OWASP Wordpress Vulnerability Scanner Project - Revision history

Ramadhan: /* Road Map */

2015-12-09T04:02:35Z

‎Road Map

Johanna Curiel at 23:23, 22 June 2015

2015-06-22T23:23:58Z

Johanna Curiel: Replaced content with "=Main=
Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Projec..."

2015-06-21T20:17:42Z

Replaced content with "=Main= <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Projec..."

Johanna Curiel at 20:17, 21 June 2015

2015-06-21T20:17:14Z

Ramadhan: /* Current Features */

2015-06-08T14:48:28Z

‎Current Features

Ramadhan: /* Requirement / Installation */

2015-06-08T13:56:55Z

‎Requirement / Installation

Ramadhan: /* Requirement / Installation */

2015-06-08T13:56:12Z

‎Requirement / Installation

Ramadhan: /* Quick Download */

2015-06-08T13:55:48Z

‎Quick Download

Ramadhan: /* Contributors */

2015-06-05T07:31:56Z

‎Contributors

Ramadhan: /* OWASP Wordpress Vulnerability Scanner Project */

2015-06-04T20:10:53Z

‎OWASP Wordpress Vulnerability Scanner Project

@@ Line 79: / Line 79: @@
 As of now, the priorities are:
 *Rewrite code to be more modular
 *Unit Tests
 *Add Web UI
 *Add custom wordpress directory(wp-content and wp-plugin)
 *Add support for static user agent(currently random)

← Older revision		Revision as of 23:23, 22 June 2015
Line 1:		Line 1:
	=Main=		=Main=

−	<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[~~Image~~:OWASP ~~Inactive Banner~~.jpg\|~~800px~~\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=~~Inactive_Projects~~]] </~~div~~>	+	<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg\|link=]]</div>
		+
		+	{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|-
		+	\| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" \|
		+
		+	==OWASP Wordpress Vulnerability Scanner Project==
		+
		+	A Wordpress Scanner written in PHP, focus on vulnerability assessment and security audit of misconfiguration in the Wordpress installation. Wordpress Scanner is capable of finding the flaw in the Wordpress installation and will provide all the information regarding the vulnerability. Wordpress Scanner is not a tool for code auditing, it performs "black box" scanning for the Wordpress powered web application.
		+
		+	The basic security check will review a WordPress installation for common security related mis-configurations. Testing with the basic check option uses regular web requests. The system downloads a handful of pages from the target site, then performs analysis on the resulting html source.
		+
		+	The more aggressive enumeration option attempts to find all plugins / themes that are being used on the WordPress installation and can attempt to enumerate users of the site. These tests will generate HTTP 404 errors in the web server logs of the target site. If you test all plugins, be warned that this will generate more than 18000 log entries and potentially triggered intrusion prevention measures.
		+
		+	Aggressively discover the WordPress plugins and themes installed on a site. Utilizes a database of over 18000 plugins and 2600 themes during testing. Fingerprint the version of the discovered plugins and themes. This version can be compared against latest releases and known security vulnerabilities.
		+
		+	==Current Features==
		+	The following features are currently available.
		+	* Detect version of wordpress installation
		+	* Detect sensitive file. (eg: readme, database replacing file, etc..)
		+	* Detect enabled feature on installation. (eg: multisite enabled, allow registration, etc..)
		+	* Detect theme name (through passive fingerprinting)
		+	* List of installed plugins (through passive fingerprinting)
		+	* Enumerate Plugins
		+	* Enumerate Themes
		+	* Enumerate Users
		+	* Password auditing
		+
		+	\| valign="top" style="padding-left:25px;width:200px;" \|
		+
		+	== Quick Download ==
		+	*Latest Release @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/releases Stable Release]
		+	*Source Code @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/ Github]
		+
		+	== Project Leader ==
		+	* [https://github.com/RamadhanAmizudin Ramadhan Amizudin]
		+
		+	==Contact Us==
		+	* #owaspmy @ FreeNode
		+	* [https://www.facebook.com/OWASP.Malaysia OWASP Malaysia]
		+
		+	==Licensing==
		+	OWASP Wordpress Scanner is free software: you can redistribute it and/or modify it under the terms of the [http://opensource.org/licenses/MIT MIT License].
		+
		+	==Classifications==
		+
		+	{\| width="200" cellpadding="2"
		+	\|-
		+	\| colspan="2" align="center" \| [[File:Project_Type_Files_TOOL.jpg\|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
		+	\|-
		+	\| align="center" valign="top" width="50%" rowspan="2"\| [[File:Owasp-incubator-trans-85.png\|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects\|Incubator Project]]
		+
		+	\|}
		+	\|}
		+
		+	=Requirement / Installation=
		+
		+	'''Requirement'''
		+	* PHP >= 5.3
		+	* PHP cURL Extension
		+	* PHP JSON Extension
		+	* PHP OpenSSL Extension (HTTPS Support)
		+
		+	'''Installation'''
		+
		+	*Download from repo: <tt>git clone https://github.com/RamadhanAmizudin/Wordpress-scanner.git</tt>
		+	*And run <tt>php app.php -h</tt>
		+
		+	= Acknowledgements =
		+	==Contributors==
		+	*[https://github.com/mokhdzanifaeq/ Mokhdzani Faeq] - Multi-thread support for plugin enumeration.
		+	*[https://github.com/d0lph1n98 Fakhri Zulkifli]
		+	*[https://github.com/nawawi Nawawi Jamili] - Code Enhancement.
		+	*Big thanks to WPScan.org team for providing plugin/theme/version vulnerability database - WPScan.org
		+
		+	= Road Map and Getting Involved =
		+	===Road Map===
		+	As of now, the priorities are:
		+	*Rewrite code to be more modular
		+	*Change to script argument instead of user input for scan options.
		+	*Unit Tests
		+	*Add Proxy Support
		+	*Add Web UI
		+	*Add Password audit support
		+	*Add custom wordpress directory(wp-content and wp-plugin)
		+	*Add support for static user agent(currently random)
		+	*Vulnerability Database (currently using https://wpvulndb.com)
		+
		+	__NOTOC__ <headertabs />
		+
		+	[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]

