Wordpress

wordpress pwning!!

• Do you have a SQLi on wordpress site?
• Cannot crack the hash ?
• -> request a password reset and dump the “user_activation_key” from wp_users
• Then go to https://example.com/wp-login.php?action=rp&key={ACTIVATION_KEY}&login={USERNAME}