wpscanteam/wpscan
Wpscan
WPScan is a security analysis utility and vulnerability scanner designed specifically for auditing WordPress installations and other content management systems. It functions as a web application security tool that identifies misconfigurations, outdated software, and security holes in core installations, plugins, and themes.
The tool employs black-box scanning techniques to perform site component enumeration, identifying users, themes, and plugins by matching known file paths and response signatures. It matches these detected components against a database of known security flaws to analyze the total attack surface of a website.
The system supports vulnerability management through both local security database synchronization and remote API lookups using authentication tokens. Operational settings and target lists can be managed via JSON or YAML configuration files to automate scanning tasks.
Features
- CMS Security Auditing - Scans WordPress installations to find security holes in the core software, plugins, and themes.
- Web Security Analysis - Provides a comprehensive security analysis tool for identifying vulnerabilities in WordPress web installations.
- Web Security Tools - Provides utilities for scanning and enumerating exposed users and sensitive data on web applications.
- Vulnerability Management - Checks website components against databases of known security flaws to prioritize updates and patching.
- Component Enumeration - Identifies installed plugins, themes, and users to locate potential entry points or exposed sensitive data.
- Attack Surface Analysis - Maps the total attack surface by discovering installed plugins, themes, and user accounts.
- Component Enumeration - Identifies plugins, themes, and users by matching known file paths and response signatures.
- WordPress Security Scanning - Detects outdated software and security holes specifically within WordPress installations.
- Vulnerability Matching - Matches detected plugins, themes, and core versions against a database of known security flaws.
- Penetration Testing Suites - Provides a suite of tools for conducting black-box security assessments to identify potential entry points.
- Black Box Scanning - Implements black-box scanning techniques to identify security holes via public HTTP responses.
- Vulnerable Library Detectors - Matches detected WordPress plugins and themes against a database of known vulnerable versions.
- Black Box Security Scanning - Analyzes public HTTP responses to identify site components and security weaknesses without requiring internal system access.
- Security Maintenance - Regularly verifies that plugins and themes are secure and up to date for site owners.
- Remote-to-Local Database Synchronizers - Maintains a local copy of vulnerability definitions synchronized from a remote source for offline checks.
- Vulnerability Database Management - Synchronizes and maintains local copies of security metadata to ensure current vulnerability definitions.
- Vulnerability Data Query Engines - Implements a query engine to match detected software versions against a remote vulnerability database.
- Vulnerability Database APIs - Provides API-based lookups to a remote security database to identify flaws in detected plugins and themes.
- Vulnerability Data Synchronization - Retrieves real-time security information from a remote database via API tokens to ensure scan accuracy.
- Vulnerability Scanners - WordPress vulnerability scanner.
- Web Application Scanners - Security scanner specifically for WordPress installations.
- CMS Scanners - Dedicated security scanner for identifying vulnerabilities in WordPress installations.
- CMS Vulnerability Scanning - Black-box security scanner for WordPress sites.
- Security Tools - Black box WordPress vulnerability scanner
- Vulnerability Auditing - Black-box vulnerability scanner specifically for WordPress sites.
- Web Application Analysis - Black-box scanner specifically for WordPress security vulnerabilities.
- Web Application Scanning - Specialized vulnerability scanner for WordPress sites.
- Web Hacking - Black-box vulnerability scanner for WordPress installations.
- Web Vulnerability Scanners - Black-box vulnerability scanner for WordPress sites.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
