ankhcorp/xmlrpc-bruteThis tool tests WordPress installations for XML-RPC authentication vulnerabilities.
A tool designed to test WordPress sites for XML-RPC vulnerabilities by attempting to brute force user credentials through the XML-RPC interface.
This tool tests WordPress installations for XML-RPC authentication vulnerabilities. It can perform standard brute force attacks or use system.multicall to test multiple passwords in a single request, potentially bypassing some rate-limiting protections.
git clone https://github.com/AnkhCorp/xmlrpc-brute.git
cd xmlrpc-brute
pip install -r requirements.txt
python3 xmlrpc-brute.py -t <target_url> -u <username> -P <password_list>
Test a single username with a password list:
python3 xmlrpc-brute.py -t http://example.com/wordpress -u admin -P wordlist.txt
Test multiple usernames with a password list using multicall:
python3 xmlrpc-brute.py -t http://example.com/wordpress -U userlist.txt -P wordlist.txt -m
Test with a 2-second delay between requests and limit to 1000 passwords:
python3 xmlrpc-brute.py -t http://example.com/wordpress -u admin -P rockyou.txt -d 2 --max-passwords 1000
This tool is provided for educational and testing purposes only. Only use this tool on systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal and unethical.
This project is licensed under the MIT License - see the LICENSE file for details.
| Option | Long Form | Description |
|---|
-t | --target | Target URL (e.g., https://example.com/) |
-u | --username | Single username to test |
-U | --userlist | File containing list of usernames |
-p | --password | Single password to test |
-P | --passlist | File containing list of passwords |
-d | --delay | Delay between requests in seconds (default: 1.0) |
-m | --multicall | Use system.multicall to test multiple passwords at once |
-b | --batch | Batch size for multicall (default: 3) |
--max-passwords | Maximum number of passwords to test (0 = no limit) |