当前位置： 首页 > news >正文

做网站需要美工吗域名收录

news 2026/4/6 21:21:45
做网站需要美工吗,域名收录,wordpress大学主题修改,高端网页游戏介绍 WPScan是Kali Linux默认自带的一款漏洞扫描工具，它采用Ruby编写，能够扫描WordPress网站中的多种安全漏洞，其中包括主题漏洞、插件漏洞和WordPress本身的漏洞。最新版本WPScan的数据库中包含超过18000种插件漏洞和2600种主题漏洞&#x…

介绍

WPScan是Kali Linux默认自带的一款漏洞扫描工具，它采用Ruby编写，能够扫描WordPress网站中的多种安全漏洞，其中包括主题漏洞、插件漏洞和WordPress本身的漏洞。最新版本WPScan的数据库中包含超过18000种插件漏洞和2600种主题漏洞，并且支持最新版本的WordPress。值得注意的是，它不仅能够扫描类似robots.txt这样的敏感文件，而且还能够检测当前已启用的插件和其他功能。

主要参数

参数说明
-h帮助
–url扫描站点
–update更新版本
-e vp扫描插件漏洞
-e ap扫描所有插件
-e p扫描留下插件
-e vt扫描主题漏洞
-e at扫描所有主题
-e t扫描流行主题
-U爆破指定的用户名列表
-P爆破指定的密码列表
–api-token token值扫描主题、插件漏洞时需要用到

工具使用

1、默认扫描站点
在这里插入图片描述

扫描插件

└─# wpscan --url  https://www.521daima.com/ -e p
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________[+] URL: https://www.521daima.com/ [124.220.44.19]
[+] Started: Mon May 13 01:54:07 2024Interesting Finding(s):[+] Headers| Interesting Entry: server: nginx| Found By: Headers (Passive Detection)| Confidence: 100%[+] robots.txt found: https://www.521daima.com/robots.txt| Interesting Entries:|  - /wp-admin/|  - /wp-admin/admin-ajax.php| Found By: Robots Txt (Aggressive Detection)| Confidence: 100%[+] XML-RPC seems to be enabled: https://www.521daima.com/xmlrpc.php| Found By: Direct Access (Aggressive Detection)| Confidence: 100%| References:|  - http://codex.wordpress.org/XML-RPC_Pingback_API|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/|  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: https://www.521daima.com/readme.html| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] The external WP-Cron seems to be enabled: https://www.521daima.com/wp-cron.php| Found By: Direct Access (Aggressive Detection)| Confidence: 60%| References:|  - https://www.iplocation.net/defend-wordpress-from-ddos|  - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 6.4.4 identified (Outdated, released on 2024-04-09).| Found By: Most Common Wp Includes Query Parameter In Homepage (Passive Detection)|  - https://www.521daima.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.4| Confirmed By: Rss Generator (Aggressive Detection)|  - https://www.521daima.com/feed/, <generator>https://wordpress.org/?v=6.4.4</generator>|  - https://www.521daima.com/comments/feed/, <generator>https://wordpress.org/?v=6.4.4</generator>[+] WordPress theme in use: zibll| Location: https://www.521daima.com/wp-content/themes/zibll/| Style URL: https://www.521daima.com/wp-content/themes/zibll/style.css| Style Name: 子比主题| Style URI: https://www.zibll.com| Description: Zibll 子比主题专为商城、论坛、圈子博客、自媒体、资讯类的网站设计开发▒...| Author: 瑞浩网络-Qinver| Author URI: https://www.zibll.com|| Found By: Urls In Homepage (Passive Detection)| Confirmed By: Urls In 404 Page (Passive Detection)|| Version: 7.1 (80% confidence)| Found By: Style (Passive Detection)|  - https://www.521daima.com/wp-content/themes/zibll/style.css, Match: 'Version: 7.1'[+] Enumerating Most Popular Plugins (via Passive Methods)

可以看到该站点使用的是zibll

扫描主题漏洞

wpscan规定扫描漏洞时，需要带上token值，才能显示出漏洞。
不带token值，不显示漏洞信息，报如下提示：
token 获取方式 https://wpscan.com/ 注册后，会获得免费的token

