# Wprecon | A Vulnerability Recognition Tool In CMS WordPress, 100% Developed In Go

**URL:** <https://onehack.st/t/wprecon-a-vulnerability-recognition-tool-in-cms-wordpress-100-developed-in-go/169443>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [January 11, 2021, 2:07pm UTC](https://onehack.st/t/wprecon-a-vulnerability-recognition-tool-in-cms-wordpress-100-developed-in-go/169443 "2021-01-11T14:07:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [January 11, 2021, 2:07pm UTC](https://onehack.st/t/wprecon-a-vulnerability-recognition-tool-in-cms-wordpress-100-developed-in-go/169443/1 "2021-01-11T14:07:18Z")

</div>

[![Golpher Ninja by Takuya Ueda](https://raw.githubusercontent.com/tenntenn/gopher-stickers/master/png/ninja.png)](https://raw.githubusercontent.com/tenntenn/gopher-stickers/master/png/ninja.png)

# WPrecon (Wordpress Recon)

[![License: GPL v3](https://camo.githubusercontent.com/400c4e52df43f6a0ab8a89b74b1a78d1a64da56a7848b9110c9d2991bb7c3105/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d47504c76332d626c75652e737667) ](https://www.gnu.org/licenses/gpl-3.0)[![GitHub commit activity](https://camo.githubusercontent.com/f0e09a317bd396d480e980495ff12b482089d527257df5b7ea08de01cbe0abb0/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f636f6d6d69742d61637469766974792f6d2f626c61636b6372772f77707265636f6e)](https://camo.githubusercontent.com/f0e09a317bd396d480e980495ff12b482089d527257df5b7ea08de01cbe0abb0/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f636f6d6d69742d61637469766974792f6d2f626c61636b6372772f77707265636f6e) [![GitHub go.mod Go version (branch)](https://camo.githubusercontent.com/da2497cf1600079709b529ba5985f8edc5700077559ae2229d41de42320a653c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f676f2d6d6f642f676f2d76657273696f6e2f626c61636b6372772f77707265636f6e2f6d61737465723f6c6162656c3d476f266c6f676f3d676f)](https://camo.githubusercontent.com/da2497cf1600079709b529ba5985f8edc5700077559ae2229d41de42320a653c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f676f2d6d6f642f676f2d76657273696f6e2f626c61636b6372772f77707265636f6e2f6d61737465723f6c6162656c3d476f266c6f676f3d676f)

Hello! Welcome. Wprecon (Wordpress Recon), is a vulnerability recognition tool in CMS Wordpress, 100% developed in Go.

#### Version: 0.1.3.0a

### Notice:

#### Why is the project out of updates these days ?! What happens is that I am doing the vulnerability scanner.

#### [Branch Dev](https://github.com/blackcrw/wprecon/tree/dev)

### [Compile and Install](https://github.com/blackcrw/wprecon/doc/compile&install.md)

## Features

| Status | Features |
| --- | --- |
| ✅ | Random Agent |
| ✅ | Detection WAF |
| ✅ | User Enumerator |
| ✅ | Plugin Scanner |
| ✅ | Theme Scanner |
| ✅ | Tor Proxy’s |
| ✅ | Detection Honeypot |
| ✅ | Fuzzing Backup Files |
| ❌ | Fuzzing Passwords |
| ❌ | Vulnerability Scanner |

## Usage

| Flag(s) | Description |
| --- | --- |
| -u, --url string | Target URL (Ex: http(s)://example.com/). (Required) |
| –users-enumerate | Use the supplied mode to enumerate Users. |
| –themes-enumerate | Use the supplied mode to enumerate Themes. |
| –plugins-enumerate | Use the supplied mode to enumerate Plugins. |
| –detection-waf | I will try to detect if the target is using any WAF. |
| –detection-honeypot | I will try to detect if the target is a honeypot, based on the shodan. |
| –no-check-wp | Will skip wordpress check on target. |
| –random-agent | Use randomly selected HTTP(S) User-Agent header value. |
| –tor | Use Tor anonymity network. |
| –disable-tls-checks | Disables SSL/TLS certificate verification. |
| -h, --help | help for wprecon. |
| -v, --verbose | Verbosity mode. |

## WPrecon running

Command: `wprecon --url "https://www.xxxxxxx.com/" --detection-waf`

##### Output:

```auto
—————————————————————————————————————————————————————————————————————

_________________________________________________ __
__| / /__  __\__  __\__  ____/_____ /_ __\__ | / /
__| /| / /__ /_/ /_ /_/ /_ __/ _ / _ / / /_ |/ /
__|/ |/ / _____ /_ _, _/_ / ___/ /___ / /_/ /_ /| /
____/|__ / /_/ /_/ |_| / _____/ \____ / \ ____ / /_/ |_/

Github: https://github.com/blackcrw/wprecon
Version: 0.0.1a
—————————————————————————————————————————————————————————————————————
[•] Target: https://www.xxxxxxx.com/
[•] Starting: 09/jan/2020 12:11:17

[•] Listing enable: https://www.xxxxxxx.com/wp-content/plugins/
[•] Listing enable: https://www.xxxxxxx.com/wp-content/themes/
[•••] Status Code: 200 — URL: https://www.xxxxxxx.com/wp-admin/
[•••] I'm not absolutely sure that this target is using wordpress! 37.50% chance. do you wish to continue ? [Y/n]: Y
[•••] Status Code: 200 — WAF: Wordfence Security Detected
[•••] Do you wish to continue ?! [Y/n] : Y

```

### Yes Baby, Thank You! ✋

## GitHub:

> **[GitHub - ffx64/wprecon: WRecon, is a tool for the recognition of...](https://github.com/ffx64/wprecon)**
>
> WRecon, is a tool for the recognition of vulnerabilities and blackbox information for wordpress.