WordPress User Enumeration
with WPScan on Kali Linux

This lab teaches a fundamental concept in penetration testing called user enumeration — the process of identifying valid account names on a target system. Before an attacker can attempt to log into WordPress, they need valid usernames. WordPress, by default, exposes this information in multiple public-facing locations.

Understanding this attack helps you as a defender to identify and fix the information leakage vulnerabilities in your own WordPress installations.

The lab uses two virtual machines running inside Oracle VirtualBox on a Windows 11 host. Both VMs share the same network, so they can communicate with each other and with other devices on your Wi-Fi.

Step 1 — VirtualBox Manager: Two VMs Side by Side

Open Oracle VirtualBox Manager. You will see two VMs listed. The Kali Linux VM should show "Running" status. If not, select it and click Start.

Step 2 — Logging into Kali Linux

When Kali boots, you will see a lock screen with its distinctive blue maze wallpaper. Enter the default credentials:

Step 3 — The Kali Linux Desktop & Tools Menu

After logging in, click the applications menu. Notice it is organised by MITRE ATT&CK phases — from Reconnaissance (01) to Forensics (15). This categorisation maps directly to real-world penetration testing workflows. For this lab, our work falls under 01 – Reconnaissance.

Step 4 — Booting the WordPress VM

Go back to VirtualBox Manager and start the WordPress VM. When it boots to a terminal screen, the Bitnami welcome banner immediately provides valuable intelligence — just by being visible on the console:

Step 5 — Finding the WordPress Server IP Address

Log in to the Bitnami WordPress console at the terminal prompt:

Once logged in, run the following command to find the server's IP address on your network:

ip address

In the output, ignore lo (loopback). Look at enp0s3 — this is your real network interface. The IP address shown is 192.168.18.8 (yours may differ depending on your router's DHCP range).

Step 6 — Open the Website in a Browser

On any device connected to the same Wi-Fi (your Windows host, a phone, or within Kali), open a browser and navigate to:

http://192.168.18.8

The site is confirmed running. We can now see it is a standard WordPress installation — making it the perfect target for WPScan. Three quick observations a real attacker would note:

• → HTTP only — no SSL/TLS encryption
• → Default theme — Études theme unchanged from installation
• → No login lockout visible — ready to accept multiple requests

WPScan is a free, open-source WordPress security scanner included in Kali Linux. It can automatically discover WordPress versions, plugins, themes, and — critically for this lab — valid usernames.

Step 7 — Running the WPScan Command

Open a Terminal Emulator in Kali Linux and run:

wpscan --url http://192.168.18.8 -e u

Here is exactly what each part of this command does:

WPScan will probe the site using two strategies: passive detection (reading publicly available pages) and aggressive detection (actively probing the WordPress API, login form, and author ID system).

WPScan successfully discovered 6 valid user accounts without knowing any passwords. Here is a full breakdown:

How Each Detection Method Works

Now that we understand how the enumeration works, here are the specific steps a WordPress administrator should take to defend against it:

// Disable the REST API user enumeration endpoint
add_filter('rest_endpoints', function($endpoints) {
  if (isset($endpoints['/wp/v2/users'])) {
    unset($endpoints['/wp/v2/users']);
  }
  return $endpoints;
});

In this lab, we built a complete isolated penetration testing environment, confirmed network connectivity between attacker and target, and used WPScan to successfully enumerate 6 valid WordPress user accounts — all without knowing any passwords in advance.

This demonstrates a core cybersecurity principle: information leakage. WordPress, by default, was not designed with attacker enumeration in mind. Multiple public-facing features expose usernames that were never meant to be easily harvested.

After this lab, you can:

• Set up a safe, isolated penetration testing lab using Oracle VirtualBox
• Identify IP addresses on virtual machines using the ip address command
• Explain what user enumeration is and why it is a security risk
• Use WPScan with the -e u flag to enumerate WordPress usernames
• Distinguish between passive and aggressive detection methods
• Implement at least 3 specific defences against WordPress user enumeration
• Identify the relevant MITRE ATT&CK tactic and technique for this attack

MITRE ATT&CK Mapping