Hack Like a Pro: How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!WordPress-based websites are among the most numerous on this planet (maybe other planets too, but I can't vouch for that). According to WordPress's own website, WordPress powers 23% of the top 10 million websites. That's approximately 2.3 million sites using WordPress!WordPress websites arealsoamong the mostvulnerablewebsites. Generally, WordPress hosts small- to medium-sized businesses that are not the most vigilant at installing patches and updates. This makes for some broad and fertile ground forweb app hacking!In this tutorial, before we advance to vulnerability assessment and exploitation, I want to show how to identify these potentially vulnerable WordPress websites.WordPress VulnerabilitiesWordPress is among the Internet's most widely used content management systems (CMS). In addition, it is among the most vulnerable. A quick glance atSecurityFocus's websitereveals 16 pages of known vulnerabilities to WordPress sites, with the most recent group coming just last month.A similar analysis of exploits particular to WordPress onExploit Databasereveals 784 exploits. The most recent of these are just this month, October 2015.These two bits of information make it clear that WordPress provides fertile ground forweb app hacking.Step 1: Finding Sites Built on WordPressThe first step here is to identify whether the website is running WordPress. If we are examining a particular website and we want to know whether it runs WordPress, there is a website calledBuiltWithwhere we can enter the domain name and it will return information on the technologies that the site was built with.In this case, let's take a look at theToronto Standard, a venerable newspaper of Canada's largest city. When we enter its URL into the BuiltWith website, it returns that following information.As you can see, it reveals to us that the Toronto Standard runs on Apache and is hosted by BlueHost. If we scroll down a bit, we can see that BuiltWith tells us that the newspaper uses WordPress as its CMS.Step 2: Google Dorks to Find WordPress SitesThere are numerous signatures of a WordPress website. These include unique directories, login pages, tags, text, etc. For those of you familiar with Google hacking, you can usually find those signatures in the URL.A few usefulGoogle dorksto identify WordPress websites include:"index of" inurl:wp-content/This dork returned 10,400,000 sites."inurl:"/wp-content/plugins/wp-shopping-cart/"This dork returned 4,230 sites."inurl:wp-content/plugins/wp-dbmanager/"This dork returned 290 sites.I'm sure that you can come up with many more dorks that will return WordPress sites, but these should provide you with plenty of sites to practice on for awhile.While doing Google hacking, you might get a webpage from Google with a CAPTCHA. Don't worry, Google is just trying to make certain you aren't running a script which violates the Google EULA.Step 3: Tools for Identifying WordPress SitesThere are a number of tools that you can use to identify WordPress websites. Probably the two best are the browser extensionsChrome Snifferfor the Chrome web browser (it's also availableon GitHub) andBuiltWithfor the Mozilla web browsers (these include Firefox and Kali's IceWeasel).With the Chrome Sniffer extension installed, when I navigate totorontostandard.com, a small WordPress logo appears in the the right side of the URL box indicating that this site runs WordPress.Now, whenever you navigate to a website, your browser will identify the technology the site is built with. This, obviously, can be useful for all types ofweb app hacking, not just WordPress.Keep Coming Back for More Web App Hacking!In my next tutorial inthis series, we look at ways to find known vulnerabilities in these websites and, ultimately, the tools and techniques for exploiting them, so keep coming back!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)Hack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Hack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)How To:Set Up a Pentesting Lab Using XAMPP to Practice Hacking Common Web ApplicationsNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Hack Hackademic.RTB1 Machine Part 1Hack Like a Pro:How to Find Website Vulnerabilities Using WiktoHow To:The Art of 0-Day Vulnerabilities, Part3: Command Injection and CSRF VulnerabilitiesHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityHack Like a Pro:Use Your Hacking Skills to Haunt Your Boss with This Halloween PrankHow To:A Security Bug Just Made It Risky to Open Links on Your iPhone—Here's How to Protect YourselfHow To:Launch Apps, Tasks, & Websites Directly from Your iPhone's Notification CenterHack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)Become an Elite Hacker Part 4:Hacking a Website. [Part 1]How To:Gain Control of WordPress by Exploiting XML-RPCHow to Hack Databases:Hacking MySQL Online Databases with SqlmapHow To:Check for the Stagefright Exploit on Your Android DeviceHow To:Create a portfolio website for videos using WordPressHack Like a Pro:How to Fingerprint Web Servers Using HttprintHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateAR:Everytime You See BP Logo, See 3D Oil SpillHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:install a favicon on wordpressHow To:The Official Google+ Insider's Guide IndexHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitGoogle Dorking:AmIDoinItRite?How To:Hack Coin-Operated Laudromat Machines for Free Wash & Dry CyclesExploiting XSS with BeEF:Part 1Community Byte:HackThisSite, Realistic 3 - Real Hacking Simulations