Project 7 - WordPress Pentesting

Time spent: 6 hours spent in total

Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress

Pentesting Report

1. (Required) Authenticated stored cross-site scripting

• Summary:
  • Vulnerability types: XSS
  • Tested in version: 4.2
  • Fixed in version: 4.6.1
• GIF Walkthrough:
  • 
• Steps to recreate: Make a new post, title the post anything you want and paste <a onmouseover= "alert('Hacked!!!')" >click here</a> into the text area. Click "Preview" and the post will appear. An alert will show up each time you hover your cursor over the "click here" link.
• Affected source code:
  • Link 1

2. (Required) Authenticated stored cross-site scripting with Image Title

• Summary:
  • Vulnerability types: XSS
  • Tested in version: 4.2
  • Fixed in version:
• GIF Walkthrough:
  • 
• Steps to recreate: On the create media page, upload a picture from your computer. Once you upload the picture, click the image and enter the following code into the Title field: filename<img src=a onerror=alert(1337)>.png. Now click on "View attachment page" and the alert will show up.
• Affected source code:
  • Link 1

3. (Required) User Enumeration reveals users that exists

• Summary:
  • Vulnerability types: User Enumeration
  • Tested in version: 4.2
  • Fixed in version: 4.7.5
• GIF Walkthrough:
  • 
• Steps to recreate: On the sign in page, put admin in the username field without a password. Next put a random password that isn't correct. Lastly, try to login as some random user with a random password. It shows whether a user exists or not.
• Affected source code:
  • Link 1

1. (Optional) Embeded URL

• Summary:
  • Vulnerability types: Embeded URL
  • Tested in version: 4.2
  • Fixed in version: 4.2.13
• GIF Walkthrough:
  • 
• Steps to recreate: Create a new page, title it anything and paste [embed src='https://youtube.com/embed/123\x3csvg onload=alert(7331)\x3e'][/embed] below. Then click to preview the page, and the alert will display
• Affected source code:
  • Link 1

Assets

N/A

Resources

• WordPress Source Browser
• WordPress Developer Reference

GIFs created with LiceCap.

Notes

A bit time consuming trying a bunch of different tactics into many different places.

License

Copyright [2018] [Luis Bueno]

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.