Wordpress

Enumeration

Find Users

https://cavementech.com/wp-json/wp/v2/userscavementech.com

use the link

Enumerate Plugins

Gobuster to find wordpress plugins

gobuster dir -u http://target2.ine.local/wpcontent/plugins/ -w /usr/share/nmap/nselib/data/wp-plugins.lst

Nmap to find vulnerable wordpress scripts

nmap --script=http-wordpress-enum target2.ine.local

Wpscan to look for plugins

wpscan --url http://target2.ine.local/ --enumerate u,t,p 

WPSCAN

WPScan is a WordPress security scanner designed to find vulnerabilities in WordPress websites.

🔒 What it does:

• Scans for known vulnerabilities in:

  • WordPress core (the main system)

  • Installed plugins

  • Installed themes

• Checks for weak passwords on user accounts.

• Looks for configuration issues (e.g., directory listing enabled, debug mode active).

wpscan | Kali Linux ToolsKali Linux

wpscan --url http://wordpress.local

Wpscan is installed in Kali and parrot OS, you need to register on WPSCAN website and get the API-Key

wpscan --url http://cmnatics.playground/ --enumerate u,p,t,vp --api-token kAp93ZFanbv7N35slZDR6IHuWqiKpuws2aM3grEMsbY

Bruteforcing

wpscan –-url http://cmnatics.playground –-passwords rockyou.txt –-usernames cmnatic

Default backup file

http://target.ine.local/wp-config.bak

Nikto scan wordpress

nikto -h target2.ine.local

Exploiting duplicator plugin

there is an exploit for duplicator

So there are multiple exploits available. One of them is an arbitrary file read exploit in Metasploit.

Let’s use it by running msfconsole and search that particular module.

Interact with the module by typing use 1 and then options to list the required parameters.

So we need to set only RHOSTS as target2.ine.local and run the exploit.

set RHOSTS target2.ine.local