WPScan
A WordPress site can be scanned for vulnerabilities using WPScan within the Kali Linux distro. WPScan is a specialized, pre-installed tool designed to identify security issues within a WordPress installation. It can identify version vulnerabilities, outdated plugins, theme flaws, and misconfigurations.
Lifetime deal · Unlimited Plan
🚀🚀🚀🚀🚀 The toolstack behind the scenes of 10,000+ Successful Content Creators
Create, transform, and publish content across all platforms with one click. Save 20+ hours per week and never struggle with content creation again.
You get access to the full content engine — for less than the cost of 1 month on any other tool. Confidently trusted by 10,000+ Creators. Claim Your Special Deal Right Now! Click Here Now!
Crucial Notes
Authorization:
Only run these type scans on sites that you own or have explicit permission to test.
Update First
Before scanning, ensure your WPScan database is updated using wpscan –update.
False Positives
Scanners can produce false positives; verify findings.
Alternatives
If not using the pre-installed version, you can install it with sudo apt install wpscan.
Basic Scans and Updates
- Update the vulnerability database: Regularly updating the database ensures WPScan can detect the latest vulnerabilities.
wpscan --update
Perform a basic scan: This command provides an overview of the WordPress version, themes, and plugins, flagging known issues from publicly available data.
wpscan --url http://yourwebsite.comForce a scan: Use this option if WPScan does not automatically detect a site as a WordPress installation.
wpscan --url http://yourwebsite.com --force
Get the WPScan API Here! https://wpscan.com/
Save scan output to a file: The -o option allows you to save results for later analysis.
wpscan --url http://yourwebsite.com -o wpscan_results.txt
Other Related Tools in Kali Linux
CMSeeK
A specialized CMS detection and exploitation suite that scans WordPress, Joomla, and Drupal.
Wapiti
A black-box scanner that acts as a fuzzer, injecting payloads to detect SQL injections and XSS.
Nmap
Useful for finding open ports and identifying services (e.g., Apache/NGINX) on the server.
Further Reading
wpscan | Kali Linux Tools
wpscan Usage Examples Scan a target WordPress URL and enumerate any plugins that are installed: https://www.kali.org/tools/wpscan/
WPScan Intro: How to Scan for WordPress Vulnerabilities
https://blog.sucuri.net/2023/12/wpscan-intro-how-to-scan-for-wordpress-vulnerabilities.html
2.6: Penetration Testing Your WordPress Website
https://www.wordfence.com/learn/penetration-testing-your-wordpress-website
Did you know that websites can potentially identify visitors through IP addresses, cookies, and browser fingerprinting? Did you know that your ISP can see all the activities you do online as they track all your activities?
The fact is websites and apps use different technologies to collect information about what you do online. What can you do about this? Protect your privacy with a VPN, not just any VPN, Surfshark VPN. Surfshark VPN is a high-security, user-friendly virtual private network service known for allowing unlimited simultaneous device connections. It encrypts internet traffic to protect user privacy, bypassing geo-restrictions for streaming, and offers advanced features like MultiHop, ad-blocking, and a strict no-logs policy, making it a top-tier, affordable security tool.
PRW Digital Services – Digital Services Done Right – Have a project, need help, inquire within.
