Even though I believe that security experts should be the ones to carry out penetration tests, it is always important for us developers to understand how make our web applications more secure.

An article how to test your blog or WordPress installation using Kali Linux.

https://deliciousbrains.com/wordpress-penetration-testing/

There are some tools which are not WordPress focused therefore it is worth reading even if you are not into WP.