Watch me hack a Wordpress website..

Подписаться 762 тыс.

Просмотров 230 тыс.

50% 1

In this video, I hacked a Wordpress blog!
$1000 OFF your Cyber Security Springboard Boot camp with my code TECHRAJ. See if you qualify for the JOB GUARANTEE! 👉 www.springboar...
I first enumerate the directories of the website that lead me to the Wordpress login page, and then I enumerate the users of the blog. Performing a dictionary attack revealed the password of one of the user which enabled me to get an initial foothold on the blog. From there, I exploit a Wordpress vulnerability to escalate my privileges and ultimately take over the whole website. How easy!
DISCLAIMER: This video is intended only for educational purposes.
The experiments in this video are performed in a controlled
lab setup and not on a live target. The content is purely
from a penetration testing perspective. I do not
condone or encourage any illegal activities.
Join my Discord: / discord
Follow me on Instagram: / teja.techraj
Website: techraj156.com
Blog: blog.techraj15...
Thanks for watching!
SUBSCRIBE for more videos!

Наука

Опубликовано:

26 сен 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 285

@Pafkatax Месяц назад

Bro is legit hacking a wordpress website. i rarely see someone actually hacking and not giving a 3 minute example with a vulnerable made website in 10 mins :D Good stuff

@yousefal-hadhrami7853 3 месяца назад

Pro tip, Keep the old password hash so that you change it back when you are done

@peterkim9696 3 месяца назад

😎💀

@Codebyakshay 3 месяца назад

thanks black collar stuff

@null-undefined-none Месяц назад

well I think that depends on motive. If you want to cover your tracks, sure that makes sense. But if you did this as bounty hunting then better leave it changed so you can claim the bounty :)

@gibrains 3 месяца назад

Lesson learned: Just use static html ! =))

@ネメシス-h1z 3 месяца назад

static is the best anyways for blogs and basic websites.

@PIRATA_TV 2 месяца назад

If you don't know, when your website has SSL certificate (non self sign) and your host has the worst firewall sql injections are blocked and you can't do nothing.🙃

@CoreyThompson73 2 месяца назад

Actually 70%+ of Wordpress sites could move to something like Hugo and have the same webpage functionality.

@malzkaffee3581 2 месяца назад

other the tool "simply static"

@bootsycoll 2 месяца назад

What a lot of “devs” tend to overlook is the main selling point of Wordpress is it’s a cms and easily updated/managed by non-technical clients, one of the reasons why it’s still so popular,…sure, static sites are faster and more secure but how does a non-techie update them? They’re definitely not going to be uploading markdown files to a server for example, another option would be to go headless but then you have to configure a headless cms to manage it…more development time…or u could just install Wordpress and it’s pretty much good to go out of the box

@monkaSisLife 3 месяца назад

Once you got into the db you couldve literally just changed the account to an admin, or just change the admins password. no need for hashcat at that point

@TechRaj156 3 месяца назад

True. But I was also trying to escalate privileges on the machine and not just get admin on the blog. But I agree the hashcat part was unnecessary.

@L0zzer 3 месяца назад

@@TechRaj156 Perfect

@benargee 3 месяца назад

@@TechRaj156depends on the objective. Many times people use the same email and password on other sites so if you crack the leaked hashes, the same credentials could be attempting on the other sites.

@vaibhavsingh8122 3 месяца назад

@@TechRaj156 ltrace however is not installed by default on all distros

@emresanden 3 месяца назад

Was just about to comment the same thing 😛😂

@wndr0 3 месяца назад

Guys I’m 89% sure he can center a div

@koniply Месяц назад

glazing, I'd say about 60% give or take

@I_hu85ghjo Месяц назад

@@koniply 3, wont get lower

@145karpiu Месяц назад

I'm 100% sure nobody can center a div without Googling it...

@DeepThinker193 11 дней назад

My Div

@1brokkolibaum 3 месяца назад

I havent thought I will watch the full video.. But suddenly you finished your task 🫥😂👌 Great explanation in general, enough to keep up following the process logically. Surely I personally would have asked more about certain tools and useage, but for this case 10/10.

@shi-nee7966 3 месяца назад

lol this was very fun to watch! Always loved your fresh content!

