WPScan 工具简单使用
最近在打 Vulnhub，正巧遇到了 Wordpress，想起以前用的一个工具 wpscan，做个记录吧。
本篇文章参考：
1 工具介绍
WPScan 是一款用于 WordPress 网站的漏洞扫描和安全检测的开源工具。它是一个命令行工具，旨在帮助安全专家和网站管理员发现和修复可能存在的 WordPress 漏洞和安全问题。
以下是 WPScan 工具的一些主要特点和功能：
漏洞扫描：WPScan 可以扫描 WordPress 网站以查找已知漏洞和安全问题。它使用一个广泛的漏洞数据库来检测潜在的安全漏洞，包括已公开披露的漏洞、插件和主题的已知漏洞等。
用户名枚举：WPScan 可以尝试枚举 WordPress 网站的有效用户名。这可以帮助攻击者确定目标网站上存在的有效用户，从而进行更有针对性的攻击。
弱密码猜测：WPScan 可以进行弱密码猜测攻击，尝试使用常见的用户名和密码组合进行登录。这有助于检测使用弱密码的用户账户，从而提醒管理员采取更强的密码策略。
插件和主题扫描：WPScan 可以扫描已安装的 WordPress 插件和主题，以检测已知的漏洞和安全问题。这可以帮助管理员及时更新和修复存在问题的插件和主题，以减少潜在的安全风险。
数据库扫描：WPScan 可以检查 WordPress 数据库中的敏感信息，如数据库名、表前缀等。这有助于发现可能泄露敏感信息的配置问题。
2 工具安装
WPScan 是 Kali Linux 默认自带的一款漏洞扫描工具，由于 Kali 中自带了 WPScan，所以怎么安装就不讲了，直接说说怎么使用：
root at kali in ~/Desktop
$ wpscan
One of the following options is required: --url, --update, --help, --hh, --version
Please use --help/-h for the list of available options.
3 工具使用
3.1 常用参数
使用 wpscan -h 查看参数用法：
root at kali in ~
$ wpscan -h
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.24
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
Usage: wpscan [options]
--url URL The URL of the blog to scan
Allowed Protocols: http, https
Default Protocol if none provided: http
This option is mandatory unless update or help or hh or version is/are supplied
-h, --help Display the simple help and exit
--hh Display the full help and exit
--version Display the version and exit
-v, --verbose Verbose mode
......
3.1.1 扫描格式参数
3.1.2 扫描指定参数
3.1.3 漏洞扫描参数
3.1.4 暴力破解参数
3.2 使用示例
这里以 VulnHub 靶机的 DC-2 为例。
3.2.1 更新数据库
root at kali in ~
$ wpscan --update --no-banner
[i] Updating the Database ...
[i] Update completed.
3.2.2 扫描指定的站点
root at kali in ~
$ wpscan --url http://dc-2 --no-banner
[+] URL: http://dc-2/ [10.10.8.143]
[+] Started: Sun Nov 12 12:59:18 2023
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.10 (Debian)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://dc-2/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://dc-2/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://dc-2/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.7.10 identified (Insecure, released on 2018-04-03).
| Found By: Rss Generator (Passive Detection)
| - http://dc-2/index.php/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
| - http://dc-2/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
[+] WordPress theme in use: twentyseventeen
| Location: http://dc-2/wp-content/themes/twentyseventeen/
| Last Updated: 2023-11-07T00:00:00.000Z
| Readme: http://dc-2/wp-content/themes/twentyseventeen/README.txt
| [!] The version is out of date, the latest version is 3.4
| Style URL: http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10
| Style Name: Twenty Seventeen
| Style URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Css Style In Homepage (Passive Detection)
|
| Version: 1.2 (80% confidence)
| Found By: Style (Passive Detection)
| - http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10, Match: 'Version: 1.2'
[+] Enumerating All Plugins (via Passive Methods)
[i] No plugins Found.
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
Checking Config Backups - Time: 00:00:00 <=========================================================> (137 / 137) 100.00% Time: 00:00:00
[i] No Config Backups Found.
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
[+] Finished: Sun Nov 12 12:59:20 2023
[+] Requests Done: 139
[+] Cached Requests: 37
[+] Data Sent: 32.367 KB
[+] Data Received: 19.868 KB
[+] Memory used: 264.207 MB
[+] Elapsed time: 00:00:01
3.2.3 使用 API Token 扫描
3.2.3.1 注册 API Token
之后就可以使用 api 扫描漏洞了：
root at kali in ~
$ wpscan --url http://dc-2 --no-banner --api-token xxxxxxxxXPyuh1NaOi2Bk30zbcJRg25js
root at kali in ~
$ cat result.txt
[+] URL: http://dc-2/ [10.10.8.143]
[+] Started: Sun Nov 12 13:07:05 2023
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.10 (Debian)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://dc-2/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://dc-2/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://dc-2/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.7.10 identified (Insecure, released on 2018-04-03).
