1

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the host seems to be down" but the website is running completely fine!

I think there is a WAF that is blocking the scanner from scanning that website, but when I did a Port Scanning using NMAP for checking what services are running in that website I found that no WAF is installed on it. Also, I used WAFW00F to check which WAF is there but I found nothing!

So how do I search for that thing which is blocking me from scanning that website? Also please tell me what kind of mechanism is that website using?

the command I am using in wpscan is wpscan -u https://www.websitename.com

Improve this question
7
  • Can you add the command which you are using with wpscan? Are you scanning on the right port and host? I assume you have permission from the owner. Then simply ask him if there is a WAF in front of the application. Also, try running WPSCAN through a proxy and determine which requests and responses are sent.
    – Silver
    Jan 18, 2019 at 8:15
  • 3
    It might also help to know what error message you get when you run wpscan.
    – Tom K.
    Jan 18, 2019 at 8:15
  • Certain user-agents can also be blocked (i.e. the default WPScan v2.9 (http://wpscan.org)) to deter enumeration so maybe try a custom UA
    – jonroethke
    Jan 18, 2019 at 18:48
  • @Silver i have added the command which I used in WpSCAN and yes I am scanning right ports and hosts and also I have permissions for scanning that website
    – kinan nagariya
    Jan 19, 2019 at 9:31
  • @waymobetta yes this site is running on wordpress ... i have seen wp directories in that website
    – kinan nagariya
    Jan 19, 2019 at 9:32

2 Answers 2

Reset to default
2

You can't detect a web application firewall (WAF) using port scanning as it sits in front of the web server rather than listening on a separate port. You might detect a WAF from the headers it modifies or the cookies it adds, but it doesn't need to manifest itself in any way. The wafw00f.py you already used utilizes these methods in an automated way, but if it doesn't find one it's not a proof there isn't any.

It's actually better to avoid giving hints on which WAF you use: it's usable information, as the WAF could be vulnerable too, just like any other program. If a vulnerable WAF is protecting a vulnerable application, there's a chance that there's a hole big enough for an attack.

If there's a WAF in front of the web server, you simply need to place your scanner behind it. If you can't, you are probably not allowed to do so, which would make this question off-topic. If you can, your idea of testing the site separately is good. Another option is to copy the site to a test environment and run the tests there, to avoid breaking anything.

Improve this answer
0

try

wpscan --url http://www.example.target --force --detection-mode aggressive --random-user-agent --wp-content-dir /wp-content/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .