xmlrpc-exploitation

name	xmlrpc-exploitation
description	WordPress XML-RPC triage: method enum, multicall abuse, pingback SSRF, and upload-chain validation.
version	1.0.0
author	Hermes Agent Offsec maintainers
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3, jq, optional Burp Collaborator/interactsh
metadata	{"hermes":{"tags":["recon","wordpress","xmlrpc","ssrf","brute-force","upload","chaining"],"category":"recon","related_skills":["wp-mass-recon","cors-credential-wordpress","wordpress-plugin-hunt","phpinfo-to-rce","source-leak-hunt","staging-subdomain-hunt","wordpress-full-compromise","cross-attack-chains","attack-patterns-reference"]}}

XML-RPC Exploitation Skill

WordPress XML-RPC abuse workflow for authorized testing. Use this skill when /xmlrpc.php exists, when attack-patterns-reference flags P-07/P-08/P-09/P-24, or when a WordPress chain needs method enumeration, pingback SSRF, multicall amplification, or wp.uploadFile validation.

When to Use

• WordPress is confirmed and /xmlrpc.php responds with XML faults or Hello!.
• system.listMethods exposes system.multicall, pingback.ping, or wp.uploadFile.
• You need to decide whether XML-RPC is only exposed, rate-limit bypassable, SSRF-capable, or chainable to upload/RCE.
• A broader chain references P-07, P-08, P-09, P-10, P-24, WP-04, WP-05, or WP-06.

Operator Rules

• Test only authorized targets.
• Prefer proof-of-capability over noisy exploitation.
• Keep request volume low until the target's rate limits and scope are clear.
• Do not run credential attacks unless the engagement explicitly permits it.
• Record exact request, response code, XML fault code, and timing for each confirmed behavior.

Quick Reference

Pattern	Test	Positive Signal	Next Step
WP-04	system.listMethods	Method list includes XML-RPC methods	Classify exposed methods
WP-05 / P-07	system.multicall	Batched calls accepted	Check amplification/rate-limit bypass
WP-06 / P-08	pingback.ping to callback URL	Callback received or distinct XML fault	SSRF triage
P-09 / P-24	Pingback to IMDS paths	Non-generic response or callback behavior	IAM role path probing
P-10	wp.uploadFile available with valid low-priv account	Upload succeeds	Chain with role/capability misconfig

Procedure

Phase 1 - Confirm XML-RPC Surface

TARGET="https://example.com"

curl -sk -i  |  -40

curl -sk -X POST  \
  -H  \
  -d