Как установить wpscan на kali linux

Инструменты Kali Linux

Список инструментов для тестирования на проникновение и их описание

WPScan

Описание WPScan

WPScan — это сканер уязвимостей WordPress, работающий по принципу «чёрного ящика», т. е. без доступа к исходному коду. Он может быть использован для сканирования удалённых сайтов WordPress в поисках проблем безопасности.

Автор: The WPScan Team

Справка по WPScan

Некоторые значения можно изменить в конфигурационном файле, смотрите example.conf.json

Руководство по WPScan

Страница man отсутствует.

Примеры запуска WPScan

Справка по программе

Сделать «ненавязчивую» проверку

Выполнить брутфорс пароля по перечисленным пользователям с использованием 50 потоков

ruby ./wpscan.rb —url www.example.com —wordlist darkc0de.lst —threads 50

Выполнить фрутфорс паролей только по имени ‘admin’

Перечислить установленные плагины

Перечислить установленный темы

Перечислить установленные timthumb

Использовать HTTP прокси

Использовать SOCKS5 прокси … (нужна cURL >= v7.21.7)

Использовать заданную директорию контента

Использовать заданную директорию плагинов

Смотрите README для дальнейшей информации.

Установка WPScan

WPScan предустановлена на следующие дистрибутивы Linux:

• Ruby >= 2.1.9 — Рекомендуется: 2.2.3
• Curl >= 7.21 — Рекомендуется: последний FYI, 7.29 имеет ошибку сегментации
• RubyGems — Рекомендуется: последний
• Git

Windows не поддерживается. Если программа установлена из Github обновите код с git pull. База данных обновляется так wpscan.rb —update.

Установка на Ubuntu:

Установка на Debian:

Установка на Fedora:

Установка на Arch Linux:

Установка на Mac OSX:

Нужны Apple Xcode, Command Line Tools и (чтобы появилась возможность установить FFI gem), Смотрите http://stackoverflow.com/questions/17775115/cant-setup-ruby-environment-installing-fii-gem-error

Установка с RVM:

Скриншоты WPScan

Инструкции по WPScan

• Поиск уязвимостей в сайтах на WordPress
• Анонимные сканирования с Nmap, sqlmap и WPScan через Tor
• Бесплатный онлайн сервис для сканирования WordPress с помощью WPScan: https://suip.biz/ru/?act=wpscan&color=on
• Безопасность сайтов на WordPress
• Как установить и запустить WPScan в Windows

Известные проблемы

Ошибка сегментации Typhoeus

Обновите cURL до версии => 7.21 (возможно, придётся устанавливать из исходников).

Прокси не работает

Обновите cURL до версии => 7.21.7 (возможно, придётся устанавливать из исходников).

Установка cURL из исходников:

Откройте директорию с распакованными файлами

не может загрузить такой файл — readline:

Затем откройте директорию readline gem (вам самим нужно найти её)

Источник

WPScan: WordPress Vulnerability Scanner Guide [5 Steps]

Table of Contents

Related Searches: wordpress vulnerability scanner, wp scan, wpvulndb, wordpress scanning tools, enumerate users wpscan, how does wpscan enumerate users, wpscan api

As of 2021, 39.5% of websites online are powered by WordPress. That’s about 64 million-plus websites. When we talk of all websites powered by Content Management Systems (CMS), WordPress powers 60% of these sites; from these figures, it’s evident that WordPress is one of the most used CMS in web development. That, however, raises one concern — How secure is your WordPress site?

What is WPScan?

WPScan is a WordPress vulnerability scanner, a penetration testing tool used to scan for vulnerabilities on WordPress-powered websites. It uses the WPScan WordPress Vulnerability Database, which has been around since 2014, to scan for WordPress vulnerabilities, plugin vulnerabilities, and theme vulnerabilities. The Database is updated regularly by security specialists, developers, and the community at large. As of writing this post, the database contains more than 21,000 known WordPress security vulnerabilities.

