XMLRPC Exploitation Skill

5-phase exploitation pipeline for WordPress XMLRPC endpoints. Covers bulk detection, method enumeration, SSRF via pingback.ping, amplified brute force via system.multicall (1000x amplification), and RCE via wp.uploadFile when open registration is present. XMLRPC is open on ~52% of WordPress targets found via wp-mass-recon.

When to Use

• wp-mass-recon detected XMLRPC returning HTTP 200 on POST.
• Target has WordPress with open registration (chain: upload → webshell → RCE).
• Need a brute-force amplification vector for WordPress credentials.
• Probing for internal SSRF via pingback.ping to cloud metadata endpoints.

Prerequisites

• terminal with curl.
• Target has confirmed XMLRPC endpoint (/xmlrpc.php returns 200 on POST with demo.sayHello).
• For RCE chain: target must have open registration or another file upload path.
• For SSRF chain: need a Collaborator/Burp Collaborator endpoint or internal target IPs.

How to Run