[NetScan]

Magic Button
A project by NetScan team
WordPress Credential Checker & Code Injection Tool
wpmagic.net

---

What is WP Magic Button?

WP Magic Button is a professional platform for WordPress credential checking and code injection. It accepts login lists (domain + user + password), checks them in parallel against live sites, and for successful logins automatically injects your PHP/JS script through all available methods.
wpmagic.net

---

Key Features

• Credential Checking — parallel WordPress login verification across multiple threads
  


• Code Injection — writes script via Theme Editor, File Manager, Plugin Editor or Plugin Upload
  


• Campaign System — organize checks into named campaigns with saved results and resume capability
  


• Proxy Support — proxy lists for IP rotation during checking
  

---

4 Injection Methods (in priority order)

After successful login, the system tries methods in order and stops at first success:

#	Method	How it works	Label
1	Theme Editor	Opens theme-editor.php, finds active theme's functions.php and appends the script	TE_INJECTED
2	File Manager	Activates file manager plugin and writes script directly to the filesystem	FM_INJECTED
3	Plugin Editor	Opens plugin-editor.php and injects into the main PHP file of a plugin	PE_INJECTED
4	Plugin Upload	Uploads ZIP via plugin-install.php and activates it. Requires ZIP upload in settings	PU_INJECTED

Methods 3 and 4 are only attempted if methods 1 and 2 fail. This prevents double injection on a single site.

---

Result Categories

Good — login successful, credentials valid, WordPress panel accessible
Injected — login successful and script written to the site via one of 4 methods
NoPlugin — login successful, but no injection method worked due to editor restrictions
Bad — login failed: invalid credentials, site unreachable, or timeout

"Clone missed" feature — if some Good credentials were not injected, creates a new campaign with only the uninjected credentials for retry.

---

Supported Credential Formats

The parser automatically detects the delimiter character. All 7 formats supported:

Code

site.com/wp-login.php:user:password
site.com/wp-login.php:user;password
site.com/wp-login.php;user;password
site.com/wp-login.php#user#password
site.com/wp-login.php@user@password
site.com/wp-login.php|user|password
site.com/wp-login.php#user@password

// With scheme:
https://site.com/wp-login.php|user|password

// With port (colon in port is NOT treated as delimiter):
site.com:8080/wp-login.php|user|password

// Subdirectory install:
site.com/blog/wp-login.php|user|password

// Passwords with delimiter characters are preserved:
site.com|admin|p@ss:w0rd!

The parser uses the first delimiter found between URL and username, and the second occurrence of the same character between username and password. Everything after the second delimiter is the password.

---

Campaign Settings

Parameter	Description	Recommended
Name	Label for the campaign	Any descriptive name
Threads	Parallel workers	5–20
Timeout (sec)	Per-request timeout	30–60
Proxy List	Rotate through saved proxy list	—
Plugin Upload	Enable plugin upload method	if ZIP available
Injection Script	PHP/JS code to execute after successful injection	Optional

Lifecycle: idle → running → paused/stopped → done

---

Adding Hosts

Two methods:

1. Inline list — paste credentials directly in the campaign creation form
   


2. File upload — Hosts tab → Add Hosts → Select file. Files of any size supported (streaming, no RAM buffering)
   

---

Proxies

1. Go to Proxies → New List
   


2. Open the list → Add Proxies
   


3. Paste one URL per line:
   
   Code

   http://user:pass@host:port
   or
   
   Code

   socks5://host:port


4. In campaign settings, select the list. Proxies are used in round-robin
   

---

Account & Payment

All payments in USDT TRC-20 (Tron network).

1. Enter amount and click Request Deposit
   


2. A unique TRON address will be assigned
   


3. Send the exact amount within 20 minutes
   


4. System checks blockchain every 30 seconds. Balance credited automatically
   

---

Quick Start

1. Log in at /login
   


2. Top up USDT balance and purchase access (Day / Week / Month)
   


3. Create a proxy list and add proxies
   


4. Create a campaign: name, threads, timeout, proxy
   


5. Upload hosts with credentials
   


6. Configure injection (PHP script) and/or upload ZIP plugin
   


7. Click Start
   


8. Monitor results in real time
   


9. Download results or use "Clone missed"
   

Video demo: [https://vimeo.com/1182430537?share=copy&fl=sv&fe=ci]

---

FAQ

Can I run two campaigns at once?
No. Only one campaign can run at a time.

Why doesn't the Start button respond?
Another campaign is already running. The button will show an error with the reason.

What is "Clone missed"?
Creates a new campaign with only the Good credentials that were not injected.

"Too many uploads" error
Server limits concurrent uploads to 8. Wait a few seconds and retry.
https://wpmagic.net/

https://wpmagic.net/
Telegram support - https://t.me/wpMagicButton
Chanel - https://t.me/+LBj4Zop8ct5kMTgx
Jabber - http://[email protected]

Magic Button — any script on any WordPress
A project by NetScan team

🔐 loading encrypted image…

Start Contract

[Money-]

Useful tool very handy. Especially for ppl who wana inject miners/backdoors or SEO purposes on a batch of sites..

Kinda pricey for a day tho lol..

[Sticky Bot]

Hi, I'm Sticky Bot. The owner of this thread has purchased a Paid Sticky. Hack Forums does not get involved in deals or deal disputes. We do not vouch for the product or the service offered by members. Please note that all deals are at your own risk. The sticky will expire on May 13, 2026. If you or a loved one are interested in buying a sticky please visit this page: Buy Sticky. For more information about Paid Stickies you can read our Help Doc.

[Stanley]

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

[Menacho]

I understand