I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed authentication attempt. The login endpoint has the same mechanism in place. I have a username that is known to exist on the server and only need to authenticate for the user via any means.
wpscan --url **MYURL** --no-banner nets the following information (reduced to information that may be relevant to the problem):
[+] URL: **MYURL** [**MY_IP**] Interesting Finding(s): [+] Headers | Interesting Entries: | - server: Apache | - content-security-policy: upgrade-insecure-requests; | Found By: Headers (Passive Detection) | Confidence: 100% [+] robots.txt found: **MYURL**/robots.txt | Interesting Entries: | - /wp-admin/admin-ajax.php | - /wp-admin/ | Found By: Robots Txt (Aggressive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: **MYURL**/xmlrpc.php | Found By: Headers (Passive Detection) | Confidence: 100% | Confirmed By: | - Link Tag (Passive Detection), 30% confidence | - Direct Access (Aggressive Detection), 100% confidence | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] Upload directory has listing enabled: **MYURL**/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: **MYURL**/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 5.9.3 identified (Latest, released on 2022-04-05).
According to this repository, the maximum number of logins that can be attempted from a single request is 1999, while Cloudflare mentions that they have only tried 1000 attempts at once. If anyone knows a way to bypass this limit to upload
rockyou.txt or similar, that would also be helpful.
While I am aware that I can build a custom wordlist for the box, I was hoping someone would be able to inform me if they have encountered anything similar, and if so if they were able to find a way around it. It feels like
Fail2Ban or a similar software, which I am unaware of any ways around.