I happened to look into wpscan, the tool for attacking WordPress, following tutorials demonstrated online, and found there are an awful lot of pitfalls.
Most of them are tutorials for old versions; the commands changed in the latest version — —wordlist has been dropped in favor of -P.
You need to register on the official site to generate a key and use it locally.
Also, you have to generate the password dictionary yourself with crunch; most weak passwords can be brute-forced.
Installation
sudo pip3 install usbrip
Query the USB list
sudo usbrip events history -q -n 100
