WAFっていいな。簡単なペネトレ全部防げそう
root@dev-bot:~# nmap example.com
Starting Nmap 7.95 ( https://nmap.org ) at 2026-11-03 13:22 UTC
Nmap scan report for nmap example.com (104.21.20.26)
Host is up (0.0046s latency).
Other addresses for nmap example.com (not scanned): 172.67.190.251 2606:4700:3037::6815:141a 2606:4700:3035::ac43:befb
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 4.74 seconds
curl -I example.com
#---
HTTP/1.1 200 OK
Date: Tue, 03 Nov 2026 13:24:38 GMT
Content-Type: text/html
Connection: keep-alive
CF-Cache-Status: HIT
Cache-Control: public, max-age=0, must-revalidate
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Pbe8W5nVe0oNQVKN8w0qKmjlbI...略"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
CF-RAY: a54bb34f3c92d472-NRT
alt-svc: h3=":443"; ma=86400
何のページがあるのかわからない..そんなときはこれ。
zenn.dev
note.com
github.com/matteo741/Gobuster/blob/main/wordlist.…
sudo apt update && sudo apt install -y gobuster dirb
#gobuster --help
gobuster dir -u http://study-hack-come.com -w /usr/share/wordlists/dirb/common.txt
wordlist1.txtにワードのリストをはりつけ。
gobuster dir -u https://example.com -w wordlist1.txt
結果
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: https://example.com
[+] Method: GET
[+] Threads: 10
[+] Wordlist: wordlist1.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/robots.txt (Status: 200) [Size: 1248]
/wp-config.php (Status: 403) [Size: 4917]
/admin (Status: 401) [Size: 27]
/index (Status: 307) [Size: 0] [--> /]
Progress: 1828 / 1829 (99.95%)
===============================================================
Finished
===============================================================
gobuster dir -u https://example.com -w wordlist1.txt -x php,html,txt -o gobuster-basic.txt
結果
# gobuster-basic.txtからでも確認できる。
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: https://example.com
[+] Method: GET
[+] Threads: 10
[+] Wordlist: wordlist1.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: php,html,txt
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/robots.txt (Status: 200) [Size: 1248]
/wp-config.php (Status: 403) [Size: 4917]
/wp-config.php.html (Status: 403) [Size: 4917]
/wp-config.php.php (Status: 403) [Size: 4917]
/wp-config.php.txt (Status: 403) [Size: 4917]
/admin (Status: 401) [Size: 27]
/index.html (Status: 307) [Size: 0] [--> /]
/index (Status: 307) [Size: 0] [--> /]
Progress: 7312 / 7316 (99.95%)
