Wordpress Pingback Port Scanner

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 class="western"><span style="font-weight: normal;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">WordpressPingbackPortScanner</span></span></span></h1><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other hosts on the intra- or internet via this server. You can also use this feature for some kind of distributed port scanning: You can scan a single host using multiple Wordpress Blogs exposing this API. This issue was fixed in Wordpress 3.5.1. Older versions are vulnerable, if the XML-RPC Interface is active.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(1)Download from <a href="https://github.com/FireFart/WordpressPingbackPortScanner/archive/master.zip" target="_blank">here</a></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(2)Extract it in folder</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(3)cd Downloads/WordpressPingbackPortScanner-master/ </span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(4)It does not work default ruby version which is 1.9.2 ; so by running update-alternatives we can change ruby version to 1.8.2</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">update-alternatives --config ruby </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">select 1</span></span></div><div style="margin-bottom: 0in;"><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(5)</span></span><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">gem install bundler</span></span><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">bundle install </span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIbGv5RQfTSOXndYH8NUJ7tRdqS-YlL7qhF1RcNlIpc4x_cLH1QwdY1s95YFaDHMYkwjL18MRsilLty7tNofWJVjkEqkEmS9txlAZV0eueSZf7BBc28W_6CBuRjkuTmGA34XLUNhgO9UjA/s1600/ping_back_port_scanner.jpeg" imageanchor="1"><img alt="wordpress-pingback-port-scanner" border="0" height="322" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIbGv5RQfTSOXndYH8NUJ7tRdqS-YlL7qhF1RcNlIpc4x_cLH1QwdY1s95YFaDHMYkwjL18MRsilLty7tNofWJVjkEqkEmS9txlAZV0eueSZf7BBc28W_6CBuRjkuTmGA34XLUNhgO9UjA/s400/ping_back_port_scanner.jpeg" title="wordpress_pingback_port_scanner" width="400" /></a></div><pre class="western" style="margin-bottom: 0.2in;"><code class="western"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;"> Use:-<br /><br />Quick-scan a target via a blog:<br /><br />ruby wppps.rb -t http://www.target.com http://www.myblog.com/<br /><br />Use multiple blogs to scan a single target:<br /><br />ruby wppps.rb -t http://www.target.com http://www.myblog1.com/ http://www.myblog2.com/ http://www.myblog3.com/<br /><br />Scan a free wordpress.com blog (all ports) from the internal network:<br /><br />ruby wppps.rb -a -t http://localhost http://myblog.wordpress.com/<br /></span></span></code></pre><div style="margin-bottom: 0in;"></div><a name="more"></a></div>

Wordpress Pingback Port Scanner

WordpressPingbackPortScanner Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other ho...

+ Read more »

List of vulnerability in wordpress 3.5.1.

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">Recently true-caller and Tango messenger is hacked by Syrian-Electronic-Army.</span></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">And large amount of Database has been stolen. Now what is common in these sites?</span></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">They have word-press 3.5.1 which is vulnerable to some attack.</span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><br /></div><span style="font-size: medium;">A weakness and multiple vulnerabilities have been reported in WordPress, which can be exploited by malicious users to disclose certain system information and bypass certain security restrictions and by malicious people to conduct spoofing and cross-site scripting attacks, bypass certain security restrictions, and cause a DoS (Denial of Service).<br /><br />1) An error when calculating the hash cycle count within the "crypt_private()" method in /wp-includes/class-phpass.php can be exploited to exhaust CPU and memory resources by sending HTTP requests with a specially crafted password cookie.<br /><br />Successful exploitation of this vulnerability requires knowledge of the URL for a password-protected post.<br /><br />This vulnerability is confirmed in version 3.5.1. Prior versions may also be affected.</span><br /><br /><br /><div style="margin-bottom: 0in;"><span style="font-size: medium;">Here is full details & exploitation is available ;visit this link.</span></div><div style="margin-bottom: 0in;"><span style="font-size: medium;"><a href="https://vndh.net/note:wordpress-351-denial-service">https://vndh.net/note:wordpress-351-denial-service</a></span></div><span style="font-size: medium;"><br />2) An unspecified error within the HTTP API related to server-side requests can be exploited to gain access to the site.</span><br /><div style="margin-bottom: 0in;"><span style="font-size: medium;">Here is full details.</span></div><span style="font-size: medium;"><a href="http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-additional.html">http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-additional.html</a></span><br /><span style="font-size: medium;"><br />3) An unspecified error can be exploited to bypass certain restrictions when publishing posts.<br /><br />Successful exploitation requires the "Contributor" role.<br /><br />4) An unspecified error can be exploited to reassign the post authorship.<br /><br />5) Certain input related to SWFUpload is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.</span><br /><a name="more"></a><span style="font-size: medium;"><br />6) Certain input related to Flash applet within TinyMCE Media Plugin is not properly verified before being used. This can be exploited to e.g. spoof unspecified content.<br /><br />7) Certain input related to media uploading is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.<br /><br />8) An error when handling failed uploads can be exploited to disclose the full installation path.</span></div>

List of vulnerability in wordpress 3.5.1.

Recently true-caller and Tango messenger is hacked by Syrian-Electronic-Army. And large amount of Database has been stolen. Now what is com...

