aeondave/wpscan

WPScan

WordPress vulnerability and enumeration scanner.

Quick Start

wpscan --url https://target.com
wpscan --url https://target.com --enumerate u,p,t --api-token <TOKEN>
wpscan --url https://target.com -U admin -P /usr/share/wordlists/rockyou.txt

Core Flags

| Flag | Purpose | |------|---------| | --url <url> | Target WordPress URL | | --enumerate <items> | u=users, p=plugins, t=themes, vp=vuln plugins, vt=vuln themes, ap=all plugins, at=all themes, tt=timthumbs, cb=config backups, dbe=db exports, m=media ids | | --api-token <token> | WPScan API token (required for CVE data) | | --plugins-detection | aggressive / passive / mixed | | --themes-detection | aggressive / passive / mixed | | -U <user> | Username (or file) for brute-force | | -P <wordlist> | Password wordlist | | --password-attack | xmlrpc / xmlrpc-multicall / wp-login | | --usernames <list> | Usernames to brute-force (comma-sep or file) | | --proxy <proxy> | HTTP proxy (e.g., http://127.0.0.1:8080) | | --cookie <str> | Cookie for authenticated scans | | --headers <str> | Custom HTTP headers | | --http-auth <u:p> | HTTP basic auth | | -o <file> | Output file | | --format <fmt> | cli / json / cli-no-colour | | --throttle <ms> | Milliseconds between requests | | --request-timeout <n> | Timeout per request | | --connect-timeout <n> | Connection timeout | | --max-threads <n> | Max concurrent threads (default 5) | | --wp-content-dir <dir> | Override wp-content dir if non-standard | | --wp-plugins-dir <dir> | Override plugins dir | | --disable-tls-checks | Skip SSL verification | | --ignore-main-redirect | Don't follow main domain redirect | | --force | Proceed even if target isn't WordPress | | --update | Update WPScan database | | -v / --verbose | Verbose output | | --stealthy | Passive detection only + random UA |

Enumeration Targets

# Users only (fastest, high value)
wpscan --url https://target.com --enumerate u

# Vulnerable plugins only (most impactful)
wpscan --url https://target.com --enumerate vp --api-token $TOKEN

# Full aggressive enum
wpscan --url https://target.com \
    --enumerate ap,at,u,tt,cb,dbe \
    --plugins-detection aggressive \
    --api-token $TOKEN

# Config backups (wp-config.php.bak, wp-config.php~, etc.)
wpscan --url https://target.com --enumerate cb

# Database exports
wpscan --url https://target.com --enumerate dbe

Password Attacks

# Brute-force via wp-login.php (slower, stealthier)
wpscan --url https://target.com \
    --usernames admin \
    --passwords /usr/share/wordlists/rockyou.txt \
    --password-attack wp-login

# XML-RPC multicall (faster, bypasses rate limiting)
wpscan --url https://target.com \
    --usernames admin \
    --passwords /usr/share/wordlists/rockyou.txt \
    --password-attack xmlrpc-multicall

# Enumerate users first, then attack
wpscan --url https://target.com --enumerate u --api-token $TOKEN -o users.json --format json
cat users.json | jq -r '.users[].username' > found_users.txt
wpscan --url https://target.com -U found_users.txt -P passwords.txt

Authenticated Scanning

# With session cookie (login via browser first)
wpscan --url https://target.com \
    --cookie "wordpress_logged_in_xxx=admin%7C..."

# With admin credentials (finds more plugins/themes)
wpscan --url https://target.com \
    --enumerate ap \
    --username admin --password 'AdminPass123!' \
    --plugins-detection aggressive

Common Findings

| Finding | Impact | |---------|--------| | Outdated plugins with CVEs | RCE / LFI / SQLi | | User enumeration via author archive | Enables password attacks | | xmlrpc.php enabled | Brute-force amplification (multicall = 500 tries/request) | | readme.html / license.txt | WordPress version disclosure | | Timthumb vulnerability | Remote code execution | | Debug log exposed (/wp-content/debug.log) | Info disclosure, credentials | | Config backup (wp-config.php.bak) | Database credentials | | DB export in web root | Full database dump | | Registration open | Account creation → plugin exploit |

Common Workflows

# Quick recon pass
wpscan --url https://target.com --enumerate u,vp,vt \
    --api-token $TOKEN -o wp_scan.json --format json

# Parse JSON output for CVEs
cat wp_scan.json | jq '.plugins | to_entries[] | {plugin: .key, vulns: .value.vulnerabilities}'

# Stealthy scan (minimize fingerprint)
wpscan --url https://target.com --stealthy --enumerate u \
    --throttle 2000

# Through proxy for manual review
wpscan --url https://target.com --proxy http://127.0.0.1:8080 \
    --disable-tls-checks --enumerate u,vp --api-token $TOKEN

Key Attack Paths

1. Enumerate users → brute-force weak passwords → admin access → RCE via theme editor
2. Find vulnerable plugin (CVE) → exploit SQLi/LFI/RCE directly
3. xmlrpc.php enabled → multicall brute-force (bypass account lockout)
4. Config backup found → extract DB creds → wp_users table → crack password hashes
5. Registration enabled + vulnerable plugin → account takeover chain

Resources

| File | When to load | |------|--------------| | references/wordpress-testing.md | XML-RPC abuse, REST API enum, auth bypass, manual exploitation |