===============================================================
Finished
===============================================================
robots.txtを確認する。
検索エンジンのクローラーにここは検索結果に載せるなと指示する設定ファイル
curl -s https://example.com/robots.txt
特になにもなかった。
# As a condition of accessing this website, you agree to abide by the following
# content signals:
# (a) If a content-signal = yes, you may collect content for the corresponding
# use.
# (b) If a content-signal = no, you may not collect content for the
# corresponding use.
# (c) If the website operator does not include a content signal for a
# corresponding use, the website operator neither grants nor restricts
# permission via content signal with respect to the corresponding use.
# The content signals and their meanings are:
# search: building a search index and providing search results (e.g., returning
# hyperlinks and short excerpts from your website's contents). Search does not
# include providing AI-generated search summaries.
# ai-input: inputting content into one or more AI models (e.g., retrieval
# augmented generation, grounding, or other real-time taking of content for
# generative AI search answers).
# ai-train: training or fine-tuning AI models.
# ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
# RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
# AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.
WordPress専用スキャンを試す
cubepath.com
sudo apt update
sudo apt install curl unzip jq
NUCLEI_VERSION=$(curl -fsSL https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | jq -r .tag_name | sed 's/^v//')
echo "$NUCLEI_VERSION"
cd "$(mktemp -d)"
curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_linux_amd64.zip"
curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_checksums.txt"
sha256sum --check --ignore-missing "nuclei_${NUCLEI_VERSION}_checksums.txt"
# nuclei_3.11.1_linux_amd64.zip: OK を期待
unzip nuclei_*_linux_amd64.zip nuclei
sudo install -m 0755 nuclei /usr/local/bin/nuclei
nuclei -version
#バージョン表示を確認
テンプレートをダウンロードする
nuclei -update-templates
ファイルを確認
ls /root/nuclei-templates
#---
CODE_OF_CONDUCT.md TEMPLATES-STATS.md headless
CONTRIBUTING.md TOP-10.md helpers
LICENSE.md cloud http
PULL_REQUEST_TEMPLATE.md code javascript
README_CN.md contributors.json network
README_JA.md cves.json profiles
README_KR.md cves.json-checksum.txt ssl
TEMPLATE-CREATION-GUIDE.md dast templates-checksum.txt
TEMPLATE-REVIEW-GUIDE.md dns workflows
TEMPLATES-STATS.json file
試しに実行
nuclei -u https://example.com -severity high,critical -rate-limit 50 -stats
結果
[INF] Scan completed in 3m. 0 matches found.
[INF] HTTP connections: 5911 total, 1894 new, 4017 reused (68.0%)
[0:03:06] | Templates: 4457 | Hosts: 1 | RPS: 57 | Matched: 0 | Errors: 22 | Requests: 10615/10782 (98%)
なにもなしと。
本題のwordpress
topscoder/nuclei-wordfence-cve
export GITHUB_TEMPLATE_REPO=topscoder/nuclei-wordfence-cve
nuclei -update-templates
期待する結果
[INF] No new updates found for nuclei templates
[INF] Repo topscoder/nuclei-wordfence-cve cloned successfully at /root/nuclei-templates/github/topscoder/nuclei-wordfence-cve
早速試す
nuclei -t github/topscoder/nuclei-wordfence-cve -u https://example.com -o results.jsonl
# Deepl
# 特定の CVE に関連する脆弱性をスキャンするには
# nuclei -t github/topscoder/nuclei-wordfence-cve -template-id cve-2023-32961 -u https://target.com
# 重大なものだけスキャン
# nuclei -t github/topscoder/nuclei-wordfence-cve -severity critical -u https://target.com
# WordPress コアの脆弱性のみをスキャンするには、次のコマンドを実行します。
# nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-core -u https://target.com
# WordPress プラグインの脆弱性のみをスキャンするには、次のコマンドを実行してください：
# nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com
nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com
nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u rico-diary.com
jqを使って深刻度ごとに表示
jq -r '.info.severity' results.jsonl | sort | uniq -c
CMSeekを試す WebサイトのCMS検出・脆弱性スキャンツール
Tuhinshubhra/CMSeeK
sudo apt update
sudo apt install git python3 python3-pip -y
git clone https://github.com/Tuhinshubhra/CMSeeK
cd CMSeeK
curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc
#source ~/.bashrc
uv venv && source .venv/bin/activate
uv pip install -r requirements.txt
試す
python3 cmseek.py -u example.com
Niktoを試す
omomuki-tech.com
sudo apt update
sudo apt install -y perl libxml-parser-perl libxml-writer-perl
git clone https://github.com/sullo/nikto.git
cd nikto/program
perl nikto.pl -Version
試す
perl nikto.pl -h https://example.com -ssl
# 80の時は
perl nikto.pl -h http://example.com
保存形式
# テキスト形式で保存
perl nikto.pl -h http://example.com -o scan_result.txt -Format txt
# HTML形式で保存
perl nikto.pl -h http://example.com -o scan_result.html -Format htm
# CSV形式で保存
perl nikto.pl -h http://example.com -o scan_result.csv -Format csv
# XML形式で保存
perl nikto.pl -h http://example.com -o scan_result.xml -Format xml
# JSON形式で保存
perl nikto.pl -h http://example.com -o scan_result.json -Format json
結果をみる。
- Nikto v2.6.1/
+ Target Host: example.com
+ Target Port: 443
+ GET /: An alt-svc header was found which is advertising HTTP/3. The endpoint is: ':443'. Nikto cannot test HTTP/3 over QUIC. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/alt-svc:
+ GET /: Cloudflare detected via cf-ray header. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks. See: https://github.com/sullo/nikto/wiki/Using-a-Proxy:
+ SSL Info: Subject: /CN=example.com
CN: example.com
SAN: example.com, www.example.com, *.www.example.com
Ciphers: TLS_AES_256_GCM_SHA384
Issuer: /C=US/O=Google Trust Services/CN=WE1
+ GET /: cloudflare - Cloudflare detected via banner. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks if not already proxying.
