I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed authentication attempt. The login endpoint has the same mechanism in place. I have a username that is known to exist on the server and only need to authenticate for the user via any means.

Running wpscan --url **MYURL** --no-banner nets the following information (reduced to information that may be relevant to the problem):

[+] URL: **MYURL** [**MY_IP**]

Interesting Finding(s):

[+] Headers
| Interesting Entries:
|  - server: Apache
|  - content-security-policy: upgrade-insecure-requests;
| Found By: Headers (Passive Detection)
| Confidence: 100%

[+] robots.txt found: **MYURL**/robots.txt
| Interesting Entries:
|  - /wp-admin/admin-ajax.php
|  - /wp-admin/
| Found By: Robots Txt (Aggressive Detection)
| Confidence: 100%

[+] XML-RPC seems to be enabled: **MYURL**/xmlrpc.php
| Found By: Headers (Passive Detection)
| Confidence: 100%
| Confirmed By:
|  - Link Tag (Passive Detection), 30% confidence
|  - Direct Access (Aggressive Detection), 100% confidence
| References:
|  - http://codex.wordpress.org/XML-RPC_Pingback_API
|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
|  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] Upload directory has listing enabled: **MYURL**/wp-content/uploads/
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%

[+] The external WP-Cron seems to be enabled: **MYURL**/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
|  - https://www.iplocation.net/defend-wordpress-from-ddos
|  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.9.3 identified (Latest, released on 2022-04-05).

According to this repository, the maximum number of logins that can be attempted from a single request is 1999, while Cloudflare mentions that they have only tried 1000 attempts at once. If anyone knows a way to bypass this limit to upload rockyou.txt or similar, that would also be helpful.

While I am aware that I can build a custom wordlist for the box, I was hoping someone would be able to inform me if they have encountered anything similar, and if so if they were able to find a way around it. It feels like Fail2Ban or a similar software, which I am unaware of any ways around.

1 Answer 1


read this https://book.hacktricks.xyz/pentesting-web/rate-limit-bypass it contains some way that could be useful to bypass ip lockout or u could try to brute force from /wp-admin if it doesn't lock u out after some fails

  • Hey RobotPwn3r, thanks for your suggested reading! I've tried a few of those tricks out but no luck so far. As for brute forcing /wp-admin, it has the same IP lockout policy for 24 hours after one failed attempt per username. There is only one username on the server, so unfortunately that will not work for me in this case. Jun 22 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.