Skip to content

WordPress BAZOOKA v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@ayinedjimi ayinedjimi released this 21 May 07:56
· 16 commits to master since this release
v1.0.0
94ab7c2

WordPress BAZOOKA v1.0.0 — Initial public release

Automated WordPress penetration testing & security audit framework

📦 Download

  • bazooka.exe — single portable Windows executable (35 MB, no Python needed)
  • Source: git clone or .zip
bazooka.exe scan https://target.com           # CLI scan
bazooka.exe gui                                # Web UI on http://localhost:8666
bazooka.exe doctor                             # Check prerequisites

Highlights

  • 40x faster than WPScan in real-world benchmarks (~2 min vs ~96 min)
  • 135x fewer HTTP requests (1 129 vs 153 078)
  • 0 false positives vs WPScan's 3 (user/theme misclassified as plugins)
  • CVE matching without API token via free wpvulnerability.net live feed
  • Multi-vector user enum (REST, ?author=N, oEmbed, sitemap)
  • Plugins + Core + Infrastructure CVE (Apache, nginx, PHP, MySQL, MariaDB, Redis, Memcached)
  • Real-time web GUI (FastAPI + WebSocket) with live progress, animated activity bar
  • Reports: HTML, DOCX, JSON with OWASP/CWE/MITRE mapping

Benchmark on DVWP (Damn Vulnerable WordPress + extended lab)

  • Detected 4/4 ground truth CVE plugins
  • 29 plugins fingerprinted (vs 6 by passive-only scanners)
  • 144 plugin CVE matches via live wpvulnerability.net

Companion project

wordpress-vulnerable-lab — 39+ CVE plugins, 12 WP core CVE, 8 infra CVE, 11 misconfigs, 5 weak creds = 82 verifiable vulnerabilities in a ready-to-scan Docker WP lab.

From source

git clone https://github.com/ayinedjimi/wordpress-bazooka
cd wordpress-bazooka
pip install -e .
bazooka scan https://target.com
python run_gui.py  # web UI on :8666

Author: Ayi NEDJIMI · ayinedjimi-consultants.fr

Assets 3
Loading