Welches Theme ist das? WPScan

Man sieht eine gute Seite und will wissen, welches Theme genutzt wird oder welche Plugins installiert sind. Für den schnellen Blick helfen Seiten wie: WordPress Theme Search, WPThemeDoctor und WhatTheme.
Wenn man sorgfältig sein WordPress betreiben möchte oder seinen Dienstleister unterstützen will, hat man einen Schwachstellen-Scanner wie zum Bsp. WPScan installiert und im regelmäßigen Einsatz. Mit WPScan ist ein Scan nach Plugin und Theme effektiver, denn er zeigt Sicherheitsprobleme, die man mit den Plugin oder dem Theme haben könnte, gleich mit an.
Mit den o.g. Web-Tools läßt man sich das entsprechende Theme oder Plugin anzeigen, installiert es in seine Testumgebung und prüft dann mit WPScan.
WPScan
WPScan läuft da, wo Ruby läuft, weiterhin auf der Projektseite. Wer weitere Sicherheitstest macht, dem sei die Linux-Distribution Kali Linux1 empfohlen, hier ist WPScan bereits installiert.
Web-Seite scannen
ruby wpscan.rb --url http://test.jens-falk.de
Das sieht dann so aus:
_______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 2.9.3 Sponsored by Sucuri - https://sucuri.net @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart________________________________________________________________[+] URL: http://test.jens-falk.de/[+] Started: Fri Sep 22 20:20:15 2017[+] robots.txt available under: 'http://test.jens-falk.de/robots.txt'[!] The WordPress 'http://test.jens-falk.de/readme.html' file exists exposing a version number[!] Full Path Disclosure (FPD) in 'http://test.jens-falk.de/wp-includes/rss-functions.php': [+] Interesting header: LINK: <http://test.jens-falk.de/wp-json/>; rel="https://api.w.org/"[+] Interesting header: SERVER: Apache/2.4.25[+] Interesting header: X-CACHE: MISS from falkproxy[+] Interesting header: X-CACHE-LOOKUP: HIT from falkproxy:800[+] Interesting header: X-POWERED-BY: PHP/5.6.28[+] XML-RPC Interface available under: http://test.jens-falk.de/xmlrpc.php[+] WordPress version 4.8.2 (Released on 2017-09-19) identified from meta generator, links opml[+] WordPress theme in use: advanced-twenty-seventeen-child - v1.0[+] Name: advanced-twenty-seventeen-child - v1.0 | Location: http://test.jens-falk.de/wp-content/themes/advanced-twenty-seventeen-child/ | Style URL: http://test.jens-falk.de/wp-content/themes/advanced-twenty-seventeen-child/style.css | Theme Name: Advanced Twenty Seventeen Child | Theme URI: http://saturnsolutions.com | Description: Twenty Seventeen brings your site to life with immersive featured images and subtle animations. W... | Author: SaturnSolutions | Author URI: http://saturnsolutions.com/[+] Detected parent theme: twentyseventeen - v1.3[+] Name: twentyseventeen - v1.3 | Latest version: 1.3 (up to date) | Last updated: 2017-06-08T00:00:00.000Z | Location: http://test.jens-falk.de/wp-content/themes/twentyseventeen/ | Readme: http://test.jens-falk.de/wp-content/themes/twentyseventeen/README.txt | Style URL: http://test.jens-falk.de/wp-content/themes/twentyseventeen/style.css | Theme Name: Twenty Seventeen | Theme URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a... | Author: the WordPress team | Author URI: https://wordpress.org/[+] Enumerating plugins from passive detection ... | 1 plugin found:[+] Name: advanced-twenty-seventeen - v1.3.1 | Latest version: 1.3.1 (up to date) | Last updated: 2017-02-27T05:49:00.000Z | Location: http://test.jens-falk.de/wp-content/plugins/advanced-twenty-seventeen/ | Readme: http://test.jens-falk.de/wp-content/plugins/advanced-twenty-seventeen/readme.txt
Benutzernamen suchen
Der Befehl lautet:
ruby wpscan.rb --url http://test.jens-falk.de --enumerate u
bzw. bei zahlreichen Benutzern
ruby wpscan.rb --url http://deinewebseite.de --enumerate u[10-20]
Das Ergebnis
[+] Enumerating usernames ...[+] Identified the following 1 user/s: +----+--------+----------+ | Id | Login | Name | +----+--------+----------+ | 1 | tester | Tester – | +----+--------+----------+
Passwortsicherheit prüfen
Es macht durchaus Sinn nun zu prüfen, ob ein Angreifer sich anmelden könnte:
ruby wpscan.rb --url http://deineseite.de --wordlist passwoerter.txt
Das Ergebnis
[+] Enumerating usernames ...[+] Identified the following 1 user/s: +----+--------+----------+ | Id | Login | Name | +----+--------+----------+ | 1 | tester | Tester – | +----+--------+----------+[+] Starting the password brute forcer Brute Forcing 'tester' Time: 00:00:00 <=====================================================================================> (1 / 1) 100.00% Time: 00:00:00 [+] [SUCCESS] Login : tester Password : geheim +----+--------+----------+--------------------------+ | Id | Login | Name | Password | +----+--------+----------+--------------------------+ | 1 | tester | Tester – | geheim | +----+--------+----------+--------------------------+
Dateien mit Passwörtern sind zahlreich zu finden (Google "password list txt"). Viele Nutzer verwenden für Webseiten immer das gleiche Passwort. Ihnen ist nicht klar, daß mit einem Einbruch Passwörter ausgelesen und in Listen gespeichert werden.