@digitzero3613 3 месяца назад

Everything else was realistic except the Linux privilege escalation part. Like what's the probability of finding something like this checker binary file which sets the uid to 0.

@bob-p7x6j 3 месяца назад

I may sound like a simpleton and compared to you I am but since you say you are trying to help people protect themselves, as a Wordpress user, what would be your most valuable tips to give, this video is too advanced for most people, but if you could give a list of say, the 10 or 20 most valuable techniques to protect yourself from most common attacks, or something like that...If you have time and feel like it... Subscribed, very informative, thanks!

@ghostofakina8747 3 месяца назад

Sure here's 3 big ones: - Keep your WordPress, themes and plugins up to date - Don't use the default username and have a strong password - Don't use pirates/nulled or crappy plugins

@stefanjohansson2373 2 месяца назад

There’s a lot of free security plugins like WP Security that blocks some of the different attack steps. A strong password and everything updated is most important, but if you also change everything that’s default like the login link and so on you don’t look like the low hanging fruit I guess. 😂

@annahri 3 месяца назад

I don't think there's something like that in the wild. That `checker` thing is so unlikely. But great video nevertheless.

@AREWASOUND 2 месяца назад

I watched the full video just to know how to protect my wordpress site, Thanks

@dearestdi 29 дней назад

how is it? i am trying to protect too

@imarvindpanwar 21 день назад

@@dearestdi just use security plugins to block backdoor entry

@yassinesafraoui 3 месяца назад

There is just no way you could find a suid binary that gives you a shell if you set an env variable to 1, it feels like those movies where someone hides the keys of his house in a really obvious spot. But still the video is greatt for educational purposes, it was fun watching it and knowing about the tools that let you do this kindof stuff

@seephor 3 месяца назад

Obviously. This is a setup hack challenge so you know there's some vector you need to find.

@phyoewaipaing6670 Месяц назад

Appreciated. Hacking WP is possible as long as it goes with the default installation. The typical setup is to restrict those sensitive URLs to dedicated IP like using your own VPN. Also need to update all plugins and themes on a regular basis and use security plugins like fail-to-ban, and you’re all set. For the password tips, it’s better to set 48+ characters with complexity and reCAPTCHA is supported for the login as an additional protection. Love to see next video with updated WP version as well🎉

@ballfoot2460 Месяц назад

I am using 2 factor authentification, do you think it's ok too ?

@phyoewaipaing6670 28 дней назад

@@ballfoot2460 yeah and make sure all plugins and themes are updated and remove unused ones.

@noobgam6331 Месяц назад

This will never happen with any real website.

@TheNamesJT 2 месяца назад

This is why you need a plugin like wordfence and perma ban ips that request more then 5 failed login attempts

@ahmadganteng7435 2 месяца назад

Even getting access to read DB is a big vulnerability. I hope my hosting provider has something to prevent this app. This is horrifying..

@rdi7371 3 месяца назад

This was very interesting, and your explanation was also very instructive. I understood the steps you took to overcome each difficulty you encountered. Thank you, because now I know what to study before becoming a cybersecurity analyst.

@louislouislouislouisssss 3 месяца назад

BTW, the password value in Wordpress DB is just an MD5 hash. You can create the hash right in terminal.

@Zircuitz 2 месяца назад

There's no fucking way... MD5? Srsly? Do they want the passwords cracked?

@Adam2fg 24 дня назад

@@ZircuitzYep. They're begging to be cracked😂😂

@AamirHMalik Месяц назад

How easy and satisfying it looks but when you deep dive in it's heeelllll a lot more than thatttt! It's like pain in the az!

@TechnicalHeavenSM 3 месяца назад

Simply amazing... got to know many things about the insights of how some things work!

@fkwebdev 2 месяца назад

Moral of the story is that: don't use software based websites, just use coded websites because we developer code very hard to apply bunch of security layers....

@anolbe 2 месяца назад

This is one of the reasons i always make my own hash and salting algorithms; and also a reason that i prefer making the software i'm using myself, despite how much work is needed.

