ranbot-ai/wordpress-penetration-testing

WordPress Penetration Testing

Purpose

Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.

Prerequisites

Required Tools

• WPScan (pre-installed in Kali Linux)
• Metasploit Framework
• Burp Suite or OWASP ZAP
• Nmap for initial discovery
• cURL or wget

Required Knowledge

• WordPress architecture and structure
• Web application testing fundamentals
• HTTP protocol understanding
• Common web vulnerabilities (OWASP Top 10)

Outputs and Deliverables

1. WordPress Enumeration Report - Version, themes, plugins, users
2. Vulnerability Assessment - Identified CVEs and misconfigurations
3. Credential Assessment - Weak password findings
4. Exploitation Proof - Shell access documentation

Core Workflow

Phase 1: WordPress Discovery

Identify WordPress installations:

# Check for WordPress indicators
curl -s http://target.com | grep -i wordpress
curl -s http://target.com | grep -i "wp-content"
curl -s http://target.com | grep -i "wp-includes"

# Check common WordPress paths
curl -I http://target.com/wp-login.php
curl -I http://target.com/wp-admin/
curl -I http://target.com/wp-content/
curl -I http://target.com/xmlrpc.php

# Check meta generator tag
curl -s http://target.com | grep "generator"

# Nmap WordPress detection
nmap -p 80,443 --script http-wordpress-enum target.com

Key WordPress files and directories:

• /wp-admin/ - Admin dashboard
• /wp-login.php - Login page
• /wp-content/ - Themes, plugins, uploads
• /wp-includes/ - Core files
• /xmlrpc.php - XML-RPC interface
• /wp-config.php - Configuration (not accessible if secure)
• /readme.html - Version information

Phase 2: Basic WPScan Enumeration

Comprehensive WordPress scanning with WPScan:

# Basic scan
wpscan --url http://target.com/wordpress/

# With API token (for vulnerability data)
wpscan --url http://target.com --api-token YOUR_API_TOKEN

# Aggressive detection mode
wpscan --url http://target.com --detection-mode aggressive

# Output to file
wpscan --url http://target.com -o results.txt

# JSON output
wpscan --url http://target.com -f json -o results.json

# Verbose output
wpscan --url http://target.com -v

Phase 3: WordPress Version Detection

Identify WordPress version:

# WPScan version detection
wpscan --url http://target.com

# Manual version checks
curl -s http://target.com/readme.html | grep -i version
curl -s http://target.com/feed/ | grep -i generator
curl -s http://target.com | grep "?ver="

# Check meta generator
curl -s http://target.com | grep 'name="generator"'

# Check RSS feeds
curl -s http://target.com/feed/
curl -s http://target.com/comments/feed/

Version sources:

• Meta generator tag in HTML
• readme.html file
• RSS/Atom feeds
• JavaScript/CSS file versions

Phase 4: Theme Enumeration

Identify installed themes:

# Enumerate all themes
wpscan --url http://target.com -e at

# Enumerate vulnerable themes only
wpscan --url http://target.com -e vt

# Theme enumeration with detection mode
wpscan --url http://target.com -e at --plugins-detection aggressive

# Manual theme detection
curl -s http://target.com | grep "wp-content/themes/"
curl -s http://target.com/wp-content/themes/

Theme vulnerability checks:

# Search for theme exploits
searchsploit wordpress theme <theme_name>

# Check theme version
curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
curl -s http://target.com/wp-content/themes/<theme>/readme.txt

Phase 5: Plugin Enumeration

Identify installed plugins:

# Enumerate all plugins
wpscan --url http://target.com -e ap

# Enumerate vulnerable plugins only
wpscan --url http://target.com -e vp

# Aggressive plugin detection
wpscan --url http://target.com -e ap --plugins-detection aggressive

# Mixed detection mode
wpscan --url http://target.com -e ap --plugins-detection mixed

# Manual plugin discovery
curl -s http://target.com | grep "wp-content/plugins/"
curl -s http://target.com/wp-content/plugins/

Common vulnerable plugins to check:

# Search for plugin exploits
searchsploit wordpress plugin <plugin_name>
searchsploit wordpress mail-masta
searchsploit wordpress slideshow gallery
searchsploit wordpress reflex gallery

# Check plugin version
curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt

Phase 6: User Enumeration

Discover WordPress users:

# WPScan user enumeration
wpscan --url http://target.com -e u

# Enumerate specific number of users
wpscan --url http://target.com -e u1-100

# Author ID enumeration (manual)
for i in {1..20}; do
    curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
done

# JSON API user enumeration (if enabled)
curl -s http://target.com/wp-jso