{"id":4805,"date":"2017-11-07T01:11:13","date_gmt":"2017-11-06T17:11:13","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4805"},"modified":"2017-11-07T01:11:29","modified_gmt":"2017-11-06T17:11:29","slug":"wpseku-black-box-remote-wordpress-security-scanner","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2017\/11\/wpseku-black-box-remote-wordpress-security-scanner\/","title":{"rendered":"WPSeku &#8211; Black-Box Remote WordPress Security Scanner"},"content":{"rendered":"<p>WPSeku is a black box WordPress Security scanner that can be used to scan remote WordPress installations to find security issues and vulnerabilities.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/WPSeku-Black-Box-Remote-WordPress-Security-Scanner-640x365.png\" alt=\"WPSeku - Black-Box Remote WordPress Security Scanner\" width=\"640\" height=\"365\" class=\"aligncenter size-medium wp-image-4878\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/WPSeku-Black-Box-Remote-WordPress-Security-Scanner-640x365.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/WPSeku-Black-Box-Remote-WordPress-Security-Scanner.png 1009w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h2>Features of WPSeku WordPress Security Scanner<\/h2>\n<p>WPSeku supports various types of scanning including:<\/p>\n<ul>\n<li>Testing for XSS Vulnerabilities<\/li>\n<li>Testing for SQL Injection Vulnerabilities<\/li>\n<li>Testing for LFI Vulnerabilities<\/li>\n<li>Bruteforce login via xmlrpc<\/li>\n<li>Username Enumeration<\/li>\n<li>Proxy Support<\/li>\n<li>Method (GET\/POST)<\/li>\n<li>Custom Wordlists<\/li>\n<li>Custom user-agent<\/li>\n<\/ul>\n<p>It also uses the WPVulnDB Vulnerability Database API at <a href=\"https:\/\/wpvulndb.com\/api\">https:\/\/wpvulndb.com\/api<\/a>.<\/p>\n<h2>Using WPSeku WordPress Security Scanner<\/h2>\n<pre>\r\n\\ \\      \/ \/  _ \\\/ ___|  ___| | ___   _ \r\n \\ \\ \/\\ \/ \/| |_) \\___ \\ \/ _ \\ |\/ \/ | | |\r\n  \\ V  V \/ |  __\/ ___) |  __\/   <| |_| |\r\n   \\_\/\\_\/  |_|   |____\/ \\___|_|\\_\\\\__,_|\r\n                                         \r\n|| WPSeku - WordPress Security Scanner   \r\n|| Version 0.2.1                         \r\n|| Momo Outaadi (M4ll0k)                 \r\n|| https:\/\/github.com\/m4ll0k\/WPSeku\r\n\r\n\r\nUsage: .\/wpseku.py [--target|-t] http:\/\/localhost\r\n\t\t-t --target\t\tTarget URL (eg: http:\/\/localhost)\r\n\t\t-x --xss\t\tTesting XSS vulns\r\n\t\t-s --sql\t\tTesting SQL vulns\r\n\t\t-l --lfi\t\tTesting LFI vulns\r\n\t\t-q --query\t\tTestable parameters (eg: \"id=1&#038;test=1\")\r\n\t\t-b --brute\t\tBruteforce login via xmlrpc\r\n\t\t-u --user\t\tSet username, default=admin\r\n\t\t-p --proxy\t\tSet proxy, (host:port)\r\n\t\t-m --method\t\tSet method (GET\/POST)\r\n\t\t-c --cookie\t\tSet cookies\r\n\t\t-w --wordlist\tSet wordlist\r\n\t\t-a --agent\t\tSet user-agent\r\n\t\t-r --redirect\tRedirect target url, default=True\r\n\t\t-h --help\t\tShow this help and exit\r\n\r\nExamples:\r\n\t\twpseku.py --target http:\/\/localhost\r\n\t\twpseku.py -t http:\/\/localhost\/wp-admin\/post.php -m GET -q \"post=49&#038;action=edit\" [-x,-s,-l]\r\n\t\twpseku.py --target http:\/\/localhost --brute --wordlist dict.txt\r\n\t\twpseku.py --target http:\/\/localhost --brute --user test --wordlist dict.txt<\/pre>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h3>WPSeku WordPress Security Scan Installation<\/h3>\n<pre># git clone https:\/\/github.com\/m4ll0k\/WPSeku.git\r\n# cd WPSeku\r\n# pip install -r requirements.txt\r\n# python wpseku.py<\/pre>\n<p>There's also these to check out:<\/p>\n<p>- <a href=\"https:\/\/www.darknet.org.uk\/2015\/05\/plecost-wordpress-fingerprinting-tool\/\">Plecost \u2013 WordPress Fingerprinting Tool<\/a><br \/>\n- <a href=\"https:\/\/www.darknet.org.uk\/2015\/03\/cmsmap-content-management-system-security-scanner\/\">CMSmap \u2013 Content Management System Security Scanner<\/a><br \/>\n- <a href=\"https:\/\/www.darknet.org.uk\/2011\/07\/wpscan-wordpress-securityvulnerability-scanner\/\">WPScan \u2013 WordPress Vulnerability Scanner<\/a><\/p>\n<p>You can download WPSeku here:<\/p>\n<p><a href=\"https:\/\/github.com\/m4ll0k\/WPSeku\/archive\/master.zip\">WPSeku-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/m4ll0k\/WPSeku\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WPSeku is a black box WordPress Security scanner that can be used to scan remote WordPress installations to find security issues and vulnerabilities. Features of WPSeku WordPress Security Scanner WPSeku supports various types of scanning including: Testing for XSS Vulnerabilities Testing for SQL Injection Vulnerabilities Testing for LFI Vulnerabilities Bruteforce login via xmlrpc Username Enumeration [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"WPSeku is a black box WordPress Security scanner that can be used to scan remote WordPress installations to find security issues and vulnerabilities.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[899,910],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4805"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4805"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4805\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}