Skip to content

Brute force WordPress sites vulnerabile to XML-RPC amplification.

Notifications You must be signed in to change notification settings

jeonghoonkim/wpxmlrpcbrute

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 

Repository files navigation

WordPress XML-RPC Brute Force Amplification Attack

This script uses a vulnerability discovered in the XML-RPC implementation in WordPress to brute force user accounts. This allows for amplification of hundreds (or thousands) of requests per individual HTTP(s) request. For more details on the attack, see the related blog post on sucuri.net.

NOTE: As of WordPress 4.4, this amplification method no longer works. All system.multicall requests via XML-RPC fail after the first authentication failure. See https://core.trac.wordpress.org/ticket/34336 for more details.

Usage

usage: wpxmlrpcbrute.py [-h] [-c COUNT] [-t THREADS] [-u USER] [-l LEVEL]
                        url wordlist

positional arguments:
  url                   URL of WordPress site to brute force
  wordlist              Path of the password list to use

optional arguments:
  -h, --help            show this help message and exit
  -c COUNT, --count COUNT
                        Number of passwords to send in each request. Default:
                        100
  -t THREADS, --threads THREADS
                        Number of threads to spawn. Default: 4
  -u USER, --user USER  WordPress username to brute force. Default: admin
  -l LEVEL, --level LEVEL
                        Log level (1-5). 1 = debug, 5 = critical. Default: 1

Examples

$ ./wpxmlrpcbrute.py -c 1500 -u admin http://example.com/ wordlists/grimwepa_pw.txt

TODO

  • Exception handling within threads
  • Better feedback in UI. Debug log output works, but it isn't so clean.
  • Track number of total requests and attempts

About

Brute force WordPress sites vulnerabile to XML-RPC amplification.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%