Web developers are advised to use WPScan to scan their sites for vulnerabilities and implement the right security measures before hackers exploit these security flaws. Additionally, you can use WPScan to reveal any existing server issues, such as directory listings that are not turned OFF present on Apache or NGINX. Other than Password brute-forcing, the WPScan tool by itself cannot be used maliciously on a website. However, the information revealed during the scans can be used to develop ways of exploiting the security flaws on the website.

In this tutorial, we will give you step by step guide on how to carry out vulnerability scanning on your site with WPScan. Let’s get started.

Pre-requisites

You must have an up and running Kali Linux Setup to use WPScan

Step-1: Install WPScan on Kali Linux

If you are running the full version of Kali Linux, WPScan should be installed by default on your system. However, if that’s no the case for you, execute the command below on the Terminal:

Источник

WPScan User Documentation

Clone this wiki locally

WPScan User Documentation

WPScan is a free, for non-commercial use, black box WordPress security scanner written for security professionals and blog maintainers to test the security of their sites.

WPScan is written in the Ruby programming language. The first version of WPScan was released on the 16th of June 2011.

What can WPScan check for?

• The version of WordPress installed and any associated vulnerabilities
• What plugins are installed and any associated vulnerabilities
• What themes are installed and any associated vulnerabilities
• Username enumeration
• Users with weak passwords via password brute forcing
• Backed up and publicly accessible wp-config.php files
• Database dumps that may be publicly accessible
• If error logs are exposed by plugins
• Media file enumeration
• Vulnerable Timthumb files
• If the WordPress readme file is present
• If WP-Cron is enabled
• If user registration is enabled
• Full Path Disclose
• Upload directory listing
• And much more.

WPScan is not Open Source software. WPScan is licensed with a custom license that requires a fee to be paid if used commercially. Please find the full license terms here.

WPScan is shipped as a Ruby gem, and can be installed with the following command:

gem install wpscan

We also support Docker. Pull the repo with:

docker pull wpscanteam/wpscan

Example Docker command to enumerate usernames:

docker run -it —rm wpscanteam/wpscan —url https://example.com/ —enumerate u

brew install wpscanteam/tap/wpscan to install the latest stable version

brew install wpscanteam/tap/wpscan —HEAD to install the latest code from the master branch

To update the WPScan software:

gem update wpscan

To update WPScan in Kali Linux:

apt-get update && apt-get upgrade

WPScan keeps a local database of metadata that is used to output useful information, such as the latest version of a plugin. The local database can be updated with the following command:

Metadata does not include the vulnerability data.

Optional: WordPress Vulnerability Database API

The WPScan CLI tool uses the WordPress Vulnerability Database API to retrieve WordPress vulnerability data in real time. For WPScan to retrieve the vulnerability data an API token must be supplied via the —api-token option, or via a configuration file. An API token can be obtained by registering an account on WPScan.com.

Up to 25 API requests per day are given free of charge, that should be suitable to scan most WordPress websites at least once per day. When the daily 25 API requests are exhausted, WPScan will continue to work as normal but without any vulnerability data. Users can upgrade to paid API usage to increase their API limits within their user profile on WPScan.com.

The Free plan allows 25 API requests per day. View the different available API plans.

How many API requests do you need?

• Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin and one request per installed theme.
• On average, a WordPress website has 22 installed plugins.
• The Free plan should cover around 50% of all WordPress websites.

When enumerating the WordPress version, installed plugins or installed themes, you can use three different «modes», which are:

If you want the most results use the «mixed» mode. However, if you are worried that the server may not be able to handle a large number of requests, use the «passive» mode. The default mode is «mixed», with the exception of plugin enumeration, which is «passive». You will need to manually override the plugin detection mode, if you want to use anything other than the default, with the —plugins-detection option.

WPScan can enumerate various things from a remote WordPress application, such as plugins, themes, usernames, backed up files wp-config.php files, Timthumb files, database exports and more. To use WPScan’s enumeration capabilities supply the -e option.

