⚡ WordPress Plugin Scanner

A blazing-fast, hybrid WordPress plugin enumerator written in Go. Built with the assistance of AI specifically for cybersecurity labs, CTF challenges, practical exam environments (e.g., OSCP, CPTS), and authorized security assessments.

It features a Dual-Phase Hybrid Engine:

1. Phase 1 (Passive Spider & REST API Inspector): Crawls the target's internal child links (strictly within the same domain) and inspects /wp-json/ to instantly catch custom, in-house, and premium plugins that have never been uploaded to WordPress.org.
2. Phase 2 (Active High-Speed Wordlist Probe): Rapidly scans backend-only / unrendered plugins using 50,000+ popularity-ranked official WordPress.org slugs with automatic connection-drop retries.

---

🎯 Intended Purpose: Labs & Exam Environments

This tool was designed to solve the bottlenecks encountered during time-sensitive security exams and lab environments (such as OSCP, CPTS, Hack The Box, TryHackMe, and Proving Grounds):

• ⚡ Real-Time Streaming Output (No Waiting): You do not need to wait for the full plugin list scan to finish! Any discovered plugin is printed to your screen immediately with its version, so you can begin researching exploits/CVEs within the first 10–20 seconds while the scan continues in the background.
• Catches Custom & Premium Plugins: Automatically spiders child links and checks REST API routes to detect private/in-house plugins even if they aren't in any public wordlist.
• Auto-Retry & Overload Protection: Automatically retries dropped connections and backs off if a low-spec lab VM throttles or rate-limits requests (429/503), ensuring zero missed plugins even at high concurrency.
• Zero External API Dependencies: Works completely offline against target machines once the wordlist is generated, requiring no cloud tokens or external API keys.
• CTF / Offsec Exam Friendly: Single standalone binary with zero runtime dependencies.

---

🚀 Key Features

• ⚡ Instant On-Screen Streaming: Discovered plugins appear on your terminal immediately the moment they are found.
• 🕷️ Strict Same-Domain Spider: Automatically crawls internal pages (configurable via -crawl) to extract plugin assets (/wp-content/plugins/<slug>/) embedded in HTML, scripts, and CSS—strictly ignoring external third-party domains.
• 🔌 REST API Route Discovery: Automatically queries /wp-json/ to discover plugins exposing custom API namespaces.
• 🔄 Self-Healing Connection Retries: Built-in auto-retry engine handles server socket exhaustion and transient network drops gracefully.
• 🌐 100% Official WordPress.org Sources: Directly queries api.wordpress.org for 50,000 popular plugins in exact rank order of active installations, and plugins.svn.wordpress.org for the historical archive.
• ⚡ Ultra-High Concurrency: Built with Go worker pools and an optimized http.Transport connection pool (reusing persistent TCP Keep-Alive sockets across hundreds of requests/second).
• 🛡️ Zero False Positives (Soft-404 Protection): Pre-flight baseline testing and strict validation (only accepts 403 Forbidden on folders or verified 200 OK on readme.txt files). Redirects to homepages/search pages are automatically discarded.
• 🔍 Version Detection: Automatically inspects and extracts Stable tag: or Version: from readme.txt upon directory discovery.
• ✨ Live Terminal Ticker: Clean, single-line in-place progress ticker ([scanned]/[total]) that cleanly prints discoveries without garbling output.

---

📋 Prerequisites

• Go 1.20 or newer installed (golang.org)

---

🛠️ Quick Start

1. Build or Update the Plugin List

To download and prioritize 50,000+ plugins from the official WordPress.org API and SVN:

go run scan.go -update

2. Run a Hybrid Scan

# Standard hybrid scan (Same-domain passive crawl + 50k active scan with auto-retry)
go run scan.go -u http://10.10.10.X

# Deep crawl (spider up to 30 same-domain internal pages)
go run scan.go -u http://10.10.10.X -crawl 30 -w 25

# Active scan only (skip passive spidering)
go run scan.go -u http://10.10.10.X -no-passive

3. Compile Standalone Binary (Optional)

# On Linux / macOS
go build -o wp-plugin-scanner scan.go
./wp-plugin-scanner -u http://10.10.10.X -w 25

# On Windows
go build -o wp-plugin-scanner.exe scan.go
.\wp-plugin-scanner.exe -u http://10.10.10.X -w 25

---

⚙️ Command-Line Options

Flag	Type	Default	Description
-u	string	(Required)	Target WordPress base URL (e.g., http://10.10.10.X or https://example.com)
-w	int	25	Number of concurrent workers (recommended 15–30 for lab VMs)
-crawl	int	15	Max internal child pages to spider strictly on the same host
-no-passive	bool	false	Skip passive HTML spidering and REST API inspection
-t	int	5	HTTP request timeout in seconds per plugin
-l	string	plugin_list.txt	Path to plugin wordlist file
-o	string	found_plugins.txt	Output file for detected findings
-update	bool	false	Re-download and prioritize 50,000+ plugins from WordPress.org API
-h, --help	bool	false	Show the help menu and exit

---

🧠 How It Works Under the Hood

Dual-Phase Detection Engine

flowchart TD
    A["Target URL"] --> B["Phase 1: Passive Same-Domain Spider & REST API Inspection"]
    B --> C["Spiders Internal HTML Pages (Strict Same-Host)"]
    B --> D["Queries /wp-json/ for Registered Plugin Namespaces"]
    C --> E["Discovers Custom & Premium In-House Plugins"]
    D --> E
    
    E --> F["Phase 2: Active 50k Wordlist Probe (With Auto-Retry)"]
    F --> G{"Is Directory 403 Forbidden?"}
    G -->|"Yes"| H["Mark FOUND (Folder Exists on Disk)"]
    G -->|"No"| I["Check /wp-content/plugins/<slug>/readme.txt"]
    I --> J{"Is 200 OK & has valid 'Stable tag / Version' header?"}
    J -->|"Yes"| K["Mark FOUND (readme.txt with Version)"]
    J -->|"No (404, or 301/302 redirect to homepage)"| L["DISCARD (Not Found)"]

Loading

---

📁 Output Format

Discovered plugins are saved to found_plugins.txt (or custom -o path) formatted as:

custom-auth-portal | Extracted from HTML: http://10.10.10.X/login/ | http://10.10.10.X/wp-content/plugins/custom-auth-portal/
gravityforms | Exposed via REST API Route (/wp-json/gravityforms/v2) | http://10.10.10.X/wp-content/plugins/gravityforms/
woocommerce | Status: 403 | Stable tag: 8.5.2 | http://10.10.10.X/wp-content/plugins/woocommerce/

---

🤖 Built With AI & 🤝 Contributing

This tool was designed and built with the assistance of AI to provide a modern, high-speed solution for WordPress reconnaissance in lab environments.

Contributions are warmly welcome! Whether you want to:

• Add theme enumeration support
• Improve version detection regex heuristics
• Add JSON output formatting
• Optimize concurrency further

Feel free to open an Issue or submit a Pull Request!

---

⚠️ Disclaimer & Authorized Use

Important

Intended for Educational & Authorized Security Assessments Only: This tool is developed specifically for use in cybersecurity labs (Hack The Box, TryHackMe, VulnHub), practical exam environments (OSCP, CPTS, etc.), and authorized penetration tests. Unauthorized scanning of third-party websites without prior written permission is strictly prohibited and may violate local laws and regulations.