HTB academy Wordpress hacking login

HTB Content Academy
1

Hi All,

I working on Wordpress hacking login and try call method by system.listMethods first ,

curl -X POST -d “system.listMethods” 167.172.55.94:31042/xmlrpc.php

in response i receive method * 100

i add to method wc -l and grep “wp” and count the number the results, but academy didn’t accept my answer

Any idea u guys can share?

1 Like
3

Follow the CURL POST REQUEST tutorial on the page and replace wp.getUsersBlogs with system.listMethods

you can find info about system.listMethods here WP system.listMethods

curl -s -X POST -d "<methodCall><methodName>system.listMethods</methodName><params><param><value>admin</value></param><param><value>CORRECT-PASSWORD</value></param></params></methodCall>" http://<web_host_here>/xmlrpc.php

you can use the below to count

 | grep 'value' | wc -1

and… don’t forget to replace <web_host_here> with your target ip host

3 Likes
4

Hotttttt thanks . It’s works :smiling_face_with_three_hearts:

5

I have been trying the same command but getting 82. Can you please help me?

1 Like
6

I got 82 too. So then I tried 81, 80 and it worked.

1 Like
9

For those of you who are getting a word count of 82, it is because you are likely using … | grep 'value' | wc -l. If you add the -o flag and search for the string <string>, for example, you will get a count of 80.