用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill hunt-wordpress命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | hunt-wordpress |
| description | Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior. |
| version | 3.0.0 |
| license | MIT |
| platforms | ["linux","macos"] |
| compatibility | Requires curl, jq, and optional wpscan |
| tags | ["redteam","wordpress","web","api","plugins"] |
| category | redteam |
| related_skills | ["cors-credential-wordpress","error-log-mining","source-leak-hunt","staging-subdomain-hunt","wordpress-plugin-hunt","wp-plugin-rest-auth-bypass","xmlrpc-exploitation"] |
Map WordPress core, REST, XML-RPC, plugins, themes, authentication boundaries, and adjacent installations before selecting a vulnerability-specific test. WordPress presence, a public route, or a version match is not a finding by itself.
/wp-json/, /wp-login.php, /xmlrpc.php, or /wp-content/ is reachable.curl and jq; wpscan is optional.Begin with a bounded, read-only map:
TARGET="https://www.example.test"
OUTPUT_DIR="${OUTPUT_DIR:-./output/wordpress}"
mkdir -p "$OUTPUT_DIR"
for path in \
/ \
/wp-json/ \
/wp-login.php \
/xmlrpc.php \
/readme.html \
/author-sitemap.xml; do
curl -sS --max-time 10 \
-o /dev/null \
-w '%{http_code} %{content_type} %{size_download} %{url_effective}\n' \
"$TARGET$path"
sleep 1
done
Use multiple signals:
curl -sS --max-time 10 "$TARGET/" \
| grep -Eio 'wp-content|wp-includes|wp-json|wordpress' \
| sort -u
curl -sS --max-time 10 "$TARGET/wp-json/" \
-o
jq -r \
| -u \
>
A generic 200 response is insufficient. Compare suspicious paths with a
random nonexistent path to detect catch-all routing.
curl -sS --max-time 10 "$TARGET/" \
| grep -Eo "wp-content/(plugins|themes)/[^/?\"']+" \
| sort -u \
> "$OUTPUT_DIR/components.txt"
Confirm a component with at least two signals when practical: an asset path, REST namespace, readme or changelog, HTML marker, or versioned file. Match CVEs only after establishing the exact affected version and prerequisite.
Use wordpress-plugin-hunt for plugin discovery and version validation.
for path in \
/wp-json/ \
/wp-json/wp/v2/types \
/wp-json/wp/v2/posts?per_page=2 \
/wp-json/wp/v2/pages?per_page=2 \
/wp-json/wp/v2/users?per_page=2; do
curl -sS --max-time 10 \
-D "$OUTPUT_DIR/headers.tmp" \
-o "$OUTPUT_DIR/body.tmp" \
"$TARGET$path"
printf '%s %s\n' "$path" "$(wc -c < "$OUTPUT_DIR/body.tmp")"
sleep 1
done
Classify the response before assigning impact:
For authorization claims, compare anonymous, user A, user B, and an approved privileged identity against the same synthetic object.
curl -sS --max-time 10 \
-D "$OUTPUT_DIR/cors-headers.txt" \
-o "$OUTPUT_DIR/cors-body.txt" \
-H 'Origin: https://attacker.example' \
"$TARGET/wp-json/wp/v2/users?per_page=2"
Header reflection is only a lead. Credentialed CORS impact requires:
Access-Control-Allow-Credentials: true when cookies are required;Use cors-credential-wordpress for the complete browser workflow.
curl -sS --max-time 15 \
-X POST "$TARGET/xmlrpc.php" \
-H 'Content-Type: text/xml' \
--data-binary \
'<methodCall><methodName>system.listMethods</methodName></methodCall>' \
-o "$OUTPUT_DIR/xmlrpc-methods.xml"
grep -Eo '<string>[^<]+</string>' "$OUTPUT_DIR/xmlrpc-methods.xml" \
| sed -E 's#</?string>##g' \
| sort -u
Do not follow redirects during protocol classification. A valid
methodResponse proves XML-RPC behavior; a status code alone does not.
Credential testing, multicall amplification, uploads, and SSRF bypasses require
their own authorization and safety limits. Use xmlrpc-exploitation only when
the relevant method and prerequisites have been confirmed.
Certificate transparency, archives, and asset paths may reveal staging hosts or subdirectory installations. Compare:
A weaker staging control matters only when the environment is in scope and its
impact is demonstrated. Use staging-subdomain-hunt for a bounded comparison.
Probe only the paths justified by the observed stack. Validate content rather than status:
| Candidate | Required content |
|---|---|
.git/HEAD | Git ref such as ref: refs/heads/... |
.env | Configuration assignments, not generic HTML |
debug.log or error_log | Real application errors or sensitive runtime data |
| backup archive | Correct file signature and meaningful contents |
| directory listing | Directory index markers and actual entries |
Use source-leak-hunt and error-log-mining; retain only the minimum sanitized
sample needed to demonstrate exposure.
Connect only verified prerequisites:
observed component
-> exact version and configuration
-> reachable vulnerable operation
-> approved identity or synthetic object
-> reproduced security impact
Registration, XML-RPC, an upload route, and an executable PHP configuration do not automatically form an RCE chain. Confirm the role capability, upload validation, storage path, and execution behavior independently.
GET /xmlrpc.php returning 405 does not classify a valid POST method call.