WPScan is a WordPress vulnerability scanner written in ruby, which is capable of detecting common security vulnerabilities as well as listing all plugins used by a website hosting WordPress.

WPScan Installation

To install WPScan on Ubuntu 11.10/11.04 or any older versions of Ubuntu, open the terminal and install first these dependencies:

sudo apt-get install rails
sudo apt-get install gem
sudo apt-get install libcurl4-gnutls-dev libopenssl-ruby
sudo gem install typhoeus xml-simple
sudo apt-get install subversion
gem install --user-install typhoeus

To install WPScan, run these two commands:

svn checkout http://wpscan.googlecode.com/svn/trunk/ ./wpscan
cd wpscan

The tool will be installed in the home folder (wpscan).

WPScan Use

To do a non-intrusive checks for a WordPress website, you can use this command from the terminal:

ruby ./wpscan.rb --url www.domain.com

Replace www.domain.com with the domain hosting WordPress you want to check.

To check for example installed plugins used by a WordPress website, use this command:

ruby ./wpscan.rb --url www.domain.com --enumerate p

The command will enumerate all installed WordPress plugins. For more help about WPScan, you can check the README file that comes with the tool, or run this command from the terminal:


That's it!

Post a Comment