WPScan - A WordPress Vulnerability Scanner

WPScan is a black box WordPress vulnerability scanner.

It comes pre-installed on the following Linux distributions:

Note: Windows is not supported.

On macOS WPScan is packaged by Homebrew as wpscan.

Docker

Use the official Docker image to avoid installation problems.

Pull the repo with docker pull wpscanteam/wpscan

Start WPScan:

  docker run -it --rm wpscanteam/wpscan -u https://yourblog.com [options]

Example:
Mount a local wordlist to the docker container and start a bruteforce attack for user admin:

  docker run -it --rm -v ~/wordlists:/wordlists wpscanteam/wpscan --url 
https://yourblog.com --wordlist /wordlists/crackstation.txt --username admin

This mounts the host directory ~/wordlists to the container in the path /wordlists

Manual Install

Requirements:

Ruby >= 2.1.9 - Recommended: 2.5.0
Curl >= 7.21 - Recommended: latest - FYI the 7.29 has a segfault
RubyGems - Recommended: latest
Git

Installing dependencies on Ubuntu:

  sudo apt-get install libcurl4-openssl-dev libxml2 libxml2-dev libxslt1-dev ruby-dev 
build-essential libgmp-dev zlib1g-dev

Installing dependencies on Debian:

  sudo apt-get install gcc git ruby ruby-dev libcurl4-openssl-dev make zlib1g-dev

Installing dependencies on Fedora:

  sudo dnf install gcc ruby-devel libxml2 libxml2-devel libxslt libxslt-devel libcurl-devel
patch rpm-build

Installing dependencies on Arch Linux:

  pacman -Syu ruby
pacman -Syu libyaml

Installing dependencies on macOS:
Apple Xcode, Command Line Tools and the libffi are needed (to be able to install the FFI gem)

Installing with RVM:
If you are using GNOME Terminal, there are some steps required before executing the commands.

  # Install all prerequisites for your OS (look above)
cd ~
curl -sSL http://ift.tt/1paXbM9 | gpg --import -
curl -sSL https://get.rvm.io | bash -s stable
source ~/.rvm/scripts/rvm
echo "source ~/.rvm/scripts/rvm" >> ~/.bashrc
rvm install 2.5.0
rvm use 2.5.0 --default
echo "gem: --no-ri --no-rdoc" > ~/.gemrc
git clone http://ift.tt/1hL3n7H
cd wpscan
gem install bundler
bundle install --without test

Installing manually:

  git clone http://ift.tt/1hL3n7H
cd wpscan
sudo gem install bundler && bundle install --without test

WPScan Arguments

--update Update the database to the latest version.

--url | -u The WordPress URL/domain to scan.

--force | -f Forces WPScan to not check if the remote site is
running WordPress.

--enumerate | -e [option(s)] Enumeration.

option :

u usernames from id 1 to 10

u[10-20] usernames from id 10 to 20 (you must write [] chars)

p plugins

vp only vulnerable plugins

ap all plugins (can take a long time)

tt timthumbs

t themes

vt only vulnerable themes

at all themes (can take a long time)

Multiple values are allowed : "-e tt,p" will enumerate timthumbs and plugins

If no option is supplied, the default is "vt,tt,u,vp"

--exclude-content-based ""

Used with the enumeration option, will exclude
all occurrences based on the regexp or string
supplied. You do not need to provide the regexp
delimiters, but you must write the quotes (simple
or double).

--config-file | -c Use the specified config file,
see the example.conf.json.

--user-agent | -a Use the specified User-Agent.

--cookie String to read cookies from.

--random-agent | -r Use a random User-Agent.

--follow-redirection If the target url has a redirection, it will be
followed without asking if you wanted to do so
or not

--batch Never ask for user input, use the default behaviour.

--no-color Do not use colors in the output.

--log [filename] Creates a log.txt file with WPScan's output if no
filename is supplied. Otherwise the filename is
used for logging.

--no-banner Prevents the WPScan banner from being displayed.

--disable-accept-header Prevents WPScan sending the Accept HTTP header.

--disable-referer Prevents setting the Referer header.

--disable-tls-checks Disables SSL/TLS certificate verification.

--wp-content-dir WPScan try to find the content directory
(ie wp-content) by scanning the index page,
however you can specify it.

Subdirectories are allowed.

--wp-plugins-dir Same thing than --wp-content-dir but for the
plugins directory.

If not supplied, WPScan will use
wp-content-dir/plugins. Subdirectories are allowed

--proxy <[http://protocol]host:port> Supply a proxy. HTTP, SOCKS4 SOCKS4A and SOCKS5 are
supported. If no protocol is given
(format host:port), HTTP will be used.
--proxy-auth Supply the proxy login credentials.

--basic-auth Set the HTTP Basic authentication.

--wordlist | -w Supply a wordlist for the password brute forcer.

If the "-" option is supplied, the wordlist is
expected via STDIN.

--username | -U Only brute force the supplied username.

--usernames Only brute force the usernames from the file.

--cache-dir Set the cache directory.

--cache-ttl Typhoeus cache TTL.

--request-timeout Request Timeout.

--connect-timeout Connect Timeout.

--threads | -t The number of threads to use when multi-threading
requests.

--throttle Milliseconds to wait before doing another web
request. If used, the --threads should be set to 1.

--help | -h This help screen.

--verbose | -v Verbose output.

--version Output the current version and exit.

Examples

Do 'non-intrusive' checks:

  ruby wpscan.rb --url www.example.com

Do wordlist password brute force on enumerated users using 50 threads:

  ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --threads 50

Do wordlist password brute force on enumerated users using STDIN as the wordlist:

  crunch 5 13 -f charset.lst mixalpha | ruby wpscan.rb --url www.example.com --wordlist -

Do wordlist password brute force on the 'admin' username only:

  ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --username admin

Enumerate installed plugins:

  ruby wpscan.rb --url www.example.com --enumerate p

Run all enumeration tools:

  ruby wpscan.rb --url www.example.com --enumerate

Use custom content directory:

  ruby wpscan.rb -u www.example.com --wp-content-dir custom-content

Update WPScan's databases:

  ruby wpscan.rb --update

Debug output:

  ruby wpscan.rb --url www.example.com --debug-output 2>debug.log

Download WPScan

You might also like:

from Effect Hacking full article here

Nexus

WPScan - A WordPress Vulnerability Scanner

Recent Posts

Facebook

Nexus

WPScan - A WordPress Vulnerability Scanner

Docker

Manual Install

Requirements:

WPScan Arguments

Examples

You Might Also Like

Recent Posts

Facebook