Welcome to the WP Enumeration Tool! This Python script is designed to help security researchers and developers identify potential vulnerabilities in WordPress sites by enumerating users, checking for accessible files, and testing various endpoints. π
- User Enumeration: Discover WordPress users through the REST API and individual user endpoints.
- Admin Login Check: Verify the existence of common WordPress login paths.
- Uploads Accessibility Check: Check if the
wp-content/uploadsdirectory is accessible. - XML-RPC Testing: Test for the presence of
xmlrpc.phpfor potential pingback and brute force attacks. - Configuration File Check: Attempt to download sensitive configuration files like
wp-config.php. - oEmbed Proxy Check: Test for SSRF vulnerabilities via the oEmbed proxy.
- Python 3.x
requestslibrary (install viapip install requests)
- Clone the repository:
git clone https://github.com/ace-83/simple-wp-checker.git cd simple-wp-checker
Create a domains.txt file and list the domains you want to test, one per line.