Web App hacking Wordpress. You can download an iso named as Wordpress vm, type it on google “Wordpress vm appliance” from turnkeylinux.org. Install it as usual. Enter all credentials asked while installing, such as mysql psw, etc… After installing, it will show you’re its IP address. Open up your kali linux machine and check if it connects with the Wordpress machine by typing “ping IP add of the Wordpress machine”, then press enter.

For the kont root heslo a se:Blabla8karakte
Mysql hs for the ‘adminer’ kont: Blabla8kar
Wordpress hs for the ‘admin’ kont:Blabla8kar
Done, info li ba ou yo:_web: http://192.168.1.133, https://192.168.1.133; web shell:https://192.168.1.133:12320; webmin: https://192.168.1.133:12321; adminer: https://192.168.1.133:12322; ssh/sftp: root@192.168.1.133 (port 22) 

Now go to your kali machine for the hacking process:
- Open up terminal and type: ping 192.168.1.133, press enter to see if internet is working there (on the victim’s machine Wordpress)
- Open a web browser and type that IP, then press enter. Now, you should see how is TurnKey Linux looks like with so many information.
- Now, you can try to log in as admin, as you’ve already know the Wordpress pasw while installing the OS to have the dashboard before you.
- The hacking phase: in your kali terminal, type: “wpscan” to see all commands which are available, then type: “wpscan —url http://192.168.1.133”, then press enter.
[[[
If you face some problems, error, while typing in terminal “wpscan”, try to proceed using these commands below to make it work:

Resolved the same issue. In my fix, I did NOT uninstall anything.
a) apt-get install ruby-dev 
b) gem install ffi --platform=ruby 
c) gem install yajl-ruby 
d) apt-get install libxslt-dev libxml2-dev 
e) gem install nokogiri -- --use-system-libraries
Then wpscan worked.

]]]
- To see how many user accounts that Wordpress has, you can type: “wpscan —url http://192.168.1.133 --enumerate u”, enter.
- If you want to crack the password, you can use crunch to build your dictionary file/bruteforce attack, then put that filename into the command like this: (let’s say your dictionary file is: “a.txt”)
“wpscan —url http://192.168.1.133 --wordlist /root/Desktop/a “, and press enter. Sometimes it doesn’t matter if you don’t put the extension. It depends on if you’ve put it while creating that file.
192.168.1.133
192.168.1.133

9. 9. 2019, 14:03

When the Turnkey wordp OS, in the terminal page, it will ask you to enter the wordpress login. So, type root as the username, and Blabla8karakte as the psw.