I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do that, for that I did it on a graybox basis knowing that is a wordpress site with some plugins.

But somehow wpscan fails to detects the installed plugins, therefore I need some sort of "directory scanning" tool where I can scan on wp-content/plugin folder from a plugin list in order to list which wordpress plugins have been installed based on "signature paths" or "signature http requests" eg if /wp-content/plugin/my-plugin/somefile.php exists then it may have been installed the my-plugin.

The idea is to "scan" an http directory with specific patterns in order to enumerate its files. Is that feasible even if the webserver is configured NOT to show the files and directories?

I know I can click around the website and get the vague idea which plugin uses but sometimes plugins do not have visible signs that exist to the webpage's html eg backup ones.

  • wpscan is a bruteforce dictionary tool – schroeder Jun 3 '18 at 17:36
  • But also detects plugins for wordpress, wordpress version and installed theme as well (sometimes). – Dimitrios Desyllas Jun 3 '18 at 17:40
  • What I'm saying is that I'm confused. A bruteforce tool didn't work, so you want a bruteforce tool... I think that you need to investigate why wpscan didn't work. – schroeder Jun 3 '18 at 17:41
  • I am not brute forcing the password but for scanning a website for hidden directories and files without relying on website's html. – Dimitrios Desyllas Jun 3 '18 at 17:43
  • I also improved the question in order to be more understandable. – Dimitrios Desyllas Jun 3 '18 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.