DISCLAIMER: This “how to hack a WordPress website” is a Ethical Hacking Tutorial and geared towards Security Professionals. Do not, I repeat, do not use those techniques without the written consent of the receiving party. If you use this tutorial in a unlawful context, lawful charges and / or prison time might be waiting for you.

Introduction

Ultimate SVG Design Mega Bundle.1200+ SVG Designs Included. This is a digital download of a word art vinyl decal cutting file, which can be imported to a number of paper crafting programs like Cricut Explore and some other cutting machines. Ultimate svg by botresell mega.

Websites are used daily by a large part of the world’s population to carry sensitive data from a person to an entity with online-based presence. In websites containing materials that are shown after authentication only, forms transfer data containing user credentials to server-side scripts. Users store their credit card details in their online accounts and use forms to buy items online, so it is crucial to keep the integrity, confidentiality and availability of this data intact.

This article is written merely with penetration testing and website security in mind. Any attempts to penetrate into live systems on your behalf and without consent may lead to criminal proceedings.

To try the training files that come along with this article, you would need a local server such as XAMPP or WAMPP with Apache and preferably MySQL turned on. If you are on Windows, to install Hydra you would need to install make, gcc and ssl libraries of Cygwin. Therafter, you would need to start it with the Cygwin Terminal. John the Ripper, on the other hand, can be started from the Command Prompt.

Fill out the form below to download the code associated with this article.

Exercise 1: Deep Data Hiding

In the past, and even today, some people have used security through obscurity. This means that they have unprotected directories and files with the sole protection being that they do not have any backlinks and no links to them in the main site. Thus, if one knew the URL of the directory or file – he could readily access it. A common way to reveal obscure directories is to check the publicly visible robots.txt and see what is disallowed to be indexed by search engines.

Now open the DeepDataHiding folder through your localhost and try to find the hidden directory where uploaded .doc files from “users” are stored, then access it. If you upload a .doc file to test this out, in the main page of the directory – it won’t leave your computer.

Exercise 2: Populating a Dictionary

To populate a dictionary, we will be using John the Ripper. Open the PopulatingDictionary folder.

You can populate a dictionary in John the Ripper and cut the output size by knowing the type of password (its maximum length, whether it should be only digits, contain special characters, etc.).

To create a simple dictionary and save it to a file, you can browse to the directory of the john the ripper installation in CMD and use: john-mmx –incremental=alpha –stdout > filename whereas filename is the name and location of the file in which the words should be saved to.

There are various options in the incremental mode, such as Digit (only digits), Lanman (letters, numbers and some special characters), Alpha (only letters) and All (all characters). Thus, you can also use john-mmx –incremental=lanman –stdout > wordlist.txt, etc.

Be aware that the size of the text file would probably get really big in just a couple of seconds, depending on your machine’s abilities.

Exercise 3: Acquiring user and password list for dictionary attacks

Querying Google for passwords and user lists is usually pretty straightforward.

You use something like filetype:lst password for passwords and filetype:lst user for username lists.

We have included a sample username list and a password list downloaded from the Internet along with the attachment files to this article.

Exercise 4: Breaking HTTPAuth

For this exercise, we will be using Hydra and the user/pass lists included in the attachment files.

When calling Hydra ($ hydra.exe) the parameter –L usrlistpath serves the purpose of supplying the program a path to a username list file whose usernames will be tested along with all the passwords until a match is found. –l username gives Hydra a single username, which option can be used if you know the username you are trying to break into but do not know the particular password.

-P loads a password list while –p loads a single password.

Next, you specify the host to attack (localhost or 127.0.0.1) followed by http-get (request a directory/page), followed by the path to the particular directory or file you are trying to access (path excluding the host which is already given). It will most likely look something like this:

hydra.exe -L HD:/WebsiteHacking/FormCracking/usrnames.txt -P HD:/WebsiteHacking/FormCracking/passwords.txt localhost http-get /HTTPSecurity/

Figure 1: the HTTPAuth seeking credentials. Get them!

To establish a simple HTTPAuth mechanism yourself, you need to create your password by browsing to htpasswd.exe in your Apache bin folder, starting it in Command Prompt, and creating it. You can move the user account list file to any directory you want and start the mechanism by editing your .htaccess file:

You can select only particular users to be able to access the page, and you can set different username lists for different parts of the website, but this mechanism for protection remains basic. To test cracking the example from the files, change the path of AuthUserFile to the current location of the HTTPSecurity directory.