@gamishreyansh9940 3 месяца назад

dear at 20:06 you have database access you can just create new admin user in database

@1brokkolibaum 3 месяца назад

But the goal could also have been to stay hidden for further investigation, so a new user would rise way more suspicion. 🤷‍♂😁

@vaibhavsingh8122 3 месяца назад

Moreover the password recovered from wordpress site can also be used in emails or at other places, including the sudo user in the bash

@digitzero3613 3 месяца назад

He got access to "wordpressuser" database account. It most probably doesn't have administrator access so can't really change admin password and can't create a new account either.

@vaibhavsingh8122 3 месяца назад

@@digitzero3613 no, he can change the WordPress admin account password, no restriction can be put in a MySQL user to prevent changing the data of a specific row of a table, MySQL user can only be restricted from updating the entire database. Beside the user mentioned in wp-config is the one that creates all the table in the place, that's the only db user WordPress know and that's the only user WordPress will use to update the password when the admin user chooses to change the password from WordPress's dashboard

@SwarajSahu Месяц назад

@@1brokkolibaum No, if they have plugin like wordfence, any shell upload will trigger an email. so anyway this hack is possible with noob setup wordpress.

@DELvEK 3 месяца назад

Not a real hacking in real time btw ! @Tech Raj. This was pre-setup for the video

@isaachiroman 3 месяца назад

If you already have access to the server, you should install the WP CLI, then create a new admin user or change the password of any user (of course I don't want to leave any traces so I'll make a new user, then get what I need and delete all traces).

@vaibhavsingh8122 3 месяца назад

He can also update the wp-login.php file to log the password in plain text file and after logging either an email can be sent using wp_mail or an api endpoint of his own server can be called with the logged credentials, so whenever someone logs in again with the same user he gets a notification.

@kmwebverse2 Месяц назад

You just need a free security plugin like Solid Security and hacker will not even be able to see your usernames

@mostafaharb81 3 месяца назад

Well if you got access the the second user, then when you got access to the wp_user table, you could have updated the first user encrypted password with the second user encrypted password and then access the admin user with the second user password...

@TechRaj156 3 месяца назад

That would be a smart move! But I was also trying to root the whole machine and not just get admin rights on the blog.

@mostafaharb81 3 месяца назад

@TechRaj156 yeah I do understand for sure, but wordpress password encryption is based on the codes available in the config.php file which you accessed at the begining, so the password you generated at the website would not work in newer versions unless you create password on same keys in config or the easier path is to switch passwords or switch role to admin for the user account.. but still, you have done qn awesome work 👌

@digitzero3613 3 месяца назад

He got access to "wordpressuser" database account. It most probably doesn't have administrator access so can't really change admin password and can't create a new account either.

@stefanjohansson2373 2 месяца назад

Newbie question: How much of this is possible in general on the latest WP version and with WP security or any other similar security plugin? Security plugins can block user enumeration, IP number after wrong username/password. They also change default settings like the login URL. Of course no backup of important files are stored on the server. Also add the fact that a lot of hosting companies block sites in shared hosting if they don’t keep their sites updated. Combining a security plugin with everything updated and using a long and strong password (not with English words in it!) maybe is the best way to avoid being the low hanging fruit for all script kiddies? 🤔

@brodierobson4490 Месяц назад

the reality is, you will need to find / create an exploit yourself.

@StevenNorth 2 месяца назад

Great video! Thanks for the detailed explanation.

@Rajeshevhu 3 месяца назад

Try in latest version of WordPress.

@qwaszx2 3 месяца назад

The latest version of WP breaks all themes so nobody updates. :P

@Rajeshevhu 3 месяца назад

@@qwaszx2 i updated latest version of my wordpress 6.4 or something. My site is working fine

@webrevolution. 3 месяца назад

@@qwaszx2 No decent website worth hacking for bug bounties uses wordpress anyways. CMSs like wordpress are generally only used for personal blogs of no name individuals or companies.

@nick-leffler 3 месяца назад

@@qwaszx2Lol that's why you use a good theme.

@tomxygen5963 3 месяца назад

@@qwaszx2what are you even talking about? there’s absolutely no issue with themes in the latest version of wordpress

@osherezra131 3 месяца назад

Great lesson bro thank you. nice process keep it up with this kind of videos

@MizManFryingP 3 месяца назад

Wouldn't most of these attack surfaces be shut down with simple too many requests protection?