SSL/TLS証明書検索
platform.censys.io
Mentions
WAFっていいな。簡単なペネトレ全部防げそう root@dev-bot:~# nmap example.com Starting Nmap 7.95 ( https://nmap.org ) at 2026-11-03 13:22 UTC Nmap scan report for nmap example.com (104.21.20.26) Host is up (0.0046s latency). Other addresses for nmap example.com (not scanned): 172.67.190.251 2606:4700:3037::6815:141a 2606:4700:3035::ac43:befb Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 4.74 seconds curl -I example.com #--- HTTP/1.1 200 OK Date: Tue, 03 Nov 2026 13:24:38 GMT Content-Type: text/html Connection: keep-alive CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Pbe8W5nVe0oNQVKN8w0qKmjlbI...略"}]} Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server: cloudflare CF-RAY: a54bb34f3c92d472-NRT alt-svc: h3=":443"; ma=86400 何のページがあるのかわからない..そんなときはこれ。 zenn.dev note.com github.com/matteo741/Gobuster/blob/main/wordlist.… sudo apt update && sudo apt install -y gobuster dirb #gobuster --help gobuster dir -u http://study-hack-come.com -w /usr/share/wordlists/dirb/common.txt wordlist1.txtにワードのリストをはりつけ。 gobuster dir -u https://example.com -w wordlist1.txt 結果 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: https://example.com [+] Method: GET [+] Threads: 10 [+] Wordlist: wordlist1.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /robots.txt (Status: 200) [Size: 1248] /wp-config.php (Status: 403) [Size: 4917] /admin (Status: 401) [Size: 27] /index (Status: 307) [Size: 0] [--> /] Progress: 1828 / 1829 (99.95%) =============================================================== Finished =============================================================== gobuster dir -u https://example.com -w wordlist1.txt -x php,html,txt -o gobuster-basic.txt 結果 # gobuster-basic.txtからでも確認できる。 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: https://example.com [+] Method: GET [+] Threads: 10 [+] Wordlist: wordlist1.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /robots.txt (Status: 200) [Size: 1248] /wp-config.php (Status: 403) [Size: 4917] /wp-config.php.html (Status: 403) [Size: 4917] /wp-config.php.php (Status: 403) [Size: 4917] /wp-config.php.txt (Status: 403) [Size: 4917] /admin (Status: 401) [Size: 27] /index.html (Status: 307) [Size: 0] [--> /] /index (Status: 307) [Size: 0] [--> /] Progress: 7312 / 7316 (99.95%) =============================================================== Finished =============================================================== robots.txtを確認する。 検索エンジンのクローラーにここは検索結果に載せるなと指示する設定ファイル curl -s https://example.com/robots.txt 特になにもなかった。 # As a condition of accessing this website, you agree to abide by the following # content signals: # (a) If a content-signal = yes, you may collect content for the corresponding # use. # (b) If a content-signal = no, you may not collect content for the # corresponding use. # (c) If the website operator does not include a content signal for a # corresponding use, the website operator neither grants nor restricts # permission via content signal with respect to the corresponding use. # The content signals and their meanings are: # search: building a search index and providing search results (e.g., returning # hyperlinks and short excerpts from your website's contents). Search does not # include providing AI-generated search summaries. # ai-input: inputting content into one or more AI models (e.g., retrieval # augmented generation, grounding, or other real-time taking of content for # generative AI search answers). # ai-train: training or fine-tuning AI models. # ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF # RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT # AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET. WordPress専用スキャンを試す cubepath.com sudo apt update sudo apt install curl unzip jq NUCLEI_VERSION=$(curl -fsSL https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | jq -r .tag_name | sed 's/^v//') echo "$NUCLEI_VERSION" cd "$(mktemp -d)" curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_linux_amd64.zip" curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_checksums.txt" sha256sum --check --ignore-missing "nuclei_${NUCLEI_VERSION}_checksums.txt" # nuclei_3.11.1_linux_amd64.zip: OK を期待 unzip nuclei_*_linux_amd64.zip nuclei sudo install -m 0755 nuclei /usr/local/bin/nuclei nuclei -version #バージョン表示を確認 テンプレートをダウンロードする nuclei -update-templates ファイルを確認 ls /root/nuclei-templates #--- CODE_OF_CONDUCT.md TEMPLATES-STATS.md headless CONTRIBUTING.md TOP-10.md helpers LICENSE.md cloud http PULL_REQUEST_TEMPLATE.md code javascript README_CN.md contributors.json network README_JA.md cves.json profiles README_KR.md cves.json-checksum.txt ssl TEMPLATE-CREATION-GUIDE.md dast templates-checksum.txt TEMPLATE-REVIEW-GUIDE.md dns workflows TEMPLATES-STATS.json file 試しに実行 nuclei -u https://example.com -severity high,critical -rate-limit 50 -stats 結果 [INF] Scan completed in 3m. 0 matches found. [INF] HTTP connections: 5911 total, 1894 new, 4017 reused (68.0%) [0:03:06] | Templates: 4457 | Hosts: 1 | RPS: 57 | Matched: 0 | Errors: 22 | Requests: 10615/10782 (98%) なにもなしと。 本題のwordpress topscoder/nuclei-wordfence-cve export GITHUB_TEMPLATE_REPO=topscoder/nuclei-wordfence-cve nuclei -update-templates 期待する結果 [INF] No new updates found for nuclei templates [INF] Repo topscoder/nuclei-wordfence-cve cloned successfully at /root/nuclei-templates/github/topscoder/nuclei-wordfence-cve 早速試す nuclei -t github/topscoder/nuclei-wordfence-cve -u https://example.com -o results.jsonl # Deepl # 特定の CVE に関連する脆弱性をスキャンするには # nuclei -t github/topscoder/nuclei-wordfence-cve -template-id cve-2023-32961 -u https://target.com # 重大なものだけスキャン # nuclei -t github/topscoder/nuclei-wordfence-cve -severity critical -u https://target.com # WordPress コアの脆弱性のみをスキャンするには、次のコマンドを実行します。 # nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-core -u https://target.com # WordPress プラグインの脆弱性のみをスキャンするには、次のコマンドを実行してください： # nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u rico-diary.com jqを使って深刻度ごとに表示 jq -r '.info.severity' results.jsonl | sort | uniq -c CMSeekを試す WebサイトのCMS検出・脆弱性スキャンツール Tuhinshubhra/CMSeeK sudo apt update sudo apt install git python3 python3-pip -y git clone https://github.com/Tuhinshubhra/CMSeeK cd CMSeeK curl -LsSf https://astral.sh/uv/install.sh | sh source ~/.bashrc #source ~/.bashrc uv venv && source .venv/bin/activate uv pip install -r requirements.txt 試す python3 cmseek.py -u example.com Niktoを試す omomuki-tech.com sudo apt update sudo apt install -y perl libxml-parser-perl libxml-writer-perl git clone https://github.com/sullo/nikto.git cd nikto/program perl nikto.pl -Version 試す perl nikto.pl -h https://example.com -ssl # 80の時は perl nikto.pl -h http://example.com 保存形式 # テキスト形式で保存 perl nikto.pl -h http://example.com -o scan_result.txt -Format txt # HTML形式で保存 perl nikto.pl -h http://example.com -o scan_result.html -Format htm # CSV形式で保存 perl nikto.pl -h http://example.com -o scan_result.csv -Format csv # XML形式で保存 perl nikto.pl -h http://example.com -o scan_result.xml -Format xml # JSON形式で保存 perl nikto.pl -h http://example.com -o scan_result.json -Format json 結果をみる。 - Nikto v2.6.1/ + Target Host: example.com + Target Port: 443 + GET /: An alt-svc header was found which is advertising HTTP/3. The endpoint is: ':443'. Nikto cannot test HTTP/3 over QUIC. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/alt-svc: + GET /: Cloudflare detected via cf-ray header. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks. See: https://github.com/sullo/nikto/wiki/Using-a-Proxy: + SSL Info: Subject: /CN=example.com CN: example.com SAN: example.com, www.example.com, *.www.example.com Ciphers: TLS_AES_256_GCM_SHA384 Issuer: /C=US/O=Google Trust Services/CN=WE1 + GET /: cloudflare - Cloudflare detected via banner. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks if not already proxying. SSL/TLS証明書検索 platform.censys.io