WPSploit

Aggressive Code Scanner for Wordpress Themes/Plugins

This tool is intended for Penetration Testers who audit WordPress themes or plugins or developers who wish to audit their own WordPress code. This script should be used for learning purposes only. By downloading and running this script you take every responsibility for wrong or illegal uses of it.

For more informations about the vulnerabilities tested click here.

Getting started

Download the code cloning the repository or via wget:

$ git clone https://github.com/m4ll0k/wpsploit.git

or

$ wget https://raw.githubusercontent.com/m4ll0k/wp_sploit/master/wpsploit.py

Usage

Type --help or -h to get the usage information anytime:

 __      ____________  _________       __          __   __  
/  \    /  \______   \/   _____/_____ |  |   ____ |__|_/  |__ 
\   \/\/   /|     ___/\_____  \\____ \|  |  /  _ \|  |_   ___|
 \        / |    |    /        \  |_) |  |_(  (_) )  | |  |
  \__/\  /  |____|   /_______  /   __/|____/\____/|__| |__|
       \/                    \/|__|

Aggressive Code Scanner for WordPress Themes/Plugins

Author: Momo (m4ll0k) Outaadi 
Contributors: Filippo (b4dnewz) Conti

Usage: $ python wpsploit.py <file|dir> 

You can run it against a single file or a directory and it will test for common code vulnerabilities.