When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/].
While pentesting some sites, I faced a common issue i.e it shows that Wordpress SEO 1.14.15 is vulnerable to Cross Site Scripting Attack. Output is given below:
| * Title: WordPress SEO 1.14.15 - index.php s Parameter Reflected XSS | * Reference: [http://packetstormsecurity.com/files/123028/] | * Reference: http://osvdb.org/97885
But when following the link http://packetstormsecurity.com/files/123028/ , it shows that attack can be executed with
But the main problem is when I tried to inject several XSS vectors, the results were not positive. I was not able to find any XSS in above url. There is proper output encoding, a snapshot is shown below:
So my question is:
- Do you have any method to bypass this and execute an XSS?
- Do you have any other tool or resources through which I can do better blackbox testing of Wordpress?