Schwachstellen im Theme finden
ruby wpscan.rb --url http://deineseite.de --enumerate vt
Schwachstellen bei Plugins finden
ruby wpscan.rb --url http://deineseite.de --enumerate vp
Das Ergebnis
[+] URL: https://meine-verwundbaren-wp-plugins.de/[+] Started: Fri Sep 22 20:29:41 2017[+] robots.txt available under: 'https://meine-verwundbaren-wp-plugins.de/robots.txt'[+] Interesting entry from robots.txt: Sitemap: http://meine-verwundbaren-wp-plugins.de/?feed=google_news_sitemap[!] The WordPress 'https://meine-verwundbaren-wp-plugins.de/readme.html' file exists exposing a version number[+] Interesting header: SERVER: nginx[+] Interesting header: X-CACHE-ENGINE: WP-FFPC with memcached via PHP[+] Interesting header: X-POWERED-BY: PHP/5.4.45-1~dotdeb+7.1[+] This site has 'Must Use Plugins' (http://codex.wordpress.org/Must_Use_Plugins)[+] XML-RPC Interface available under: https://meine-verwundbaren-wp-plugins.de/xmlrpc.php[+] WordPress version 4.7 (Released on 2016-12-06) identified from readme[!] 27 vulnerabilities identified from the version number[!] Title: WordPress 4.3-4.7 - Remote Code Execution (RCE) in PHPMailer Reference: https://wpvulndb.com/vulnerabilities/8714 Reference: https://www.wordfence.com/blog/2016/12/phpmailer-vulnerability/ Reference: https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/24767c76d359231642b0ab48437b64e8c6c7f491 Reference: http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html Reference: https://www.rapid7.com/db/modules/exploit/unix/webapp/wp_phpmailer_host_header[i] Fixed in: 4.7.1[!] Title: WordPress 4.7 - User Information Disclosure via REST API Reference: https://wpvulndb.com/vulnerabilities/8715 Reference: https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/ Reference: https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5487[i] Fixed in: 4.7.1[!] Title: WordPress 2.9-4.7 - Authenticated Cross-Site scripting (XSS) in update-core.php Reference: https://wpvulndb.com/vulnerabilities/8716 Reference: https://github.com/WordPress/WordPress/blob/c9ea1de1441bb3bda133bf72d513ca9de66566c2/wp-admin/update-core.php Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5488[i] Fixed in: 4.7.1[!] Title: WordPress <= 4.7 - Cross-Site Request Forgery (CSRF) via Flash Upload Reference: https://wpvulndb.com/vulnerabilities/8717 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5489[i] Fixed in: 4.7.1[!] Title: WordPress 3.4-4.7 - Stored Cross-Site Scripting (XSS) via Theme Name fallback Reference: https://wpvulndb.com/vulnerabilities/8718 Reference: https://www.mehmetince.net/low-severity-wordpress/ Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/ce7fb2934dd111e6353784852de8aea2a938b359 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5490[i] Fixed in: 4.7.1[!] Title: WordPress <= 4.7 - Post via Email Checks mail.example.com by Default Reference: https://wpvulndb.com/vulnerabilities/8719 Reference: https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c8596a Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5491 [i] Fixed in: 4.7.1 [!] Title: WordPress 2.8-4.7 - Accessibility Mode Cross-Site Request Forgery (CSRF) Reference: https://wpvulndb.com/vulnerabilities/8720 Reference: https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842bf0fb00c733 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5492 [i] Fixed in: 4.7.1 [!] Title: WordPress 3.0-4.7 - Cryptographically Weak Pseudo-Random Number Generator (PRNG) Reference: https://wpvulndb.com/vulnerabilities/8721 Reference: https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5493 [i] Fixed in: 4.7.1 [!] Title: WordPress 4.2.0-4.7.1 - Press This UI Available to Unauthorised Users Reference: https://wpvulndb.com/vulnerabilities/8729 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ Reference: https://github.com/WordPress/WordPress/commit/21264a31e0849e6ff793a06a17de877dd88ea454 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5610 [i] Fixed in: 4.7.2 [!] Title: WordPress 3.5-4.7.1 - WP_Query SQL Injection Reference: https://wpvulndb.com/vulnerabilities/8730 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ Reference: https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5611 [i] Fixed in: 4.7.2 [!] Title: WordPress 4.3.0-4.7.1 - Cross-Site Scripting (XSS) in posts list table Reference: https://wpvulndb.com/vulnerabilities/8731 Reference: https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ Reference: https://github.com/WordPress/WordPress/commit/4482f9207027de8f36630737ae085110896ea849 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5612 [i] Fixed in: 4.7.2 [!] Title: WordPress 4.7.0-4.7.1 - Unauthenticated Page/Post Content Modification via REST API Reference: https://wpvulndb.com/vulnerabilities/8734 Reference: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html Reference: https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html Reference: https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab Reference: https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7 Reference: https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_content_injection [i] Fixed in: 4.7.2 [!] Title: WordPress 3.6.0-4.7.2 - Authenticated Cross-Site Scripting (XSS) via Media File Metadata Reference: https://wpvulndb.com/vulnerabilities/8765 Reference: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/28f838ca3ee205b6f39cd2bf23eb4e5f52796bd7 Reference: https://sumofpwn.nl/advisory/2016/wordpress_audio_playlist_functionality_is_affected_by_cross_site_scripting.html Reference: http://seclists.org/oss-sec/2017/q1/563 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6814 [i] Fixed in: 4.7.3 [!] Title: WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation Reference: https://wpvulndb.com/vulnerabilities/8766 Reference: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/288cd469396cfe7055972b457eb589cea51ce40e Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6815 [i] Fixed in: 4.7.3 [!] Title: WordPress 4.7.0-4.7.2 - Authenticated Unintended File Deletion in Plugin Delete Reference: https://wpvulndb.com/vulnerabilities/8767 Reference: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/4d80f8b3e1b00a3edcee0774dc9c2f4c78f9e663 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6816 [i] Fixed in: 4.7.3 [!] Title: WordPress 4.0-4.7.2 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds Reference: https://wpvulndb.com/vulnerabilities/8768 Reference: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/419c8d97ce8df7d5004ee0b566bc5e095f0a6ca8 Reference: https://blog.sucuri.net/2017/03/stored-xss-in-wordpress-core.html Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6817 [i] Fixed in: 4.7.3 [!] Title: WordPress 4.7-4.7.2 - Cross-Site Scripting (XSS) via Taxonomy Term Names Reference: https://wpvulndb.com/vulnerabilities/8769 Reference: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/9092fd01e1f452f37c313d38b18f9fe6907541f9 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6818 [i] Fixed in: 4.7.3 [!] Title: WordPress 4.2-4.7.2 - Press This CSRF DoS Reference: https://wpvulndb.com/vulnerabilities/8770 Reference: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/263831a72d08556bc2f3a328673d95301a152829 Reference: https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_press_this_function_allows_dos.html Reference: http://seclists.org/oss-sec/2017/q1/562 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6819 [i] Fixed in: 4.7.3 [!] Title: WordPress 2.3-4.7.5 - Host Header Injection in Password Reset Reference: https://wpvulndb.com/vulnerabilities/8807 Reference: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html Reference: http://blog.dewhurstsecurity.com/2017/05/04/exploitbox-wordpress-security-advisories.html Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8295 [!] Title: WordPress 2.7.0-4.7.4 - Insufficient Redirect Validation Reference: https://wpvulndb.com/vulnerabilities/8815 Reference: https://github.com/WordPress/WordPress/commit/76d77e927bb4d0f87c7262a50e28d84e01fd2b11 Reference: https://wordpress.org/news/2017/05/wordpress-4-7-5/ Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9066 [i] Fixed in: 4.7.5 [!] Title: WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC Reference: https://wpvulndb.com/vulnerabilities/8816 Reference: https://wordpress.org/news/2017/05/wordpress-4-7-5/ Reference: https://github.com/WordPress/WordPress/commit/3d95e3ae816f4d7c638f40d3e936a4be19724381 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9062 [i] Fixed in: 4.7.5 [!] Title: WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks Reference: https://wpvulndb.com/vulnerabilities/8817 Reference: https://wordpress.org/news/2017/05/wordpress-4-7-5/ Reference: https://github.com/WordPress/WordPress/commit/e88a48a066ab2200ce3091b131d43e2fab2460a4 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9065 [i] Fixed in: 4.7.5 [!] Title: WordPress 2.5.0-4.7.4 - Filesystem Credentials Dialog CSRF Reference: https://wpvulndb.com/vulnerabilities/8818 Reference: https://wordpress.org/news/2017/05/wordpress-4-7-5/ Reference: https://github.com/WordPress/WordPress/commit/38347d7c580be4cdd8476e4bbc653d5c79ed9b67 Reference: https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_connection_information.html Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9064 [i] Fixed in: 4.7.5 [!] Title: WordPress 3.3-4.7.4 - Large File Upload Error XSS Reference: https://wpvulndb.com/vulnerabilities/8819 Reference: https://wordpress.org/news/2017/05/wordpress-4-7-5/ Reference: https://github.com/WordPress/WordPress/commit/8c7ea71edbbffca5d9766b7bea7c7f3722ffafa6 Reference: https://hackerone.com/reports/203515 Reference: https://hackerone.com/reports/203515 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9061 [i] Fixed in: 4.7.5 [!] Title: WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF Reference: https://wpvulndb.com/vulnerabilities/8820 Reference: https://wordpress.org/news/2017/05/wordpress-4-7-5/ Reference: https://github.com/WordPress/WordPress/commit/3d10fef22d788f29aed745b0f5ff6f6baea69af3 Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9063 [i] Fixed in: 4.7.5 [!] Title: WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection Reference: https://wpvulndb.com/vulnerabilities/8905 Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128e48 Reference: https://github.com/WordPress/WordPress/commit/fc930d3daed1c3acef010d04acc2c5de93cd18ec[i] Fixed in: 4.8.2[!] Title: WordPress 2.3.0-4.7.4 - Authenticated SQL injection Reference: https://wpvulndb.com/vulnerabilities/8906 Reference: https://medium.com/websec/wordpress-sqli-bbb2afcc8e94 Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ Reference: https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128e48 Reference: https://wpvulndb.com/vulnerabilities/8905[i] Fixed in: 4.7.5
Diese Scripte werden ganz sicher auch von jenen genutzt, die sich Zugang zum Content Management System verschaffen möchten. Deshalb sollte WPScan regelmäßig die eigene WordPress-Installation prüfen.
- Kali Linux enthält Softwaretools, die zum Teil Sicherheitsvorkehrungen umgehen und die nach § 202c StGB, dem Ende Mai 2007 in Kraft getretenen sogenannten Hackerparagrafen, in Deutschland als Computerprogramme zum Ausspähen von Daten aufgefasst werden. Aufgrund dieser Gesetzeslage kann bereits der Besitz oder Vertrieb strafbar sein, sofern die Absicht zu einer rechtswidrigen Nutzung nach § 202a StGB (Ausspähen von Daten) oder § 202b StGB (Abfangen von Daten) besteht. Zitat von Seite „Kali Linux“, Rechtliches. In: Wikipedia, Die freie Enzyklopädie. Bearbeitungsstand: 4. August 2017, 20:02 UTC. URL: https://de.wikipedia.org/w/index.php?title=Kali_Linux&oldid=167875818 (Abgerufen: 22. September 2017, 09:59 UTC)