wpcheck - Vulnerability scanner for WordPress based on Node.

项目说明

wpcheck

wpcheck is a Node.js CLI tool that allows you to quickly scan WordPress sites looking for known , security issues and misconfigurations. wpcheck helps you secure and maintain your WordPress against hackers.

![Dependency Status]()
![Code Climate]()
![Build Status]()
![Known ]()

Features

Preinstalled rules for a quick start.

Custom rules increase the functionality.

Selectively ignore default and custom rules.

Multiple WordPress scans from a bulk file.

Detection for

- WordPress directories (wp-content, ...).
- WordPress installed in a subdirectory.

Changeable User-Agent string.

Silent mode displays warnings only.

Fix issues: WordPress security best practices.

Beginner friendly, easy to install.

Lightweight, cross plattform framework.

Work in progress, see todos and changelog.

Install

*or*

##### Notes
* wpcheck requires Node.js >= 8.10 and npm.
* Fix npm permissions if you get the Permission denied error.

Usage

url → WordPress site URL (e.g. )

Multiple URLs can be separated by spaces.

Options

Option | Shortcut | Description
------ | -------- | -----------
--help | -h | Outputs supplied help text.
--silent | -s | Disables success and info messages. Displays warnings only.
-- | -v | Prints wpcheck .
--rules-dir | -r | Loads additional rules from a directory (see Custom rules).
--bulk-file | -b | Reads additional WordPress site URLs from a text file (see Bulk scan).
--ignore-rule | -i | Skips loading and execution of a specific rule (see Ignore rules).
--user-agent | -u | Defines a custom User-Agent string. Default is wpcheck.

Quick examples

Default rules

wpcheck has a few rules that are enabled by default. Follow also our WordPress security best practices to fix detected by wpcheck default rules.

##### 1. Checks sensiti/Apache/Dot files for their a
- /wp-config.php
- /wp-admin/maint/repair.php
- /.htaccess
- /.htpasswd
- /.ssh
- /.npmrc
- /.gitconfig
- /config.json
- /wp-config-sample.php
- /wp-content/debug.log

##### 2. Scans WordPress login page for security issues
- Basic access authentication
- HTTPS protocol usage

##### 3. Checks whether WordPress is affected by FPD

##### 4. Checks whether the Apache directory listing is activated

Custom rules

The power of wpcheck is the flexibility: You can expand the tool functionality by building their own rules, scans and checks. The option --rules-dir allows loading of user-defined rules from a custom directory.

The directory path

- can be absolute or relative to the wpcheck folder

The custom rules

- must be stored as .js files
- can be a Node.js script
- can be a npm package
- must have an exported function named fire

wpcheck will run (technically require) every custom rule file. The file naming does not matter, short and unique names are welcome. Feel free to create your own rules, enjoy!

##### Get inspired

example custom rules

wpcheck default rules

Ignore rule(s)

wpcheck can skip certain default and custom rules. The CLI option --ignore-rule takes a rule name, the rule name is the Ja file name of the rule without path. Multiple rule filtering is possible by a multiple use of the CLI option.

Bulk scan

Multiple WordPress site URLs can be imported from a single file. This is a simple text file with one URL per line.

Use, don't abuse!

项目信息

开发语言：JavaScript

Star 数：63

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Vulnerability scanner for WordPress based on Node.js展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。