The best way to determine if your web site has built in vulnerabilities that an attacker could exploit is to hack your website yourself. This is not typically a do-it-yourself project, unless you have some decent technical skills. But with a little time and a few free downloadable tools, it could be something you could try, if for no other reason than to learn how easy this can be. This type of website penetration testing is used to find unpatched vulnerabilities, test the security of web applications, and meet regulatory compliance requirements
A good way to start is to scan your website using WPScan. WPScan is a black box vulnerability scanner for WordPress written in PHP. It is installed in Kali Linux, and other security distros, or can be downloaded from Git Hub for installation in your preferred distro. WPScan searches for version information on installations of Apache Web Server, WordPress, WordPress themes, and plugins. WPScan uses a database of 18,000 plugins and 2600 themes during scanning the target to find outdated versions and vulnerabilities. WPScan can:
- Detect a version of currently installed WordPress.
- Detect enabled features on currently installed WordPress.
- Enumerate theme version and name.
- Detect installed plugins and can tell you if it is outdated or not.
- Enumerate user names also.
- Detect sensitive files like readme, robots.txt, database replacing files, etc.
Once you have a list of vulnerabilities at hand, you can use Metaploit to find exploits that would work against them. From Metasploit you could run Meterpreter in order to spawn a terminal or shell session, and launch pass the hash tool like Mimikatz. From here you could:
These techniques are available to potential attackers as well. The quick fix to any vulnerabilities you discover is to update your Apache, WordPress, plugin, and theme versions to the latest release. Once you have upgraded everything, run another scan to see if an vulnerabities remain.
- How to hack into a WordPress website, the complete guide 30th May 2016 Ogi Djuraskovic
- WordPress Penetration Testing using WPScan & Metasploit Raj Chandel 9-27-2017