With information on WordPress vulnerabilities available, and with the increase of useful tools to validate the security of WordPress installations, we will now use that information to perform an attack on a WordPress installation targeting the administrative user through an identified SQL injection vulnerability in a third party plugin.
Hacking WordPress
Getting ready
To successfully complete this section, we will need the following:
- Installation and configuration of OWASP-BWA as highlighted in the recipe Installing OWASP-BWA of Chapter 1, Installing Kali and the Lab Setup
- Network connectivity between your Kali Linux desktop and the OWASP-BWA instance
- Results from the WPScan run in the section Scanning WordPress