🔎Part II – Enumeration

Enumeration is the first step after discovery. Once a target is identified as WordPress, the next move is to gather as much information as possible about its version, plugins, themes, users, and configurations. This information helps attackers (and pentesters) plan exploitation attempts.

Keep in mind:

Your site URL: https://[ip-vm]/wordpress/

Admin Panel: https://[ip-vm]/wordpress/wp-admin

---

📌 Fingerprinting WordPress (fingerprinting)

Fingerprinting means detecting whether a website is running WordPress and what version it uses.

Techniques:

1. Look for common paths:

• /wp-login.php

• /wp-admin/

• /wp-content/

• /xmlrpc.php

• /wp-login/

• /wp-admin.php

• /login/

⚠️ Important Note

If you followed my WordPress setup, remember that the admin panel is not located at: https://[VM-IP]/wp-admin

Instead, you must access it through: https://[VM-IP]/wordpress/wp-admin

This is because we installed WordPress inside the /wordpress/ directory rather than the web root.

1. Inspect HTML source code for:

• meta name="generator" content="WordPress x.x.x"

  • Right click on the wordpress site --> inspect --> ctrl+f --> meta

• WordPress-specific CSS/JS paths (e.g., /wp-includes/)

• In the top red box (search bar labeled meta), you can confirm the presence of WordPress.

• In the second red box, you’ll see the /wordpress/ directory, which tells you the site is not in the root folder.

• In the third red box, you can identify the WordPress version, which is useful for enumeration and vulnerability research.

1. Use online services/tools:

• Wappalyzer is a browser extension that helps you quickly identify the technologies used by a website.

  • Detects CMS platforms (e.g., WordPress, Joomla, Drupal).

  • Shows frameworks, JavaScript libraries, analytics tools, and more.

  • Can often reveal the WordPress version, which is valuable during enumeration.

  • Easy to use and highly recommended for both beginners and professionals.

1. Using Nikto

   Nikto is an open-source web server scanner that can help identify WordPress installations and potential vulnerabilities.

   Installation (if not already installed on Kali Linux):

   sudo apt update
   sudo apt install nikto -y

   Basic Usage:

   nikto -h [ip-vm]

Output:

+ Server: Apache/2.4.65 (Debian)
+ /wordpress/wp-content/plugins/akismet/readme.txt: The WordPress Akismet plugin 'Tested up to' version usually matches the WordPress version.
+ /wordpress/wp-links-opml.php: This WordPress script reveals the installed version.
+ /wordpress/wp-admin/: Uncommon header 'x-redirect-by' found, with contents: WordPress.
+ /wordpress/: Drupal Link header found with value: <http://[ip-vm]/wordpress/index.php/wp-json/>; rel="https://api.w.org/". See: https://www.drupal.org/
+ /wordpress/: A Wordpress installation was found.
+ /wordpress/wp-content/uploads/: Directory indexing found.
+ /wordpress/wp-content/uploads/: Wordpress uploads directory is browsable. This may reveal sensitive information.
+ /wordpress/wp-login.php: Wordpress login found.

---

🎨 Finding Themes & Plugins (themes-plugins)

Themes and plugins are often the weakest link in WordPress security. Many vulnerabilities stem not from WordPress Core itself but from outdated or poorly coded themes and plugins. That’s why detecting them during enumeration is so important.

Note for your lab setup: You won’t see any plugins here because we didn’t install any in our WordPress lab environment. In a real-world target, however, plugins are usually present and are prime attack vectors.

🔍 Manual Methods

• Themes usually live in:

  [ip-vm]/wp-content/themes/<theme-name>/
  
  In your lab:
  [ip-vm]/wordpress/wp-content/themes/<theme-name>/

• Plugins usually live in:

  [ip-vm]/wp-content/plugins/<plugin-name>/
  
  In your lab:
  [ip-vm]/wordpress/wp-content/plugins/<plugin-name>/

Example:

curl -s http://target.com/wp-content/themes/ | grep "<title>"

In your lab:
curl -s http://ip-vm]/wp-content/themes/ | grep "<title>"

Page Source Inspection

• Open the website in a browser → right-click → View Source.

• Look for wp-content/plugins/ or wp-content/themes/ references in:

  • CSS/JS includes

  • Image paths

  • Comments left by developers

  

#Plugins
curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/support/article/pages/ | grep -E 'wp-content/plugins/' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2

#Themes
curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-content/themes' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2

Extract Versions from Assets

curl -s https://target.com | grep '?ver='
curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/support/article/pages/ | grep http | grep -E '?ver=' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2

Change "https://wordpress.org/support/article/pages/" to your target.

---

🛠️ WPScan & Other Tools (wpscan-tools)

WPScan is the go-to framework for WordPress enumeration. It leverages a large vulnerability database and makes detection efficient.

🚀 Install WPScan

sudo apt install wpscan

🔧 Basic Usage

wpscan --url http://target.com

• Enumerate Plugins:

  wpscan --url http://target.com --enumerate p

• Enumerate Users:

  wpscan --url http://target.com --enumerate u

Other Useful Tools:

• whatweb → quick tech fingerprinting

• nmap + http-wordpress-enum.nse → plugin/theme enumeration

• gobuster / dirsearch → brute-forcing hidden paths

---

Recommended HTB Boxes for WordPress Enumeration

Blocky

A WordPress instance running on the machine, with accessible directories like /plugins/ for enumeration.

Hint 1

Try harder to search for some username and passwords for SSH with it.

Hint 2

Use wpscan to find username using -e u

Then search harder inside the files in /plugins

Solution

Writeup by 0xdf:

https://0xdf.gitlab.io/2020/06/30/htb-blocky.html

Video by Ippsec:

https://www.youtube.com/watch?v=C2O-rilXA6I

MetaTwo

Features a vulnerable WordPress installation along with a specific vulnerable plugin that you can identify during enumeration.

Hint 1

You have to add the subdomain to /etc/hosts , and only then you will be able to find the site. After enumerate the site.

sudo nano /etc/hosts

#paste in the last line
[HTB - Machine-ip] metapress.htb 

ctrl+x then y (For save it)

Hint 2

Look closer for vulnerable plugin version in the source code.

Solution

Writeup by 0xdf:

https://0xdf.gitlab.io/2023/04/29/htb-metatwo.html

Video by Ippsec:

https://www.youtube.com/watch?v=Alx5KQWq7ZM

Backdoor

A retired HTB machine hosting WordPress. Enumeration tools can reveal key details like user accounts and version numbers.

Hint 1

You have to add the subdomain to /etc/hosts , and only then you will be able to find the site. After enumerate the site.

sudo nano /etc/hosts

#paste in the last line
[HTB - Machine-ip] backdoor.htb

ctrl+x then y (For save it)

Hint 2

Try to use wpsacn more aggresive! check what this flag means --plugins-detection

Solution

Writeup by 0xdf:

https://0xdf.gitlab.io/2022/04/23/htb-backdoor.html

Video by Ippsec:

https://www.youtube.com/watch?v=4zrypJMVWpc