#1 XML-RPC DOS Attack | WordPress Exploit

XML-RPC on WordPress is actually an API that allows developers who make 3rd party applications and services the ability to interact with your WordPress site. The XML-RPC API that WordPress provides several key functionalities that include:

1- Publish a post
2- Edit a post
3- Delete a post.
4- Upload a new file (e.g. an image for a post)
5- Get a list of comments
6- Edit comments

WordPress the XML-RPC interface opens two kinds of attacks:

* XML-RPC pingbacks
* Brute force attacks via XML-RPC

Searching for XML-RPC servers on WordPress:
1- Ensure you are targeting a WordPress site.
2- Ensure you have access to the xmlrpc.php file. In general, it is found at https://example.com/xmlrpc.php and would reply to a GET request with: XML-RPC server accepts POST requests only.
3- It will be pointless to target an XML-RPC server that is disabled/hardcoded/tampered/not working. Therefore, we will check its functionality by sending the following request

============================================================
#bugbounty #xmlrpc #wordpress #topbugbounty #cyberasset

For more information, please write back to us at [email protected]
============================================================
Music Credit: https://www.bensound.com
============================================================
Blog: https://cyberasset-india.blogspot.com/
Instagram: https://www.instagram.com/cyber_asset/
Facebook: https://www.facebook.com/cyberassetindia/
Twitter:
LinkedIn:
Telegram: https://t.me/joinchat/PmIq6xwPWVvgOnF6wtlLWw