Currently Empty: £0.00
WordPress is one of the most popular content management systems on the web, powering millions of websites. However, its widespread use also makes it a prime target for hackers. In this comprehensive course, you will learn the ins and outs of WordPress security from both offensive and defensive perspectives.
The first part of the course will focus on ethical hacking techniques specific to WordPress. You will delve into the mindset of malicious actors, learning how they exploit vulnerabilities to compromise WordPress sites. Through hands-on labs and exercises, you will master common attack vectors such as Remote Code Execution (RCE), Local File Inclusion (LFI), and brute force attacks. By understanding how hackers operate, you will be better equipped to anticipate and defend against their tactics.
In the second part of the course, you will explore strategies for hardening WordPress sites against cyber threats. You will learn best practices for securing WordPress installations, themes, and plugins. Topics covered will include configuring secure user authentication, implementing HTTPS, and employing web application firewalls (WAFs) to safeguard against known vulnerabilities. Additionally, you will learn how to conduct security audits and implement security monitoring to detect and respond to suspicious activity.
By the end of this course, you will have the knowledge and skills to ethically hack WordPress sites to identify vulnerabilities and weaknesses, as well as the expertise to harden those sites to mitigate the risk of exploitation. Whether you are a WordPress developer, administrator, or security professional, this course will empower you to protect WordPress sites from cyber threats effectively.
Intro to Wordpress
Intro to WPScan
-
2What is wordpress?
-
3Installing Wordpress
-
4Wordpress Main Files
Main WordPress Files
index
license.txt contains useful information such as the version WordPress installed.
wp-activate.php is used for the email activation process when setting up a new WordPress site.
Login folders (may be renamed to hide it):
/wp-admin/login
/wp-admin/wp-login
/login
/wp-login
xmlrpc is a file that represents a feature of WordPress that enables data to be transmitted with HTTP acting as the transport mechanism and XML as the encoding mechanism. This type of communication has been replaced by the WordPress REST API.
The wp-content folder is the main directory where plugins and themes are stored.
wp-content/uploads/ Is the directory where any files uploaded to the platform are stored.
wp-includes/ This is the directory where core files are stored, such as certificates, fonts, JavaScript files, and widgets.
wp-sitemap.xml In Wordpress versions 5.5 and greater, Worpress generates a sitemap XML file with all public posts and publicly queryable post types and taxonomies.
Post exploitation
The wp-config.php file contains information required by WordPress to connect to the database such as the database name, database host, username and password, authentication keys and salts, and the database table prefix. This configuration file can also be used to activate DEBUG mode, which can useful in troubleshooting.
-
5Wordpress User & Roles
Users Permissions
Administrator
Editor: Publish and manages his and others posts
Author: Publish and manage his own posts
Contributor: Write and manage his posts but cannot publish them
Subscriber: Browser posts and edit their profile
-
6Wordpress Dashboard Overview
-
7Installing Kali Linux
-
8Get WordPress version
-
9Get Wordpress Users
Exploiting a Vulnerable Plugin & Core
-
10WPScan Overview and Getting Token
-
11What can WPScan check for?
-
12basic scan
wpscan --url yourwebsite
Running the command above will perform a basic scan of your site. After a few minutes, you’ll have a whole bunch of “Interesting Findings” that WPScan discovered from your site’s code. That could include information like:
Headers to discover server information
Accessibility of xmlrpc.php
Accessibility of wp-cron.php
WordPress version
Active theme and its basic information
Active plugins and their basic information
Discoverable Config backups
-
13Enumeration Modes
When enumerating the WordPress version, installed plugins or installed themes, you can use three different "modes", which are:
passive
aggressive
mixed
If you want the most results use the "mixed" mode. However, if you are worried that the server may not be able to handle a large number of requests, use the "passive" mode. The default mode is "mixed", with the exception of plugin enumeration, which is "passive". You will need to manually override the plugin detection mode, if you want to use anything other than the default, with the --plugins-detection option.
-
14Enumeration Options
WPScan can enumerate various things from a remote WordPress application, such as plugins, themes, usernames, backed up files wp-config files, Timthumb files, database exports and more. To use WPScan's enumeration capabilities supply the -e option.
The following enumeration options exist:
vp (Vulnerable plugins)
ap (All plugins)
p (Popular plugins)
vt (Vulnerable themes)
at (All themes)
t (Popular themes)
tt (Timthumbs)
cb (Config backups)
dbe (Db exports)
u (User IDs range. e.g: u1-5)
m (Media IDs range. e.g m1-15)
If no option is supplied to the -e flag, then the default will be: vp,vt,tt,cb,dbe,u,m
-
15Enumeration Options
-
16user enumeration with WPScan
wpscan --url yourwebsite -e u
wpscan --url yourwebsite -e --passwords password.txt
You can probably guess what the “u” stands for.
WPScan will use a few different techniques to do its own guessing: determining usernames based on the information available publicly on your site (i.e. author names). WordPress will tip its hands in some subtle ways as WPScan probes those guesses. (The blacked out content below are discovered user IDs.)
Why does user enumeration work on WordPress?
By default, WordPress is prone to user enumeration. This is because of permalinks, a feature that provides permanent URLs to individual WordPress posts and pages.
Notably, WordPress lets you list all posts by a specific author’s username or ID, which could be exploited by attackers to identify valid usernames. This is where WPScan’s enumeration tool comes in handy, as it quickly checks if your WordPress site is susceptible to user enumeration.
Attackers strive to collect information about the targeted website, like usernames, plugin names, their versions, themes, and other factors. Knowing usernames alone might not enable an attacker to breach your site, but this information can aid them in crafting their attack strategy.
-
17User Enumeration
Attacking WordPress with Metasploit
-
18WordPress Plugin Reflex Gallery - Arbitrary File Upload
-
19Gwolle GuestBook RFI
-
20Mail Masta 1.0 - Local File Inclusion
-
21Brute Force User Password, Upload Plugin, Modified Theme
-
22Quiz Time!
-
23Plainview Activity Monitor CSRF & RCE
-
24What is?
-
25Local File Inclusion to Shell Part 1
-
26Local File Inclusion to Shell Part 2
-
27incomplete wordpress install
-
28So Simple Remote Code Execution
-
29Wordpress Host Server - Arbitrary File Upload
-
30Wordpress Host Server - ad-manager-wd
WordPress Hardening
-
31WordPress Enumeration With Metasploit
use auxiliary/scanner/http/wordpress_scanner
show options
set rhost
set targeturi (if it is in another directory)
run
-
32Wordpress User Enumeration With Metasploit
use auxiliary/scanner/http/wordpress_login_enum
show options
set rhost
set targeturi (if it is in another directory)
run
Assuming we have no idea about any user credentials on the target machine, the first thing to do is enumerating and validating usernames. So set “bruteforce” option to false as shown below.
-
33Metasploit to upload a malicious WordPress Plugin
-
34Jerome WP Crop Shell (Authenticated)
How long do I have access to the course materials?
You can view and review the lecture materials indefinitely, like an on-demand channel.
Can I take my courses with me wherever I go?
Definitely! If you have an internet connection, courses on Udemy are available on any device at any time. If you don't have an internet connection, some instructors also let their students download course lectures. That's up to the instructor though, so make sure you get on their good side!
Please, login to leave a review