4 entries tagged “Wordpress”. Browse all tags
The CeWL quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Crawl an authorized site, build a wordlist from its own words, tune depth and length, harvest emails and document authors, rank by frequency, then feed hydra, john, and hashcat.
The WPScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Enumerate users, find vulnerable plugins and themes, pull exposed config backups, run an authorized login attack, tune detection-mode noise, and parse the JSON with jq.
WordPress user enumeration via wpscan plus SSH brute-force gain a foothold, then a cracked KeePass database yields a filename that triggers a root cron job for root credentials.
A WordPress login brute-forced with wpscan plants a PHP reverse shell in a theme's 404.php, then passwordless sudo nmap escalates to root.
Type to search · / or Ctrl+K to open · ↑↓ to move · Enter to open · Esc to close