+ Read more »

How to Solve problem of wpscan in Backtrack 5 r3?

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">Wpscan is wordpress security scanner, which is pre-installed in backtrack 5 , but it`s outdated version, so when you tried to update it, you may  have face some problems. Here is solution which work for me.</div><div style="text-align: left;"><br /></div><div style="text-align: left;">cd /pentest/web<br />rm -rf wpscan<br />git clone https://github.com/wpscanteam/wpscan.git<br />cd wpscan</div><div style="text-align: left;">gem install bundler && bundle install --without test development<br />apt-get install libxml2 libxml2-dev libxslt1-dev<br />gem install  bundler</div><div style="text-align: left;">bundle install </div><div style="text-align: left;">ruby ./wpscan.rb</div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><a name="more"></a><br /><div style="text-align: left;">==WPSCAN ARGUMENTS==<br /><br />--update   Update to the latest revision<br /><br />--url   | -u <target url>  The WordPress URL/domain to scan.<br /><br />--force | -f Forces WPScan to not check if the remote site is running WordPress.<br /><br />--enumerate | -e [option(s)]  Enumeration.<br />  option :<br />    u        usernames from id 1 to 10<br />    u[10-20] usernames from id 10 to 20 (you must write [] chars)<br />    p        plugins<br />    vp       only vulnerable plugins<br />    ap       all plugins (can take a long time)<br />    tt       timthumbs<br />    t        themes<br />    vp       only vulnerable themes<br />    at       all themes (can take a long time)<br />  Multiple values are allowed : '-e tt,p' will enumerate timthumbs and plugins<br />  If no option is supplied, the default is 'vt,tt,u,vp'<br /><br />--exclude-content-based '<regexp or string>'  Used with the enumeration option, will exclude all occurrences based on the regexp or string supplied<br />                                              You do not need to provide the regexp delimiters, but you must write the quotes (simple or double)<br /><br />--config-file | -c <config file> Use the specified config file<br /><br />--follow-redirection  If the target url has a redirection, it will be followed without asking if you wanted to do so or not<br /><br />--wp-content-dir <wp content dir>  WPScan try to find the content directory (ie wp-content) by scanning the index page, however you can specified it. Subdirectories are allowed<br /><br />--wp-plugins-dir <wp plugins dir>  Same thing than --wp-content-dir but for the plugins directory. If not supplied, WPScan will use wp-content-dir/plugins. Subdirectories are allowed<br /><br />--proxy <[protocol://]host:port>  Supply a proxy (will override the one from conf/browser.conf.json).<br />                                  HTTP, SOCKS4 SOCKS4A and SOCKS5 are supported. If no protocol is given (format host:port), HTTP will be used<br /><br />--proxy-auth <username:password>  Supply the proxy login credentials (will override the one from conf/browser.conf.json).<br /><br />--basic-auth <username:password>  Set the HTTP Basic authentication<br /><br />--wordlist | -w <wordlist>  Supply a wordlist for the password bruter and do the brute.<br /><br />--threads  | -t <number of threads>  The number of threads to use when multi-threading requests. (will override the value from conf/browser.conf.json)<br /><br />--username | -U <username>  Only brute force the supplied username.<br /><br />--help     | -h This help screen.<br /><br />--verbose  | -v Verbose output.<br /><br />==WPSCAN EXAMPLES==<br /><br />Do 'non-intrusive' checks...<br /><br />  ruby wpscan.rb --url www.example.com<br /><br />Do wordlist password brute force on enumerated users using 50 threads...<br /><br />  ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --threads 50<br /><br />Do wordlist password brute force on the 'admin' username only...<br /><br />  ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --username admin<br /><br />Enumerate installed plugins...<br /><br />  ruby wpscan.rb --url www.example.com --enumerate p<br /><br />==WPSTOOLS ARGUMENTS==<br /><br />--help    | -h   This help screen.<br />--Verbose | -v   Verbose output.<br />--update  | -u   Update to the latest revision.<br />--generate_plugin_list [number of pages]  Generate a new data/plugins.txt file. (supply number of *pages* to parse, default : 150)<br />--gpl  Alias for --generate_plugin_list<br />--check-local-vulnerable-files | --clvf <local directory>  Perform a recursive scan in the <local directory> to find vulnerable files or shells<br /><br />==WPSTOOLS EXAMPLES==<br /><br />- Generate a new 'most popular' plugin list, up to 150 pages ...<br />ruby wpstools.rb --generate_plugin_list 150<br /><br />- Locally scan a wordpress installation for vulnerable files or shells :<br />ruby wpstools.rb --check-local-vulnerable-files /var/www/wordpress/<br /><br /><div style="text-align: left;"><span style="font-size: large;"><span style="color: red;"><span style="font-weight: normal;"> If this solution does not work for you then try to <a href="http://tipstrickshack.blogspot.com/2013/07/how-to-solve-metasploit-problem-in-set.html" target="_blank">upgrade ruby version</a> & then process to installation. </span></span></span></div></div></div>

How to Solve problem of wpscan in Backtrack 5 r3?

Wpscan is wordpress security scanner, which is pre-installed in backtrack 5 , but it`s outdated version, so when you tried to update it, you...

+ Read more »