hunt-wordpress

To find and exploit WordPress vulnerabilities, you need to systematically fingerprint attack surfaces like REST API endpoints and XMLRPC, then probe for misconfigurations and vulnerable plugin versions to establish an exploitation chain. This Skill automates that manual auditing workflow.

The best way to enumerate users and detect exposed WordPress REST API endpoints is by running structured fingerprinting scripts against the target domain. This Skill uses curl, python3, and jq to identify these misconfigurations and exposed debug logs that scanners often miss.

Yes, you can brute force WordPress logins via XMLRPC. This Skill provides structured exploitation workflows specifically for XMLRPC abuse, allowing you to execute brute force attacks and identify system enumeration opportunities during manual penetration testing.

Yes, you need curl, python3, jq, and nc installed. These dependencies are required to execute the fingerprinting and exploitation workflows against target infrastructure, enabling you to identify vulnerable plugins like Revslider or ElementsKit.

CORS credential reflection in WordPress misconfigurations allows attackers to capture user authentication data from cross-origin requests. This Skill provides structured exploitation workflows to probe these misconfigurations, enabling you to establish an exploit chain during offensive security assessments.