Wordpress Penetration Testing

# WordPress Penetration Testing

Purpose

Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.

Prerequisites

Required Tools

- WPScan (pre-installed in Kali Linux)

- Metasploit Framework

- Burp Suite or OWASP ZAP

- Nmap for initial discovery

- cURL or wget

Required Knowledge

- WordPress architecture and structure

- Web application testing fundamentals

- HTTP protocol understanding

- Common web vulnerabilities (OWASP Top 10)

Outputs and Deliverables

1. **WordPress Enumeration Report** - Version, themes, plugins, users

2. **Vulnerability Assessment** - Identified CVEs and misconfigurations

3. **Credential Assessment** - Weak password findings

4. **Exploitation Proof** - Shell access documentation

Core Workflow

Phase 1: WordPress Discovery

Identify WordPress installations:

```bash

# Check for WordPress indicators

curl -s http://target.com | grep -i wordpress

curl -s http://target.com | grep -i "wp-content"

curl -s http://target.com | grep -i "wp-includes"

# Check common WordPress paths

curl -I http://target.com/wp-login.php

curl -I http://target.com/wp-admin/

curl -I http://target.com/wp-content/

curl -I http://target.com/xmlrpc.php

# Check meta generator tag

curl -s http://target.com | grep "generator"

# Nmap WordPress detection

nmap -p 80,443 --script http-wordpress-enum target.com

```

Key WordPress files and directories:

- `/wp-admin/` - Admin dashboard

- `/wp-login.php` - Login page

- `/wp-content/` - Themes, plugins, uploads

- `/wp-includes/` - Core files

- `/xmlrpc.php` - XML-RPC interface

- `/wp-config.php` - Configuration (not accessible if secure)

- `/readme.html` - Version information

Phase 2: Basic WPScan Enumeration

Comprehensive WordPress scanning with WPScan:

```bash

# Basic scan

wpscan --url http://target.com/wordpress/

# With API token (for vulnerability data)

wpscan --url http://target.com --api-token YOUR_API_TOKEN

# Aggressive detection mode

wpscan --url http://target.com --detection-mode aggressive

# Output to file

wpscan --url http://target.com -o results.txt

# JSON output

wpscan --url http://target.com -f json -o results.json

# Verbose output

wpscan --url http://target.com -v

```

Phase 3: WordPress Version Detection

Identify WordPress version:

```bash

# WPScan version detection

wpscan --url http://target.com

# Manual version checks

curl -s http://target.com/readme.html | grep -i version

curl -s http://target.com/feed/ | grep -i generator

curl -s http://target.com | grep "?ver="

# Check meta generator

curl -s http://target.com | grep 'name="generator"'

# Check RSS feeds

curl -s http://target.com/feed/

curl -s http://target.com/comments/feed/

```

Version sources:

- Meta generator tag in HTML

- readme.html file

- RSS/Atom feeds

- JavaScript/CSS file versions

Phase 4: Theme Enumeration

Identify installed themes:

```bash

# Enumerate all themes

wpscan --url http://target.com -e at

# Enumerate vulnerable themes only

wpscan --url http://target.com -e vt

# Theme enumeration with detection mode

wpscan --url http://target.com -e at --plugins-detection aggressive

# Manual theme detection

curl -s http://target.com | grep "wp-content/themes/"

curl -s http://target.com/wp-content/themes/

```

Theme vulnerability checks:

```bash

# Search for theme exploits

searchsploit wordpress theme <theme_name>

# Check theme version

curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version

curl -s http://target.com/wp-content/themes/<theme>/readme.txt

```

Phase 5: Plugin Enumeration

Identify installed plugins:

```bash

# Enumerate all plugins

wpscan --url http://target.com -e ap

# Enumerate vulnerable plugins only

wpscan --url http://target.com -e vp

# Aggressive plugin detection

wpscan --url http://tar