> For the complete documentation index, see [llms.txt](https://hackzzz.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackzzz.gitbook.io/welcome/everything-about-and-notes/web-pentesting/cms/wpscan.md).

# Wpscan

{% tabs %}
{% tab title="Enum All" %}
wpscan --url http\:// -e vp, ap, p, vt, at, t, tt, cb, dbe, u, m # Enumerate all
{% endtab %}

{% tab title="Brute-Force" %}
wpscan –url \<target> -P \<path/to/your/wordlist.txt>

* Change detection from passive, aggressive, and mixed: –detection-mode \<mode>
* Use a random user-agent on a scan (useful when blocked by a WAF): –random-user-agent
* Select a list of users to be targeted during a password brute force attack: -U \<path/to/your/userlist.txt>
  {% endtab %}
  {% endtabs %}