wpscan VS BloodHound

After our initial port scan, we might do more scans depending on what we find. In order to be as effective as possible, and to gather as much information as possible, pentesters are often running multiple scans simultaneously on a target. There are hundreds of tools out there for every service imaginable. Some of the tools worth mentioning are wpscan (https://wpscan.com/wordpress-security-scanner) for Wordpress sites or sqlmap (https://sqlmap.org/) for automatic SQL injection. For a more extensive list of tools check out https://0xcybery.github.io/ehtk/ or https://github.com/enaqx/awesome-pentest

So the website is using Wordpress. Having said that, we are going to use WPScan. But before that, make sure that you have already acquired your API token before using WPScan or you will never be able to utilize the scanner. You can get your own API token by signing up on their website.

Specialised tools can be used, for example WPScan. Allowing us to enumerate the wordpress CMS.

Linux Servers (Remotely): nmap -> nmap -sC -sV -p- ipHere WordPress Websites: wpscan -> wpscan --url http://site.com/

There is one annoying "gotcha" when using WPScan, especially plugin enumeration, which is for the best results you have to go an extra step and add the "--plugins-detection mixed" option. It is documented in our user documentation - https://github.com/wpscanteam/wpscan/wiki/WPScan-User-Documentation#enumeration-modes

There is a free wordpress security scanning service that you could leverage for regular security auditing of your site called WPScan that is fantastic on detecting and auditing common vulnerabilities to plugins and security exposures.

wpscan will audit for plugins used that have publicly exposed vulnerabilities. The methods of detection are quite clever and it works well.

Tool Language Url Notes SharpHound .NET 4 executable https://github.com/BloodHoundAD/SharpHound/ Also possible to be executed in-memory using Cobalt Strike, check @william_knows’ blog post AzureHound PowerShell https://github.com/BloodHoundAD/AzureHound/ Specifically for Azure environments, outside of the scope of this article SharpHound.ps1 PowerShell https://github.com/BloodHoundAD/BloodHound/ Available from the Collectors folder. Using PowerShell reflectively loads the embedded SharpHound.exe .NET executable. It exposes the Invoke-BloodHound function which calls the main function of the SharpHound binary. SharpHound.py Python https://github.com/fox-it/BloodHound.py/ Python version of SharpHound ADExplorerSnapshot.py Python https://github.com/c3c/ADExplorerSnapshot.py/ Convert Sysinternals ADExplorer snapshots to BloodHound-compatible JSON files. BOFHound Python https://github.com/fortalice/bofhound/ Generate BloodHound compatible JSON from logs written by ldapsearch BOF and pyldapsearch.

BloodHound is a web application that identifies and visualizes attack paths in Active Directory environments. It identifies the fastest series of steps from any AD account or machine to a desired target, such as membership in the Domain Admins group. Regularly checking your AD using BloodHound can be an effective defense mechanism that helps you ensure that compromising an account or machine doesn’t enable an attacker to compromise your domain.

Bloodhound - AD attack path management/enumeration

If you're planning to use Active Directory and/or Azure AD, run ADRecon/AzureADRecon and Bloodhound frequently and review in depth. Run ScoutSuite frequently and review as part of a normal operational cycle (e.g., at weekly team meetings make the results available and set aside 15 minutes to discuss and make assignments). Look critically at where these three tools overlap within two or three degrees of separation from your jump hosts (e.g., hosts/nodes that are one or two devices away and users/security groups that are one or two devices away) for help prioritizing when you have too many high-risk/high-impact items to look through.

Hi guys, bloodhound (Linux latest release at https://github.com/BloodHoundAD/BloodHound) is giving me the following error whenever I'm trying to run it on my kali machine.

BlookdHound is useful to reveal the hidden and often unintended relationships within an Active Directory or Azure environment