WPScan is a popular open-source web vulnerability scanner specifically created for WordPress. It's used by security professionals and website administrators to detect security weaknesses in WordPress installations, themes, and plugins.
Hello everyone. In today's article, I'll show you how WPScan can be used to scan and uncover vulnerabilities in WordPress.
Before we go through, ensure you have three
prerequisites in place.
.png)
First, you'll need Kali Linux installed and running on a virtual machine. This virtual environment isolates your scanning activities and safeguards your main computer. Make sure the virtual machine's network adapter is configured in a special mode called "Host-only" to allow communication between Kali and your target website.
.png)
Next, you'll require a vulnerable WordPress website to scan.
For this tutorial, we'll be using a website called OWASP Broken Web Application, intentionally made vulnerable for educational use. This offers a secure environment to practice without impacting a real website. If you're unsure about obtaining and setting it up on VirtualBox, please watch this instructional video first. Ensure that the virtual machine's network adapter is configured as "Host-only" to enable communication between Kali Linux and your target website.
.png)
Next, we need a Steady Internet Connection. A stable internet connection is essential for the scanning process to communicate with the target website. First, ensure you have a reliable internet connection. This is crucial for the scanning process to interact with the target website. Access your Kali VM, navigate to settings, then to Network adapter, and confirm that the second adapter is connected to the NAT network.
.png)
Once you have the necessary prerequisites set up, you're ready to begin scanning for vulnerabilities on your target website.
Unlike other scenarios, you won't need to use the net discover command line tool to obtain the IP address. Here, on the OWASP Broken Web Application virtual machine, the IP address is readily visible.
.png)
To proceed, open your preferred browser in Kali Linux and navigate to this IP address. Here, Scroll down the page to locate a section labeled "OLD (vulnerable) versions of real applications," where you'll find WordPress listed.
.png)
Click on the WordPress link, and you'll be redirected to the Broken WordPress webpage.
.png)
Now that our target website is prepared, we can proceed with scanning it using the WPScan tool.
WPScan comes preinstalled with Kali Linux and can be accessed through the "Web Applications" menu, typically found under "Web Vulnerability Scanners."
.png)
Upon execution, WPScan will display a simple help menu.
If you need more detailed instructions, you can use the command wpscan --hh, for the full help documentation.
Now, let's proceed to scan the WordPress website to uncover details such as the WordPress version, theme information, plugin details, security-related headers, and more.
Open a new terminal window and enter the command `wpscan --url`, followed by the URL of the WordPress site you want to scan.
After scanning, WPScan will provide insights into the
WordPress installation, revealing details like version numbers, theme
information, and detected plugins, as well as whether XML-RPC functionality is
enabled. The scan results may highlight potential security concerns, such as
outdated software versions and the presence of exploitable features like
XML-RPC, which could be targeted by attackers.
In another article, I'll demonstrate how an attacker can exploit these vulnerabilities.
WPScan offers various enumeration techniques that can be specified during execution. For a detailed view, let's enumerate WordPress themes. In the terminal, include the -e flag to specify enumeration and the at the flag to target "all themes".
Additionally, you can use other flags like vt to specifically list vulnerable themes. The scan output reveals two outdated theme versions, "classic" and "default", which are potentially vulnerable to known security issues that could be exploited by attackers.
Now, let's enumerate the plugins installed within WordPress. To achieve this, we'll use the ap flag during the scanning process.
In the scan results, we have identified the my_gallery plugin with an unknown version.
The inability to determine the version of this plugin raises concerns, as it could potentially be outdated or vulnerable, posing a risk to the security of the WordPress installation.
WPScan can also be used to enumerate WordPress user accounts. To do this, we'll utilize the -u flag during the scan.
During the scanning process, we discovered a user named "admin".
This information is critical as it reveals a potential target for attackers, who could leverage this knowledge for targeted attacks, such as brute-force attempts to crack the password associated with the "admin" account.
You can use WPScan for a brute-force attack on WordPress user accounts. In the terminal, use the -U flag followed by the username, and then use the -P flag to specify a wordlist. For this purpose, I will use “rockyou.txt”.
Once the wordlist is ready, specify it after the -P flag in the WPScan command. The process may take considerable time, depending on the size of the wordlist and the availability of matching passwords.
The WPScan brute-force attempt yields no results.
But, don't worry. You can try another tool like Hydra for performing brute-force attacks more effectively. Hydra is a versatile tool specifically designed for password-cracking tasks and can be used for various protocols and services beyond WordPress.
To use Hydra effectively, we first need to capture some data like login parameters and response phases. We can accomplish this using Burp Suite.
.png)
On the browser, visit the WordPress "WP-admin" login page in your web browser.
.png)
This page is the default login portal for WordPress. Now, let’s intercept the data while visiting this page. To do this, launch Burp Suite from the Kali Linux menu.
.png)
Adjust the proxy settings in Burp Suite to capture the necessary data. Unfortunately, due to time constraints, I won't be able to go through this step.
To start, switch the proxy tab in Burp Suite to capture the necessary data. Set the intercept mode to "on" and click on, open a browser.
.png)
Visit the WP-admin page of WordPress, and forward the intercept data
to capture the login form. Enter a username and password to generate the
intercept data we need.
.png)
Next, copy this intercepted data into a text editor to craft a Hydra command.
.png)
Let's create and execute the Hydra command in the terminal.
Upon execution, I discovered that the password for the username "admin" is also "admin".
Now, let's use these credentials to log in. We're now inside the WordPress dashboard, which might appear outdated.
.png)
From here, we can make modifications as desired. This is all, that covers the basic usage of the WPScan command-line tool. There are additional functionalities and uses that we'll explore in another video.
