Hack Forums
WP Magic Button host checker + script/captcha injector - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Auxiliary (https://hackforums.net/forumdisplay.php?fid=453)
+---- Forum: Member Sales Market (https://hackforums.net/forumdisplay.php?fid=176)
+---- Thread: WP Magic Button host checker + script/captcha injector (/showthread.php?tid=6323693)

WP Magic Button host checker + script/captcha injector - NetScan - Apr 12, 2026

Magic Button
A project by NetScan team
WordPress Credential Checker & Code Injection Tool
wpmagic.net



What is WP Magic Button?

WP Magic Button is a professional platform for WordPress credential checking and code injection. It accepts login lists (domain + user + password), checks them in parallel against live sites, and for successful logins automatically injects your PHP/JS script through all available methods.
wpmagic.net



Key Features
  • Credential Checking — parallel WordPress login verification across multiple threads

  • Code Injection — writes script via Theme Editor, File Manager, Plugin Editor or Plugin Upload

  • Campaign System — organize checks into named campaigns with saved results and resume capability

  • Proxy Support — proxy lists for IP rotation during checking





4 Injection Methods (in priority order)

After successful login, the system tries methods in order and stops at first success:







#MethodHow it worksLabel
1Theme EditorOpens theme-editor.php, finds active theme's functions.php and appends the scriptTE_INJECTED
2File ManagerActivates file manager plugin and writes script directly to the filesystemFM_INJECTED
3Plugin EditorOpens plugin-editor.php and injects into the main PHP file of a pluginPE_INJECTED
4Plugin UploadUploads ZIP via plugin-install.php and activates it. Requires ZIP upload in settingsPU_INJECTED


Methods 3 and 4 are only attempted if methods 1 and 2 fail. This prevents double injection on a single site.



Result Categories

Good — login successful, credentials valid, WordPress panel accessible
Injected — login successful and script written to the site via one of 4 methods
NoPlugin — login successful, but no injection method worked due to editor restrictions
Bad — login failed: invalid credentials, site unreachable, or timeout

"Clone missed" feature — if some Good credentials were not injected, creates a new campaign with only the uninjected credentials for retry.



Supported Credential Formats

The parser automatically detects the delimiter character. All 7 formats supported:

Code
site.com/wp-login.php:user:password
site.com/wp-login.php:user;password
site.com/wp-login.php;user;password
site.com/wp-login.php#user#password
site.com/wp-login.php@user@password
site.com/wp-login.php|user|password
site.com/wp-login.php#user@password

// With scheme:
https://site.com/wp-login.php|user|password

// With port (colon in port is NOT treated as delimiter):
site.com:8080/wp-login.php|user|password

// Subdirectory install:
site.com/blog/wp-login.php|user|password

// Passwords with delimiter characters are preserved:
site.com|admin|p@ss:w0rd!

The parser uses the first delimiter found between URL and username, and the second occurrence of the same character between username and password. Everything after the second delimiter is the password.



Campaign Settings









ParameterDescriptionRecommended
NameLabel for the campaignAny descriptive name
ThreadsParallel workers5–20
Timeout (sec)Per-request timeout30–60
Proxy ListRotate through saved proxy list—
Plugin UploadEnable plugin upload methodif ZIP available
Injection ScriptPHP/JS code to execute after successful injectionOptional


Lifecycle: idle → running → paused/stopped → done



Adding Hosts

Two methods:
  1. Inline list — paste credentials directly in the campaign creation form

  2. File upload — Hosts tab → Add Hosts → Select file. Files of any size supported (streaming, no RAM buffering)





Proxies

  1. Go to Proxies → New List

  2. Open the list → Add Proxies

  3. Paste one URL per line:
    Code
    http://user:pass@host:port
    or
    Code
    socks5://host:port

  4. In campaign settings, select the list. Proxies are used in round-robin





Account & Payment

All payments in USDT TRC-20 (Tron network).

  1. Enter amount and click Request Deposit

  2. A unique TRON address will be assigned

  3. Send the exact amount within 20 minutes

  4. System checks blockchain every 30 seconds. Balance credited automatically





Quick Start

  1. Log in at /login

  2. Top up USDT balance and purchase access (Day / Week / Month)

  3. Create a proxy list and add proxies

  4. Create a campaign: name, threads, timeout, proxy

  5. Upload hosts with credentials

  6. Configure injection (PHP script) and/or upload ZIP plugin

  7. Click Start

  8. Monitor results in real time

  9. Download results or use "Clone missed"



Video demo: [https://vimeo.com/1182430537?share=copy&fl=sv&fe=ci]



FAQ

Can I run two campaigns at once?
No. Only one campaign can run at a time.

Why doesn't the Start button respond?
Another campaign is already running. The button will show an error with the reason.

What is "Clone missed"?
Creates a new campaign with only the Good credentials that were not injected.

"Too many uploads" error
Server limits concurrent uploads to 8. Wait a few seconds and retry.
https://wpmagic.net/

https://wpmagic.net/
Telegram support - https://t.me/wpMagicButton
Chanel - https://t.me/+LBj4Zop8ct5kMTgx
Jabber - http://[email protected]

Magic Button — any script on any WordPress
A project by NetScan team
🔐 loading encrypted image…

[contract=tid]Start Contract[/contract]

RE: WP Magic Button host checker + script/captcha injector - Money- - Apr 12, 2026

Useful tool very handy. Especially for ppl who wana inject miners/backdoors or SEO purposes on a batch of sites..

Kinda pricey for a day tho lol..

Paid Sticky Post - Sticky Bot - Apr 13, 2026

Hi, I'm Sticky Bot. The owner of this thread has purchased a Paid Sticky. Hack Forums does not get involved in deals or deal disputes. We do not vouch for the product or the service offered by members. Please note that all deals are at your own risk. The sticky will expire on May 13, 2026. If you or a loved one are interested in buying a sticky please visit this page: Buy Sticky. For more information about Paid Stickies you can read our Help Doc.

BUMP - Stanley - Apr 15, 2026

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

RE: WP Magic Button host checker + script/captcha injector - Menacho - Apr 22, 2026

I understand