[Petrichor]

Hey everyone,

Usually, I'm prompted to log in when browsing to a sites /wp-admin/ folder. However, I found a site where it shows me the index (directory) of the /wp-admin/ folder instead of the login form (how is this actually possible?) and thus I have access to all files.

Is there anything I could gain from having this kind of access?

Thanks in advance!

[centauri]

it's happening cuz the admin of this site or some ( hacker ) removed index.php file and you can't do anything with this

[Petrichor]

it's happening cuz the admin of this site or some ( hacker ) removed index.php file and you can't do anything with this

Thank you for your reply. This leaves me a little puzzled, because in fact, index.php is included in the /wp-admin/ directory. Opening the file shows me php code. How would the admin access his wp dashboard in this case?

[Kiddie]

hey dude, try 0 day exploits. I know a good site. Please write me a message!

[n0cent]

Thank you for your reply. This leaves me a little puzzled, because in fact, index.php is included in the /wp-admin/ directory. Opening the file shows me php code. How would the admin access his wp dashboard in this case?

In that case the configuration of the folder has been changed both to ignore index pages and to parse php as text. Sounds like the site has already been hacked because I doubt the admin would do that. Anyway, you still can't do anything as far as logging into wp-admin, but I'm sure you can find some juicy info (such as db logins) now that you can read all the files.

[Petrichor]

In that case the configuration of the folder has been changed both to ignore index pages and to parse php as text. Sounds like the site has already been hacked because I doubt the admin would do that. Anyway, you still can't do anything as far as logging into wp-admin, but I'm sure you can find some juicy info (such as db logins) now that you can read all the files.

Alright, thanks a lot for your reply.

[centauri]

In that case the configuration of the folder has been changed both to ignore index pages and to parse php as text. Sounds like the site has already been hacked because I doubt the admin would do that. Anyway, you still can't do anything as far as logging into wp-admin, but I'm sure you can find some juicy info (such as db logins) now that you can read all the files.

i agree with that also try to search for uploaded shell
try in
wp-content/plugins
wp-content/themes
you may find one