A penetration tester is conducting a black-box assessment of a client's web application. They discover that the application has a login form and want to identify valid usernames by observing differences in the application's response to valid versus invalid usernames. Which Metasploit module is specifically designed to enumerate WordPress usernames by observing response differences?
- Aauxiliary/scanner/http/wordpress_enum
- Bauxiliary/scanner/http/wordpress_login_enum
- Cauxiliary/scanner/http/wordpress_xmlrpc_login
- Dauxiliary/scanner/http/wordpress_content_scanner
Show answer & explanationAnswer & explanation
Correct answer: B. auxiliary/scanner/http/wordpress_login_enum
The `auxiliary/scanner/http/wordpress_login_enum` Metasploit module is specifically designed to enumerate valid usernames on WordPress installations. It typically works by sending login attempts and analyzing unique error messages or response codes for valid versus invalid usernames, exploiting a common WordPress behavior.
Why the other options are wrong
- A. `wordpress_enum` is a general enumeration module, but `wordpress_login_enum` is more specific for usernames via the login page response.
- C. `wordpress_xmlrpc_login` is for brute-forcing login via the XML-RPC interface, not directly enumerating usernames by observing login form responses for distinct error messages.
- D. `wordpress_content_scanner` scans for common WordPress files and directories, not usernames.
Metasploit wordpress_login_enum
A Metasploit auxiliary module used to enumerate valid usernames on WordPress websites. It typically achieves this by analyzing the differences in error messages or HTTP response codes returned by the login page when an invalid username is provided versus a valid one.
- Targets WordPress login pages.
- Identifies valid usernames.
- Relies on distinct error messages or response codes.
- Part of Metasploit's auxiliary scanner modules.
Memory trick: Login_enum is like a detective listening for specific whispers at the WordPress door.