domains / families / security / xmlrpc-exploitation

xmlrpc-exploitation

separate

Exploit XMLRPC multicall, pingback for brute force and SSRF.

When to use

• `wp-mass-recon` detected XMLRPC returning HTTP 200 on POST.
• Target has WordPress with open registration (chain: upload → webshell → RCE).
• Need a brute-force amplification vector for WordPress credentials.
• Probing for internal SSRF via `pingback.ping` to cloud metadata endpoints.

Skill page

Source