www.i4info.org

i4info Provides the best hacking Material. Latest hacking tutorials and tools are available here. It is the best place for hackers.

Latest topics

» Facebook Account Hacked
Today at 10:14 am by ssameer758

» Teen Patti Gold Hack & 3 Patti Chips Code Extra Bonus 2016
Today at 8:31 am by furqansweet73

» BitCoin Wallet stealor New
Wed Dec 07, 2016 7:46 pm by Admin

» Muhammad Shahroze Rashid | Marketing Consultant
Wed Dec 07, 2016 1:48 pm by Admin

» Muhammad Shahroze Rashid | Sharp Mind, Sharp Innovations
Wed Dec 07, 2016 1:47 pm by Admin

» How to design an effective job ad
Wed Dec 07, 2016 1:45 pm by Admin

» Content Marketing | Promotional Video
Fri Dec 02, 2016 2:45 pm by Admin

» How to start an Online Business | Complete Guide
Fri Dec 02, 2016 2:30 pm by Admin

» Zeeshan Bhatti
Wed Nov 30, 2016 3:18 pm by Admin

December 2016

MonTueWedThuFriSatSun
   1234
567891011
12131415161718
19202122232425
262728293031 

Calendar Calendar

Affiliates


free forum

Forumotion on Facebook Forumotion on Twitter Forumotion on YouTubeForumotion on Google+

Visitors Counter


Flag Counter

About Author

Muhammad Shahroze Rashid
i4info
Web Developer
Web Developer & Designer,Researcher and Technical writer. An Information Security Consultant and System Auditor, a keen Security researcher.
samanabad
lahore, Punjab
54000
Pakistan
[email protected]
03064904829
DOB: 05/25/1992
Muhammad Shahroze Rashid
Muhammad Shahroze Rashid is a Web Developer and Designer, Android Developer, InfoGrapher, IT consultant and Researcher
Reviewed by Google
Google
Date published: 01/19/2016
9 / 10 stars
Muhammad Shahroze Rashid
Muhammad Shahroze Rashid Web Developer & Designer,Researcher and Technical writer. An Information Security Consultant and System Audito
samanabad
lahore
Punjab
54000
Pakistan

How to hack a WordPress website with WPScan

Share

Admin
Admin

Posts : 455
Reputation : 5
Join date : 2014-12-10
Age : 24
Location : Pakistan

How to hack a WordPress website with WPScan

Post by Admin on Sun Jun 12, 2016 1:45 pm



This tutorial in the category WordPress hacking shows you how to scan WordPress websites and blogs for possible vulnerabilities and enumerate WordPress users. WordPress user enumeration is the first step in the brute force attack in order to gain access to a WordPress account and is used to retrieve a list of account names. We will also show you how to hide usernames from WPScan so you can avoid easy user enumeration and brute force attempts. We will conclude this tutorial with a demonstration on how to brute force root passwords using WPScan in Kali Linux. WPScan is a black box WordPress vulnerability scanner and a must have tool for any WordPress web developer to scan for vulnerabilities and solve issues before they get exploited by hackers. Together with [You must be registered and logged in to see this link.], a great webserver assessment tool, this tool should be part of any penetration test targeting a WordPress website or blog.

WPScan comes pre-installed on the following Linux distributions:

The latest version is WPScan 2.8 and the database currently contains:

  • Total vulnerable versions: 98

  • Total vulnerable plugins: 1.076

  • Total vulnerable themes: 361

  • Total version vulnerabilities: 1.104

  • Total plugin vulnerabilities: 1.763

  • Total theme vulnerabilities: 443


The Windows operation system is currently not supported by WPScan. The latest version is available for download at the following website (Linux & Mac): [You must be registered and logged in to see this link.]

WPScan update


Start with the following command to update the WPScan vulnerabilities database:

wpscan –update

Scanning WordPress vulnerabilities


Then use the following command to scan the target website for possible vulnerabilities:

wpscan –url [wordpress url]


How to enumerate WordPress users


The WordPress user enumeration tool is used the retrieve a list of registered WordPress users for the target host. User enumeration is the first step when an attacker wants to gain access to a specific target by brute forcing. The enumeration tool scans the target on posts, pages and custom types for authors and usernames.

Use the following command to enumerate the WordPress users:

wpscan –url [wordpress url]–enumerate u


How to brute force the root password


Use the following command to brute force the password for user root:

wpscan –url [wordpress url]–wordlist [path to wordlist]–username [username to brute force]–threads [number of threads to use]

How to avoid WordPress User Enumeration


If you want to avoid WordPress user enumeration, you should avoid using the username as nickname and display name which is shown publicly in WordPress. The best option is to choose an administrator username which consists of random characters and use a different nickname. WPScan scans for usernames in the URL’s so if you won’t use the username it cannot be scanned by WPScan. Another way to prevent user enumeration is to use a different account to publish posts and answer to replies.

How to avoid Wordpres password brute forcing


The best way to keep attackers using brute force methods out is to limit the login attempts for and IP address. There are several plug-ins available for WordPress to limit login attempts. The latest WordPress versions have this option by default. Make sure you limit entries to a maximum of 3 and increase lock out time a lot after 2 lock outs (which is 6 password attempts).

    Current date/time is Sun Dec 11, 2016 2:45 pm