WPScan

WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites.

NOTE: You need to provide WPSan with an API Token so that it can look up vulnerabilities infos with https://wpvulndb.com. Without the token WPScan will only identify Wordpress Core / Plugin / Theme versions but not if they are actually vulnerable. You can get a free API Token at by registering for an account at https://wpvulndb.com. Using the secureCodeBox WPScans you can specify the token via the WPVULNDB_API_TOKEN target attribute, see the example below.

To learn more about the WPScan scanner itself visit wpscan.org or wpscan.io.

Deployment

The WPScan scanType can be deployed via helm:

helm upgrade --install wpscan secureCodeBox/wpscan

Scanner Configuration

The following security scan configuration example are based on the WPScan Documentation, please take a look at the original documentation for more configuration examples.

• Scan all plugins with known vulnerabilities: wpscan --url example.com -e vp --plugins-detection mixed --api-token WPVULNDB_API_TOKEN
• Scan all plugins in our database (could take a very long time): wpscan --url example.com -e ap --plugins-detection mixed --api-token WPVULNDB_API_TOKEN
• Password brute force attack: wpscan --url example.com -e u --passwords /path/to/password_file.txt
• WPScan keeps a local database of metadata that is used to output useful information, such as the latest version of a plugin. The local database can be updated with the following command: wpscan --update
• When enumerating the WordPress version, installed plugins or installed themes, you can use three different "modes", which are:
  • passive
  • aggressive
  • mixed If you want the most results use the "mixed" mode. However, if you are worried that the server may not be able to handle a large number of requests, use the "passive" mode. The default mode is "mixed", with the exception of plugin enumeration, which is "passive". You will need to manually override the plugin detection mode, if you want to use anything other than the default, with the --plugins-detection option.
• WPScan can enumerate various things from a remote WordPress application, such as plugins, themes, usernames, backed up files wp-config.php files, Timthumb files, database exports and more. To use WPScan's enumeration capabilities supply the -e option.

Available Choices:

vp | Vulnerable plugins

ap | All plugins

p | Plugins

vt | Vulnerable themes

at | All themes

t | Themes

tt | Timthumbs

cb | Config backups

dbe | Db exports

u | User IDs range. e.g: u1-5

Range separator to use: '-'

Value if no argument supplied: 1-10

m | Media IDs range. e.g m1-15

Note: Permalink setting must be set to "Plain" for those to be detected

Range separator to use: '-'

Value if no argument supplied: 1-100

Separator to use between the values: ','

Default: All Plugins, Config Backups

Value if no argument supplied: vp,vt,tt,cb,dbe,u,m

Incompatible choices (only one of each group/s can be used):

- vp, ap, p

- vt, at, t

Chart Configuration

Key	Type	Default	Description
image.repository	string	"wpscanteam/wpscan"	Container Image to run the scan
image.tag	string	nil	defaults to the charts appVersion
parseJob.ttlSecondsAfterFinished	string	nil	seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
parserImage.repository	string	"docker.io/securecodebox/parser-wpscan"	Parser image repository
parserImage.tag	string	defaults to the charts version	Parser image tag
scannerJob.env	list	[]	Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
scannerJob.extraContainers	list	[]	Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
scannerJob.extraVolumeMounts	list	[]	Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scannerJob.extraVolumes	list	[]	Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scannerJob.resources	object	{}	CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
scannerJob.securityContext	object	{}	Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
scannerJob.ttlSecondsAfterFinished	string	nil	seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/

Examples

example.com

note

This example is only meant as a guideline for configuring wpscan. The example scan will fail as it uses example.com as a target, which isn't a valid wpscan target.

• Scan
• Findings

apiVersion: "execution.securecodebox.io/v1"

kind: Scan

metadata:

name: "wpscan-www.example.com"

spec:

scanType: "wpscan"

parameters:

- "--url"

- https://www.example.com

- "-e"

- "vp"

- "--plugins-detection"

- "mixed"

- "--api-token"

- "AAAAABBBBBCCCCCDDDDEEEEEEE"

old-wordpress

note

This example scan uses a demo wordpress 4.0 instance. You can deploy it as a demo target into you cluster. The scan assumes that it is installed in the demo-apps namespace. See the installation guide.

• Scan
• Findings

apiVersion: "execution.securecodebox.io/v1"

kind: Scan

metadata:

name: "wpscan-old-wordpress-internal"

spec:

scanType: "wpscan"

parameters:

- "--url"

- old-wordpress.demo-apps.svc.cluster.local

- "-e"

- "vp"

- "--plugins-detection"

- "mixed"