I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it does and doesn't for various other cases.

Would it make sense to do this? If so, when might it not?

I know there are a dozen scanning tools in a Kali, and I've seen the results be quite different about usually important things. Does anyone have any experience with what tools might work best for certain types of applications or known features?

  • I'm not sure what you're asking. Have you tried wpscan on your local host? Do you want to know how to scan a localhost address? Are you asking about tools besides wpscan? – schroeder May 27 '15 at 19:23
  • Welcome to Information Security! I'm a bit confused by your question. Are you asking if it makes sense to install tools to your server and then scan against – amccormack May 27 '15 at 19:23
  • Yes, I was asking about other scanning tools as well. I was also hoping to learn more about scanning local host with wpscan. – Alexander Kleinhans May 27 '15 at 19:37

When scanning over a network, the topology between the scanning software and the server you are scanning is very important.

Some tools need to be run on the server you are scanning.

Depending on the type of scan you are doing, some tools will require that you run them on the server you are analyzing. This is usually done in what is called white-box testing. By running the tool on the server, the tool will be able to read the source code of the application. An example of this kind of tool would be the Acunetix WP Security Plugin. This is a plugin that runs within your wordpress application.

Other tools should be run over the network.

You should position your tool so that it can reach your server similar to how your users reach your server. WPScan is this type of tool. For example, if your website is on a private intranet, you should be running your tools from an intranet connected machine.

Should I install wpscan on my wordpress server?

I can't see anything directly wrong with this. You should note that if you have load balancers or web application firewalls then your results from using WPScan locally may be different than if you ran them from another place on the internet. This can be helpful, as you may find vulnerabilities that your WAF may block, but still exist.

If you do have direct access to the server, you should look into white-box security solutions as well. White-box can often be more accurate since analysis can be performed directly on the code and not just on server responses.

  • Why does wpscan need to be run over the network? It tests for WP plugin versions. That can be done on local host. – schroeder May 27 '15 at 19:38
  • I suppose my language could be clearer. It runs over the network stack. Even if you are routing over lo you are still interfacing via the network stack. The point I'm trying to make is that it is black-box testing that is being performed based on responses from the webserver, not a white-box test. Unless, of course, WPScan includes a white-box local scanning feature that I am unaware of. – amccormack May 27 '15 at 19:40
  • Thank you. I was wondering if there were scenarios where WPScan might produce different results if ran from different places. You answered my question. – Alexander Kleinhans May 27 '15 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.