@HansFriedrich532 2 месяца назад

Yes it would, bruteforcing an account is unlikely on most Wordpress websites, as the passwords for new accounts are automatically generated and it discourages users from creating unsafe passwords

@d3layd 3 месяца назад

Once you got access to the db, why didn't you just change the password? All you need to do is clear the hash, type in the new password and hash it and boom you've got access to any user. I do this all the time whenever I loose a password for a site.

@digitzero3613 3 месяца назад

He got access to "wordpressuser" database account. It most probably doesn't have administrator access so can't really change admin password and can't create a new account either.

@SwarajSahu Месяц назад

@@digitzero3613 No , in wordpress, db_config user has all permissions. so yes he can change the pass.

@captain9756 27 дней назад

Wow this is so easy let's hack all WordPress websites

@zeddybear1379 3 месяца назад

It still shocks me that wordpress has features to protect you against brute force and telling you if you have the correct username but incorrect password, but you have to manually configure and turn them on, and most of the people who use wordpress use it because its simple to use to make a website and you dont need any coding knowledge so they dont know about these extremely important features... it should be default

@hoholebaguette7298 3 месяца назад

why didnt you use sudo -l when you were trying to root?

@alexlove2012 3 месяца назад

If you have admin access to database, you can just change the hashed password no?

@michalkorneluk2186 3 месяца назад

"ignore those warnings, i'm going to fix them later" them metasploit warnings are never getting fixed are they? XD

@yjawhar 3 месяца назад

Nice video. But, since you already gained access to the database, it's as good as being an admin on the website since you can modify everything but it's gonna be more difficult!

@Sobbayi 3 месяца назад

Another option is to add a function into functions.php file to create a new user in the DB with admin privileges leaving the original admin untouched

@Kaotix_music 2 месяца назад

this seems much easier to do. How do you access my websites functions.php thou thought logging into my server?

@hatnis 3 месяца назад

what stopped you from just changing the hash once u had database access?

@qwerty-p5m1f 3 месяца назад

Lack of experience.

@philipehusani 3 месяца назад

@@qwerty-p5m1f 😂😂😂😂

@Robin-ce6jd 3 месяца назад

Very good and detailed tutorial, thank you very much! However, I don't see the reason why you absolutely have to be root on the server. As soon as you have access to the database, you can change the password or even create a new user :)

@emanueleborghini3186 3 месяца назад

Peak scriptkiddie content

@tpevers1048 3 месяца назад

You do not quit youtube

@s0kulite 3 месяца назад

no devs are gonna leave those sort of bins for your the sake of your privilege escalation, but sure, nice video before that.

@MRJMXHD 3 месяца назад

Good job, but any wordpress dev worth their salt would have blocked user and directory enumeration.

@imnbsp 3 месяца назад

I lost faith in you completely at 18:00 You don't need to guess the password if you already have database access. You can just set the admin password to whatever you want, or even better, you can just create a php file like a.php that gets the first admin user and creates a logged in session for you, without even having to update the admin password at all. It's super easy just by using the WordPress methods on the docs.

@andrinenz463 3 месяца назад

Do you have to be a root user to change values in a db? Just curious because then the other steps are not necessary

@ioccodeioccode6138 3 месяца назад

You're right. He could have get WordPress administration access by changing the password hash the first time he got access to the database.

@amajangbah9265 3 месяца назад

Tips: Always use webflow

@froza_horizon Месяц назад

Can anyone drop vul for wordpress5. 8.1?

@gamingmetxadrian3710 3 месяца назад

You earned a new sub, I'm a reverse engineer and have little knowledge to pentesting. You make it really interesting and clear!

@mysinN89 2 месяца назад

Please tell me the checker binary has been put there by yourself ;-) lol

@n1m390 3 месяца назад

I'm a WordPress developer, seeing all this makes me 😢

@samuelhalder8472 3 месяца назад

Lol

@Yarkanlaki 3 месяца назад

its common password attack they would never crack random passwords

@Heisenberg696 3 месяца назад

This kind of videos we need keep making this kind of videos

@ShriSumitJi 3 месяца назад

do you provide private classes

@thepickicool97 Месяц назад

wow, I will never use wordpress again lol

@sevenrichiewhite 2 месяца назад

This video actually shows how easy it is to get hacked when using a Wordpress website. And Wordpress is getting hacked and exploited every day in many different forms. Which is good and also bad. So you're save from all that by just not using Wordpress or any other CMS of that kind. Static websites and Flat File CMS without admin interface or actual user are my choice anyways. Now i can show my clients actually why.

