+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Access to a websites /wp-admin/ folder (/showthread.php?tid=4812665)
Access to a websites /wp-admin/ folder - Petrichor - May 8, 2015
Hey everyone,
Usually, I'm prompted to log in when browsing to a sites /wp-admin/ folder. However, I found a site where it shows me the index (directory) of the /wp-admin/ folder instead of the login form (how is this actually possible?) and thus I have access to all files.
Is there anything I could gain from having this kind of access?
Thanks in advance!
* - centauri - May 8, 2015
it's happening cuz the admin of this site or some ( hacker ) removed index.php file and you can't do anything with this
* - Petrichor - May 8, 2015
(May 8, 2015 02:39 PM)centauri Wrote: it's happening cuz the admin of this site or some ( hacker ) removed index.php file and you can't do anything with thisThank you for your reply. This leaves me a little puzzled, because in fact, index.php is included in the /wp-admin/ directory. Opening the file shows me php code. How would the admin access his wp dashboard in this case?
* - Kiddie - May 8, 2015
hey dude, try 0 day exploits. I know a good site. Please write me a message!
* - n0cent - May 9, 2015
(May 8, 2015 02:50 PM)Petrichor Wrote: Thank you for your reply. This leaves me a little puzzled, because in fact, index.php is included in the /wp-admin/ directory. Opening the file shows me php code. How would the admin access his wp dashboard in this case?
In that case the configuration of the folder has been changed both to ignore index pages and to parse php as text. Sounds like the site has already been hacked because I doubt the admin would do that. Anyway, you still can't do anything as far as logging into wp-admin, but I'm sure you can find some juicy info (such as db logins) now that you can read all the files.
* - Petrichor - May 9, 2015
(May 9, 2015 01:57 AM)n0cent Wrote: In that case the configuration of the folder has been changed both to ignore index pages and to parse php as text. Sounds like the site has already been hacked because I doubt the admin would do that. Anyway, you still can't do anything as far as logging into wp-admin, but I'm sure you can find some juicy info (such as db logins) now that you can read all the files.Alright, thanks a lot for your reply.
* - centauri - May 9, 2015
(May 9, 2015 01:57 AM)n0cent Wrote: In that case the configuration of the folder has been changed both to ignore index pages and to parse php as text. Sounds like the site has already been hacked because I doubt the admin would do that. Anyway, you still can't do anything as far as logging into wp-admin, but I'm sure you can find some juicy info (such as db logins) now that you can read all the files.
i agree with that also try to search for uploaded shell
try in
wp-content/plugins
wp-content/themes
you may find one