“You will be learning how to compromise a WordPress website’s credentials using different brute-force techniques. WPScan, Metasploit, and Burp Suite each offer distinct advantages depending on the engagement scope.”
Where the broader WordPress Penetration Testing Guide walks the whole kill chain, WordPress for Pentester: Cracking Login stops at one door: wp-login.php. It sets three credential-attack tools side by side and, more usefully, tells you when to reach for each—because the right choice depends less on the tool than on whether the engagement rewards stealth, speed, or integration with what comes next.
Vector One: WPScan
The guide opens with the obvious choice. WPScan is a purpose-built command-line scanner that does credential testing quickly, and the manual gives the exact syntax for running a username list against the rockyou.txt wordlist:
wpscan --url [target] -U users.txt -P /usr/share/wordlists/rockyou.txt
The manual flags the trade-off honestly: WPScan hammers out a flood of HTTP POST requests, and pointed at a production site on lightweight shared hosting with a huge dictionary, it can tip the target into a denial-of-service you never intended to cause. On a real engagement that is a scoping conversation, not a footnote.
Vector Two: Metasploit
When you want the credential attack to feed straight into a post-exploitation workflow, the guide turns to Metasploit. Its auxiliary/scanner/http/wordpress_login_enum module does something smarter than blind brute force: it confirms which usernames actually exist first, then only tries passwords against real accounts. Fewer wasted requests, less noise, shorter run—the difference between spraying the whole grid and testing the doors you know are there.
Vector Three: Burp Suite Intruder
The most precise option is Burp Suite’s Intruder. The guide walks it in detail: intercept a live login through the Proxy, mark the username and password parameters, send the request to Intruder, set Cluster Bomb mode across both positions, and watch the response-length column—the valid pair almost always redirects, so its response length breaks from the pack of identical failures. Precise, and slow, since community-edition Intruder is deliberately throttled; that speed penalty is the price of the control.
Defensive Countermeasures
The guide closes on defence, and is realistic about which measures actually help. Rate-limiting plugins and CAPTCHA on the login page raise the cost of every attempt; renaming wp-login.php sheds the automated scanners that only know the default path. None of it is a substitute for a strong password and two-factor authentication—moving the door does not help if the lock is weak—but together they turn an easy target into one that is more trouble than it is worth.
Who Is This Book REALLY For?
- Bug Bounty Hunters: Spot a WordPress target and authentication strength is the first thing to test. The guide keeps the syntax sharp across all three tools so you are not fumbling flags mid-hunt.
- Web Application Testers: A clean framework for picking the right tool against the constraint that actually matters—stealth, speed, or integration.
- WordPress Administrators: An uncomfortable look at how fast a default install folds to an automated dictionary run, and why 2FA stops being optional.
The Bottom Line
WordPress for Pentester: Cracking Login is a narrow, focused credential-assault manual. Its single argument, proven three ways, is that on most WordPress sites the administrator’s password is the weakest link in the whole stack—and no amount of downstream hardening rescues a bad one.