Exercise 5: Breaking a POST login form

The password and usernames list are in the FormCracking folder. They have not been changed, but the correct login credentials are easy enough.

The following statement might work:

hydra –L path/FormCracking/usrnames.txt -P path/FormCracking/passwords.txt 127.0.0.1 http-post-form

“/FormCracking/index.php:username=^USER^&passwd=^PASS^:Oops”

The difference between this statement and when we cracked the HTTPAuth mechanism is that here we include the parameters that the form sends to the server-side script, in this case username and password. Those are the “name” attributes of the relevant input tags that we want to test.

Figure 2: viewing the POST fields.

Another difference is that after the address that we want to crack we include separated by a colon ( : ) the text that shows when the login submission is incorrect. Basically, we are telling the program to repeat until it gets a different output. In our case, we have “Oops” as a part of the login error string we receive.

We also include ^USER^ and ^PASS^ after each POST field that must be filled with the data from the username and password lists by the program.

Then, we wait and the job is done.

Exercise 6: Modifying Parameters

The next exercise is in the folder ParameterTampering. Open ParameterTampering/login.php with your browser. Your task is to bypass authorization or login with wrong credentials without viewing the server-side code and accessing members.php message and members2.php without the “Error!”. You do not have to crack the user details. For one of the methods, you must see what logging in looks like – use john/123

The first manner in which you can do this is by modifying an element in the page, the second involves a change in the URL.

The other task is to enter in members2.php without the server echoing “Error”. To do this, you should tamper with the HTTP Headers and add a referrer. I would recommend a plugin such as Tamper Data for Firefox or Request Maker for Chrome.

Answers:

1st possibility:

Figure 3: modifying the values of hidden inputs.

It might seem weird at first, but many sites actually have hidden inputs in which they store important data. An example is PayPal shopping carts on third-party websites where you can change fields such as name of the product directly by changing the value of a hidden input. There are some outdated shopping carts which still use price as a hidden input which means that if you don’t use their API and verify the amount that was paid to you through a server-side script – the user can easily pay as much as he wants for the product!

Figure 4: an example of a shopping cart which sets the price of the item on the client-side.

Figure 5: changing the name of the product in stores using PayPal as a payment method can still do some harm.

2nd possibility:

Setting a loggedin GET request, that’s probably not something you would meet somewhere today though.

3rd possibility, members2.php:

Install and start Tamper Data with alt+T when the page is opened. Add a new Header…

Called Referer and with value the path to login.php, it would look like you were redirected from login.php. There are developers out there who think HTTP_REFERER proves that the user is legitimate despite that it’s just a header sent through HTTP requests, and this is a point of exploitation in some sites even today.

Exercise 7: Exploiting Account Lockout

If you have a simple lockout mechanism like this (PHP/MySQL (AccountLockout1 folder)):

Torrent professional rapper 2017. Lil Dicky: Professional Rapper Audio Preview. TORRENT download. Download 1 file. VBR M3U download. Download 20 files. Uplevel BACK 696.0K. Meet the Burds (Interlude) download. Professional Rapper download.

If we have such a login form and we are relying on a plugin from WordPress or Joomla and we are not aware of that – then malicious people can block an account just by knowing the username. In many sites, the username is readily available such as in comments to articles, message boards, social media likes, etc.

A solution is both to block only the offending IP address and to provide the block only for a limited duration.

A sample solution of adding a duration for the account lockout In PHP/MySQL could look something like this:

Adding a user to the database could look like:

We use the number -1 to indicate that there is no lockout.
Then we change a bit the old code:

This simple script will lockout the account after 3 attempts for different periods of time – until a full hour has passed since the lockout. It can be found in the AccLockoutDuration folder.

It is yet even better to create an IP ban and implement a better version of the above script as it serves demonstrative purposes only.

Exercise 8: yet to come…

Conclusion

We have barely covered the topic of website hacking and web security, as this is a vast field to touch upon. Yet, I hope future articles would reveal more and more of this field, as the leakage of data could not only harm the reputation of your business, the trust of your clients, the well-being of clients, but also can put you in front of serious legal proceedings.