Monday, July 22, 2024

WPScan – Penetration Testing Tool to Find The Security Vulnerabilities in Your WordPress Websites

WPScan is a WordPress security scan for detecting and reporting WordPress vulnerabilities.

WordPress is a free online Open source content Managed system focused on PHP and MySQL. It is one of the most powerful and most used blogging tools.

As there are too many up’s and downs in WordPress usage, it requires security improvement, so WordPress Penetration testing is essential to find the vulnerabilities and secure your WordPress-powered Website.

WordPress Penetration testing with WPScan

It is a WordPress vulnerability scanner created by Ryan Dewhurst and it was sponsored by Sucuri.

It comes pre-installed with BackBox Linux, Kali Linux, Pentoo, SamuraiWTF, and BlackArch and it will not support Windows.

With this tool, we can enumerate themes, plugins, users, and HTTP proxy and will not check the source code of the page.


git clone

cd wpscan/

bundle install && rake install

To Enumerate WordPress versions, themes and plugin

wpscan –url –enumerate p wpscan –url –enumerate t

Penetration testing

To Enumerate WordPress Users

wpscan –url –enumerate u

Penetration testing

To launch a brute-force attack

wpscan –url –wordlist /root/Desktop/password.txt –username kcwto

Penetration testing

To Enumerate timthumbs

If you are still using TimThumb, even after a very serious vulnerability, you have one more reason to be concerned.

wpscan –url –enumerate tt

Penetration testing

To store Output in a separate File

wpscan –url –debug-output 2>debug.log

Penetration testing is an art and the active analysis depends upon the security researcher, here we evaluated some of the basic and important checks that need to be done on the WordPress-powered website.


This article with WPScan was created only for legal security testing, you should use the tool only for Testing purposes and you are not intended to use them against any unknown websites. Misuse of the information on this website can result in criminal charges brought against the persons in question. The Authors and  will not be held responsible in the event any criminal charges be brought against any individuals misusing the information on this website to break the law.

Also Read:


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles