Millionen von Websites werden mit WordPress betrieben und belegen mit ca. 62% des Marktanteils in der CMS-Welt die Nummer eins. Vor 6 Jahren hatte ich hier schon mal berichtet, wie WPScan mit Kali Linux genutzt werden kann. Dort ist es schon vorinstalliert. Aber man kann es auch auf einem Debian Linux auf einen Raspberry Pi installieren und laufen lassen.
Hier mal ein Beispiel auf einem Pi Zero. Es gibt kein Package für wpscan. Aber es läuft unter Ruby, und das kann man leicht installieren.
Also wer ein WordPress am laufen hat, könnte seine eigene (und nur die!) Installation auf Lücken überprüfen, und nicht nur das. WPScan ist eine kostenlose Software, mit der die sicherheitsrelevanten Probleme auf einer WordPress-Site identifiziert werden können. WPScan kann ua.:
- Die verwendete WP Version ausgeben
- Alle installierten Plugins listen
- Alle installierten Themen listen
- Verzeichnis Listing
- WP Versions ausgabe
- Bruce force Usernamen, alle User Listen
- Suchen nach vergessene Backups
- DB dumps
- Media Dateien listen
- Sicherheitslücken ausgeben
- …
Die Installation kann in ca. 1 Stunde wie folgt durchgeführt werden:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
sudo apt update sudo apt upgrade // alle nötigen Abhängigkeiten und ruby installieren sudo apt install build-essential libcurl4-openssl-dev libxml2 libxml2-dev libxslt1-dev ruby-dev libgmp-dev zlib1g-dev ruby // mit gem wpscann installieren sudo gem install wpscan // und noch ein update, um die aktuellste Version 3.8.18 zu erhalten wpscan --update // check, ausgeben aller Befehle: wpscan --help |
Ergebnis:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 |
_______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.18 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ Usage: wpscan [options] --url URL The URL of the blog to scan Allowed Protocols: http, https Default Protocol if none provided: http This option is mandatory unless update or help or hh or version is/are supplied -h, --help Display the simple help and exit --hh Display the full help and exit --version Display the version and exit --ignore-main-redirect Ignore the main redirect (if any) and scan the target url -v, --verbose Verbose mode --[no-]banner Whether or not to display the banner Default: true --max-scan-duration SECONDS Abort the scan if it exceeds the time provided in seconds -o, --output FILE Output to FILE -f, --format FORMAT Output results in the format supplied Available choices: cli-no-color, cli, json, cli-no-colour --detection-mode MODE Default: mixed Available choices: mixed, passive, aggressive --scope DOMAINS Comma separated (sub-)domains to consider in scope. Wildcard(s) allowed in the trd of valid domains, e.g: *.target.tld Separator to use between the values: ',' --user-agent, --ua VALUE --headers HEADERS Additional headers to append in requests Separator to use between the headers: '; ' Examples: 'X-Forwarded-For: 127.0.0.1', 'X-Forwarded-For: 127.0.0.1; Another: aaa' --vhost VALUE The virtual host (Host header) to use in requests --random-user-agent, --rua Use a random user-agent for each scan --user-agents-list FILE-PATH List of agents to use with --random-user-agent Default: /var/lib/gems/2.5.0/gems/cms_scanner-0.13.5/app/user_agents.txt --http-auth login:password -t, --max-threads VALUE The max threads to use Default: 5 --throttle MilliSeconds Milliseconds to wait before doing another web request. If used, the max threads will be set to 1. --request-timeout SECONDS The request timeout in seconds Default: 60 --connect-timeout SECONDS The connection timeout in seconds Default: 30 --disable-tls-checks Disables SSL/TLS certificate verification, and downgrade to TLS1.0+ (requires cURL 7.66 for the latter) --proxy protocol://IP:port Supported protocols depend on the cURL installed --proxy-auth login:password --cookie-string COOKIE Cookie string to use in requests, format: cookie1=value1[; cookie2=value2] --cookie-jar FILE-PATH File to read and write cookies Default: /tmp/wpscan/cookie_jar.txt --cache-ttl TIME_TO_LIVE The cache time to live in seconds Default: 600 --clear-cache Clear the cache before the scan --cache-dir PATH Default: /tmp/wpscan/cache --server SERVER Force the supplied server module to be loaded Available choices: apache, iis, nginx --force Do not check if the target is running WordPress or returns a 403 --[no-]update Whether or not to update the Database --api-token TOKEN The WPScan API Token to display vulnerability data, available at https://wpscan.com/profile --wp-content-dir DIR The wp-content directory if custom or not detected, such as "wp-content" --wp-plugins-dir DIR The plugins directory if custom or not detected, such as "wp-content/plugins" --interesting-findings-detection MODE Use the supplied mode for the interesting findings detection. Available choices: mixed, passive, aggressive --wp-version-all Check all the version locations --wp-version-detection MODE Use the supplied mode for the WordPress version detection, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --main-theme-detection MODE Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive -e, --enumerate [OPTS] Enumeration Process Available Choices: vp Vulnerable plugins ap All plugins p Popular plugins vt Vulnerable themes at All themes t Popular themes tt Timthumbs cb Config backups dbe Db exports u User IDs range. e.g: u1-5 Range separator to use: '-' Value if no argument supplied: 1-10 m Media IDs range. e.g m1-15 Note: Permalink setting must be set to "Plain" for those to be detected Range separator to use: '-' Value if no argument supplied: 1-100 Separator to use between the values: ',' Default: All Plugins, Config Backups Value if no argument supplied: vp,vt,tt,cb,dbe,u,m Incompatible choices (only one of each group/s can be used): - vp, ap, p - vt, at, t --exclude-content-based REGEXP_OR_STRING Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration. Both the headers and body are checked. Regexp delimiters are not required. --plugins-list LIST List of plugins to enumerate Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt' --plugins-detection MODE Use the supplied mode to enumerate Plugins. Default: passive Available choices: mixed, passive, aggressive --plugins-version-all Check all the plugins version locations according to the choosen mode (--detection-mode, --plugins-detection and --plugins-version-detection) --plugins-version-detection MODE Use the supplied mode to check plugins' versions. Default: mixed Available choices: mixed, passive, aggressive --plugins-threshold THRESHOLD Raise an error when the number of detected plugins via known locations reaches the threshold. Set to 0 to ignore the threshold. Default: 100 --themes-list LIST List of themes to enumerate Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt' --themes-detection MODE Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --themes-version-all Check all the themes version locations according to the choosen mode (--detection-mode, --themes-detection and --themes-version-detection) --themes-version-detection MODE Use the supplied mode to check themes versions instead of the --detection-mode or --themes-detection modes. Available choices: mixed, passive, aggressive --themes-threshold THRESHOLD Raise an error when the number of detected themes via known locations reaches the threshold. Set to 0 to ignore the threshold. Default: 20 --timthumbs-list FILE-PATH List of timthumbs' location to use Default: /home/pi/.wpscan/db/timthumbs-v3.txt --timthumbs-detection MODE Use the supplied mode to enumerate Timthumbs, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --config-backups-list FILE-PATH List of config backups' filenames to use Default: /home/pi/.wpscan/db/config_backups.txt --config-backups-detection MODE Use the supplied mode to enumerate Config Backups, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --db-exports-list FILE-PATH List of DB exports' paths to use Default: /home/pi/.wpscan/db/db_exports.txt --db-exports-detection MODE Use the supplied mode to enumerate DB Exports, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --medias-detection MODE Use the supplied mode to enumerate Medias, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --users-list LIST List of users to check during the users enumeration from the Login Error Messages Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt' --users-detection MODE Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode. Available choices: mixed, passive, aggressive --exclude-usernames REGEXP_OR_STRING Exclude usernames matching the Regexp/string (case insensitive). Regexp delimiters are not required. -P, --passwords FILE-PATH List of passwords to use during the password attack. If no --username/s option supplied, user enumeration will be run. -U, --usernames LIST List of usernames to use during the password attack. Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt' --multicall-max-passwords MAX_PWD Maximum number of passwords to send by request with XMLRPC multicall Default: 500 --password-attack ATTACK Force the supplied attack to be used rather than automatically determining one. Available choices: wp-login, xmlrpc, xmlrpc-multicall --login-uri URI The URI of the login page if different from /wp-login.php --stealthy Alias for --random-user-agent --detection-mode passive --plugins-version-detection passive |
Dann mal ein erster Scann:
wpscan –url http(s)://EIGENE.DOMAINE -e
Das kann dann einige Minuten dauern (in diesem Fall 5 Minuten), bis alle Checks durch sind, hier mal ein paar Auszüge:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
... Interesting Finding(s): [+] Headers | Interesting Entries: | - Server: Apache/2.4.48 (Unix) | - X-Powered-By: PHP/7.4.22 | - WPO-Cache-Status: cached | Found By: Headers (Passive Detection) | Confidence: 100% // man bekommt die Server und PHP Version ... [+] WordPress version 5.8.1 identified (Latest, released on 2021-09-09). | Found By: Emoji Settings (Passive Detection) | - http://wenzlaff.info/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.8.1' | Confirmed By: Meta Generator (Passive Detection) | - http://../, Match: 'WordPress 5.8.1' // man bekommt die WP Version ... [+] Enumerating Vulnerable Plugins (via Passive Methods) [i] No plugins Found. [+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods) Checking Known Locations - Time: 00:00:10 <===================================================================================================> (357 / 357) 100.00% Time: 00:00:10 [i] No themes Found. [+] Enumerating Timthumbs (via Passive and Aggressive Methods) Checking Known Locations - Time: 00:01:05 <===================================================================================== > (2253 / 2568) 87.73% ETA: 00:00: [+] Enumerating Config Backups (via Passive and Aggressive Methods) Checking Config Backups - Time: 00:00:06 <====================================================================================================> (137 / 137) 100.00% Time: 00:00:06 [i] No Config Backups Found. [+] Enumerating DB Exports (via Passive and Aggressive Methods) Checking DB Exports - Time: 00:00:02 <==========================================================================================================> (71 / 71) 100.00% Time: 00:00:02 [i] No DB Exports Found. [+] Enumerating Medias (via Passive and Aggressive Methods) (Permalink setting must be set to "Plain" for those to be detected) Brute Forcing Attachment IDs - Time: 00:00:22 <===============================================================================================> (100 / 100) 100.00% Time: 00:00:22 [i] No Medias Found. [+] Enumerating Users (via Passive and Aggressive Methods) ... [+] Finished: ... [+] Requests Done: 3314 [+] Cached Requests: 34 [+] Data Sent: 923.226 KB [+] Data Received: 9.917 MB [+] Memory used: 223 MB [+] Elapsed time: 00:05:39 |
Wer nur die Plugins überprüfen will, kann auch schnell (1-2 Minuten) den Parameter -e vp (Vulnerable plugins) aufrufen:
wpscan –url http(s)://EIGENE.DOMAINE -e vp
Weitere Infos in engl. gibt es im Handbuch oder hier und auch eine DB mit Fehlerbeschreibung. Dazu muss ein Api-Key auf erstellt werden. Für 25 Aufrufe ist das kostenlose. Wer es braucht … Und es gibt auch ein WPScan-Plugin. Wer es braucht …