← Older revision		Revision as of 20:17, 21 June 2015
Line 2:		Line 2:

	<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[Image:OWASP Inactive Banner.jpg\|800px\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] </div>		<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[Image:OWASP Inactive Banner.jpg\|800px\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] </div>
−
−	~~{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|-~~
−	~~\| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" \|~~
−
−	~~==OWASP Wordpress Vulnerability Scanner Project==~~
−
−	A Wordpress Scanner written in PHP, focus on vulnerability assessment and security audit of misconfiguration in the Wordpress installation. Wordpress Scanner is capable of finding the flaw in the Wordpress installation and will provide all the information regarding the vulnerability. Wordpress Scanner is not a tool for code auditing, it performs "black box" scanning for the Wordpress powered web application.
−
−	The basic security check will review a WordPress installation for common security related mis-configurations. Testing with the basic check option uses regular web requests. The system downloads a handful of pages from the target site, then performs analysis on the resulting html source.
−
−	The more aggressive enumeration option attempts to find all plugins / themes that are being used on the WordPress installation and can attempt to enumerate users of the site. These tests will generate HTTP 404 errors in the web server logs of the target site. If you test all plugins, be warned that this will generate more than 18000 log entries and potentially triggered intrusion prevention measures.
−
−	Aggressively discover the WordPress plugins and themes installed on a site. Utilizes a database of over 18000 plugins and 2600 themes during testing. Fingerprint the version of the discovered plugins and themes. This version can be compared against latest releases and known security vulnerabilities.
−
−	~~==Current Features==~~
−	~~The following features are currently available.~~
−	* Detect version of wordpress installation
−	* Detect sensitive file. (eg: readme, database replacing file, etc..)
−	* Detect enabled feature on installation. (eg: multisite enabled, allow registration, etc..)
−	* Detect theme name (through passive fingerprinting)
−	* List of installed plugins (through passive fingerprinting)
−	* Enumerate Plugins
−	* Enumerate Themes
−	* Enumerate Users
−	* Password auditing
−
−	~~\| valign="top" style="padding-left:25px;width:200px;" \|~~
−
−	~~== Quick Download ==~~
−	*Latest Release @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/releases Stable Release]
−	*Source Code @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/ Github]
−
−	~~== Project Leader ==~~
−	* [https://github.com/RamadhanAmizudin Ramadhan Amizudin]
−
−	~~==Contact Us==~~
−	* #owaspmy @ FreeNode
−	* [https://www.facebook.com/OWASP.Malaysia OWASP Malaysia]
−
−	~~==Licensing==~~
−	~~OWASP Wordpress Scanner is free software: you can redistribute it and/or modify it under the terms of the [http://opensource.org/licenses/MIT MIT License].~~
−
−	~~==Classifications==~~
−
−	~~{\| width="200" cellpadding="2"~~
−	\|-
−	~~\| colspan="2" align="center" \| [[File:Project_Type_Files_TOOL.jpg\|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]~~
−	\|-
−	~~\| align="center" valign="top" width="50%" rowspan="2"\| [[File:Owasp-incubator-trans-85.png\|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects\|Incubator Project]]~~
−
−	\|}
−	\|}
−
−	~~=Requirement / Installation=~~
−
−	~~'''Requirement'''~~
−	* PHP >= 5.3
−	* PHP cURL Extension
−	* PHP JSON Extension
−	* PHP OpenSSL Extension (HTTPS Support)
−
−	~~'''Installation'''~~
−
−	*Download from repo: <tt>git clone https://github.com/RamadhanAmizudin/Wordpress-scanner.git</tt>
−	*And run <tt>php app.php -h</tt>
−
−	~~= Acknowledgements =~~
−	~~==Contributors==~~
−	*[https://github.com/mokhdzanifaeq/ Mokhdzani Faeq] - Multi-thread support for plugin enumeration.
−	*[https://github.com/d0lph1n98 Fakhri Zulkifli]
−	*[https://github.com/nawawi Nawawi Jamili] - Code Enhancement.
−	*Big thanks to WPScan.org team for providing plugin/theme/version vulnerability database - WPScan.org
−
−	~~= Road Map and Getting Involved =~~
−	~~===Road Map===~~
−	~~As of now, the priorities are:~~
−	*Rewrite code to be more modular
−	*Change to script argument instead of user input for scan options.
−	*Unit Tests
−	*Add Proxy Support
−	*Add Web UI
−	*Add Password audit support
−	*Add custom wordpress directory(wp-content and wp-plugin)
−	*Add support for static user agent(currently random)
−	*Vulnerability Database (currently using https://wpvulndb.com)
−
−	~~__NOTOC__ <headertabs />~~
−
−	~~[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]]~~

