Skip to content

Remove wpscan module - #3243

Merged
liquidsec merged 1 commit into
devfrom
remove-wpscan-module
Jun 24, 2026
Merged

Remove wpscan module#3243
liquidsec merged 1 commit into
devfrom
remove-wpscan-module

Conversation

@liquidsec

Copy link
Copy Markdown
Collaborator

Removes the wpscan module and its test. It's become too heavy and too brittle for bbot's lightweight install model:

  • Heavy install footprint. wpscan is a Ruby gem that needs a build toolchain (gcc, make, ruby-dev) to compile a native C extension (yajl-ruby, pulled in transitively via cms_scanner) on the user's machine. Enabling one module drags a compiler onto the host.
  • Brittle pinned dependencies. wpscan 3.8.28 pins an old activesupport (6.1.x). When the transitive concurrent-ruby released 1.3.5 (which dropped its implicit require 'logger'), wpscan stopped booting entirely with uninitialized constant ActiveSupport::LoggerThreadSafeLevel::Logger. That's a field breakage with zero changes on our side, and it recurs whenever a transitive gem floats forward.
  • Stuck on the old pin. Current wpscan (4.x) requires Ruby >= 3.3, newer than what Ubuntu 24.04 and the CI runners ship (3.2.3), so we can't move off the brittle 3.8.x line.
  • Failures weren't graceful. setup() returned True unconditionally without verifying wpscan could run, so when it failed it raised on every event ('NoneType' object has no attribute 'stdout', or json.loads("") on empty output), flooding scans with errors.
  • The test never ran the tool. The module test monkeypatches helpers.run to return canned JSON, so it only exercised the output parser; the binary was never invoked. That's why CI stayed green while the tool was broken in the field.

Removes:

  • bbot/modules/wpscan.py
  • bbot/test/test_step_2/module_tests/test_module_wpscan.py

Heavy Ruby/compiler install footprint (yajl-ruby needs gcc/make/ruby-dev),
a pinned old activesupport that breaks on transitive gem drift
(concurrent-ruby 1.3.5), stuck on an old wpscan line by wpscan 4.x's
Ruby >=3.3 requirement, crashes instead of degrading when wpscan fails,
and a test that stubbed out the binary so none of it was ever caught.

Docs regeneration handled separately.
@ausmaster
ausmaster self-requested a review June 24, 2026 19:38
@github-actions

Copy link
Copy Markdown
Contributor

📊 Performance Benchmark Report

Comparing dev (baseline) vs remove-wpscan-module (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name 📏 Base 📏 Current 📈 Change 🎯 Status
Bloom Filter Dns Mutation Tracking Performance 4.55ms 4.34ms -4.7%
Bloom Filter Large Scale Dns Brute Force 18.67ms 18.02ms -3.5%
Large Closest Match Lookup 346.13ms 326.04ms -5.8%
Realistic Closest Match Workload 182.36ms 178.64ms -2.0%
Event Memory Medium Scan 1402 B/event 1402 B/event +0.0%
Event Memory Large Scan 1527 B/event 1527 B/event +0.0%
Event Validation Full Scan Startup Small Batch 407.33ms 392.97ms -3.5%
Event Validation Full Scan Startup Large Batch 517.31ms 501.54ms -3.0%
Make Event Autodetection Small 20.35ms 20.19ms -0.8%
Make Event Autodetection Large 208.54ms 202.75ms -2.8%
Make Event Explicit Types 8.68ms 8.33ms -4.0%
Excavate Single Thread Small 3.648s 3.636s -0.3%
Excavate Single Thread Large 9.270s 9.322s +0.6%
Excavate Parallel Tasks Small 3.823s 3.855s +0.8%
Excavate Parallel Tasks Large 5.861s 5.844s -0.3%
Intercept Throughput Small 905.37ms 982.80ms +8.6%
Intercept Throughput Medium 892.49ms 881.45ms -1.2%
Dns Throughput Quiet 2.578s 2.634s +2.2%
Dns Throughput Loaded 1.772s 1.702s -3.9%
Dns Throughput Inherited 2.317s 2.148s -7.3%
Is Ip Performance 2.47ms 2.31ms -6.4%
Make Ip Type Performance 208.73µs 294.04µs +40.9% 🔴🔴🔴 ⚠️
Mixed Ip Operations 2.49ms 2.39ms -3.8%
Memory Use Web Crawl 1.0 MB 1.0 MB +0.0%
Memory Use Subdomain Enum 28.3 MB 28.3 MB +0.0%
Memory Use Deep Chain 5.0 MB 5.0 MB +0.0%
Memory Use Parallel Chains 10.7 MB 12.1 MB +12.7% 🟡🟡 ⚠️
Scan Throughput 100 2.728s 2.493s -8.6%
Scan Throughput 1000 17.976s 17.734s -1.3%
Typical Queue Shuffle 5.32µs 5.46µs +2.7%
Priority Queue Shuffle 26.50µs 26.82µs +1.2%

🎯 Performance Summary

! 2 regressions ⚠️
  29 unchanged ✅

🔍 Significant Changes (>10%)

  • Make Ip Type Performance: 40.9% 🐌 slower
  • Memory Use Parallel Chains: 12.7% 🐌 more memory

🐍 Python Version 3.11.15

@codecov

codecov Bot commented Jun 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (3bc8e9c) to head (76fe1be).

Additional details and impacted files
@@          Coverage Diff           @@
##             dev   #3243    +/-   ##
======================================
+ Coverage     90%     90%    +1%     
======================================
  Files        453     451     -2     
  Lines      46304   46125   -179     
======================================
- Hits       41411   41270   -141     
+ Misses      4893    4855    -38     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@liquidsec
liquidsec merged commit c785b97 into dev Jun 24, 2026
17 checks passed
@ausmaster
ausmaster deleted the remove-wpscan-module branch June 30, 2026 15:36
@liquidsec liquidsec mentioned this pull request Jul 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants