WordPress is a widely known CMS (Content Management System) that is used in many industries. Nmap now includes its own NSE script to help pentesters launch dictionary attacks and find accounts using weak passwords that could compromise the application's integrity.
This recipe shows how to perform brute force password auditing against WordPress installations.
To find accounts with weak passwords in WordPress installations, use the following Nmap command:
$ nmap -p80 --script http-wordpress-brute <target>
All of the valid accounts that were found will be shown in the results:
PORT STATE SERVICE REASON 80/tcp open http syn-ack | http-wordpress-brute: | Accounts | papa:a1b2c3d4 => Login correct | Statistics |_ Perfomed 360 guesses in 17 seconds, average tps: 6
The argument -p80 –script http-wordpress-brute initiates the NSE script http-wordpress-brute if a web server is found on port 80 (-p80). I developed this script to save me from having to set the WordPress URI and the HTML variable names for the usernames and passwords, when using http-brute against WordPress installations.
This script uses the following default variables:
uri:/wp-login.phpuservar:logpassvar:pwd
To set the number of threads, use the script argument http-wordpress-brute.threads:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.threads=5 <target>
If the server has virtual hosting, set the host field by using the argument http-wordpress-brute.hostname:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.hostname="ahostname.wordpress.com" <target>
To set a different login URI, use the argument http-wordpress-brute.uri:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.uri="/hidden-wp-login.php" <target>
To change the name of the POST variable that stores the usernames and passwords, set the arguments http-wordpress-brute.uservar and http-wordpress-brute.passvar:
$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.uservar=usuario,http-wordpress-brute.passvar=pasguord <target>
There are some packet filtering products that block requests made using Nmap's default HTTP User Agent. You can use a different User Agent value by setting the argument http.useragent:
$ nmap -p80 --script http-wordpress-brute --script-args http.useragent="Mozilla 42" <target>
The Brute library supports different modes that alter the combinations used in the attack. The available modes are:
user: In this mode, for each user listed inuserdb, every password inpassdbwill be tried$ nmap --script http-wordpress-brute --script-args brute.mode=user <target>pass: In this mode, for each password listed inpassdb, every user inusedbwill be tried$ nmap --script http-wordpress-brute --script-args brute.mode=pass <target>creds: This mode requires the additional argumentbrute.credfile$ nmap --script http-wordpress-brute --script-args brute.mode=creds,brute.credfile=./creds.txt <target>
- The Detecting possible XST vulnerabilities recipe
- The Discovering interesting files and directories on various web servers recipe
- The Detecting web application firewalls recipe
- The Brute forcing HTTP authentication recipe
- The Abusing mod_userdir to enumerate user accounts recipe
- The Testing default credentials in web applications recipe
- The Brute-force password auditing Joomla! installations recipe
- The Finding SQL injection vulnerabilities in web applications recipe
- The Detecting web servers vulnerable to slowloris denial of service attacks recipe