Skip to main content

wpscan

wpscan is a specialized WordPress security scanner designed to identify vulnerabilities within WordPress installations as part of automated security workflows. It facilitates the discovery of security issues, allowing organizations to proactively manage their web assets.

Ideal Use Cases & Fit​

wpscan excels in scenarios where security assessments of WordPress sites are required. It is ideal for:

  • Conducting routine security checks on multiple WordPress installations.
  • Integrating into CI/CD pipelines for automated security validation during deployments.
  • Providing detailed reports on vulnerabilities, plugins, and versioning to track compliance.

However, it is less suited for scanning non-WordPress environments or for situations where speed is critical, as comprehensive scanning may require significant time and resource investment.

Value in Workflows​

In security workflows, wpscan adds significant value by automating the assessment process of WordPress websites. It can be positioned in early reconnaissance stages to gather data, and its structured output enhances reporting and post-processing efforts to prioritize remediation activities. Integration with vulnerability management systems can also facilitate proactive risk mitigation.

Input Data​

wpscan requires input in the form of a list of target URLs. This input is crucial as it defines the websites that will be scanned for vulnerabilities. An example of acceptable input is:

https://example1.com
https://example2.com

Configuration​

  • format: Specifies the output format (e.g., JSON). It is mandatory and defaults to JSON.
  • no-update: If set, skips the update process for WPScan.
  • enumerate: Allows configuration of enumeration options, such as vulnerability and theme checks. Defaults to a comprehensive list.
  • api-token: Enables enhanced reporting by providing a WPScan API Token for accessing detailed vulnerability data.
  • detection-mode: Determines the aggressiveness of scanning (mixed, passive, aggressive).
  • plugins-detection: Configures the scanning mode for plugin detection.
  • proxy: Defines a proxy to route the scanning requests.
  • request-timeout: Sets the timeout duration for requests in seconds, with a default of 60 seconds.
  • disable-tls-checks: Allows disabling SSL/TLS verification if needed.
  • random-user-agent: When enabled, uses a random user-agent for each request to avoid detection.
  • force: Bypasses the initial WordPress check and 403 detection, useful for stealthy scans.
  • max-threads: Controls the maximum number of threads used during the scan to balance performance and resource usage.