# \[SOLVED\] how hacker hack a wordpress website? **URL:** \ **Category:** Tutorials & Methods\ **Tags:** solved, programming, hacking\ **Created:** [February 28, 2020, 10:09am UTC](https://onehack.st/t/solved-how-hacker-hack-a-wordpress-website/71733 "2020-02-28T10:09:59Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Shayla](https://onehack.st/user_avatar/onehack.st/shayla/32/174870_2.png) [@Shayla](https://onehack.st/u/Shayla)\ **Post date:** [February 28, 2020, 5:46pm UTC](https://onehack.st/t/solved-how-hacker-hack-a-wordpress-website/71733/2 "2020-02-28T17:46:20Z")
## Common Types of Attacks You Can Try On WordPress Websites # SQL Injection Underneath the WordPress CMS platform is a database layer that stores administrative information. It contains elements like user data, content storage, and site configuration information. SQL or Structured Query Language is what makes all this work. Hackers can inject malicious SQL into your website to run a customized command. They can do everything from viewing extra information through “Select” queries to changing data and more. And SQL attacks happen more often than you realize. Cybercriminals using [SQL](https://en.wikipedia.org/wiki/SQL) injection were behind attacks on NASDAQ, Heartland, 7-eleven, and other significant data breaches. Each year, these attacks alone cost companies an estimated $300 million. # Cross-site Scripting Cross-site scripting attacks (XSS) resemble SQL injections. But they target JavaScript page elements instead of databases. These attacks result in the compromised private information of the users. It happens because hacked JavaScript redirects users to fraudulent landing pages. They do resemble their target destination. But once customers input personal details, they go straight to the hands of hackers. XSS attacks can affect even the most prominent names. Hackers have used them on eBay product pages for years. # Command Injection WordPress operates on three main layers: - the database server - Application server - the webserver Each of these servers represents different areas of potential vulnerability. Using command injection attacks, hackers target a specific layer and enter malicious information. On the surface, the code will appear normal. But underneath, the command can prompt layers to display vital information, such as file lists and directories. Internet-connected cameras are a frequent target of command injection attacks. For example, researchers discovered a vital flaw makes popular macOS Terminal app vulnerable to command injection attacks. # File Inclusion Exploits WordPress relies on popular coding languages like PHP and Java. As a result, they allow web programmers to use external files and scripts in code to create website features. This activity is known as the “include” command. Hackers can manipulate WP sites to exploit the “include” code section. It allows them to access the application server. More often than not, plugins are a target for these types of attacks. Once a user installs an infected plugin, hackers can gain access to all data on the server. * * * # #1 Core WordPress Vulnerabilities You have to learn some HTML and some PHP. Then pick out a vuln at [exploit-db.com](http://exploit-db.com/). Older versions of wordpress are okay cuz you can use wpdata.monster to find sites that have not updated. Then research, research, and research. Being an open source site-building platform keeps WordPress free, but it also exposes it to core vulnerabilities because anyone can obtain the source code and perform reverse engineering on it to identify weak points. This is why there are so many WordPress updates: as honest developers discover such vulnerabilities, they create bug fixes to make the platform more secure. This is one of the key reasons why you should always apply new updates as soon as they are released. * * * # #2 Brute-force attack To fellow security fans! Today I will show you how to hack the WordPress Site, our first step is to prepare the tool we will use: 1. virtualbox 2. kali linux / parrotsec (attacker) 3. Ubuntu machine (target =\> 192.168.1.23) 4. wpscan 5. metasploit 6. dirb first I will scan to the target using nmap with ip address 192.168.1.23, at the scanning stage using nmap we can see open port ports that we can exploit, on there are three types of vulnerabilities ftp, ssh and http. ![image](https://onehack.st/uploads/default/original/3X/b/d/bd46f6c11e4d9902fa4d16cd2bcaf8d96a2b3d1a.jpeg) `image for nmap scanning` Often, to hack websites, we need to connect and exploit certain objects on the website. Maybe the admin panel or sub-directory is vulnerable to attacks. The key, of course, is to find these objects, because they might be hidden. DIRB, developed by The Dark Raver, is a tool designed to find these objects, hidden and not hidden. Because it was entered into Kali, there is no need to download and install anything. ![image](https://onehack.st/uploads/default/original/3X/d/7/d7e1df9073a9b747608838e3b0762c7df6cc2c74.jpeg) `image for dirb` ![image](https://onehack.st/uploads/default/original/3X/9/2/9226beea9c3ad3dd42ef6f3b3c00fd52df8d7006.jpeg) `image for dirb` in the next stage we try to open the ip address in the browser and we open the admin login page. ![image](https://onehack.st/uploads/default/original/3X/4/e/4e3614ce835f99b9bf5ff075cb032592dbe75d93.png) `image for secret` ![image](https://onehack.st/uploads/default/original/3X/2/c/2c8e7fac33d93dac158862cafd48a42e5c91e1fb.png) `image for login apge` in the next stage we managed to open the login page for the admin and we can do it bruteforce to enter the dashboard page here we can use the wpscan tool, ![image](https://onehack.st/uploads/default/original/3X/4/e/4e54100220d5fcc962b3244574bd9fdcc9103774.jpeg) `image for wpscan` ![image](https://onehack.st/uploads/default/original/3X/1/2/12e85d0405418bae87d2315aa968a0e24ac8170e.jpeg) `image for wpscan` ## now bruteforce username and password useing wpscan. ![image](https://onehack.st/uploads/default/original/3X/1/a/1a4c5e46812bbf23133afdedb88c5419c9067713.jpeg) `image for wpscan` ![image](https://onehack.st/uploads/default/original/3X/1/0/10619c2ad60f655282c0f45d60698e73bbdca927.jpeg) `image for wpscan` use useful information, namely the default username “admin” that we can try to force. ![image](https://onehack.st/uploads/default/original/3X/c/0/c01fb6c27747c4ddd23a225b4774fd6b16c1f120.jpeg) `image for wpscan` ![image](https://onehack.st/uploads/default/original/3X/a/3/a39886025c17b657433e5f016cbe32c6b758df1d.jpeg) `image for wpscan` in the next stage we will succeed in finding the admin user that we will bruteforce the password and we can use it to enter the dashboard page. login using username :admin and password:admin and you can access dashboard admin. ![image](https://onehack.st/uploads/default/original/3X/a/4/a49f8489e77c25bdb8145f779b5b49a4fef91ae1.jpeg) `image for dashboard admin` > DISCLAIMER, This is for educational purposes only, attempting the below method on a website that does not belong to you is probably illegal in the country you live in. * * * ## Extras > [@Types Of Hackers & What They Do?](https://onehack.st/t/types-of-hackers-what-they-do/56657): > > Hackers can be classified into different categories such as white hat, black hat, and grey hat, based on their intent of hacking a system. These different terms come from old Spaghetti Westerns, where the bad guy wears a black cowboy hat and the good guy wears a white hat. White Hat Hackers White Hat hackers are also known as Ethical Hackers . They never intent to harm a system, rather they try to find out weaknesses in a computer or a network system as a part … > [@The Best Vulnerable Websites To Improve Your Hacking Skills | 1Hack Special 100](https://onehack.st/t/the-best-vulnerable-websites-to-improve-your-hacking-skills-1hack-special/66084): > > Some of the best places to learn ethical hacking. The best websites to exercise your hacking skills irrespective of whether you are a hacker, cybersecurity, pen-tester or still a noob. These vulnerable websites are great for developing our minds, increasing our capacity to solve problems, new innovative ideas come to our minds. Also, you will face brainfuck a lot of difficulties. Never give up always try to give your best. Because if you want to be a professional hacker, then you must… > [@How To Hack A Website | Including Online Example!](https://onehack.st/t/how-to-hack-a-website-including-online-example/61707): > > More people have access to the internet than ever before. This has prompted many organizations to develop web-based applications that users can use online to interact with the organization. Poorly written code for web applications can be exploited to gain unauthorized access to sensitive data and web servers. In this article, we will introduce you to web application hacking techniques and the countermeasures you can put in place to protect against such attacks. Topics covered in this tutorial … > [@How to Brute Force Any Website Login Page using Burpsuite woman\_technologist](https://onehack.st/t/how-to-brute-force-any-website-login-page-using-burpsuite/58497): > > What is Brute Force? A BRUTE FORCE ATTACK IS A TRIAL-AND-ERROR METHOD, USED TO OBTAIN INFORMATION SUCH AS A USER PASSWORD OR PERSONAL IDENTIFICATION NUMBER (PIN). IN A BRUTE FORCE ATTACK , AUTOMATED SOFTWARE IS USED TO GENERATE A LARGE NUMBER OF CONSECUTIVE GUESSES AS TO THE VALUE OF THE DESIRED DATA. This attack is hugely dependent on system resources and computing power. An attack of this nature can time and resource consuming , and the success of these attacks depends on … > [@How To Scan Websites For Vulnerabilities Using Android | Easy Method!](https://onehack.st/t/how-to-scan-websites-for-vulnerabilities-using-android-easy-method/63455): > > The ability to hack something doesn’t depend on how powerful your devices are, it depends on how powerful your skills are. Android is one of the most used Operating Systems in the world and loved by developers. The best thing about Android is, it has very fewer restrictions in comparison to iOS. This unlocks the opportunity to customize it according to the user. We can make it a portable hacking machine. A portable device gives us more power to do something different when we are surrounded by… > [@Top 10 Useful Websites For Hackers 2020 zzz](https://onehack.st/t/top-10-useful-websites-for-hackers-2020/71775): > > I’m going to discuss top 10 useful websites for hackers to learn and practice ethical hacking and information gathering . we will discuss about dns mapping , email verify , online vulnerability, latest ssv & CVE records and much more. TOP 10 USEFUL WEBSITE FOR HACKERS:- [Dnsdumpster](https://dnsdumpster.com/) :- dns recon & research , find & lookup dns records [Verify email address](https://verify-email.org/) :- Verify email address online using free email verification tool. [ZOOMEY](https://zoomeye.org/) :- find iot device and bugs in an… --- _[View the full topic](https://onehack.st/t/solved-how-hacker-hack-a-wordpress-website/71733)._