Web Hacking: WordPress Penetration Testing and Security

Explore how WordPress plugins work by viewing, editing, and uploading plugins; learn to create a custom plugin file and inspect a site's installed plugins and version information.

Learn to gather information on a WordPress target using WPScan, enumerate themes and plugins, and identify WordPress version details while noting authorized testing practices.

The lecture guides information gathering for WordPress testing by performing an audit, enumerating users, and saving three usernames and plugin details to a separate file.

Demonstrates a practical WordPress core arbitrary file deletion attack, including uploading a file, extracting cookies and IDs, and deleting core files, with step one and step two variants.

Demonstrates how an attacker alters a WordPress admin password to gain control, illustrating password verification, plugin abuse, and email-based access methods.

Learn how a reverse shell can grant server access through a WordPress plugin, highlighting payload creation and ethical testing practices for secure web applications.

Learn how to secure a new WordPress installation by changing the default table prefix and admin username, using a strong password, and configuring database details during setup.

Replace the default WordPress admin by creating a second admin user, log in with the new account, transfer all content, and delete the old admin account.

Change WordPress file structure to boost security by deleting unused sample files, moving the config file outside the WordPress directory, and backing up the database and site before changes.

Learn to defend WordPress sites from brute force by restricting login attempts with a limit login attempts plugin, configuring 20-minute and 24-hour lockouts after failed logins.