#Xml rpc client php windows#

Strict-Transport-Security: max-age=63072000 includeSubdomains preload Therefore, we will check its functionality by sending the following request:

It will be pointless to target an XML-RPC server which is disabled/hardcoded/tampered/not working.

In general, it is found at and would reply to a GET request with: XML-RPC server accepts POST requests only.

Ensure you have access to the xmlrpc.php file.

Ensure you are targeting a WordPress site.

Searching for XML-RPC servers on WordPress:

allinurl:'wp-content/plugins/' + scoping restrictions = general wordpress detection.

intitle:'WordPress' inurl:'readme.html' + scoping restrictions = general wordpress detection.

inurl:'/xmlrpc.php?rsd' + scoping restrictions.

In this specific case I relied on Google dorks in order to fast discovery all potential targets: That’s being said, during bug bounties or penetration testing assessments I had to identify all vulnerable WordPress targets on all subdomains following the rule *. Go for the public, known bug bounties and earn your respect within the community. Test only where you are allowed to do so. I would like to add that any illegal action is your own, and I can not be held responsible for your actions against a vulnerable target. Note that in this tutorial/cheatsheet the domain “” is actually an example and can be replaced with your specific target. Unfortunately on the normal installation (not tampered with settings, and/or configs) of WordPress the XML-RPC interface opens two kinds of attacks:Īccording to the WordPress documentation ( ), XML-RPC functionality is turned on by default since WordPress 3.5.

#Xml rpc client php windows#

an image for a post)įor instance, the Windows Live Writer system is capable of posting blogs directly to WordPress because of XML-RPC.

The XML-RPC API that WordPress provides several key functionalities that include: XML-RPC on WordPress is actually an API that allows developers who make 3rd party application and services the ability to interact to your WordPress site.