Nmap 6: Network Exploration and Security Auditing Cookbook

Brute-force password auditing WordPress installations

WordPress is a widely known CMS (Content Management System) that is used in many industries. Nmap now includes its own NSE script to help pentesters launch dictionary attacks and find accounts using weak passwords that could compromise the application's integrity.

This recipe shows how to perform brute force password auditing against WordPress installations.

How to do it...

To find accounts with weak passwords in WordPress installations, use the following Nmap command:

$ nmap -p80 --script http-wordpress-brute <target>

All of the valid accounts that were found will be shown in the results:

PORT     STATE SERVICE REASON
80/tcp   open  http    syn-ack
| http-wordpress-brute:
|   Accounts
| papa:a1b2c3d4 => ...