@@ Line 1: / Line 1: @@
 =Main=
-<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
+<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] </div>
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-

@@ Line 26: / Line 26: @@
 * Enumerate Themes
 * Enumerate Users
 | valign="top"  style="padding-left:25px;width:200px;" |

← Older revision		Revision as of 13:56, 8 June 2015
Line 65:		Line 65:

	*Download from repo: <tt>git clone https://github.com/RamadhanAmizudin/Wordpress-scanner.git</tt>		*Download from repo: <tt>git clone https://github.com/RamadhanAmizudin/Wordpress-scanner.git</tt>
		+	*And run <tt>php app.php -h</tt>

	= Acknowledgements =		= Acknowledgements =

@@ Line 30: / Line 30: @@
 == Quick Download ==
-*Latest Release @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/releases Wordpress-Scanner Stable]
+*Latest Release @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/releases Stable Release]
-*Source Code @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/ Wordpress-Scanner on Github]
+*Source Code @ [https://github.com/RamadhanAmizudin/Wordpress-scanner/ Github]
 == Project Leader ==

@@ Line 70: / Line 70: @@
 ==Contributors==
 *[https://github.com/mokhdzanifaeq/ Mokhdzani Faeq] - Multi-thread support for plugin enumeration.
 *[https://github.com/nawawi Nawawi Jamili] - Code Enhancement.
 *Big thanks to WPScan.org team for providing plugin/theme/version vulnerability database - WPScan.org

← Older revision		Revision as of 20:10, 4 June 2015
Line 9:		Line 9:

	A Wordpress Scanner written in PHP, focus on vulnerability assessment and security audit of misconfiguration in the Wordpress installation. Wordpress Scanner is capable of finding the flaw in the Wordpress installation and will provide all the information regarding the vulnerability. Wordpress Scanner is not a tool for code auditing, it performs "black box" scanning for the Wordpress powered web application.		A Wordpress Scanner written in PHP, focus on vulnerability assessment and security audit of misconfiguration in the Wordpress installation. Wordpress Scanner is capable of finding the flaw in the Wordpress installation and will provide all the information regarding the vulnerability. Wordpress Scanner is not a tool for code auditing, it performs "black box" scanning for the Wordpress powered web application.
		+
		+	The basic security check will review a WordPress installation for common security related mis-configurations. Testing with the basic check option uses regular web requests. The system downloads a handful of pages from the target site, then performs analysis on the resulting html source.
		+
		+	The more aggressive enumeration option attempts to find all plugins / themes that are being used on the WordPress installation and can attempt to enumerate users of the site. These tests will generate HTTP 404 errors in the web server logs of the target site. If you test all plugins, be warned that this will generate more than 18000 log entries and potentially triggered intrusion prevention measures.
		+
		+	Aggressively discover the WordPress plugins and themes installed on a site. Utilizes a database of over 18000 plugins and 2600 themes during testing. Fingerprint the version of the discovered plugins and themes. This version can be compared against latest releases and known security vulnerabilities.

	==Current Features==		==Current Features==

OWASP Wordpress Vulnerability Scanner Project - Revision history

Ramadhan: /* Road Map */

Johanna Curiel at 23:23, 22 June 2015

Johanna Curiel: Replaced content with "=Main= Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Projec..."

Johanna Curiel at 20:17, 21 June 2015

Ramadhan: /* Current Features */

Ramadhan: /* Requirement / Installation */

Ramadhan: /* Requirement / Installation */

Ramadhan: /* Quick Download */

Ramadhan: /* Contributors */

Ramadhan: /* OWASP Wordpress Vulnerability Scanner Project */

Johanna Curiel: Replaced content with "=Main=
Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Projec..."