WPScan: Another WordPress Security/Vulnerability Scanner

WPScan è un altro scanner per WordPress.

Altri scanner molto simili a questo, tutti presenti in backbox:

• plecost




• cmsexplore




• whatweb

WPScan permette:

• Username enumeration (from author querystring and location header)
• Weak password cracking (multithreaded)
• Version enumeration (from generator meta tag)
• Vulnerability enumeration (based on version)
• Plugin enumeration (2220 most popular by default)
• Plugin vulnerability enumeration (based on version) (todo)
• Plugin enumeration list generation
• Other misc WordPress checks (theme name, dir listing, …)

WPScan è scritto in ruby e i suoi requisiti sono i seguenti:

• ruby
• typhoeus
• xml-simple

Sul nostro archlinux possiamo semplicemente installare queste dipendenze digitando:

pacman -Syu ruby

gem install typhoeus

gem install xml-simple

Per altri sistemi operativi come backbox(ubuntu based) basta seguire queste istruzioni:

Installing on Debian/Ubuntu:

sudo apt-get install libcurl4-gnutls-dev

sudo apt-get install libopenssl-ruby

sudo gem install typhoeus

sudo gem install xml-simple

Installing on other nix: (not tested)

sudo gem install typhoeus

sudo gem install xml-simple

Installing on Windows: (not tested)

gem install typhoeus

gem install xml-simple

Installing on Mac OSX:

sudo gem install typhoeus

sudo gem install xml-simple

Una volta installate le dipendenze possiamo procedere con lo scaricare WPScan:

svn checkout http://wpscan.googlecode.com/svn/trunk/ wpscan

cd wpscan

Per un help:

ruby wpscan.rb

Un esempio di utilizzo:

ruby wpscan.rb --url www.clshack.com

Sito ufficiale progetto:

http://code.google.com/p/wpscan

Video Esempio:

Related posts:

1. OWASP Joomla Vulnerability Scanner
2. WhatWeb, uno Scanner di WebSite di nuova generazione
3. [scanner]Plecost: A WordPress Penetration-Test for Plugins
4. Wapiti: Web application security Scanner
5. [tutorial]Tool for Vulnerability Identification level WEB

This entry was posted on Tuesday, July 12th, 2011 at 12:11 pm and is filed under GNU/Linux, Hacking, Software. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Tagged with: plugin • ruby • scanner • wordpress