I will help a friend to test the security behind their WordPressWordPress site. I thought about to start to do a scan with Burpsuite andand also WPScan, I also believe I will find a acunetix useful.
When I read a lot about the way people is penetration-testing wp-sites a lot of people is using sql injection on older versions of WP, though I believe this site is pretty new. Also a lot people is using brute-forcing though that builds on you have got a good word-list.
What is your suggestions?
Notice also I am not interested in break their Webserver in a any way.