【Kali linux】WPScan + APIでWordPressを脆弱性診断した結果

Kali linux + WPScanでWordPressを脆弱性診断したときのアクセスログについてまとめました。

脆弱性診断したときのアクセスログ
関連記事

脆弱性診断したときのアクセスログ

XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:08 +0900] "HEAD /searchreplacedb2.php HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:08 +0900] "POST /xmlrpc.php HTTP/2.0" 403 1334 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:08 +0900] "HEAD /readme.html HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:08 +0900] "GET /readme.html HTTP/2.0" 200 3219 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:09 +0900] "HEAD /wp-content/debug.log HTTP/2.0" 301 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:09 +0900] "GET /wp-includes/rss-functions.php HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:11 +0900] "HEAD /wp-content/backup-db/ HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:11 +0900] "HEAD /installer-log.txt HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:11 +0900] "GET /wp-signup.php HTTP/2.0" 404 37215 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:13 +0900] "GET /wp-content/mu-plugins/ HTTP/2.0" 404 37215 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:13 +0900] "GET /wp-login.php?action=register HTTP/2.0" 404 36994 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:13 +0900] "GET /wp-content/uploads/ HTTP/2.0" 403 1334 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:15 +0900] "HEAD /wp-content/uploads/tmm_db_migrate/tmm_db_migrate.zip HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:17 +0900] "HEAD /wp-content/uploads/dump.sql HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:17 +0900] "HEAD /emergency.php HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:17 +0900] "GET /wp-cron.php HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:17 +0900] "HEAD /wp-includes/version.php HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:17 +0900] "GET /wp-includes/version.php HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:18 +0900] "GET /feed/ HTTP/2.0" 200 17728 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:19 +0900] "GET /comments/feed/ HTTP/2.0" 200 3684 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:21 +0900] "GET /wp-content/themes/cocoon-master/style.css?ver=6.4.2&fver=20231123123730 HTTP/2.0" 200 53851 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:24 +0900] "HEAD /wp-content/themes/cocoon-master/readme.txt HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:25 +0900] "HEAD /wp-content/themes/cocoon-master/README.txt HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:27 +0900] "HEAD /wp-content/themes/cocoon-master/README.md HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:27 +0900] "HEAD /wp-content/themes/cocoon-master/readme.md HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:27 +0900] "GET /wp-content/themes/cocoon-master/ HTTP/2.0" 200 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:29 +0900] "HEAD /wp-content/themes/cocoon-master/error_log HTTP/2.0" 404 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:30 +0900] "POST /wp-admin/admin-ajax.php HTTP/2.0" 200 51 "https://XXX.XXX/wp-admin/post.php?post=36357&action=edit" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:33 +0900] "GET /wp-json/wp/v2/users/?per_page=100&page=1 HTTP/2.0" 401 103 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:33 +0900] "GET /wp-json/oembed/1.0/embed?url=https://XXX.XXX/&format=json HTTP/2.0" 200 1120 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:33 +0900] "GET /feed/rss/ HTTP/2.0" 301 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:34 +0900] "GET /feed/ HTTP/2.0" 200 17728 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:34 +0900] "GET /wp-sitemap-users-1.xml HTTP/2.0" 200 438 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:34 +0900] "GET /author-sitemap.xml HTTP/2.0" 200 437 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "HEAD /?author=1 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "HEAD /?author=2 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "HEAD /?author=3 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "HEAD /?author=4 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "HEAD /?author=5 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "GET /?author=1 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "GET / HTTP/2.0" 200 54018 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "GET /?author=2 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:35 +0900] "HEAD /?author=6 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:36 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:36 +0900] "GET /?author=3 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:36 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:36 +0900] "GET /?author=4 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:36 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:36 +0900] "GET /?author=5 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "HEAD /?author=7 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "HEAD /?author=8 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "HEAD /?author=9 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "HEAD /?author=10 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "GET /?author=6 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "GET /?author=7 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:37 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:38 +0900] "GET /?author=8 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:38 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:38 +0900] "GET /?author=9 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:38 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:39 +0900] "GET /?author=10 HTTP/2.0" 302 0 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:39 +0900] "GET / HTTP/2.0" 200 41643 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"
XXX.XXX [IPアドレス] - - [28/Jan/2024:08:51:39 +0900] "GET /wp-login.php HTTP/2.0" 404 36994 "https://XXX.XXX/" "WPScan v3.8.25 (https://wpscan.com/wordpress-security-scanner)"