@gabydewilde 3 месяца назад

It so willingly reveals everything

@anowarulhassan5117 3 месяца назад

When you have database access, just add a new user to db as user type admin and you can get the admin access.😅

@letslearnwordpress 2 месяца назад

Interesting! Thanks.

@ooooeakash2937 Месяц назад

You are lucky, nothing else

@EnthusiastWorld-k1u Месяц назад

i have a question, i see full video, how can i save my word-press website , could you possible suggest any free plugin ?

@faizanshakil2775 Месяц назад

I am wondering what would have you done if the the kwheel's password was not crackable ?

@youneszar5431 Месяц назад

when I run the attack on my site it says that it receive unown response code 405

@memorysmelody4589 3 месяца назад

wpscan gives various vulnerabilities available in different plugins of the websites but can't find poc of them. Please guide

@jxkz7 22 дня назад

Did you find any resources for these issues. I am also facing the same problem

@rameensuresh 2 месяца назад

Please show us how to null a plugin. Example tablesome plugin

@TheHagamanstube 3 месяца назад

This will never work in reality :)))

@_indgamer_ Месяц назад

Fun fact: buy SSL

@zen.ali238 3 месяца назад

Amazing !!

@justk-h5h Месяц назад

What is the name of the software you write the code for? I haven't been able to find it

@sambritto-o5s Месяц назад

😂😂😂Wordfence is the global leader in WordPress security.

@sambritto-o5s Месяц назад

Wordfence plugin

@arisawali5073 3 месяца назад

what if there is no xmlrpc?

@firedeveloper 3 месяца назад

Bad luck. You need to find an other vector.

@kptechnologyservices4696 2 месяца назад

This has now been fixed

@justchecking2470 3 месяца назад

Awesome job amazing content :)

@Epirium 3 месяца назад

awesome way to promote sponsor courses 😂

@Merajshaikh22 3 месяца назад

Bro come back

@thilakreddy1904 3 месяца назад

Are u using a window manager or is it a kali theme

@hridaybhatia5643 3 месяца назад

It looks like Kali

@Elia33337 2 месяца назад

I'm new at hacking, but couldn't you use sudo to get root?

@honestfrieza 3 месяца назад

Getting This Error { "code": "rest_user_cannot_view", "message": "Sorry, you are not allowed to list users.", "data": { "status": 401 } } is there any othere way to list users ?

@spiritcaress 3 месяца назад

Hi, please where can I get fuzz word lists?

@novianindy887 3 месяца назад

does wp-login only accept 7 times password guessing tries? I tried it and I can get unlimited tries.

@STFUandFY 3 месяца назад

Depends on plugins, WAF

@DeathNote00021 3 месяца назад

Great Video 👌🏻

@obertscloud 2 месяца назад

you got lucky with that script ; but what about finding the actual password ?

@StewardGodwinJornsen Месяц назад

ASSIGN ADMIN PASSWORD You already have the password for the second user. Now you have the hash. Copy that and use it to update the admin password. Backup the admin password so you can restore it. While your update remains, you can temporarily use the second user's password to login. I guess that should work better than trying to crash the admin password itself which would take longer. 😊

@StewardGodwinJornsen Месяц назад

Oops, I didn't quite go through the whole video before commenting. I guess you did relatively what I commented. 😅

@anshhmehta 3 месяца назад

Can you guide what's the procedure to manually enumerate to find the user id? coz this method did not work

@ibrahimdevx 3 месяца назад

google it 👏

@christopherjonesramos3655 3 месяца назад

Can it work if the wp site is tunneled to Cloudflare?

@firedeveloper 3 месяца назад

Short answer yes. Long answer depends on your configuration, there are many ways that can be blocked by cloudflare rules. For example you may block a url to be accessible from your static IP only. And keep in mind that cloudflare is not a firewall.