Опишете задачата
Към всички skills

wordpress-penetration-testing

aiskillstore · Сигурност

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.

Оригинален текст · няма потвърден превод на български
Платформи: ClaudeНиво: НапредналоВ индекса: 04.03.2026 г.Обновен в GitHub: 04.03.2026 г.

Първо прочетете инструкцията.

Файлът се зарежда от посочения източник само по ваше действие. Можете да го прочетете тук, да го копирате или да го запазите като .md.

Оригинален SKILL.md
GitHub хранилище
Звезди на репото
428
Лиценз
Не е посочен. Проверете в репозитория.
Последна проверка на записа
Няма посочена дата

Добавете в своя инструмент.

Командата отваря избора на skills от репозитория. Прочетете файла и условията на автора преди изпълнение.

npx skills add aiskillstore/marketplace

Страницата копира текст. Не инсталира и не изпълнява нищо на устройството ви.

Откъс от SKILL.md

Началото на файла на автора, без превод.

WordPress Penetration Testing

Purpose

Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.

Prerequisites

Required Tools

  • WPScan (pre-installed in Kali Linux)
  • Metasploit Framework
  • Burp Suite or OWASP ZAP
  • Nmap for initial discovery
  • cURL or wget

Required Knowledge

  • WordPress architecture and structure
  • Web application testing fundamentals
  • HTTP protocol understanding
  • Common web vulnerabilities (OWASP Top 10)

Outputs and Deliverables

  1. WordPress Enumeration Report - Version, themes, plugins, users
  2. Vulnerability Assessment - Identified CVEs and misconfigurations
  3. Credential Assessment - Weak password findings
  4. Exploitation Proof - Shell access documentation

Core Workflow

Phase 1: WordPress Discovery

Identify WordPress installations:

# Check for WordPress indicators
curl -s http://target.com | grep -i wordpress
curl -s http://target.com | grep -i "wp-content"
curl -s http://target.com | grep -i "wp-includes"

# Check common WordPress paths
curl -I http://target.com/wp-login.php
curl -I http://target.com/wp-admin/
curl -I http://target.com/wp-content/
curl -I http://target.com/xmlrpc.php

# Check meta generator tag
curl -s http://target.com | grep "generator"

# Nmap WordPress detection
nmap -p 80,443 --script http-wordpress-enum target.com

Key WordPress files and directories:

  • /wp-admin/ - Admin dashboard
  • /wp-login.php - Login page
  • /wp-content/ - Themes, plugins, uploads
  • /wp-includes/ - Core files
  • /xmlrpc.php - XML-RPC interface
  • /wp-config.php - Configuration (not accessible if secure)
  • /readme.html - Version information

Phase 2: Basic WPScan Enumeration

Comprehensive WordPress scanning with WPScan:

# Basic scan
wpscan --url http://target.com/wordpress/

# With API token (for vulnerability data)
wpscan --url http://target.com --api-token YOUR_API_TOKEN

# Aggressive detection mode
wpscan --url http://target.com --detection-mode aggressive

# Output to file
wpscan --url http://target.com -o results.txt

# JSON output
wpscan --url http://target.com -f json -o results.json

# Verbose output
wpscan --url http://target.com -v

Phase 3: WordPress Version Detection

Identify WordPress version:

Целият SKILL.md в GitHub