WordPress Security Test with Nmap NSE Scripts

Periodic security checking, particularly on cloud server is important. Here is how to perform WordPress security test with Nmap NSE scripts. Previously we have some important guides like for brute force vulnerability checking(it is important to read before this guide in case you are completely new). In this guide we are showing quite basic things including installation, reading help of the scripts, running the scripts. NSE script is a big topic and actually it is beyond our capability to go in depth. But knowing and doing these basic operations will help to slowly learn the terminologies and tricks yourself. We are using a Ubuntu server running WordPress for this guide’s examples. Reconnaissance is crucial to a successful penetration test. Without proper reconnaissance, closing an exploit is going to be a guess work.

 

WordPress Security Test with Nmap NSE Scripts

 

Installing Nmap is easy :

You need to locate the nse scripts with locate utility and change directory to the script directory :

You’ll get output like :

Change directory to /usr/share/nmap/scripts/ and do a ls :

In case you want to find WordPress specific nse scrips you can pipe with grep :

You’ll find three files at this moment :

In order to read the help file, you have to run this kind of command :

In most easy simple form you can run the script in this way :

You’ll get this kind of output :

After a time you’ll get the full result :

You can read the official documentation on Nmap WordPress NSE script related pages :

There are other user created scripts like you can see few on GitHub’s this repo :

You’ll see installation of custom Nmap scripts for that repo is written. After test is done, do not keep the scripts on publicly available directory.