| name | xmlrpc-exploitation |
| description | WordPress XML-RPC triage: method enum, multicall abuse, pingback SSRF, and upload-chain validation. |
| version | 1.0.0 |
| author | Hermes Agent Offsec maintainers |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3, jq, optional Burp Collaborator/interactsh |
| metadata | {"hermes":{"tags":["recon","wordpress","xmlrpc","ssrf","brute-force","upload","chaining"],"category":"recon","related_skills":["wp-mass-recon","cors-credential-wordpress","wordpress-plugin-hunt","phpinfo-to-rce","source-leak-hunt","staging-subdomain-hunt","wordpress-full-compromise","cross-attack-chains","attack-patterns-reference"]}} |
XML-RPC Exploitation Skill
WordPress XML-RPC abuse workflow for authorized testing. Use this skill when
/xmlrpc.php exists, when attack-patterns-reference flags P-07/P-08/P-09/P-24,
or when a WordPress chain needs method enumeration, pingback SSRF, multicall
amplification, or wp.uploadFile validation.
When to Use
- WordPress is confirmed and
/xmlrpc.php responds with XML faults or Hello!.
system.listMethods exposes system.multicall, pingback.ping, or wp.uploadFile.- You need to decide whether XML-RPC is only exposed, rate-limit bypassable, SSRF-capable, or chainable to upload/RCE.
- A broader chain references P-07, P-08, P-09, P-10, P-24, WP-04, WP-05, or WP-06.
Operator Rules
- Test only authorized targets.
- Prefer proof-of-capability over noisy exploitation.
- Keep request volume low until the target's rate limits and scope are clear.
- Do not run credential attacks unless the engagement explicitly permits it.
- Record exact request, response code, XML fault code, and timing for each confirmed behavior.
Quick Reference
| Pattern | Test | Positive Signal | Next Step |
|---|
| WP-04 | system.listMethods | Method list includes XML-RPC methods | Classify exposed methods |
| WP-05 / P-07 | system.multicall | Batched calls accepted | Check amplification/rate-limit bypass |
| WP-06 / P-08 | pingback.ping to callback URL | Callback received or distinct XML fault | SSRF triage |
| P-09 / P-24 | Pingback to IMDS paths | Non-generic response or callback behavior | IAM role path probing |
| P-10 | wp.uploadFile available with valid low-priv account | Upload succeeds | Chain with role/capability misconfig |
Procedure
Phase 1 - Confirm XML-RPC Surface
TARGET="https://example.com"
curl -sk -i | -40
curl -sk -X POST \
-H \
-d
