2

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the host seems to be down" but the website is running completely fine!

I think there is a WAF that is blocking the scanner from scanning that website, but when I did a Port Scanning using NMAP for checking what services are running in that website I found that no WAF is installed on it. Also, I used WAFW00F to check which WAF is there but I found nothing!

So how do I search for that thing which is blocking me from scanning that website? Also please tell me what kind of mechanism is that website using?

the command I am using in wpscan is wpscan -u https://www.websitename.com

  • Can you add the command which you are using with wpscan? Are you scanning on the right port and host? I assume you have permission from the owner. Then simply ask him if there is a WAF in front of the application. Also, try running WPSCAN through a proxy and determine which requests and responses are sent. – Silver Jan 18 at 8:15
  • 3
    It might also help to know what error message you get when you run wpscan. – Tom K. Jan 18 at 8:15
  • Certain user-agents can also be blocked (i.e. the default WPScan v2.9 (http://wpscan.org)) to deter enumeration so maybe try a custom UA – waymobetta Jan 18 at 18:48
  • @Silver i have added the command which I used in WpSCAN and yes I am scanning right ports and hosts and also I have permissions for scanning that website – kinan nagariya Jan 19 at 9:31
  • @waymobetta yes this site is running on wordpress ... i have seen wp directories in that website – kinan nagariya Jan 19 at 9:32
3

You can't detect a web application firewall (WAF) using port scanning as it sits in front of the web server rather than listening on a separate port. You might detect a WAF from the headers it modifies or the cookies it adds, but it doesn't need to manifest itself in any way. The wafw00f.py you already used utilizes these methods in an automated way, but if it doesn't find one it's not a proof there isn't any.

It's actually better to avoid giving hints on which WAF you use: it's usable information, as the WAF could be vulnerable too, just like any other program. If a vulnerable WAF is protecting a vulnerable application, there's a chance that there's a hole big enough for an attack.

If there's a WAF in front of the web server, you simply need to place your scanner behind it. If you can't, you are probably not allowed to do so, which would make this question off-topic. If you can, your idea of testing the site separately is good. Another option is to copy the site to a test environment and run the tests there, to avoid breaking anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.