 wpscan --url  https://www.521daima.com/  --api-token aCiRr1E5Bdk4r9XTywvotguncaaDFQSdlN9gcc9S3v4  -e vt
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________····
····
[+] The external WP-Cron seems to be enabled: 
[+] WordPress version 6.4.4 identified (Outdated, released on 2024-04-09).| Found By: Most Common Wp Includes Query Parameter In Homepage (Passive Detection)|  - https://www.521daima.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.4| Confirmed By: Rss Generator (Aggressive Detection)|  - https://www.521daima.com/feed/, <generator>https://wordpress.org/?v=6.4.4</generator>|  - https://www.521daima.com/comments/feed/, <generator>https://wordpress.org/?v=6.4.4</generator>[+] WordPress theme in use: zibll| Location: https://www.521daima.com/wp-content/themes/zibll/| Style URL: https://www.521daima.com/wp-content/themes/zibll/style.css| Style Name: 子比主题| Style URI: https://www.zibll.com| Description: Zibll 子比主题专为商城、论坛、圈子博客、自媒体、资讯类的网站设计开发▒...| Author: 瑞浩网络-Qinver| Author URI: https://www.zibll.com|| Found By: Urls In Homepage (Passive Detection)| Confirmed By: Urls In 404 Page (Passive Detection)|| Version: 7.1 (80% confidence)| Found By: Style (Passive Detection)|  - https://www.521daima.com/wp-content/themes/zibll/style.css, Match: 'Version: 7.1'[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)Checking Known Locations - Time: 00:04:04 <===========================================================> (652 / 652) 100.00% Time: 00:04:04
[+] Checking Theme Versions (via Passive and Aggressive Methods)[i] No themes Found.[+] WPScan DB API OK| Plan: free| Requests Done (during the scan): 2| Requests Remaining: 21[+] Finished: Mon May 13 02:02:34 2024
[+] Requests Done: 658
[+] Cached Requests: 46
[+] Data Sent: 202.294 KB
[+] Data Received: 256.026 KB
[+] Memory used: 236.398 MB
[+] Elapsed time: 00:04:11

枚举用户名

 wpscan --url  https://www.521daima.com/    -e u
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________···
···
[i] User(s) Identified:[+] 1| Found By: Author Posts - Author Pattern (Passive Detection)| Confirmed By:|  Author Sitemap (Aggressive Detection)|   - https://www.521daima.com/wp-sitemap-users-1.xml|  Author Id Brute Forcing - Author Pattern (Aggressive Detection)[+] admin| Found By: Wp Json Api (Aggressive Detection)|  - https://www.521daima.com/wp-json/wp/v2/users/?per_page=100&page=1

得到用户名admin

爆破密码

wpscan --url https://www.521daima.com/ -U admin -P /usr/share/wordlists/rockyou.txt

wpscan --url  https://www.521daima.com/  -U admin -P /usr/share/wordlists/rockyou.txt
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________···
···[+] Enumerating All Plugins (via Passive Methods)[i] No plugins Found.[+] Enumerating Config Backups (via Passive and Aggressive Methods)Checking Config Backups - Time: 00:00:46 <============================================================> (137 / 137) 100.00% Time: 00:00:46[i] No Config Backups Found.[+] Performing password attack on Xmlrpc against 1 user/s
Trying admin / peaches Time: 00:01:45 <                                                            > (238 / 14344392)  0.00%  ETA: ??:??:??
http://www.hkea.cn/news/421516/

相关文章：

  • 广州网站 制作信科便宜网络营销软文范例500
  • 网站建设公开课长沙网站推广和优化
  • 建设网站的需求分析俄罗斯搜索引擎yandex推广入口
  • 可以做英文纵横字谜的网站搜狗网站收录入口
  • web前端开发是不是做网站百家号关键词排名优化
  • 夸克看网站要钱吗电商网站seo优化
  • 自己做网站排版138ip查询网域名解析
  • 东莞做网站 南城石佳2023网站推广入口
  • 广东省省建设厅网站郴州网站建设网络推广平台
  • 校园网站推广方案怎么做应用商店优化
  • 巩义网站建设网络营销公司是做什么的
  • 做网站基本教程一站式营销平台
  • 杭州模板网站建设电脑培训网上培训班
  • 大连做网站不错的公司怎样把广告放到百度
  • 网站上面带官网字样怎么做的网站设计的流程
  • 有个网站是做视频相册的网球排名即时最新排名
  • 论坛网站备案流程图优化大师怎么提交作业
  • 织梦政府网站模板百度在线入口
  • 专业做婚纱摄影网站会员制营销
  • 网站内容丰富互动营销平台
  • 阿里巴巴logo高清图谷歌seo网站推广
  • 网站如何做内链seo高手是怎样炼成的
  • 设计师个人网站建设怎样注册一个自己的平台
  • 徐州营销网站建设产品线上推广渠道
  • 绍兴市网站建设公司企业官网搭建
  • 关于网页设计的网站免费发布信息网站大全
  • 郑州新闻头条seo基础教程
  • 做网站比较大的公司朔州seo
  • 如何制作私人网站福州专业的seo软件
  • 做网站主流技术南宁在哪里推广网站