{"id":13539700,"url":"https://github.com/swisskyrepo/wordpresscan","last_synced_at":"2025-04-02T06:31:20.572Z","repository":{"id":45811564,"uuid":"82331478","full_name":"swisskyrepo/Wordpresscan","owner":"swisskyrepo","description":"WPScan rewritten in Python + some WPSeku ideas","archived":true,"fork":false,"pushed_at":"2021-06-04T20:51:58.000Z","size":12637,"stargazers_count":638,"open_issues_count":21,"forks_count":205,"subscribers_count":31,"default_branch":"master","last_synced_at":"2025-03-27T00:34:58.495Z","etag":null,"topics":["hacktoberfest","python","vulnerabilities","vulnerability-scanners","wordpress","wordpress-plugin","wordpress-scanner","wordpress-security","wordpress-theme","wpscan"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/swisskyrepo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"github":"swisskyrepo","ko_fi":"swissky"}},"created_at":"2017-02-17T19:36:00.000Z","updated_at":"2025-03-24T06:00:23.000Z","dependencies_parsed_at":"2022-09-19T17:31:14.938Z","dependency_job_id":null,"html_url":"https://github.com/swisskyrepo/Wordpresscan","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swisskyrepo%2FWordpresscan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swisskyrepo%2FWordpresscan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swisskyrepo%2FWordpresscan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swisskyrepo%2FWordpresscan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/swisskyrepo","download_url":"https://codeload.github.com/swisskyrepo/Wordpresscan/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246767895,"owners_count":20830574,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest","python","vulnerabilities","vulnerability-scanners","wordpress","wordpress-plugin","wordpress-scanner","wordpress-security","wordpress-theme","wpscan"],"created_at":"2024-08-01T09:01:30.567Z","updated_at":"2025-04-02T06:31:15.563Z","avatar_url":"https://github.com/swisskyrepo.png","language":"Python","funding_links":["https://github.com/sponsors/swisskyrepo","https://ko-fi.com/swissky"],"categories":["\u003ca id=\"8f92ead9997a4b68d06a9acf9b01ef63\"\u003e\u003c/a\u003e扫描器\u0026\u0026安全扫描\u0026\u0026App扫描\u0026\u0026漏洞扫描","\u003ca id=\"132036452bfacf61471e3ea0b7bf7a55\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"de63a029bda6a7e429af272f291bb769\"\u003e\u003c/a\u003e未分类-Scanner"],"readme":"# Wordpresscan\nA simple Wordpress scanner written in python based on the work of WPScan (Ruby version), some features are inspired by WPSeku.\n\n## Disclaimer\n```\nThe authors of this github are not responsible for misuse or for any damage that you may cause!\nYou agree that you use this software at your own risk.\n```\n\n\n## Install \u0026 Launch\n\nInstall\n```bash\ngit clone https://github.com/swisskyrepo/Wordpresscan.git\ncd Wordpresscan\n```\n\nVirtualenv\n```bash\nvirtualenv .venv -p /usr/bin/python2.7\nsource .venv/bin/activate\npip install -r requirements.txt\n```\n\n## Examples\n### Example 1 : Basic update and scan of a wordpress\n```powershell\npython wordpresscan.py -u \"http://localhost/wordpress\" --update --random-agent\n\n-u : Url of the WordPress\n--update : Update the wpscan database\n--aggressive : Launch an aggressive version to scan for plugins/themes\n--random-agent : Use a random user-agent for this session\n```\n\n### Example 2 : Basic bruteforce (option --brute, option --nocheck)\n* bruteforce customs usernames\n```powershell\npython wordpresscan.py -u \"http://127.0.0.1/wordpress/\" --brute --usernames \"admin,guest\" --passwords-list fuzz/wordlist.lst\n```\n* bruteforce with usernames list\n```powershell\npython wordpresscan.py -u \"http://127.0.0.1/wordpress/\" --brute --users-list fuzz/wordlist.lst --passwords-list fuzz/wordlist.lst\n```\n* bruteforce detected users\n```\npython wordpresscan.py -u \"http://127.0.0.1/wordpress/\" --brute --passwords-list fuzz/wordlist.lst\n```\n\n\n```powershell\n╭─ 👻 swissky@crashlab: ~/Github/Wordpresscan  ‹master*›\n╰─$ python main.py -u \"http://127.0.0.1/wordpress/\" --brute --users-list fuzz/wordlist.lst --passwords-list fuzz/wordlist.lst --nocheck       \n_______________________________________________________________\n _    _               _                                         \n| |  | |             | |                                        \n| |  | | ___  _ __ __| |_ __  _ __ ___  ___ ___  ___ __ _ _ __  \n| |/\\| |/ _ \\| '__/ _` | '_ \\| '__/ _ \\/ __/ __|/ __/ _` | '_ \\\n\\  /\\  / (_) | | | (_| | |_) | | |  __/\\__ \\__ \\ (_| (_| | | | |\n \\/  \\/ \\___/|_|  \\__,_| .__/|_|  \\___||___/___/\\___\\__,_|_| |_|\n                       | |                                      \n                       |_|                                      \n WordPress scanner based on wpscan work - @pentest_swissky      \n_______________________________________________________________\n[+] URL: http://127.0.0.1/wordpress/\n\n[!] The Wordpress 'http://127.0.0.1/wordpress/readme.html' file exposing a version number: 4.4.7\n[i] Uploads directory has directory listing enabled : http://127.0.0.1/wordpress/wp-content/uploads/\n[i] Includes directory has directory listing enabled : http://127.0.0.1/wordpress/wp-includes/\n\n[i] Bruteforcing all users\n[+] User found admin\n[+] Starting passwords bruteforce for admin\nBruteforcing - ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░\n```\n\n### Example 3 : Thinking is overrated, this is aggressive, mostly not advised!\n```powershell\npython wordpresscan.py -u \"http://127.0.0.1/wordpress/\" --fuzz\n\n[i] Enumerating components from aggressive fuzzing ...\n[i] File: http://127.0.0.1/wordpress/license.txt - found\n[i] File: http://127.0.0.1/wordpress/readme.html - found\n[i] File: http://127.0.0.1/wordpress/wp-admin/admin-footer.php - found\n[i] File: http://127.0.0.1/wordpress/wp-admin/css/ - found\n[i] File: http://127.0.0.1/wordpress/wp-admin/admin-ajax.php - found\n[i] File: http://127.0.0.1/wordpress/wp-activate.php - found\n--fuzz :  Will fuzz the website in order to detect as much file, themes and plugins as possible\n```\n\n## Output example from a test environment\n![alt tag](https://github.com/swisskyrepo/Wordpresscan/blob/master/screens/Version%204.4.7.png?raw=true)\n\n## Deploy a test environment\n```bash\ndocker-compose -f wordpress_compose.yml up -d\n```\nTo enable `wp-json` api you need to change \"Permalink\" to anything but \"simple\" in the settings.\n\n## Credits and Contributors\n* Original idea and script from [WPScan Team](https://wpscan.org/)\n* Many PR and bugfixes from [bl4de](https://github.com/bl4de)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fswisskyrepo%2Fwordpresscan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fswisskyrepo%2Fwordpresscan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fswisskyrepo%2Fwordpresscan/lists"}