# WP Scan

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/hfUimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/hfUimage.png)

Sometimes your target has running a WordPress website running on their end. There is also a tool which allows you to scan such websites.

This is how you run an overall scan

`wpscan --url http://10.10.10.10/wordpress -e vp,u`

 [![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/dIFimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/dIFimage.png)

When you found a username you can also start a Brute-Force attack on the Website:

`wpscan --url http://10.10.10.10/wordpress  --usernames admin --passwords /usr/share/wordlists/rockyou.txt --max-threads 50`

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/oMJimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/oMJimage.png)