| Found By: Rss Generator (Passive Detection)
| - http://dc-2/index.php/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
| - http://dc-2/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
|
| [!] 65 vulnerabilities identified:
|
| [!] Title: WordPress <= 4.9.6 - Authenticated Arbitrary File Deletion
| Fixed in: 4.7.11
| References:
| - https://wpscan.com/vulnerability/42ab2bd9-bbb1-4f25-a632-1811c5130bb4
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12895
| - https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/
| - http://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/
| - https://github.com/WordPress/WordPress/commit/c9dce0606b0d7e6f494d4abe7b193ac046a322cd
| - https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/
| - https://www.wordfence.com/blog/2018/07/details-of-an-additional-file-deletion-vulnerability-patched-in-wordpress-4-9-7/
|
| [!] Title: WordPress <= 5.0 - Authenticated File Delete
| Fixed in: 4.7.12
| References:
| - https://wpscan.com/vulnerability/e3ef8976-11cb-4854-837f-786f43cbdf44
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20147
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
|
| [!] Title: WordPress <= 5.0 - Authenticated Post Type Bypass
......
3.2.4 扫描所有插件
root at kali in ~
$ wpscan --url http://dc-2 --no-banner -e ap
......
[+] Enumerating All Plugins (via Passive Methods)
[i] No plugins Found.
......
3.2.5 扫描所有主题
root at kali in ~
$ wpscan --url http://dc-2 --no-banner -e at
......
[i] Theme(s) Identified:
[+] twentyfifteen
| Location: http://dc-2/wp-content/themes/twentyfifteen/
| Last Updated: 2023-11-07T00:00:00.000Z
| Readme: http://dc-2/wp-content/themes/twentyfifteen/readme.txt
| [!] The version is out of date, the latest version is 3.6
| Style URL: http://dc-2/wp-content/themes/twentyfifteen/style.css
| Style Name: Twenty Fifteen
| Style URI: https://wordpress.org/themes/twentyfifteen/
| Description: Our 2015 default theme is clean, blog-focused, and designed for clarity. Twenty Fifteen's simple, st...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Known Locations (Aggressive Detection)
| - http://dc-2/wp-content/themes/twentyfifteen/, status: 500
|
| Version: 1.7 (80% confidence)
| Found By: Style (Passive Detection)
| - http://dc-2/wp-content/themes/twentyfifteen/style.css, Match: 'Version: 1.7'
[+] twentyseventeen
| Location: http://dc-2/wp-content/themes/twentyseventeen/
| Last Updated: 2023-11-07T00:00:00.000Z
| Readme: http://dc-2/wp-content/themes/twentyseventeen/README.txt
| [!] The version is out of date, the latest version is 3.4
| Style URL: http://dc-2/wp-content/themes/twentyseventeen/style.css
| Style Name: Twenty Seventeen
| Style URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Urls In Homepage (Passive Detection)
| Confirmed By: Known Locations (Aggressive Detection)
| - http://dc-2/wp-content/themes/twentyseventeen/, status: 500
|
| Version: 1.2 (80% confidence)
| Found By: Style (Passive Detection)
| - http://dc-2/wp-content/themes/twentyseventeen/style.css, Match: 'Version: 1.2'
[+] twentysixteen
| Location: http://dc-2/wp-content/themes/twentysixteen/
| Last Updated: 2023-11-07T00:00:00.000Z
| Readme: http://dc-2/wp-content/themes/twentysixteen/readme.txt
| [!] The version is out of date, the latest version is 3.1
| Style URL: http://dc-2/wp-content/themes/twentysixteen/style.css
| Style Name: Twenty Sixteen
| Style URI: https://wordpress.org/themes/twentysixteen/
| Description: Twenty Sixteen is a modernized take on an ever-popular WordPress layout — the horizontal masthead ...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Known Locations (Aggressive Detection)
| - http://dc-2/wp-content/themes/twentysixteen/, status: 500
|
| Version: 1.3 (80% confidence)
| Found By: Style (Passive Detection)
| - http://dc-2/wp-content/themes/twentysixteen/style.css, Match: 'Version: 1.3'
......
3.2.6 枚举用户
root at kali in ~
$ wpscan --url http://dc-2 --no-banner -e u
......
[+] Enumerating Users (via Passive and Aggressive Methods)
Brute Forcing Author IDs - Time: 00:00:00 <==========================================================> (10 / 10) 100.00% Time: 00:00:00
[i] User(s) Identified:
[+] admin
| Found By: Rss Generator (Passive Detection)
| Confirmed By:
| Wp Json Api (Aggressive Detection)
| - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1
| Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Login Error Messages (Aggressive Detection)
[+] jerry
| Found By: Wp Json Api (Aggressive Detection)
| - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1
| Confirmed By:
| Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Login Error Messages (Aggressive Detection)
[+] tom
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
......
3.2.7 爆破密码
root at kali in ~/Desktop
$ wpscan --url http://dc-2 --no-banner -P /usr/share/wordlists/rockyou.txt -U admin
