If you were able to find that your target has a website, and this website uses WordPress as its content
management system, then you can use a tool like WP scan.
WP scan is a security scanner used by ethical hackers, penetration testers and security analysts,
which is used to identify attack vectors of WordPress sites.
You can expect finding information like plugins, names, themes, usernames, and more.
So the first thing you want to do is to go to your Osint virtual machine and then run terminal as root.
So I'm going to say Osint, and then I'm going to install the tool by typing apt install and then WP
scan, and then hit enter and then type Y to continue and hit enter again.
Now sometimes the installation is going to suck.
So what I always like to do is just to hold the Ctrl and C keys to cancel the process, and then use
the exact same command again, and then hit enter.
And now it's going to continue.
So now the tool is installed on our Linux machine.
Now I'm going to run this tool.
So using this tool is very simple.
You just have to type WP scan like this.
And then minus H to see all the options that you can use with this tool.
And we can see that there are plenty of options that we can use.
In my case, I always like to use the enumeration option, which will allow me to extract information
from a WordPress website.
And I always like to find the people who are running this website or who are using this website, because
I might be able to find usernames and then use a website like what's My Name?
Or a tool like Sherlock to identify whether this username has other accounts on the internet.
So the main option that you always need to use is the URL.
So I'm going to say AWP scan minus minus URL.
And then I'm going to say cyber pseudo.org.
So we are going to assume that your target has this website.
And you would like to gather information from this website.
So I'm going to hit enter.
And now the scan is completed let's have a look at the information.
So here we can see the plugins that are installed on this website.
We can see a plugin called WP Security Hardening.
And we can see that this tool is up to date.
Now let me scroll up.
We can see that there is another plugin called tutor.
And you can always go to Google and search for these plugins to get more information about plugins that
are installed.
Now let me scroll up again.
Here are all the plugins that are installed.
We can also see when was the last time this plugin was updated, and sometimes you will see that a plugin
is out of date, which might be an attack vector for a penetration tester.
And here you can see the WordPress theme that I'm using.
So it's called Sy ARP.
And we can see the name of the author.
We can also scroll up and see more information, like a URL to register on this website, which might
reveal additional website if you were logged in to this website.
Now, one of my favorite options that I always like to use with WordPress is an option called enumerate.
And with this option you can find information about vulnerable plugins, popular plugins, time thumbs,
config backups or user IDs.
And for me this is very important.
So let's try using this switch.
So I'm going to use the exact same command that I've used before, and then add minus e and then U to
find the users that are running this website or publishing on this website.
And now the scan is completed and we can see that these users has been identified.
So we can see a user name called Satyaraj.
So what I can do with this information is that I can go to blackboard or what's my name, or use a tool
like Sherlock to find whether this user name has been used online or not.
We can also find the name Satyaraj in the RSS feed.
Now, sometimes when you use this tool, you might get an error code, and the only way to bypass this
is by using an option called random user agent, which will generate a new user agent for you and use
it to gather information about a specific website.