+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Unsecure Wordpress site access (/showthread.php?tid=6260159)
Unsecure Wordpress site access - Cosmozic - Jan 4, 2024
Hi Im not an expert by any means Im trying to gain access to a wordpress site, so far I have 3 Usernames and found 2 vulnerabilities (CVE-2022-3144 and CVE 2023-38400 there might be more but thats as far as I currently have) and and i assume xmlrpc is enabled too as it says server accepts POST requests only.
Site uses http so it has no ssl certificate either.
So far thats the progress and Im unsure what to do next other than asking for help here.
RE: Unsecure Wordpress site access - DramaKing - Jan 4, 2024
(Jan 4, 2024 03:19 PM)Cosmozic Wrote: Hi Im not an expert by any means Im trying to gain access to a wordpress site, so far I have 3 Usernames and found 2 vulnerabilities (CVE-2022-3144 and CVE 2023-38400 there might be more but thats as far as I currently have) and and i assume xmlrpc is enabled too as it says server accepts POST requests only.
Site uses http so it has no ssl certificate either.
So far thats the progress and Im unsure what to do next other than asking for help here.
Neither of those will help if you're trying to get access to the website, especially if cookies have the HttpOnly flag set.
RE: Unsecure Wordpress site access - Cosmozic - Jan 4, 2024
(Jan 4, 2024 04:28 PM)DramaKing Wrote: Neither of those will help if you're trying to get access to the website, especially if cookies have the HttpOnly flag set.
I plan to get access to the admin panel, what else can I use?
RE: Unsecure Wordpress site access - DramaKing - Jan 4, 2024
(Jan 4, 2024 04:32 PM)Cosmozic Wrote: I plan to get access to the admin panel, what else can I use?
You can use a password cracker.
RE: Unsecure Wordpress site access - Cosmozic - Jan 4, 2024
(Jan 4, 2024 04:35 PM)DramaKing Wrote: You can use a password cracker.
I tried bruteforcing no luck sadly