when you first scan a website you're
targeting its login page and once you
uncover the login page you'll be typing
away as a script Kitty to try out all
possible combination of usernames and
passwords but typically within three to
five tries you realize that you get
blocked out and what happen next is your
IP address get locked and next thing you
know the police knocks onto your door
and you get arrested the downside of
that is that you can no longer see Mr
Hecky's video and we don't want that to
happen however no worries Mr hecko is
here to save the day what we need to do
then is to find out is there a separate
authentication path into the website so
that we can ultimately pull off exrate
all this different data on the back end
and the answer is yes this is because
more and more of these applications
websites develop a separate
authentication path into your
application programming interfaces that
allow us a separate path to throwing all
these different usernames and passwords
into his authentication system possibly
without the retry limit are you ready to
learn are you ready to be as smart as Mr
hecky if you do smash the like button
and turn on notification so that you
don't get hacked
too the first thing you do when you hit
the website is you'll begin scanning the
website looking for different type of
pages that are available that you can
Target I mean we're not here for online
shopping so you be looking out for Pages
like for example API all right so this
could be potentially a path for us to
inject usernames to inject passwords so
that we can supply all these different
credentials and see which one get a hit
and for today's case we'll be going to
Target an
xmlrpc.php which is is available for a
lot of this WordPress website WordPress
is a Content management system that is
deployed widely across the internet
which allow us the ability to test them
out really quickly and before we jump
into demonstration M kits hacking is
illegal and if you get caught hacking do
not tell them you know who's Mr hack Loy
and at the same time I know you want to
test this out please do not go to lyy
young.com XMR RPC PHP to test out all
these different type of Expos passwords
and usernames on my website okay sure go
ahead try it out on my website and I can
lock your IP address I'll know where you
stay I'll know everything about you
within a few minutes of that try no I'm
just kidding okay not really so right in
front of us we're in K Linux which is
going to be our etical hacking and
penetration testing operating system and
this is going to be your best friend for
today's tutorial and right in front of
us we are on a website this is a
WordPress content management system
website that we are targeting and of
course in this case it's IP address is21
16811 so the first thing we can do is go
ahead and scan a website looking out for
potential places or pages that we can
Target so in this case I can go ahead
and enter ncto followed by- host http1
1821 1680 to11 for/ WordPress and of
course in the real world you'll be
scanning Loy Youngy young.com go ahead
and hit enter on that and you can see
right here we are scanning so this is a
direct scan against the website so that
we can understand what are the service
versions what are the potential
libraries plugins and whatnot it could
be installed directly on this website
that we can Target so several
interesting pages that we have
discovered so in this case we have
xmlrpc.php was found we also have the
wp- login which is the admin login page
that was file all right and of course we
understand that this is a WordPress
installation was file too and going back
to the website if I go ahead and enter
the folling of/ WordPress xmlrpc.php I
hit enter on that it stays the fing
right here xmlrpc server accepts post
request only and what we can do next is
go ahead and temper with our http
request so that we're sending a post
directly into xmlrpc so the first thing
I can do is go ahead and enter burp
Suite so we're launching burp Suite to
be our Interceptor so this is going to
be a proxy server where it allow us the
ability to intercept all this request
that are heading towards the target
server so in this case we're starting up
the burp Suite Community Edition right
here and you can go under the proxy Tab
and see The Intercept is on next up you
need to go back to the browser go to the
top right corner and go ahead and set
the burp Suite SD proxy and once you're
ready go ahead and hit enter game and
you can see the interception right here
directly in burp Suite so from here we
can see the falling of get WordPress
xmlrpc.php I can do a right click and I
can send this over to repeater because
what we are trying to do here is to
think about how can we tamper with the
HTTP request so that we get a least of
potential method calls against the
WordPress system and the two parts to
XML RPC for our understanding one is XML
itself is a format so this is how we are
going to be using the format of
exchanging data and the second part to
this is called remote procedure call so
this allow us to send remote
instructions over into the target server
so that we can make it do things and
this is literally like a TV remot
control so going back to call Linux
right now we need to change things up a
little bit so I need to change the HTTP
method over into post instead of G so
this is the requirement for us to
communicate with xmlrpc.php next up what
you need to do is to go all the way to
the bottom of HTTP request and have the
following XML version 1.0 maod call
system. listm so we want to see what
other methods available for us to call
over in the Target system so in this
case we have the following available
methods so we have multic call list me
get capabilities demo. add2 numbers and
so on so all this are the available
method calls for us to remotely call and
communicate with the target system and
for today's case we're going to be
focusing on the meod call of meta web
block gamp uses blocks so right here you
can see that we've changed up the HTTP
request method to met the web block Gap
users blocks followed by three values so
one atmin and the third value is the
password so we do not know exactly what
is the password of the username so in
this case what we're trying to do is to
send it over and see what's the response
coming in from the site so if I go ahead
and click Send in three 2 1 I click send
you can see right at the response at the
bottom it stats the following bad login
pass combination so we did not get the
login pass combination right which is
why there is this respond I know what
you're thinking how how did I know what
is the username of the website so
typically admin administrator this could
be the potential usernames as part of a
WordPress content management system that
is set up at the initial stage at the
same time we can also use other tools to
help us enumerate the Leist of users so
what we can do now is to enumerate the
users using the blue P scan and I
entered following of URL http1 1821
16810 1/ WordPress D- enumerate you hit
enter and that and now we're running the
WordPress security scanner to see
what other users it's available for us
to Target so in this case you can see
the following that we have the users
identify of admin jumping back to burp
Suite I can go ahead and do a right
click of repeater and send to Intruder
and once I'm done with that what we can
do now is to do the Brute Force attack I
can clear all these automatic variables
and I can select the password as the one
that we will have varying values on so I
go ahead and click add on this I go
under payloads and once you're here what
we can do is either load those
previously exposed passwords or commonly
used passwords is part of running a
brute Forest attack so I can go ahead
and click on load and right here under
USR share word list we have the comma
password.txt double clicked on that and
you can see right here we have some of
this different type of common passwords
that I can use and once you're ready go
ahead and click Start attack on the top
right corner click okay and you can see
right here we are now launching the
attack against the site I think we got a
hit that's policy right here we have the
following of 934 as the L response which
is very different from the rest of the
other responses go ahead and click onto
the requests and we can see right here
we have the post all right and then we
have the response in this case we got a
good response is admin all right URL
http1 1821 68.0 101 WordPress now going
back to the website we want a Target
login page and of course you can go to
wp-admin or wp-login up PHP but of
course in no case there even a hyperlink
for us click onto login and right here
you can enter atmin follow the password
admin click login and boom we are in
it's game over