Hands-On Bug Hunting for Penetration Testers

Technical Requirements

In this section, we'll be working with Burp and some of its extensions to set up KCV detection automatically. We'll also be relying on our usual browser setup to act as the Burp proxy. We'll also be using WPScan as both a CLI and a Burp extension.

The WPScan CLI comes with a variety of install options. Once again, we'll be using the container software Docker to download and run the wpscan CLI from within the context of a custom execution context packaged with everything it needs. Docker allows us to port this workflow anywhere we can install Docker, meaning that we don't need to worry about OS-specific behavior. And because Docker caches the WPScan CLI image, we can use it with only a marginal performance hit over a ...