How to HACK 455 MILLION Websites | WordPress Hacking

Join the Discord Server!
---------------------
MY FULL CCNA COURSE

FREE CCNA FLASHCARDS

HOW TO PASS THE CCNA

SOCIAL

Disclaimer: These are affiliate links. If you purchase using these links, I'll receive a small commission at no extra charge to you.
---------------------------------------------------------------------------------------------------------------

HackTheBox Academy

00:00 Intro to WordPress
02:20 Setup
03:28 Enumeration
08:22 Exploit
10:31 Login Brute Force
15:23 Next Steps - Hack The Box
15:52 Outro

455 million websites are using WordPress!

Now, you would think that with WordPress being so popular, it would be really secure and safe against hackers, right?

Well, not quite. In this video, I’m going to show you how to hack them!

Before we start hacking WordPress, we need to know a bit more about it. If you’ve not heard of WordPress before, It's the most popular way to create websites with little to no coding needed.

It’s a Content Management System also known as a CMS. A CMS is a tool that helps build a website without the need to code everything from scratch.

In fact, most web hosting providers provide an easy one-click installation of WordPress meaning literally anyone can start to create blogs, portfolios and business sites in a matter of minutes.

Some of the world's biggest brands are using WordPress to run their websites. Sites such as TechCrunch, SonyMusic, and Disney

So that is the core WordPress application. From here, users will customise their websites.

The first thing people will usually do is install a custom theme. A theme changes the way your website is designed and looks.

After installing a new theme, users can choose from a huge library of plugins. These plugins provide all kinds of features from contact forms to full-fledged e-commerce stores.

So these are the main components that make up a WordPress website, the core WordPress application, Themes and Plugins.

The problem with WordPress is it can be a nightmare to keep everything up to date and secure. But if you don’t, very quickly vulnerabilities can be discovered in your plugins, themes and even WordPress itself! Then, attackers can use these vulnerabilities to hack the site.

HTB Sponsor
Hack the Box Academy has tons of free and premium training available, including this one on WordPress hacking.

They have a built-in, browser-based hacking machine and target WordPress server ready for us to hack so we don't need to worry about installing it all ourselves.

[Certbros]

BIG thank you to Hack The Box for making this video happen. Check them out below and start HACKING! 👇

[SumanRoy.official]

Please Note : A situation where a 0-day is discovered wpscan won't upload the documentation for it, because they like to give the vendor some time to mitigate the issue. Timeframe is usually 30 days. By that time it gets patched, making the vulnerability useless to exploit and hackers won't be able detect it via wpscan because it won't get reported in your scans until that patch window expires. Only the sites which did not patch it because the users are unaware of it can then be exploited.

[hnp-tv]

Show me 1 Website, what you hacked with a Wordlist? Before you speak about 455 Million Websites. This Video is not realistic. It will not works.

[Free.Education]

Please, if possible, cover these advanced topics like How to bypass Drupal CMS or other secured CMS? How to bypass HARD WAF protection that stops HTML, SQL, and XSS injection payloads? Payload single-double-triple encoding using Cyber-Chef? How to find the real origin IP of secured websites behind Cloudflare, Akamai, ModSecurity, AWS CDN, etc., ? How to bypass Hard WAF using SQLMAP or Burpsuite? How to find hidden vulnerable parameters and endpoints inside the .js and .jason files? How to find hidden admin pages, cPanel pages, and WHM pages ? Please cover these important topics. Thanks

[paulvargas]

Exactly what I was looking for. Cheers!

[jasgarcha]

Great share for those interested in Hacking - ethically, of course 😊. Thank you.

[nervall_revolt]

2:03 Ah, yes… My favourite CMS, *WordPess* xd Great video btw!

[powerseostrategy]

Now there's 810 Million Wordpress sites.

[MarkoKozlica]

Hack the Box is a bit expensive and I would like to learn more about hacking Wordpress sites, any suggestions? thx

[nikosdimou]

you dont need bf if is lfi attack you can call the ssh file and take the rsa key

[viktorsalamaha]

Most wordpress sites use random passwords, where can I get sheets with these passwords? I think nowhere)

[conmcdon]

Excellent video!! Thanks so much for this.

I was wondering if you would consider a follow-up that goes into the details of RCE via the theme editor. It's also in the Hack the Box lesson, but the instructions on how to utilize a web shell aren't very clear. For example, how does one utilize a web shell to access specific files on the server?

[MSLTV-jebn]

mean which place I put these prompt ?please tell me about it

[qompete]

Location for your rockyoutext says does not exists or is not a file ???

[bharathnaidu]

Learned so much about wpscan tool.Tha nk you ❤️

[danielruzicka]

You look like that guy who played Edward Snowden in Snowden movie

[ancour]

Instead of parrot, will these functions in other kali os

[mahdidelavaran]

hi your ccna course was very good would you consider creating a security plus course

[PenAce]

This will be covered in greater detail on my page!

[Wavy]

wpscan detected 0 vulnerabilities (sorry if i misspelled it) 0 vulnerable plugins etc., what should i do?