Wordpress XMLRPC - Pingback Detection

ID: wp-xmlrpc-pingback-detection

Severity: info

Author: pdteam

Tags: wordpress,ssrf,oast,xmlrpc

Description

WordPress XML-RPC Pingback Detection refers to the identification and monitoring of XML-RPC Pingback functionality in a WordPress website. This is vulnerable to pingback detection and bruteforce attacks.

YAML Source

id: wp-xmlrpc-pingback-detection

info:
  name: Wordpress XMLRPC - Pingback Detection
  author: pdteam
  severity: info
  description: WordPress XML-RPC Pingback Detection refers to the identification and monitoring of XML-RPC Pingback functionality in a WordPress website. This is vulnerable to pingback detection and bruteforce attacks.
  reference:
    - https://github.com/dorkerdevil/rpckiller
    - https://the-bilal-rizwan.medium.com/wordpress-xmlrpc-php-common-vulnerabilites-how-to-exploit-them-d8d3c8600b32
  metadata:
    max-request: 2
  tags: wordpress,ssrf,oast,xmlrpc

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /xmlrpc.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: humans_21909=1

    matchers:
      - type: word
        words:
          - 'XML-RPC server accepts POST requests only.'
        internal: true

  - raw:
      - |
        POST /xmlrpc.php HTTP/1.1
        Host: {{Hostname}}

        <methodCall>
          <methodName>pingback.ping</methodName>
          <params>
            <param>
              <value>
                <string>http://{{interactsh-url}}</string>
              </value>
            </param>
            <param>
              <value>
                <string>{{BaseURL}}/?p=1</string>
              </value>
            </param>
          </params>
        </methodCall>

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or
# digest: 4a0a00473045022079f8ba3f9d5792206f42ff152a12d23033d039d5f19165d64fdf1682341ae671022100bf2ba07040e83c38586683cdcc572f3d9f7ac87d7e7ac8391a44537039b34f2b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/wp-xmlrpc-pingback-detection.yaml"

View on Github