Scopex

🇺🇸 English | 🇪🇸 Español

Scopex is a fast, terminal-based reconnaissance tool designed to analyze WordPress targets while strictly respecting scope boundaries. It focuses on visibility, clarity, and safety, helping bug bounty hunters and ethical hackers understand the WordPress attack surface before doing any exploitation.

---

Lightweight Scope-Aware WordPress Reconnaissance Tool

Version 2.2

This tool is WordPress-only by design. (Intended to change in the future)

---

✨ Features

🧭 Scope-Aware Scanning

• Enforces scope rules from a dedicated scopes/ directory

• Supports:

  • Root domains (example.com)
  • Subdomains (admin.example.com)
  • Wildcards (*.example.com)

• Automatically skips out-of-scope targets

• Prevents accidental scanning of unauthorized assets

---

🧠 WordPress Detection

Detects WordPress using multiple indicators:

• Common WordPress paths
• REST API presence
• HTML content analysis

If WordPress is not detected, the scan stops early.

---

🔎 WordPress Reconnaissance

Once WordPress is detected, ScopeX performs:

• WordPress version detection

• Passive plugin discovery:

  • Direct plugin paths
  • REST API references

• Detection of exposed sensitive files:

  • wp-config.php
  • .env
  • .git/config
  • Debug logs

• REST API route analysis

• User enumeration via REST API (non-intrusive)

• Brute force protection detection

• CVE lookup for detected WordPress version

• Automatic risk scoring and classification

---

📊 Risk Assessment Engine

Each target receives a risk score (0–100) based on findings such as:

• Confirmed critical file exposure
• User enumeration
• Missing brute force protection
• Development / unstable WordPress versions

Risk levels:

• INFO
• LOW
• MEDIUM
• HIGH
• CRITICAL

---

📄 Output & Reporting

Scopex generates:

• Detailed per-target reports (.txt)
• Optional JSON output (--json)
• A global summary report for all scanned targets

All results are saved inside the output/ directory.

---

📁 Project Structure

ScopeX/
│
├── scopex.py
├── requirements.txt
├── README.md
├── README_ES.md
│
├── scopes/
│   └── scope.txt        # example scope file
│
└── output/
    └── .gitkeep         # output files are generated at runtime

---

🚀 Installation

Clone the repository:

git clone https://github.com/urdev4ever/ScopeX.git
cd ScopeX

Install dependencies:

pip install -r requirements.txt

---

🛠️ Usage

python scopex.py [-h] [--url URL] [--list LIST] [--scope SCOPE] [--json] [--verbose] [--silent]

Scan a single target

python scopex.py --url example.com

---

Scan with scope enforcement

python scopex.py --url example.com --scope scope.txt

The scope file must be located inside the scopes/ directory. (Important!)

---

Scan multiple targets from a file

python scopex.py --list targets.txt

This will NOT filter out-of-scope elements.

---

JSON output

python scopex.py --url example.com --json

---

Verbose mode (show REST API routes)

python scopex.py --url example.com --verbose

---

Silent mode (no console output)

python scopex.py --url example.com --silent

---

📌 Scope File Format (scopes/scope.txt)

# Scopex scope file
# One entry per line
# Lines starting with # are comments

example.com
*.example.com
api.example.com
admin.example.com

Rules

• ❌ Do NOT include http:// or https://
• ❌ Do NOT include paths or ports
• ✅ Wildcards must start with *.

---

📂 Output Files

Generated automatically inside output/:

• {target}_{timestamp}.txt
• {target}_{timestamp}.json (if --json is enabled)
• summary_{timestamp}.txt

---

🎯 Example Output

In this example the command used was:

python scopex.py --url wordpress.org

Output:

.

.

.

.

---

🚫 What Scopex Does NOT Do

Scopex intentionally avoids:

• Exploitation
• Brute-force attacks
• Password guessing
• Payload injection
• Active fuzzing
• Aggressive crawling

It is a reconnaissance and assessment tool, not an exploitation framework.

---

🎯 Intended Audience

• Bug bounty hunters (early recon phase)
• Ethical hackers
• Pentesters needing WordPress visibility
• Anyone who wants clean recon without tool bloat

---

⚠️ Disclaimer

This tool is intended for authorized security testing only. The author is not responsible for misuse.

---

🧠 Philosophy

“Recon is about understanding the surface — not attacking it.”

Scopex helps you:

• Stay in scope
• Reduce noise
• Identify real priorities
• Decide what to test manually

---

Made with <3 by URDev.