.out)

# ----------------------------WP Database Reset plugin Tests---------------------------- # # find the username (changed at the register attack) # ----------------------------WP Time Capsule plugin Tests---------------------------- # # assert that failed because the plugin is # not installed/the url is not valid(max retries) or because the plugin is not active (unable to detect)