In this tutorial, we will show you how to install WPScan on Ubuntu 20.04 LTS. For those of you who didn’t know, WPScan is a black box WordPress vulnerability scanner. You can use it for problem location in case there are any vulnerable WordPress themes or WordPress plugins on your website.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘
sudo‘ to the commands to get root privileges. I will show you through the step by step installation WPScan on a Ubuntu 20.04 LTS (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian based distribution like Linux Mint.
Install WPScan on Ubuntu 20.04 LTS Focal Fossa
Step 1. First, make sure that all your system packages are up-to-date by running these following
apt commands in the terminal.
Step 2. Installing Required Package Dependencies.
Run the command to install all package dependencies:
Now clone the WPScan repository from GitHub:
Next, install the bundler gem:
Then, install the WPScan project with user privileges:
After that, run a scan:
You can use WPScan through arguments. You can get a complete list of arguments by executing the following command:
Scan WordPress plugins:
rubywpscan.rb--urlhttp(s)://www.your-website.com --enumerate p
Scan Vulnerable plugins:
rubywpscan.rb--urlhttp(s)://www.your-website.com --enumerate vp
rubywpscan.rb--urlhttp(s)://www.your-website.com --enumerate t
Scan vulnerable themes:
rubywpscan.rb--urlhttp(s)://www.your-website.com --enumerate vt
Scan user accounts:
rubywpscan.rb--urlhttp(s)://www.your-website.com --enumerate u
Congratulations! You have successfully installed WPScan. Thanks for using this tutorial for installing the WPScan WordPress vulnerability scanner on your Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you to check the official WPScan website.