This guide discusses how to Install and Use WPScan WordPress Vulnerability Scanner Ubuntu 18.04. WPScan, which is an acronym for WordPress Security Scanner, is a free black box vulnerability scanner written on Ruby programming language to help security professionals and blog maintainers to test the vulnerabilities on their WordPress sites. It helps unearth any vulnerability associated with WordPress themes, plugins, or any other security threat harbored on a WordPress site.
Are you using WordPress and looking for a professional WordPress website builder platform? Look no further since Elementor can help you create beautiful pages.
Installing WPScan Ubuntu 18.04
Prerequisites
Before you can install WordPress Security Scanner (WPScan), ensure that the following dependencies are installed.Also ensure that your system is up-to-date. This can be done by running the commands below;
sudo apt update sudo apt upgrade
sudo apt install curl git libcurl4-openssl-dev make zlib1g-dev gawk g++ gcc libreadline6-dev libssl-dev libyaml-dev libsqlite3-dev sqlite3 autoconf libgdbm-dev libncurses5-dev automake libtool bison pkg-config ruby ruby-bundler ruby-dev -y
WPScan can either be installed fron RubyGem repositories or from sources. The former is simpler as it involves a one line command.
Install from RubyGem
To install WPScan from RubyGem repositories, run the command below;
gem install wpscan
You can at the same time uninstall WPScan by running the command;
gem uninstall wpscan
Install WPScan Sources
To install WPScan from sources, you first need to its Github repository.
git clone https://github.com/wpscanteam/wpscan
Once the cloning is done, navigate to WPScan directory and run the commands below to do the installation.
cd wpscan/ bundle install sudo rake install
Do you have patience? If you don’t, this is where might have to learn to have a little since it may take some few mins to complete the installation. If the installation is successful, you should see such an output.
...
48) WPScan::Vulnerability behaves like WPScan::References references when references provided as array
# Temporarily skipped with xit
# ./spec/shared_examples/references.rb:45
Finished in 8 minutes 54 seconds (files took 15.12 seconds to load)
17914 examples, 0 failures, 48 pending
Coverage report generated for RSpec to $HOME/wpscan/coverage. 1709 / 2006 LOC (85.19%) covered.
wpscan 3.4.0 built to pkg/wpscan-3.4.0.gem.
wpscan (3.4.0) installed.
Well, WPScan is successfully installed on Ubuntu 18.04. To obtain a description of various command line options used with WPScan, run wpscan command with -h/--help option;
wpscan -h
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.4.0
Sponsored by Sucuri - https://sucuri.net
@_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________
Usage: wpscan [options]
--url URL The URL of the blog to scan
Allowed Protocols: http, https
Default Protocol if none provided: http
This option is mandatory unless update or help or hh or version is/are supplied
-h, --help Display the simple help and exit
--hh Display the full help and exit
--version Display the version and exit
-v, --verbose Verbose mode
--[no-]banner Whether or not to display the banner
Default: true
-o, --output FILE Output to FILE
-f, --format FORMAT Output results in the format supplied
Available choices: cli-no-color, json, cli, cli-no-colour
--detection-mode MODE Default: mixed
Available choices: mixed, passive, aggressive
--user-agent, --ua VALUE
--random-user-agent, --rua Use a random user-agent for each scan
--http-auth login:password
<output cut>
Go through the whole output to see various options that can be used with wpscan command.
Scanning for Vulnerabilities
In this guide, we are going to show you a few examples on how to perform WordPress blog vulnerability scanning. Ensure that you run the examples below against your OWN blog. It is illegal to scan other people’s sites.
Scan the whole WordPress blog
wpscan --url wordpress.example.com
WPScan can scan both http and https protocols. If not specified, it will scan http by default.
If you want to save the scanner output results in a file, use the -o/--output option.
wpscan --url http://wordpress.example.com -o scan-test
There are three detection modes in which wpscan can run against a WordPress site; passive, aggressive, mixed(default).
- The
passivemode runs a non-intrusive detection i.e it sents a few requests to the server. It commonly scans the home page for any vulnerability. The passive mode is less likely to be detected by IDS/IPS solutions. - The
aggressivemode on the other hand performs a more intrusive scan as it sents a thousand request to the server. It tries all the possible plugins even if the plugin has no known vulnerabilities linked to it. This may result in an increased load on the target server. - The
mixed(default)mode uses a mixture of both aggressive and passive.
To specify detection mode;
wpscan --url wordpress.example.com -o test --detection-mode aggressive
Check for Vulnerable Plugins
To scan for vulnerable plugins on your WordPress blog, pass the -e/--enumerate [OPTS] option to the wpscan command where [OPTS] can be; vp (vulnerable plugins), ap (all plugins), p (plugins). For example to scan for every plugin which has vulnerabilities linked to it,
wpscan --url wordpress.example.com -e vp
Check for Vulnerable Themes
Just like we used the -e/--enumerate [OPTS] option to check for vulnerable plugins, the same can be done when checking for vulnerable themes with the [OPTS] being any of the following; vt (Vulnerable themes), at (All themes), t (Themes). For example to scan for themes with known vulnerabilities;
wpscan --url wordpress.example.com -e vt
Enumerate WordPress Users
To find out the users that can login to WordPress site, you would pass the -e/--enumerate u option to wpscan where u basically means the user IDs.
wpscan --url wordpress.example.com -e u
Test for Password Strength/Bruteforce Attack against a WordPress User
Once you have enumerated the usernames, you can try to perform a brute-force attack again them as shown below. This process may be a bit slower depending on the number of passwords specified in the password file (-P, --passwords FILE-PATH) and number of threads (-t, --max-threads VALUE) you are using. For example to brute-force an admin,
wpscan --url wordpress.example.com -P password-file.txt -U admin -t 50
To test for password strength for multiple users, you would use the same command above this time round without the specific username specified.
wpscan --url wordpress.example.com -P password-file.txt -t 50
Run WordPress scan in undetectable mode
To run wpscan in a stealthy mode which basically means (--random-user-agent --detection-mode passive --plugins-version-detection passive), specify the --stealthy option.
wpscan --url wordpress.example.com --stealthy
That is all about WPScan. Feel free to explore this useful tool. We hope this article was helpful.
You can also check our previous articles on;
- How to Install and Use Nikto Web Scanner on Ubuntu 18.04
- How to Install and Configure Nessus Scanner on Ubuntu 18.04/CentOS 7
- How to Install and Setup OpenVAS 9 Vulnerability Scanner on Ubuntu 18.04
Happy vulnerability hunting.