Brute-force password auditing WordPress installations
WordPress is a widely known CMS (Content Management System) that is used in many industries. Nmap now includes its own NSE script to help pentesters launch dictionary attacks and find accounts using weak passwords that could compromise the application's integrity.
This recipe shows how to perform brute force password auditing against WordPress installations.
How to do it...
To find accounts with weak passwords in WordPress installations, use the following Nmap command:
$ nmap -p80 --script http-wordpress-brute <target>
All of the valid accounts that were found will be shown in the results:
PORT STATE SERVICE REASON 80/tcp open http syn-ack | http-wordpress-brute: | Accounts | papa:a1b2c3d4 => ...