WPHardening - WPHardening fortification is a security tool for WordPress

WPHardening is a security tool for WordPress. Different tools to hardening WordPress.

Usage

$ python wphardening.py -h 
Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -v, --verbose         Active verbose mode output results
  --update              Check for WPHardening latest stable version

  Target:
    This option must be specified to modify the package WordPress.

    -d DIRECTORY, --dir=DIRECTORY
                        **REQUIRED** - Working Directory.

  Hardening:
    Different tools to hardening WordPress.

    -c, --chmod         Chmod 755 in directory and 644 in files.
    -r, --remove        Remove files and directory.
    -b, --robots        Create file robots.txt
    -f, --fingerprinting
                        Deleted fingerprinting WordPress.
    -t, --timthumb      Find the library TimThumb.
    --wp-config         Wizard generated wp-config.php
    --delete-version    Deleted version WordPress.
    --plugins           Download Plugins Security.
    --proxy=PROXY       Use a HTTP proxy to connect to the target url for
                        --plugins and --wp-config.
    --indexes           It allows you to display the contents of directories.

  Miscellaneous:
    -o FILE, --output=FILE
                        Write log report to FILE.log

Examples

Check a WordPress Project

$ python wphardening.py -d /home/path/wordpress -v

Change permissions

$ python wphardening.py -d /home/path/wordpress --chmod -v

Remove files that are not used

$ python wphardening.py -d /home/path/wordpress --remove -v

Create your robots.txt file

$ python wphardening.py -d /home/path/wordpress --robots -v

Remove all fingerprinting

$ python wphardening.py -d /home/path/wordpress --fingerprinting -v

Check a TimThumb library

$ python wphardening.py -d /home/path/wordpress --timthumb -v

Create Index file

$ python wphardening.py -d /home/path/wordpress --indexes -v

Download Plugins security

$ python wphardening.py -d /home/path/wordpress --plugins

Wizard generated wp-config.php

$ python wphardening.py -d /home/path/wordpress --wp-config

Deleted version WordPress

$ python wphardening.py -d /home/path/wordpress --delete-version -v

WPHardening update

$ python wphardening.py --update

Use all options

$ python wphardening.py -d /home/user/wordpress -c -r -f -t --wp-config --delete-version --indexes --plugins -o /home/user/wphardening.log

Download WPHardening

Read More

wpbf - WordPress Brute Force

The script will try to login into the WordPress dashboard through the login form using a mixture of enumerated usernames, a wordlist and relevant keywords from the blog's content. If a single username is given, the script will not search for additional usernames.

When a correct username/passwords matchs, it will be logged and show on the standard output.

For faster results you can spawn threads but BE CAREFULL not to flood/DoS the site. Default settings can be changed in "config.py" and "logging.conf" files.

The wordlist must have one entry per line, a small wordlist (wordlist.txt) and plugin list (plugins.txt) are provided for testing purposes.

Features

• Username enumeration and detection (TALSOFT-2011-0526, Author's archive page and content parsing)
• Threads
• Use keywords from blog's content in the wordlist
• HTTP Proxy Support
• Basic WordPress fingerprint (version and full path)
• Advance plugins fingerprint (bruteforce, discovery and version/documentation)
• Detection of Login LockDown plugin (this plugin makes the bruteforce useless)
• Advanced logging using Python's logging library and logging configuration file

Usage

Basic

In this example, wpbf will do a bruteforce test using the default settings (you can change the default settings in config.py). It will enumerate usernames, find keywords and plugins, use the static+generated wordlist to bruteforce each user and try to guess remote path:

$ ./wpbf.py http://localhost/wordpress/
2012-02-26 14:26:18,793 - INFO - Target URL: http://localhost/wordpress/
2012-02-26 14:26:18,844 - INFO - Checking URL and username...
2012-02-26 14:26:18,845 - INFO - Enumerating users...
2012-02-26 14:26:52,027 - INFO - Usernames: admin, test, guest
2012-02-26 14:26:54,153 - INFO - 31 plugins will be tested
2012-02-26 14:26:55,311 - INFO - 215 passwords will be tested
2012-02-26 14:26:55,369 - INFO - Starting workers...
2012-02-26 14:26:56,685 - INFO - WordPress version: 3.0.1
2012-02-26 14:26:57,570 - INFO - WordPress path in server: /var/www/wordpress/
2012-02-26 14:27:08,624 - INFO - Plugin 'akismet' was found
2012-02-26 14:27:10,292 - INFO - Plugin 'akismet' version: 2.5.5 (more info @ http://localhost/wordpress/wp-content/plugins/akismet/readme.txt)
221 tasks left / 2.1 tasks per second / 1.76min left
199 tasks left / 2.2 tasks per second / 1.51min left
172 tasks left / 2.7 tasks per second / 1.06min left
21 tasks left / 1.6 tasks per second / 0.22min left
2012-02-26 14:57:23,245 - INFO - Password 'qawsed' found for username 'admin' on http://localhost/wordpress/wp-login.php

Username enumeration only

The '-eu' or '--enumerateusers' parameter will only do username enumeration and list the usernames found

$ ./wpbf.py -eu http://www.mysite.com/blog/

Aggresive

You can spawn more threads to speed up the bruteforce process. Be aware that using a lot of threads can cause hangs in the server or denial of service. For this example we will spawn 23 threads:

$ ./wpbf.py -t 23 http://www.mysite.com/blog/

Custom

Using username 'john', not using keywords in the blog content for the wordlist and trough a local proxy:

$ ./wpbf.py --nokeywords -u john -p http://localhost:8008/ http://www.mysite.com/blog/

Download wpbf

Read More

WPScan - WordPress Security Scanner

WPScan is a black box WordPress vulnerability scanner.

