85 lines
3.6 KiB
Plaintext
85 lines
3.6 KiB
Plaintext
_______________________________________________________________
|
|
__ _______ _____
|
|
\ \ / / __ \ / ____|
|
|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
|
|
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
|
|
\ /\ / | | ____) | (__| (_| | | | |
|
|
\/ \/ |_| |_____/ \___|\__,_|_| |_|
|
|
|
|
WordPress Security Scanner
|
|
Version 4.1.0
|
|
An Automattic endeavor
|
|
https://automattic.com
|
|
_______________________________________________________________
|
|
|
|
[+] URL: http://10.114.131.91/ [10.114.131.91]
|
|
[+] Started: Tue Oct 13 11:00:34 2026
|
|
[+] Command Line: wpscan --url http://10.114.131.91 -o wpscan_result_1.txt
|
|
[+] Hostname: kali-learning
|
|
|
|
Interesting Finding(s):
|
|
|
|
[+] Headers
|
|
| Interesting Entries:
|
|
| - Server: Apache
|
|
| - X-Mod-Pagespeed: 1.9.32.3-4523
|
|
| Found By: Headers (Passive Detection)
|
|
| Confidence: 100%
|
|
|
|
[+] robots.txt found: http://10.114.131.91/robots.txt
|
|
| Found By: Robots Txt (Aggressive Detection)
|
|
| Confidence: 100%
|
|
|
|
[+] XML-RPC seems to be enabled: http://10.114.131.91/xmlrpc.php
|
|
| Found By: Direct Access (Aggressive Detection)
|
|
| Confidence: 100%
|
|
| References:
|
|
| - http://codex.wordpress.org/XML-RPC_Pingback_API
|
|
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
|
|
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
|
|
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
|
|
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
|
|
|
|
[+] The external WP-Cron seems to be enabled: http://10.114.131.91/wp-cron.php
|
|
| Found By: Direct Access (Aggressive Detection)
|
|
| Confidence: 60%
|
|
| References:
|
|
| - https://www.iplocation.net/defend-wordpress-from-ddos
|
|
| - https://github.com/wpscanteam/wpscan/issues/1299
|
|
|
|
[+] WordPress version 4.3.1 identified (Insecure, released on 2015-09-15).
|
|
| Found By: Emoji Settings (Passive Detection)
|
|
| - http://10.114.131.91/ebac3be.html, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=4.3.1'
|
|
| Confirmed By: Meta Generator (Passive Detection)
|
|
| - http://10.114.131.91/ebac3be.html, Match: 'WordPress 4.3.1'
|
|
|
|
[+] WordPress theme in use: twentyfifteen
|
|
| Location: http://10.114.131.91/wp-content/themes/twentyfifteen/
|
|
| Last Updated: 2026-08-18 10:00pm GMT (1 month ago, per WordPress.org)
|
|
| Active Installs: 60,000 (per WordPress.org)
|
|
| Readme: http://10.114.131.91/wp-content/themes/twentyfifteen/readme.txt
|
|
| [!] The version is out of date, the latest version is 4.2
|
|
| Style URL: http://10.114.131.91/wp-content/themes/twentyfifteen/style.css?ver=4.3.1
|
|
| Style Name: Twenty Fifteen
|
|
| Style URI: https://wordpress.org/themes/twentyfifteen/
|
|
| Description: Our 2015 default theme is clean, blog-focused, and designed for clarity. Twenty Fifteen's simple, st...
|
|
| Author: the WordPress team
|
|
| Author URI: https://wordpress.org/
|
|
|
|
|
| Found By: Css Style In 404 Page (Passive Detection)
|
|
|
|
|
| Version: 1.3 (80% confidence)
|
|
| Found By: Style (Passive Detection)
|
|
| - http://10.114.131.91/wp-content/themes/twentyfifteen/style.css?ver=4.3.1, Match: 'Version: 1.3'
|
|
|
|
[!] No WPScan API Token given, as a result vulnerability data has not been output.
|
|
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
|
|
[+] Finished: Tue Oct 13 11:00:37 2026
|
|
[+] Requests Done: 31
|
|
[+] Cached Requests: 9
|
|
[+] Most response codes received: 404: 14, 200: 13, 500: 2, 302: 1, 403: 1
|
|
[+] Data Sent: 8.3 KB
|
|
[+] Data Received: 232.689 KB
|
|
[+] Memory used: 208.32 MB
|
|
[+] Elapsed time: 00:00:03
|