WPScan

What is WPScan?

WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites.

NOTE: You need to provide WPSan with an API Token so that it can look up vulnerabilities infos with https://wpscan.com. Without the token WPScan will only identify WordPress Core / Plugin / Theme versions but not if they are actually vulnerable. You can get a free API Token at by registering for an account at https://wpscan.com. Using the secureCodeBox WPScans you can specify the token via the WPVULNDB_API_TOKEN target attribute, see the example below.

To learn more about the WPScan scanner itself visit wpscan.org.

Deployment

The wpscan chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)
helm upgrade --install wpscan oci://ghcr.io/securecodebox/helm/wpscan

Scanner Configuration

The following security scan configuration example are based on the WPScan Documentation, please take a look at the original documentation for more configuration examples.

• Scan all plugins with known vulnerabilities: wpscan --url example.com -e vp --plugins-detection mixed --api-token WPVULNDB_API_TOKEN
• Scan all plugins in our database (could take a very long time): wpscan --url example.com -e ap --plugins-detection mixed --api-token WPVULNDB_API_TOKEN
• Password brute force attack: wpscan --url example.com -e u --passwords /path/to/password_file.txt
• WPScan keeps a local database of metadata that is used to output useful information, such as the latest version of a plugin. The local database can be updated with the following command: wpscan --update
• When enumerating the WordPress version, installed plugins or installed themes, you can use three different "modes", which are:
  • passive
  • aggressive
  • mixed If you want the most results use the "mixed" mode. However, if you are worried that the server may not be able to handle many requests, use the "passive" mode. The default mode is "mixed", except plugin enumeration, which is "passive". You will need to manually override the plugin detection mode, if you want to use anything other than the default, with the --plugins-detection option.
• WPScan can enumerate various things from a remote WordPress application, such as plugins, themes, usernames, backed up files wp-config.php files, Timthumb files, database exports and more. To use WPScan's enumeration capabilities supply the -e option.

Available Choices:
  vp  |  Vulnerable plugins
  ap  |  All plugins
  p   |  Plugins
  vt  |  Vulnerable themes
  at  |  All themes
  t   |  Themes
  tt  |  Timthumbs
  cb  |  Config backups
  dbe |  Db exports
  u   |  User IDs range. e.g: u1-5
         Range separator to use: '-'
         Value if no argument supplied: 1-10
  m   |  Media IDs range. e.g m1-15
         Note: Permalink setting must be set to "Plain" for those to be detected
         Range separator to use: '-'
         Value if no argument supplied: 1-100

Separator to use between the values: ','
Default: All Plugins, Config Backups
Value if no argument supplied: vp,vt,tt,cb,dbe,u,m
Incompatible choices (only one of each group/s can be used):
  - vp, ap, p
  - vt, at, t

Requirements

Kubernetes: >=v1.11.0-0

Values

Key	Type	Default	Description
cascadingRules.enabled	bool	false	Enables or disables the installation of the default cascading rules for this scanner
imagePullSecrets	list	[]	Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/)
parser.affinity	object	{}	Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/)
parser.env	list	[]	Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
parser.image.pullPolicy	string	"IfNotPresent"	Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
parser.image.repository	string	"docker.io/securecodebox/parser-wpscan"	Parser image repository
parser.image.tag	string	defaults to the charts version	Parser image tag
parser.nodeSelector	object	{}	Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/)
parser.resources	object	{ requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }	Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
parser.scopeLimiterAliases	object	{}	Optional finding aliases to be used in the scopeLimiter.
parser.tolerations	list	[]	Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
parser.ttlSecondsAfterFinished	string	nil	seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
scanner.activeDeadlineSeconds	string	nil	There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup)
scanner.affinity	object	{}	Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/)
scanner.backoffLimit	int	3	There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy)
scanner.env	list	[]	Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
scanner.extraContainers	list	[]	Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
scanner.extraVolumeMounts	list	[]	Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scanner.extraVolumes	list	[]	Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scanner.image.pullPolicy	string	"IfNotPresent"	Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
scanner.image.repository	string	"docker.io/securecodebox/scanner-wpscan"	Container Image to run the scan
scanner.image.tag	string	nil	defaults to the charts appVersion
scanner.nameAppend	string	nil	append a string to the default scantype name.
scanner.nodeSelector	object	{}	Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/)
scanner.podSecurityContext	object	{}	Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
scanner.resources	object	{}	CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
scanner.securityContext	object	{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}	Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
scanner.securityContext.allowPrivilegeEscalation	bool	false	Ensure that users privileges cannot be escalated
scanner.securityContext.capabilities.drop[0]	string	"all"	This drops all linux privileges from the container.
scanner.securityContext.privileged	bool	false	Ensures that the scanner container is not run in privileged mode
scanner.securityContext.readOnlyRootFilesystem	bool	false	Prevents write access to the containers file system
scanner.securityContext.runAsNonRoot	bool	false	Enforces that the scanner image is run as a non root user
scanner.suspend	bool	false	if set to true the scan job will be suspended after creation. You can then resume the job using kubectl resume <jobname> or using a job scheduler like kueue
scanner.tolerations	list	[]	Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
scanner.ttlSecondsAfterFinished	string	nil	seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/

License

Code of secureCodeBox is licensed under the Apache License 2.0.

CPU architectures

The scanner is currently supported for these CPU architectures:

• linux/amd64
• linux/arm64

Examples

example.com

note

This example is only meant as a guideline for configuring wpscan. The example scan will fail as it uses example.com as a target, which isn't a valid wpscan target.

Scan

# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "wpscan-www.example.com"
spec:
  scanType: "wpscan"
  parameters:
    - "--url"
    - https://www.example.com
    - "-e"
    - "vp"
    - "--plugins-detection"
    - "mixed"
    - "--api-token"
    - "TODO"

old-wordpress

note

For this example to work, you must add a valid API Token to the scan.yaml!

In this example we execute an wpscan scan against an old wordpress 4.0 instance old-wordpress

Initialize old-wordpress in cluster

Before executing the scan, make sure to setup old-wordpress

helm upgrade --install old-wordpress oci://ghcr.io/securecodebox/helm/old-wordpress --wait

Then, add an API Key in scan.yaml by replacing the TODO after the --api-token flag.

After that you can execute the scan in this directory:

kubectl apply -f scan.yaml

Scan

# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "wpscan-old-wordpress-internal"
spec:
  scanType: "wpscan"
  parameters:
    - "--url"
    - old-wordpress
    - "-e"
    - "vp"
    - "--plugins-detection"
    - "mixed"
    - "--api-token"
    - "TODO"