🚀 WP Finger

Fast, lightweight, high-coverage WordPress fingerprinting tool written in Go.
Built for Bug Bounty, Attack Surface Management, and large-scale reconnaissance with a focus on detecting WordPress installations—not just extracting versions.

---

✨ Features

• ⚡ High-speed concurrent scanning
• 🎯 High-coverage WordPress detection
• 🔍 Smart endpoint probing (wp-json, xmlrpc, wp-login, readme)
• 📦 Lightweight HTTP requests with connection reuse
• 📈 Version extraction when available
• 📊 Real-time progress and statistics
• 🔁 Automatic URL deduplication

---

🎯 Purpose

WP Finger was built to reliably identify WordPress websites during reconnaissance.

Unlike traditional fingerprinting tools that rely heavily on version extraction, WP Finger focuses on accurate WordPress detection even when the version is hidden or intentionally removed.

---

🔬 Research

This project was developed during research related to:

• CVE-2025-49596
• CVE-2025-49597

---

⚡ Installation

git clone https://github.com/algamil7x/wp-finger.git
cd wp-finger

go mod tidy

go build -o wp-finger wp-finger.go

---

🚀 Usage

Basic usage:

./wp-finger

Custom input/output:

./wp-finger -l alive.txt -o wordpress.txt

Custom workers & timeout:

./wp-finger -w 100 -t 10

---

📄 Output

https://example.com | 6.9.3 | wp-json,xmlrpc,generator
https://site.com | Unknown | wp-content,wp-login,api.w.org

---

⚙️ Options

Flag	Default	Description
-l	alive.txt	Input file
-o	wordpress.txt	Output file
-w	50	Number of concurrent workers
-t	5	Request timeout (seconds)

---

📬 Contact

Author: algamil7x

• GitHub: https://github.com/algamil7x
• X (Twitter): https://x.com/algamil7x

---

📜 License

This project is released under the MIT License.