  Every attack begins with gathering information about the target. The entry
point for network breaches are often vulnerabilities in internet facing
websites, which often rely on an off-the-shelf Content Management System (CMS).
Bot networks and human attackers alike rely on automated scanners to gather
information about the CMS software installed and potential vulnerabilities. To
increase the security of websites using a CMS, it is desirable to make the use
of CMS scanners less reliable. The aim of this work is to extend the current
knowledge about cyber deception in regard to CMS. To demonstrate this, a
WordPress Plugin called 'SCANTRAP' was created, which uses simulation and
dissimulation in regards to plugins, themes, versions, and users. We found that
the resulting plugin is capable of obfuscating real information and to a
certain extent inject false information to the output of one of the most
popular WordPress scanners, WPScan, without limiting the legitimate
functionality of the WordPress installation.

Cryptography and Security