Pentesting.Site - WPScan Cheat Sheet

WPScan is a black box WordPress vulnerability scanner. It's a command-line tool designed for assessing the security posture of WordPress websites.

Get an API Token

Installation and Setup

1
sudo apt update && sudo apt install wpscan

1
gem install wpscan

1
docker pull wpscanteam/wpscan
2
docker run -it --rm wpscanteam/wpscan --url https://example.com/ --enumerate u

1
brew install wpscanteam/tap/wpscan          #Install the latest stable version
2
brew install wpscanteam/tap/wpscan --HEAD   #Install the latest code from the master branch

1
git clone https://github.com/wpscanteam/wpscan.git
2
cd wpscan
3
bundle install && ruby wpscan.rb --help

1
gem update wpscan

WordPress Vulnerability Database & API

The API collects reports of WordPress vulnerabilities that could be used hand in hand with the CLI scanner. Create an account and receive an API token here. For WPScan to retrieve the vulnerability data, an API token must be supplied via the --api-token option, or via a configuration file.

Basic Usage

1
wpscan --url http://example.com                                 #Basic WordPress Scan
2
wpscan --url http://example.com --enumerate u                   #Enumerate Users
3
wpscan --url http://example.com --api-token <YOUR_API_KEY>      #Use API Token for More Requests

Target Enumeration

1
wpscan --url http://example.com --enumerate        #Enumerate Everything
2
wpscan --url http://example.com --enumerate u      #Enumerate Users
3
wpscan --url http://example.com --enumerate p      #Enumerate Plugins
4
wpscan --url http://example.com --enumerate vp     #Enumerate Vulnerable Plugins
5
wpscan --url http://example.com --enumerate ap     #Enumerate All Plugins (Not Just Active)
6
wpscan --url http://example.com --enumerate vt     #Enumerate Vulnerable Themes
7
wpscan --url http://example.com --enumerate at     #Enumerate All Themes
8
wpscan --url http://example.com --enumerate c      #Enumerate Config Backups

Brute-Forcing WordPress Logins

1
wpscan --url http://example.com -U admin -P rockyou.txt                                         #Brute-Force Admin Password
2
wpscan --url http://example.com --usernames users.txt --passwords passwords.txt                 #Multi-User Brute-Force
3
wpscan --url http://example.com --usernames admin --passwords passwords.txt --max-threads 10    #Speed Up Brute-Force
4
wpscan --url http://example.com --usernames admin --passwords rockyou.txt --throttle 1          #Add 1-Second Delay Between Requests

Detecting Vulnerabilities

1
wpscan --url http://example.com --enumerate vp                   #Enumerate Vulnerable Plugins
2
wpscan --url http://example.com --enumerate vt                   #Enumerate Vulnerable Themes
3
wpscan --url http://example.com --api-token <YOUR_API_KEY>       #Use API for Latest Vulnerability Data
4
wpscan --url http://example.com --detection-mode aggressive      #Aggressive Detection Mode

User Enumeration and Exploitation

1
wpscan --url http://example.com --enumerate u                                 #Enumerate Users
2
wpscan --url http://example.com --enumerate u --wp-content-dir wp-content     #Custom WordPress Directory
3
wpscan --url http://example.com -U admin -P passwords.txt --force             #Force Login Brute-Force
4
wpscan --url http://example.com --wp-content-dir custom-dir                   #Scan Custom WordPress Installation

Plugin and Theme Analysis

1
wpscan --url http://example.com --enumerate p     #Enumerate Installed Plugins
2
wpscan --url http://example.com --enumerate ap    #Enumerate All Plugins (Active & Inactive)
3
wpscan --url http://example.com --enumerate vp    #Enumerate Vulnerable Plugins
4
wpscan --url http://example.com --enumerate vt    #Enumerate Vulnerable Themes

Configuration and Backup Files Enumeration

1
wpscan --url http://example.com --enumerate c       #Enumerate Config Backups
2
wpscan --url http://example.com --enumerate db      #Enumerate Database Dumps
3
wpscan --url http://example.com --enumerate med     #Enumerate Media Files

Performance Tuning

1
wpscan --url http://example.com --max-threads 20          #Increase Scan Speed
2
wpscan --url http://example.com --throttle 1              #Add Delay Between Requests
3
wpscan --url http://example.com --random-user-agent       #Use Random User-Agents
4
wpscan --url http://example.com --request-timeout 10      #Set Request Timeout

Bypassing Security Measures

1
wpscan --url http://example.com --proxy http://127.0.0.1:8080               #Use Proxy
2
wpscan --url http://example.com --proxy socks5://127.0.0.1:9050             #Use SOCKS5 Proxy
3
wpscan --url http://example.com --random-user-agent                         #Spoof User-Agent
4
wpscan --url http://example.com --headers "X-Forwarded-For: 127.0.0.1"      #Bypass WAF

Stealth Mode and Obfuscation

1
wpscan --url http://example.com --quiet                            #Silent Mode (No Output)
2
wpscan --url http://example.com --random-user-agent                #Use Random User-Agent
3
wpscan --url http://example.com --proxy http://127.0.0.1:8080      #Route Through Proxy
4
wpscan --url http://example.com --throttle 5                       #Add Delay to Reduce Detection

Saving and Exporting Results

1
wpscan --url http://example.com -o results.txt                   #Save Results to File
2
wpscan --url http://example.com -o results.json --format json    #Save Results as JSON
3
wpscan --url http://example.com --log wpscan.log                 #Save Scan Log

Combining Multiple Options

1
wpscan --url http://example.com --enumerate u,p,vp --max-threads 15 --random-user-agent                       #Multi-Enumeration with Speed & Stealth
2
wpscan --url http://example.com -U admin -P rockyou.txt --proxy socks5://127.0.0.1:9050 --random-user-agent   #Brute-Force via Proxy with Spoofed User-Agent

Troubleshooting and Debugging

1
wpscan --url http://example.com --debug-output debug.log     #Enable Debug Logging
2
wpscan --url http://example.com --disable-tls-checks         #Ignore SSL/TLS Errors

Best Practices

1
wpscan --url http://example.com --enumerate u,p,vp,vt --api-token YOUR_API_KEY --max-threads 20     #Full Scan with API Data
2
wpscan --url http://example.com -U admin -P rockyou.txt --max-threads 10 --throttle 1               #Slow Brute-Force to Avoid Lockouts
3
wpscan --url http://example.com --random-user-agent --proxy socks5://127.0.0.1:9050                 #Stealth Scan via Proxy