1. Basic WordPress Identification
Perform initial checks to confirm if a website is running WordPress.
curl -s http://blog.inlanefreight.local/robots.txt # Check for disallowed paths
curl -s http://blog.inlanefreight.local/wp-admin/ # Observe redirection behavior
curl -s http://blog.inlanefreight.local/wp-content/plugins/ # Check for plugin directory
curl -s http://blog.inlanefreight.local/wp-content/themes/ # Check for theme directory
2. WordPress Version and Theme Enumeration
Identify the WordPress version and active themes.
curl -s http://blog.inlanefreight.local | grep -i "WordPress" # Check for version details
curl -s http://blog.inlanefreight.local/ | grep -i "themes" # Identify themes
curl -s http://blog.inlanefreight.local/wp-content/themes/transport-gravity/style.css # Check theme stylesheet
curl -s http://blog.inlanefreight.local/wp-content/themes/transport-gravity/readme.txt # Check theme readme
3. Plugin Enumeration
Discover installed plugins which may have known vulnerabilities.
curl -s http://blog.inlanefreight.local/ | grep -i "plugins"
curl -s http://blog.inlanefreight.local/wp-content/plugins/mail-masta/readme.txt # Check for version info
curl -s http://blog.inlanefreight.local/?p=1 | grep -i "plugins" # Look for references in page content
4. User Enumeration (Manual)
Detect valid usernames using login response differences.
curl -s -I http://blog.inlanefreight.local/wp-login.php -d "log=admin&pwd=invalid" # Check response for valid user
curl -s -I http://blog.inlanefreight.local/wp-login.php -d "log=invalid&pwd=invalid" # Check response for invalid user
5. WPScan Enumeration
Use WPScan for automated WordPress enumeration.
sudo gem install wpscan
wpscan -h
sudo wpscan --url http://blog.inlanefreight.local --enumerate --api-token YOUR_API_TOKEN
WPScan Advanced Enumeration
sudo wpscan --url http://blog.inlanefreight.local --enumerate u,p,t # Enumerate users, plugins, and themes
WPScan Brute-force Attack
sudo wpscan --url http://blog.inlanefreight.local --passwords /usr/share/wordlists/rockyou.txt --usernames admin,john
WPScan with Proxy
sudo wpscan --url http://blog.inlanefreight.local --proxy 127.0.0.1:8080
6. XML-RPC Checks
Check if XML-RPC is enabled, which can be exploited for brute-force attacks.
curl -i http://blog.inlanefreight.local/xmlrpc.php
XML-RPC Exploitation
Check if system.multicall can be used for brute-force attacks.
curl -X POST -d '<methodCall><methodName>system.listMethods</methodName></methodCall>' http://blog.inlanefreight.local/xmlrpc.php
7. Additional Security Checks
Robots.txt Insights
Identify restricted areas and test for misconfigurations.
curl -s http://blog.inlanefreight.local/robots.txt | grep "Disallow"
Test if restricted files are still accessible:
curl -s http://blog.inlanefreight.local/wp-config.php
Page Source Analysis
Extract useful information such as API keys and endpoints.
curl -s http://blog.inlanefreight.local | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*"
Detect Open Directory Listings
curl -s http://blog.inlanefreight.local/wp-content/uploads/
