wprecon - WRecon, is a tool for the recognition of vulnerabi

项目说明

<di="center">

WPRecon

A powerful, template-dri reconnaissance and scanning tool

![Go 1.17+]()

Features • Installation • Usage • Architecture • Templates

</div>

---

📋 O

WPRecon is a modern WordPress security reconnaissance tool built with Go that helps security engineers identify , misconfigurations, and information disclosure issues in WordPress installations.

Unlike traditional scanners with hardcoded checks, WPRecon uses a YAML-dri architecture, enabling:

Key Statistics

---

⚡ Features

Core Capabilities

| Feature | Description |
|---------|-------------|
| Parallel Scanning | Configurable worker pool (default: 10 workers) for concurrent requests |
| Rate Limiting | Built-in request throttling (default: 50 req/s) to be network-friendly |
| Auto Retry | Automatic retry logic for failed HTTP requests |
| Hot Reload Templates | No recompilation needed - add templates and scan |
| Resolution | Dynamic : {{BaseURL}}, {{Timestamp}}, {{RandomInt}} |
| Multi-Format Output | Human-readable tables and structured JSON |
| CLI & API Modes | Both command-line and REST API interfaces |
| Se Levels | Findings classified as info, low, medium, high, critical |

HTTP Operations

Matchers (5 Types)

Identify positive hits in responses:

1. Status - HTTP status code matching (200, 404, 500, etc.)
2. Word - Substring presence in response body
3. Regex - Pattern matching with capture groups
4. Header - Response header
5. Size - Response body size checks

Extractors (2 Types)

Extract actionable data from matched responses:

1. Regex - Extract capture groups using regular expressions
2. JSON - Simple JSON path extraction

Template Library

150+ production-ready templates co:

---

📦 Installation

Requirements

From Source

Install via Go

Docker (Optional)

---

🚀 Usage

Command-Line Interface

#### Basic Scan

Scan a WordPress website with all a templates:

#### Scan with Specific Templates

Run only selected templates:

#### Custom Output Format

#### Control Parallelization and Rate Limiting

#### List A Templates

#### Show Help

---

📋 Example Output

When running a scan, WPRecon produces detailed findings:

Table Format:

JSON Format:

---

🏗️ Architecture

Project Structure

Architecture Diagram

Design Principles

1. Single Responsibility - Each module has clear, focused purpose
2. Template-Driven - All scanning logic lives in YAML, not code
3. Horizontal Scalability - Modular design allows easy extension
4. Factory Pattern - Simple addition of new matchers and extractors
5. No External Dependencies - Only UUID and YAML parsing libraries
6. Thread-Safe - Safe concurrent scanning with worker pools

---

📚 Templates

Templates are YAML files that define how WPRecon should scan for specific or information.

Template Structure

Template Categories

#### WordPress Core

| Template | Purpose |
|----------|---------|
| wordpress-detection | Detect WordPress installation |
| wordpress- | Fingerprint WordPress |
| plugins.yaml | Detect installed plugins |
| themes.yaml | Detect installed themes |
| users.yaml | Enumerate WordPress users |

####

#### Information Disclosure

#### WAF Detection

#### Security Analysis

Adding Custom Templates

1. Create a new YAML file in templates/custom/
2. Follow the template structure (see example above)
3. Run WPRecon - templates are auto-discovered

Example:

---

🔧 Configuration

En

CLI Flags

---

💼 Use Cases

Security Assessments

Comprehensi e of WordPress installations:

CI/CD Integration

Automated scanning in deployment pipelines:

Mass Reconnaissance

Scan multiple targets efficiently:

---

🛠️ De

Prerequisites

Building

Project Dependencies

Code Structure

---

🤝 Contributing Templates

1. Fork the repository
2. Create a feature branch (git checkout -b feature/my-template)
3. Add your template to templates/
4. Test thoroughly: wprecon scan -t your-template
5. Submit a Pull Request

---

📄 License

This project is licensed under the MIT License - see LICENSE file for details.

---

<di="center">

Made with ❤️ for Matheus (ffx64)

⬆ back to top

</div>

项目信息

开发语言：Go

Star 数：24

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕WRecon, is a tool for the recognition of vulnerabilities and blackbox information for wordpress.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。