The following enumeration options exist:

• vp (Vulnerable plugins)
• ap (All plugins)
• p (Popular plugins)
• vt (Vulnerable themes)
• at (All themes)
• t (Popular themes)
• tt (Timthumbs)
• cb (Config backups)
• dbe (Db exports)
• u (User IDs range. e.g: u1-5)
• m (Media IDs range. e.g m1-15)

If no option is supplied to the -e flag, then the default will be: vp,vt,tt,cb,dbe,u,m

Here we have put together a bunch of common commands that will help you get started quickly.

NOTE: Get your API token from wpscan.com if you also want the vulnerabilities associated with the detected plugin displaying.

Enumerate all plugins with known vulnerabilities

wpscan —url example.com -e vp —plugins-detection mixed —api-token YOUR_TOKEN

Enumerate all plugins in our database (could take a very long time)

wpscan —url example.com -e ap —plugins-detection mixed —api-token YOUR_TOKEN

Password brute force attack

wpscan —url example.com -e u —passwords /path/to/password_file.txt

The remote website is up, but does not seem to be running WordPress

If you get the Scan Aborted: The remote website is up, but does not seem to be running WordPress. error, it means that for some reason WPScan did not think that the site you are trying to scan is actually WordPress. If you think WPScan is wrong, you can supply the —force option to force WPScan to scan the site regardless. You may also need to set other options in this case, such as —wp-content-dir and —wp-plugins-dir .

By default WPScan will follow in scope redirects, unless the —ignore-main-redirect option is given.

Docker Cheat Sheet

Pull the Docker repository

docker pull wpscanteam/wpscan

Run WPScan and enumerate usernames

docker run -it —rm wpscanteam/wpscan —url https://target.tld/ —enumerate u

When using —output flag along with the WPScan Docker image, a bind mount must be used. Otherwise, the file is written inside the Docker container, which is then thrown away.

The wpscan-output.txt file now exists on the host machine at

Pass password list to Docker container

Bypassing Simple WAFs

To bypass some simple WAFs you can try the —random-user-agent option.

If WPScan is not working as expected, you can use the —proxy option, and use a web proxy to inspect WPScan’s HTTP requests, and the remote server’s HTTP responses. This is useful when you do not know why you are getting false positives, or false negatives.

Footer

© 2022 GitHub, Inc.

You can’t perform that action at this time.

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.

Источник

Installation of Wpscan Tool in Kali Linux

Wpscan (WordPress vulnerability Scanner) is a black box WordPress vulnerability scanner. Wpscan is used to scan remote WordPress installations or websites to find security issues. WordPress can also be used to enumerate WordPress plugins and themes and brute-force logins. Approximately 35% of the internet runs on WordPress, WordPress is a free content management system. Which is used to build and maintain websites). Making a website using WordPress is very easy and absolutely free of cost, that’s why it is widely used. With the increase in the WordPress market, its security becoming a big concern for creators and users. Over 8% of internet breakability is found on WordPress websites. There are many WordPress vulnerability scanners available in the market like SUCURI(It is a Security website that protects your website from hackers, malware, DDoS, and blacklists), and WPScan(It is the scanner to scan your WordPress websites for vulnerable plugins, themes, and security misconfigurations).

Installation of Wpscan tool: Usually Wpscan tool comes pre-installed with Kali Linux but, if we need to install it we can run the following command :

1. We can install Git in Kali Linux by the below command

2. Once Git is installed, we need to fix Kali Linux dependencies for the latest Ruby development environment. Type below command in terminal

3. Now we can install WPScan tool on Kali Linux, by running the below command in the terminal.

4. Once the download is completed, let change our directory to WPscan directory, by following the below command.

5. Bundler is required to use the WPscan tool. WPScan is a ruby based application that uses ‘Gems’ as part of the programming language. Bundler will help keep WPScan and all of its dependencies updated effectively. We can install bundler in Kali Linux by running the below command in the WPScan directory :

Источник