I will help a friend to test the security behind their WordPress site. I thought about to start to do a scan with Burpsuite and also WPScan, I also believe I will find a acunetix useful.

When I read a lot about the way people is penetration-testing wp-sites a lot of people is using sql injection on older versions of WP, though I believe this site is pretty new. Also a lot people is using brute-forcing though that builds on you have got a good word-list.

What is your suggestions?

Notice also I am not interested in break their Webserver in a any way.


For an application scoped assessment, I would begin with the obvious tools that are specific to that application, such as WPScan (which you mentioned). Beyond the findings there, I would look at your goals, objectives, access, and likelihood of finding types of vulnerabilities.

  1. Wordpress core is relatively well hardened today. It's unlikely you'll have findings there.
  2. Wordpress plugins are a potential cesspool. Many of them have no maintenance and were written by people as one of their first programming projects. Look at the interfaces these provide.
  3. Custom themes, since they can contain PHP, are particularly a source of vulnerabilities, including XSS. Look closely if your friend has a custom theme.

I would use mostly Burp Suite in the evaluation of these areas. If you have reason to believe SQLi exists, then consider also sqlmap.

I wouldn't bother trying to brute force credentials at all -- what's the point? If you want to check whether passwords are strong, you could dump the password database and do an offline attack with JTR or Hashcat, but if the number of users is small, just make them have good passwords. :)

  • Thank you for a very clarified answer. though if the password are weaks that's fine to have that as solution to be able to get through to the login. This is the way I also thought about do it really. though i find it hard to remake the security analyse I got afterwards to "what really to do". do you know any good tutorials or guides ? Thank you in advance
    – XsiSec
    Jan 15 '18 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.