CompTIA PenTest+ Practice Test

Which CLI tool is a free black box security scanner specifically designed for testing WordPress security?

1. Nmap

2. WPScan

3. Burp Suite

4. OpenVAS

The correct answer is: WPScan

WPScan is recognized as a free black box security scanner tailored specifically for testing the security of WordPress installations. It is designed to identify vulnerabilities and potential issues that could be exploited in a WordPress site, making it an essential tool for penetration testers and security professionals working with WordPress. WPScan operates by scanning WordPress sites for a variety of security-related aspects, such as outdated plugins, themes, and WordPress core versions, as well as common vulnerabilities that might provide an entry point for attackers. The tool effectively collects information about the site without needing access to the server or the underlying code, making it particularly valuable for black box testing. Other tools mentioned are broader or serve different purposes. For example, Nmap is primarily used for network scanning and discovering devices on a network, while Burp Suite is a comprehensive tool for web application security testing, not specifically focused on WordPress. OpenVAS is an open-source vulnerability scanner that can assess a wide range of services but isn't specifically geared toward WordPress. Therefore, WPScan stands out as the purpose-built solution for WordPress security scanning.