Hands-On Web Penetration Testing with Metasploit

WordPress enumeration using Metasploit

The following are the attack surfaces where you can focus your enumeration time:

• Usernames
• Themes
• Plugins

Using the Metasploit module, auxiliary/scanner/http/wordpress_login_enum, follow these steps:

1. You can try to brute-force the username or you can enumerate the username:

2. Let's set the options just to enumerate the username and run the module:

3. You can now try brute-forcing using a dictionary. The default options for the module enable it to perform a brute-force attack:

4. Let's set the options ...