WP scan is a very important tool that will discover lots of information about the WordPress platform
you're targeting.
It will give you information about the version installed the theme used the vulnerable component employed.
You can as well enumerate the users and WS can give you the ability to brute force into these accounts.
If you use it together with the NIC to application you will be able to assess your web server in a very
good way.
I went to turnkey Linux dot org to download a wordpress virtual machine box so just go here.
Download this virtual machine that is compatible with them where install it and follow the wizard in
order to set it up it's very easy and straightforward.
So the IP of the machine here is 1 dot 1 0 4.
I'll go to my Kelly machine here.
Open the terminal Let me zoom in and use the command and WP scan hyphen hyphen update.
It will update the database which is a prerequisite to start using the application.
Now the trivial comment is to use WP scan hyphen hyphen you are L then you specify the URL the domain
name or the IP that you want to attack.
In this case it's 1 9 2 1 6 8 1 2 1 0 4.
Just hit enter and wait for the results.
So as you can see here it gave us important information about the server type.
It gave us as well information about let us see the name of the theme so very important.
Your LS and it told us there are no plugins installed and no config backups found we can append this
command by using the e switch which is enumerate and we can tell it to enumerate you which means users.
So now the scanner will start over and it will attempt to enumerate the users as you can see here.
It has identified one user which is the admin user.
Now let me show you what can w peace can enumerate
if you search here for the E which it can enumerate vulnerable plugins vulnerable themes DBA exports
and users.
So with the use of different switches you'll be able to get more information about that.
Now we have a very important piece of information which is the admin username.
Now we will try to brute force this admin username for this case I've created a simple word lists here.
Its word lists the key XY but in your case if you're doing a real world attack you can go here to WP
white security dot com.
Go to this thing here and download the zip file which has over a million password related to WordPress
still click on that.
Millions of passwords.
Which is very useful.
You can as well use the Q word list and the door code word lists as well which has more than 40 million
password.
Now using this wordless password that I've created I'll just append my command here.
I'll use the switch B and specify the word list.
Location.
And then I use the switch.
You can specify the user name which is Evan.
You can as well said the number of threads which are parallel attempts to try to brute force unto the
I can press enter and wait for the magic
as you can see here the reforming password attacks it has identified the password which is the complex
password for the user admin
in order to prevent against users in simulation try or avoid using usernames as nicknames because this
w piece can.
It identifies user names from the user ls use and in order to prevent against password.
Brute force attacks.
Just tried to use some secure plugins that will limit logging attempts for certain user names and IP
addresses.
Also make sure to set out password lock out or the account lock out time.
Now let's do a scanning for it real web.
Using Wordpress which is out there tried to enumerate the users and let me check this out here.
So this is a real upside that is hosted on the Internet.
We just want to show you that it doesn't only work for the default installation for wordpress but this
tool is very powerful and it can work on any work person installation engine X is the server the location
to the robots that DST file some your.
And this site has most use plugins.
This is the link to the plugins the website users upload directly has listening enabled so if you go
to this link here you'll be able to browse files.
The version sold is four point nine point eight.
Here is some information about the wordpress theme used and here is the information about the uses that
in fact it has identified one user which is not the admin default user and the time taken is one minute
now that you have this username.
You can try to brute force it but I don't advise you to do that on websites that you don't own.
Just try to keep this ethical.