I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used
wpscan in order to do that, for that I did it on a graybox basis knowing that is a wordpress site with some plugins.
wpscan fails to detects the installed plugins, therefore I need some sort of "directory scanning" tool where I can scan on
wp-content/plugin folder from a plugin list in order to list which wordpress plugins have been installed based on "signature paths" or "signature http requests" eg if
/wp-content/plugin/my-plugin/somefile.php exists then it may have been installed the
The idea is to "scan" an http directory with specific patterns in order to enumerate its files. Is that feasible even if the webserver is configured NOT to show the files and directories?
I know I can click around the website and get the vague idea which plugin uses but sometimes plugins do not have visible signs that exist to the webpage's html eg backup ones.