How To Install WPScan on Ubuntu 20.04 LTS

In this tutorial, we will show you how to install WPScan on Ubuntu 20.04 LTS. For those of you who didn’t know, WPScan is a black box WordPress vulnerability scanner. You can use it for problem location in case there are any vulnerable WordPress themes or WordPress plugins on your website.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation WPScan on a Ubuntu 20.04 LTS (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install WPScan on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing Required Package Dependencies.

Run the command to install all package dependencies:

sudo apt install curl git libcurl4-openssl-dev make zlib1g-dev gawk g++ gcc libreadline6-dev libssl-dev libyaml-dev libsqlite3-dev sqlite3 autoconf libgdbm-dev libncurses5-dev automake libtool bison pkg-config ruby ruby-bundler ruby-dev

Step 3. Installing WPScan on Ubuntu 20.04.

Now clone the WPScan repository from GitHub:

cd /usr/local/src/
sudo git clone https://github.com/wpscanteam/wpscan.git

Next, install the bundler gem:

sudo chown [current username]:[current username] wpscan/
cd wpscan/
gem install bundler

Then, install the WPScan project with user privileges:

bundle install --without test

After that, run a scan:

ruby wpscan.rb --url [url]

Step 4. Use WPScan to scan WordPress Sites.

You can use WPScan through arguments. You can get a complete list of arguments by executing the following command:

ruby wpscan.rb --help

Scan WordPress plugins:

ruby wpscan.rb --url http(s)://www.your-website.com --enumerate p

Scan Vulnerable plugins:

ruby wpscan.rb --url http(s)://www.your-website.com --enumerate vp

Scan themes:

ruby wpscan.rb --url http(s)://www.your-website.com --enumerate t

Scan vulnerable themes:

ruby wpscan.rb --url http(s)://www.your-website.com --enumerate vt

Scan user accounts:

ruby wpscan.rb --url http(s)://www.your-website.com --enumerate u

Congratulations! You have successfully installed WPScan. Thanks for using this tutorial for installing the WPScan WordPress vulnerability scanner on your Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official WPScan website.