用wpscan扫描了一下自己的网站,出现403错误,应该是被iThemes Security这个插件拦截了,然后停用此插件,继续对网站进行体检,没有发现脆弱主题和脆弱插件,只是用户名使用不当,用个强大的字典就能爆破密码了。下面是一些操作指令,来自freebuf。更新:wpscan –update扫描WordPress漏洞:wpscan –url [wordpress url]枚举用户列表:wpscan –url [wordpress url] –enumerate u暴力破解root密码:wpscan –url [wordpress url] –wordlist [path to wordlist] –username [username to brute force] –threads [number of threads to use]枚举参数:下面是可以在扫描中用到的枚举参数:--enumerate | -e [option(s)]Enumeration option :u – usernames from id 1 to 10u[10-20] usernames from id 10 to 20 (you must write [] chars)p – plugins 插件vp
...
继续阅读
(46)