⚡ Deep reconnaissance • Passive scanning • Zero exploitation
WP-Dex is a powerful Python-based tool designed to gather detailed intelligence about WordPress websites without modifying or attacking the target.
WP-Dex is a passive reconnaissance tool built for security researchers, developers, and ethical hackers.
It collects publicly accessible data from WordPress websites and presents it in a structured, readable format.
Unlike aggressive tools, WP-Dex does NOT exploit vulnerabilities — it only reveals what is already exposed.
Confirms if a target is running WordPress using multiple indicators.
Detects server type, PHP version, CDN/WAF, and technologies like jQuery, Bootstrap, WooCommerce, Elementor.
Extracts version from meta tags, feeds, readme files, and scripts.
Discovers usernames via REST API, author ID, sitemaps, and oEmbed.
Extracts emails from page content and mailto links.
Finds plugins via source analysis, probing, and database matching.
Identifies themes and extracts metadata like version and author.
Maps pages, posts, categories, tags, and menus.
Extracts social profiles and phone numbers.
Matches plugins with known CVEs using offline database.
Checks exposed paths and analyzes HTTP security headers.
git clone https://github.com/DotX-47/WP-Dex.git
cd WP-Dex
pip install requests beautifulsoup4python WP-Dex https://example.com
- Terminal (structured output)
- JSON report (optional)
Use only on websites you own or have permission to test.
DotX-47