+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Resetting WP password via SQLi vuln ? (/showthread.php?tid=6083085)
Resetting WP password via SQLi vuln ? - kuramiqnko - May 30, 2020
Hey guys, I would like to ask someone experienced with wordpress, lets say I have access to an database(s) with wordpress sites, and I can see the wp_users table with passwords and everything, is there any way to reset the password via the Forgotten password and then access reset token via the database which I have gained access via SQL injection vulnerability ?
Thanks for the help !
RE: Resetting WP password via SQLi vuln ? - !!*-Ir0nMan™*-!! - May 30, 2020
(May 30, 2020 07:16 AM)kuramiqnko Wrote: Hey guys, I would like to ask someone experienced with wordpress, lets say I have access to an database(s) with wordpress sites, and I can see the wp_users table with passwords and everything, is there any way to reset the password via the Forgotten password and then access reset token via the database which I have gained access via SQL injection vulnerability ?
Thanks for the help !
it was possible before but now reset key is hashed as well. If you can alter the sql records then it is possible otherwise not.
RE: Resetting WP password via SQLi vuln ? - kuramiqnko - May 30, 2020
(May 30, 2020 09:52 AM)!!*-Ir0nMan™*-!! Wrote: it was possible before but now reset key is hashed as well. If you can alter the sql records then it is possible otherwise not.I googled around and it said it was hashing the user activation key or I did not understand right ? If is that so, can I just hash the encryption key and get the reset code ?
RE: Resetting WP password via SQLi vuln ? - !!*-Ir0nMan™*-!! - May 31, 2020
(May 30, 2020 12:48 PM)kuramiqnko Wrote: I googled around and it said it was hashing the user activation key or I did not understand right ? If is that so, can I just hash the encryption key and get the reset code ?
the time u finish cracking the hash it will expire.
RE: Resetting WP password via SQLi vuln ? - frank3nstien - May 31, 2020
This is how reset token works on Wordpress
Code
check_password_reset_key( string $key, string $login )this token is generated by hashing a random string. when token is generated it is stored in the users table in the user_activation_key column and Only the most recently generated token is stored, The token is also removed from the database once used.
If you are looking to send these token using sqli, you can generate them by trying
Code
get_password_reset_key()This function accepts a WP_User object as its argument
RE: Resetting WP password via SQLi vuln ? - MahonStoN_ - Jun 6, 2020
try to alter the sql records as the guy above me said already.