Web Application Analysis
wpscan
wpscan knows WordPress inside out. A huge fraction of the web runs on it, and
its weak points are almost always the same: an outdated core, a vulnerable
plugin, a theme with a known flaw, exposed usernames, and weak passwords.
wpscan enumerates all of that and checks it against a vulnerability database,
turning “it’s a WordPress site” into a concrete list of what to try.
Official-repo package; Security → Web Application Analysis → wpscan. The
vulnerability data comes from the WPScan database — register for a free API token
and pass it with --api-token to get the CVE details filled in.
The help it prints
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner
Version 4.0.1
An Automattic endeavor
https://automattic.com
_______________________________________________________________
Usage: wpscan [options]
--url URL The URL of the blog to scan
Allowed Protocols: http, https
Default Protocol if none provided: http
This option is mandatory unless update or help or hh or version is/are supplied
-h, --help Display the simple help and exit
--hh Display the full help and exit
--version Display the version and exit
-v, --verbose Verbose mode
--[no-]banner Whether or not to display the banner
Default: true
-o, --output FILE Output to FILE
-f, --format FORMAT Output results in the format supplied
Available choices: cli-no-colour, cli-no-color, json, jsonl, sarif, cli
--[no-]stream Emit enumeration findings (plugins/themes/users) as they are discovered, instead of waiting until each enumeration step completes. Has no effect on the json or sarif output formats, which always batch.
Default: true
--detection-mode MODE Default: mixed
Available choices: mixed, passive, aggressive
--user-agent, --ua VALUE
--random-user-agent, --rua Use a random user-agent for each scan
--http-auth login:password Basic HTTP authentication, beware that the $ character must be properly escaped.
--wp-auth login:password WordPress admin credentials used to query the REST API for an authoritative inventory of installed plugins and themes (/wp-json/wp/v2/plugins and /themes). When provided, plugin/theme enumeration via -e is bypassed. The password MUST be a WordPress Application Password (WP >= 5.6, created at Users -> Profile -> Application Passwords). Real account passwords are rejected by WordPress core over Basic Auth.
-t, --max-threads VALUE The max threads to use
Default: 5
--throttle MilliSeconds Milliseconds to wait before doing another web request. If used, the max threads will be set to 1.
--request-timeout SECONDS The request timeout in seconds
Default: 60
--connect-timeout SECONDS The connection timeout in seconds
Default: 30
--disable-tls-checks Disables SSL/TLS certificate verification, and downgrade to TLS1.0+ (requires cURL 7.66 for the latter)
--proxy protocol://IP:port Supported protocols depend on the cURL installed. Note: with socks5://, hostnames are resolved locally before being sent to the proxy; use socks5h:// to have the proxy resolve them (required for .onion addresses when proxying through Tor).
--proxy-auth login:password
--cookie-string COOKIE Cookie string to use in requests, format: cookie1=value1[; cookie2=value2]
--cookie-jar FILE-PATH File to read and write cookies
Default: /home/cyberbow/.cache/wpscan/cookie_jar.txt
--force Do not check if the target is running WordPress or returns a 403
--[no-]update Whether or not to update the Database
--api-token TOKEN The WPScan API Token to display vulnerability data, available at https://wpscan.com/profile
--proxy-target-only When used with --proxy, the proxy is only applied to requests made to the target, not to requests made to the WPScan API or database repository (data.wpscan.org). Has no effect unless --proxy is also set.
--wp-content-dir DIR The wp-content directory if custom or not detected, such as "wp-content"
--wp-plugins-dir DIR The plugins directory if custom or not detected, such as "wp-content/plugins"
-e, --enumerate [OPTS] Enumeration Process
Note: --plugins-list overrides vp/ap/p; --themes-list overrides vt/at/t.
Available Choices:
vp Vulnerable plugins
ap All plugins
p Popular plugins
vt Vulnerable themes
at All themes
t Popular themes
tt Timthumbs
cb Config backups
dbe Db exports
bf Backup folders
u User IDs range. e.g: u1-5
Range separator to use: '-'
Value if no argument supplied: 1-10
m Media IDs range. e.g m1-15
Note: Permalink setting must be set to "Plain" for those to be detected
Range separator to use: '-'
Value if no argument supplied: 1-100
Separator to use between the values: ','
Value if no argument supplied: vp,vt,tt,cb,dbe,bf,u,m
Incompatible choices (only one of each group/s can be used):
- vp, ap, p
- vt, at, t
--exclude-content-based REGEXP_OR_STRING Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration.
Both the headers and body are checked. Regexp delimiters are not required.
--plugins-detection MODE Use the supplied mode to enumerate Plugins.
Available choices: mixed, passive, aggressive
--plugins-version-detection MODE Use the supplied mode to check plugins' versions.
Available choices: mixed, passive, aggressive
--exclude-usernames REGEXP_OR_STRING Exclude usernames matching the Regexp/string (case insensitive). Regexp delimiters are not required.
-P, --passwords FILE-PATH List of passwords to use during the password attack.
If no --username/s option supplied, user enumeration will be run.
-U, --usernames LIST List of usernames to use during the password attack.
Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt'
--multicall-max-passwords MAX_PWD Maximum number of passwords to send by request with XMLRPC multicall
Default: 500
--password-attack ATTACK Force the supplied attack to be used rather than automatically determining one.
Multicall will only work against WP < 4.4
Available choices: wp-login, xmlrpc, xmlrpc-multicall
--login-uri URI The URI of the login page if different from /wp-login.php
--wordlist-skip N Skip the first N passwords in the wordlist (resume from line N+1)
Default: 0
--max-retries N Maximum retry attempts for failed requests due to network/proxy errors
Default: 0
--stealthy Alias for --random-user-agent --detection-mode passive
[!] To see full list of options use --hh.Examples
# Basic scan
wpscan --url http://10.0.0.5
# Enumerate vulnerable plugins, users, and themes
wpscan --url http://10.0.0.5 --enumerate vp,u,vt
# With an API token for full vulnerability details
wpscan --url http://10.0.0.5 --api-token YOUR_TOKEN --enumerate vp
# Password-guess a discovered user against xmlrpc
wpscan --url http://10.0.0.5 -U admin -P /usr/share/wordlists/rockyou.txt