WPSCAN - A WordPress Scanner

WordPress is one of the most famous CMS in the world. Just because it is popular does not mean it has the best security, in fact, like other popular accounts (Facebook, Instagram), WordPress becomes one of the main target for many hackers. One of the tools in Kali to exploit WordPress is wpscan. Through wpscan we can get the username of the WordPress account. Once the username is gained, we can brute force for password dictionary attack using the wpscan too. Using weak password combination will prone to this kind of attack which in the end you will find out that your account has been possessed by someone.

To test for user enumeration here is the command:

Wpscan –url url_of_target –enumerate u

Just wait a moment until there is a user login table:

Once login name is on the book, the next thing we want to do is to get the password. Wpscan has built-in tool for password brute force attack. But remember brute force attack will depend on the word list that you used. If the user use strong password and uncommon combination, it will be hard to get the password but sometimes people may not really aware of the password that they use is a common password. So, brute force attack is worth to try.

That command is used to  run the brute force attack. –wordlist followed by the wordlist file that you use. The brute force run as soon as you input the command.

After the brute force ends, it will show you the table with the password and username login. But this time I will stop until this because it may took a long time. There may be many password crackers or brute force tools with better speed or method, but for this one, using wpscan is an easy method to test it.

Now you may wonder, if wpscan exists, then how our WordPress accounts will be saved from this kind of attack? There some methods to prevent user enumeration. One of the simple method is use Stop User Enumeration plugin. The plugin can be found here. When I tried to a secure-tested WordPress website, here is the result that I got. 

In conclusion, there is nothing that is safe on the internet. WordPress becomes high priority target because many sites are built using it and many users may not know about security measure.

Notes: 

Yellow blocks on image is to block website information since the target is a live website.