WPScan

WPScan identifies the WordPress version, installed plugins and themes, and users. With a free API token it also tells you which known vulnerabilities each plugin has.

Platform: Linux · macOS (Ruby)
Official site: wpscan.com
On HTB: 3 machines

Install

sudo apt install wpscan

WPScan cheat sheet

Your values Saved in this browser and applied to every cheatsheet.

Domain

4 commands

Useful options

Vulnerable plugins and themes, with an API token

wpscan --url http://box.htb -e vp,vt,u --api-token TU_TOKEN

Password brute force (xmlrpc)

wpscan --url http://box.htb -U usuarios.txt -P /usr/share/wordlists/rockyou.txt

If the site is slow or has a WAF

wpscan --url http://box.htb --random-user-agent --throttle 500

In our cheatsheets

Web enumeration › Common findings

WordPress

wpscan --url http://box.htb -e ap,u --plugins-detection aggressive

HTB machines where WPScan is used

Taken from the chapters of IppSec videos where WPScan shows up. The ▶ link jumps to the minute of that part.

Hide the ones I have done

Backdoor

easy linux

▶ CMS exploitation (foothold)

Blocky

easy linux

▶ CMS exploitation (foothold)

Tartarsauce

medium linux

Guides that use WPScan

Attacking WordPress, Joomla and Drupal: from wpscan to RCE 3 min read Identify the CMS and its version, enumerate plugins and users with wpscan, joomscan and droopescan, and go from admin to shell on WordPress, Joomla and Drupal.
Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub 4 min read From a version number to a shell: identify the software, search searchsploit, GitHub and nuclei, read the exploit before running it and fix the broken ones.