+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: wordpress bruteforce attacks (/showthread.php?tid=6275846)
wordpress bruteforce attacks - mixer - Jul 22, 2024
what are the chances of finding passwords of a wordpress website using breached credentials?
since wordpress automatically generates passwords, i personally don't think many people will change it to a simple password that they use everywhere. should i try my luck with randomly generated passwords or use breached credentials?
RE: wordpress bruteforce attacks - Dystortion - Jul 22, 2024
Honestly if you're attacking wordpress - credentials aren't the way IMO. It's so vulnerable especially through its plugins, there will always be another way in.
RE: wordpress bruteforce attacks - mixer - Jul 22, 2024
(Jul 22, 2024 07:10 AM)Dystortion Wrote: Honestly if you're attacking wordpress - credentials aren't the way IMO. It's so vulnerable especially through its plugins, there will always be another way in.
I'm starting to totally give up on web attacks and focus on SE.
RE: wordpress bruteforce attacks - Dystortion - Jul 22, 2024
(Jul 22, 2024 07:13 AM)mixer Wrote: I'm starting to totally give up on web attacks and focus on SE.
Web attacks are still highly prominent - if you're hitting more niche targets like APIs which isn't as common as people looking for XSS or SQLi
RE: wordpress bruteforce attacks - video edit/ not live - Aug 3, 2024
i need help with same thing
if some one could msg me and help that would be great for a wordpress admin pw, i have the username and email, just no pw
RE: wordpress bruteforce attacks - SilentNuke - Aug 3, 2024
you will need to find out if the wordpress instalation has its security for admin logins enabled..
if it says "username or password is incorrect" and youve found an admin account username, then the chances are they have enabled both hide valid usernames and giving you only x amount of chances before blocking you.
if is says "password for account x is invalid", then they havent activated the security settings.
RE: wordpress bruteforce attacks - video edit/ not live - Aug 3, 2024
it said paasword invalid. i know its the owner of companies log in email is user name, if that helps
RE: wordpress bruteforce attacks - pr0xed - Oct 19, 2024
if you want to bruteforce it you should first find a registered email or username to make this easier and then use tools like wpscan for the bruteforce process
RE: wordpress bruteforce attacks - Money- - Oct 19, 2024
(Oct 19, 2024 08:08 AM)pr0xed Wrote: if you want to bruteforce it you should first find a registered email or username to make this easier and then use tools like wpscan for the bruteforce process
Gotta consider some rate limits. Do you have any interesting wordpress bruteforcer tools?
RE: wordpress bruteforce attacks - pr0xed - Oct 20, 2024
(Oct 19, 2024 08:17 PM)Money- Wrote: Gotta consider some rate limits. Do you have any interesting wordpress bruteforcer tools?
use burpsuite or wpscan (both come preinstalled in kali and most of the pentesting os) or you could just get the cracked version for burpsuite for faster bruteforce attacks since wpscan is pretty slow so is the burpsuite community edition.
RE: wordpress bruteforce attacks - person123! - Nov 21, 2024
I've had luck just downloading random password lists and trying all of them
RE: wordpress bruteforce attacks - DarkRoot - Dec 15, 2024
100 percent chance, it's weird you haven't found it yet.