Features

• Username enumeration (from author querystring and location header)
• Weak password cracking (multithreaded)
• Version enumeration (from generator meta tag and from client side files)
• Vulnerability enumeration (based on version)
• Plugin enumeration (2220 most popular by default)
• Plugin vulnerability enumeration (based on plugin name)
• Plugin enumeration list generation
• Other misc WordPress checks (theme name, dir listing, …)

Prerequisites:

• Windows not supported
• Ruby >= 1.9.2 – Recommended: 1.9.3
• Curl >= 7.21 – Recommended: latest – FYI the 7.29 has a segfault
• RubyGems – Recommended: latest
• Git

Changelog v2.4

New

• ‘–batch’ switch option added – Fix #454
• Add random-agent
• Added more CLI options
• Switch over to nist – Fix #301
• New choice added when a redirection is detected – Fix #438

Removed

• Removed ‘Total WordPress Sites in the World’ counter from stats
• Old wpscan repo links removed – Fix #440
• Fingerprinting Dev script removed
• Useless code removed

General core

• Rspecs update
• Forcing Travis notify the team
• Ruby 2.1.1 added to Travis
• Equal output layout for interaction questions
• Only output error trace if verbose if enabled
• Memory improvements during wp-items enumerations
• Fixed broken link checker, fixed some broken links
• Couple more 404s fixed
• Themes & Plugins list updated

WordPress Fingerprints

• WP 3.8.2 & 3.7.2 Fingerprints added – Fix #448
• WP 3.8.3 & 3.7.3 fingerprints
• WP 3.9 fingerprints

Fixed issues

• Fix #380 – Redirects in WP 3.6-3.0
• Fix #413 – Check the version of the Timthumbs files found
• Fix #429 – Error WpScan Cache Browser
• Fix #431 – Version number comparison between ’2.3.3′ and ’0.42b’
• Fix #439 – Detect if the target goes down during the scan
• Fix #451 – Do not rely only on files in wp-content for fingerprinting
• Fix #453 – Documentation or inplemention of option parameters
• Fix #455 – Fails with a message if the target returns a 403 during the wordpress check

Vulnerabilities

• Update WordPress Vulnerabilities
• Fixed some duplicate vulnerabilities

WPScan Database Statistics:

• Total vulnerable versions: 79; 1 is new
• Total vulnerable plugins: 748; 55 are new
• Total vulnerable themes: 292; 41 are new
• Total version vulnerabilities: 617; 326 are new
• Total plugin vulnerabilities: 1162; 146 are new
• Total theme vulnerabilities: 330; 47 are new

Download WPScan

Read More

[Gojira] Herramienta para facilitar las auditorías en entornos WordPress

Gojira es una herramienta para facilitar las auditorías en entornos WordPress. Está en pañales todavía ;). Por ahora:

• -Permite crear un diccionario con los plugins más populares.
• -Enumera plugins instalados a partir del diccionario.
• -Extrae los usuarios registrados.
• -Deduce la versión del WordPress a través de Readme.html, links del HTML y el meta generator.
• -Comprueba el archivo robots.txt y comprueba cada ruta.

Download Gojira

Read More

[Dumb0] A simple tool to dump users in popular forums and CMS

A simple tool to dump users forums popular forums and CMS like:

• WordPress
• SMF
• vBulletin
• IP Board
• XEN forums
• myBB
• useBB
• vanilla
• bbPress
• etc...

Download Dumb0

Read More

[flunym0us] Vulnerability Scanner for Wordpress and Moodle

Flunym0us is a Vulnerability Scanner for Wordpress and Moodle designed by Flu Project Team.

Flunym0us has been developed in Python. Flunym0us performs dictionary attacks against Web sites. By default, Flunym0us includes a dictionary for Wordpress and other for Moodle.

Operation

Flunym0us requires python.

Arguments allowed:

-h, --help: Show this help message and exit

-wp, --wordpress: Scan WordPress site

-mo, --moodle: Scan Moodle site

-H HOST, --host HOST: Website to be scanned

-w WORDLIST, --wordlist WORDLIST: Path to the wordlist to use

-t TIMEOUT, --timeout TIMEOUT: Connection timeout

-r RETRIES, --retries RETRIES: Connection retries

-p PROCESS, --process PROCESS: Number of process to use

-T THREADS, --threads THREADS: Number of threads (per process) to use

Versions

Flunym0us is distributed under the terms of GPLv3 license

ChangeLog 1.0:

[+] Search Wordpress Plugins

[+] Search Moodle Extensions

ChangeLog 2.0:

[+] http user-agent hijacking

[+] http referer hijacking

[+] Search Wordpress Version

[+] Search Wordpress Latest Version

[+] Search Version of Wordpress Plugins

[+] Search Latest Version of Wordpress Plugins

[+] Search Path Disclosure Vulnerabilities

[+] Search Wordpress Authors  

Download flunym0us

Read More

[WPScan Android] WordPress Security Scanner Android App

WPScan is a black box WordPress Security Scanner written in Ruby which attempts to find known security weaknesses within WordPress installations. Its intended use it to be for security professionals or WordPress administrators to asses the security posture of their WordPress installations.  

  Download: https://play.google.com  or from Github https://github.com

Read More