WPSCAN(1)

NAME
wpscan - WordPress Security Scanner

SYNOPSIS
wpscan [options]

DESCRIPTION
WordPress Security Scanner by the WPScan Team

    Sponsored by Sucuri - https://sucuri.net

    @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_

OPTIONS

--url URL
    The URL of the blog to scan Allowed Protocols: http, https Default Protocol if none provided: http This option is mandatory unless update or help or hh or version is/are supplied

-h, --help
    Display the simple help and exit

--hh
    Display the full help and exit

--version
    Display the version and exit

-v, --verbose
    Verbose mode

--[no-]banner
    Whether or not to display the banner Default: true

-o, --output FILE
    Output to FILE

-f, --format FORMAT
    Output results in the format supplied Available choices: cli-no-colour, cli-no-color, json, cli

--detection-mode MODE
    Default: mixed Available choices: mixed, passive, aggressive

--user-agent, --ua VALUE

--random-user-agent, --rua
    Use a random user-agent for each scan

--http-auth login:password

-t, --max-threads VALUE
    The max threads to use Default: 5

--throttle MilliSeconds
    Milliseconds to wait before doing another web request. If used, the max threads will be set to 1.

--request-timeout SECONDS
    The request timeout in seconds Default: 60

--connect-timeout SECONDS
    The connection timeout in seconds Default: 30

--disable-tls-checks
    Disables SSL/TLS certificate verification

--proxy protocol://IP:port
    Supported protocols depend on the cURL installed

--proxy-auth login:password

--cookie-string COOKIE
    Cookie string to use in requests, format: cookie1=value1[; cookie2=value2]

--cookie-jar FILE-PATH
    File to read and write cookies Default: /tmp/wpscan/cookie_jar.txt

--force
    Do not check if the target is running WordPress

--[no-]update
    Whether or not to update the Database

--wp-content-dir DIR

--wp-plugins-dir DIR

-e, --enumerate [OPTS]
    Enumeration Process Available Choices:

    vp Vulnerable plugins

    ap All plugins

    p Plugins

    vt Vulnerable themes

    at All themes

    t Themes

    tt Timthumbs

    cb Config backups

    dbe Db exports

    u User IDs range. e.g: u1-5 Range separator to use: '-' Value if no argument supplied: 1-10

    m Media IDs range. e.g m1-15 Note: Permalink setting must be set to "Plain" for those to be detected Range separator to use: '-' Value if no argument supplied: 1-100

    Separator to use between the values: ',' Default: All Plugins, Config Backups Value if no argument supplied: vp,vt,tt,cb,dbe,u,m Incompatible choices (only one of each group/s can be used):

    - vp, ap, p - vt, at, t

--exclude-content-based REGEXP_OR_STRING
    Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration. Both the headers and body are checked. Regexp delimiters are not required.

--plugins-detection MODE
    Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode. Default: passive Available choices: mixed, passive, aggressive

--plugins-version-detection MODE
    Use the supplied mode to check plugins versions instead of the --detection-mode or --plugins-detection modes. Default: mixed Available choices: mixed, passive, aggressive

-P, --passwords FILE-PATH
    List of passwords to use during the password attack. If no --username/s option supplied, user enumeration will be run.

-U, --usernames LIST
    List of usernames to use during the password attack. Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt'

--multicall-max-passwords MAX_PWD
    Maximum number of passwords to send by request with XMLRPC multicall Default: 500

--password-attack ATTACK
    Force the supplied attack to be used rather than automatically determining one. Available choices: wp-login, xmlrpc, xmlrpc-multicall

--stealthy
    Alias for --random-user-agent --detection-mode passive --plugins-version-detection passive

To see full list of options use --hh.