Use wp-cli ?

[erwanlr]

Install & use wp-cli to manage the WP (add users, plugins, posts etc), will be easier I think :)

[firefart]

i think i will go with a database dump and a specific WP version. Plugins only extracted and can be enabled one by one by the user (to also have the plugin install hooks executed). What do you think?

[firefart]

Just for clarification: I don't like wp-cli because maybe it misses some things done by wordpress itself. going with a DB dump and a specific version will be cleaner and more reliable

[erwanlr]

Doesn't make any sense :o

Why would the users have to enable the plugins ? They won't even have the admin pasword (unless they look over here :D)

The goal is to provide a vulnerable instance, so if users have to enable the vulnerabilities (plugins / themes) themselves, I don't get it and it will be really annoying for them (the users).

Edit (for your new comment): you will have to explain how you plan to built the instance when something is modified then. You run the WP install via the docker then enabled all the things manually and push the new container to https://registry.hub.docker.com/u/wpscanteam/vulnerablewordpress/ ?

[firefart]

The plan is to deploy multiple vulnerable plugins, but enable only some of them by default. So the user can play with his installation. The dump (created with mysqldump) will be inserted in the DB on start of the container. The admin password could also be a docker parameter, but it should be smth easy crackable

i don't like to mess around with third party tools in a wordpress installation because there is so much stuff going on in the background

[erwanlr]

We don't have the same goal/idea regarding this 'vulnerable wp creation' then :/

[firefart]

so what's your goal than? Maybe we can implement both or a merge of both ideas

[erwanlr]

To create a ready to run WP blog with known vulns and some other things (see my email sent yesterday where I posted the script I was using for creating the hackme). And to add more stuff, we just have to edit the dockerfile and let the build create all for us

A bit like the wpscan docker thing, you pull the docker and can start to play :)

[firefart]

jeah but what would be the benefit of using wp-cli instead of a DB dump?