WordPress - First CMS

First CMS up is wordpress.

WordPress allows a user to easily create a website or blog. WordPress is free and allows people to create/improve the main functioning code and develop plugins and themes.

WordPress is located at: http://wordpress.org/

WordPress themes are located at: http://wordpress.org/themes/

WordPress plugins are located at: http://wordpress.org/plugins/

I will be installing an older version of WordPress: version 3.3 (http://wordpress.org/wordpress-3.3.zip)

I know this is a vulnerable version and will be looking at those from then to the current version. I will be looking at plugin that have been identified vulnerable since that version release and how they might have made a secure version of WordPress insecure.

First Post

This is the start, what this is all about. I will take the top Content Management Systems (CMS) install them to a Virtual Machine (VM) and look at these things.

• default usernames, passwords, databases.
• permissions on creating content, managing content, and deleting content.
• what vectors are might be vulnerable and how to find more information that could lead to exploitation. 
• Demonstrate walking through the application with Burp (http://portswigger.net/) and Zap (https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)

In some cases an older version of the software maybe used to find already identified vulnerabilities. The code will then be evaluated to show what improvements were made.