Scan wordpress websites for vulnerabilities with wpscan

What is WPScan?

It interrogates wordpress websites/blogs.WPScan is used to find vulnerabilities in wordpress blogs/websites.It uses blackbox techniques to penetrate wordpress.

WPScan is written in Ruby .There have been a number of security issues found in plugins and themes used in wordpress.

WPScan is a black box WordPress Security Scanner written in Ruby which attempts to find known security weaknesses within WordPress installations. Its intended use it to be for security professionals or WordPress administrators to asses the security posture of their WordPress installations

You can find following information about wordpress blogs using WPScan

1: Plugin enumeration.

2: Plugin vulnerability enumeration.

3:  Enumerating Themes.

4: Weak password cracking.

5: Username enumeration.

6: Directory listing.

Step 1:   Open the terminal and type following command
           wpscan   and enter.
This command displays all the available commands with short description. 

Step 2:  For further help type:  wpscan --help   and press enter.

Step 3:   Launch a scan.
syntax is:   wpscan --url [URL]  

Your complete command should look like this.
wpscan --url https://fashiondujourdaily.wordpress.com/ 

 As you can see in below pictures we have found some useful information,Like Robot.txt file and plugin. 

 

 

Step 4:

  

Plugin enumeration.

   To enumerate plugins you need to add --enumerate p  at the end of url.

Syntax is:  wpscan --url[URL] --enumerate p   

Your complete command should look like this

wpscan --url https://fashiondujourdaily.wordpress.com/ --enumerate p  

 

Step 5:  

Enumerate vulnerable Plugins .

To display only vulnerable plugins you need to add --enumerate vpat the end of url.

Your complete command should look like this.

wpscan --url https://fashiondujourdaily.wordpress.com/ --enumerate vp 

 As you can see in the above picture this website is vulnerable attacker can launch an Xss attack,Because plugin fails to escape the data received from user.

Step 6:

.  

Enumerating Themes .

you need to add --enumerate t  at the end of url.

Your complete command should look like this.

wpscan --url https://fashiondujourdaily.wordpress.com/ --enumerate t




As you can see the the above picture we found 10 themes used by this blog.