So in this video, we'll be seeing how to take advantage of a example are perceived at BHP.
OK, let's go to our website, that is we haven't shot in the world press.
So this is our basic WordPress blog.
Now, if you go to our piece that BHP and you'll see a similar server accepts post requests only, OK,
I would expect a similar P.C. in brief.
So these are pretty stands for remote places.
So that means the server hosted some methods.
You can run the methods and you can get the information.
So, uh, what is the circle?
So XML RPG stands for, uh, we need to craft a request in the form of XML data.
So a summary similar to but, uh, we can create our own tags.
So this example is used for transport purposes.
So in order to transfer from one application to another application, XML can be used.
So these tasks are different and XML, Passover, RFID tags and we extract the data and this XML are
busy.
We need to craft XML request that I should call it.
The methods in this are busy.
So those are some methods like 100 or 200 methods and you can call them using this request.
OK, if you go to the buppie, uh, admin.
So this is my login page admin and some password, blah, blah, blah.
So now you can see the password entries for the user name is incorrect.
Uh, that means, um, we can try another time and again.
So we have an incorrect, uh, in sometimes a WordPress, uh, have some bronchus.
I have only three are few limits, uh, position.
So after like three attempts to uh then if you attempt the password from this, uh, server for September.
So that's, uh, what you can do is, uh, we can if, uh, you can see this easy and you can try to
fix all the methods available on the server.
So let's, uh.
That they have this machine one, not two, and let's, uh, go to the that similar pretty paid.
Eight zero eight zero one press example are pieces that BHP so it's this, uh, policy question.
So order to modify the request.
We need to set the proxy on, make sure the Bapi set and the first page.
Now you can click on Central Pillar and turn this off so changes get pushed.
And pushed up in the bush and you can see parts that are not very fun because we did not send any data.
No, we need to send the data.
So we to take some.
Version one and gaudiness, you would be afraid.
So this is similar to this starting right, and then we need to set up my third my third call.
So for every opening attack, there will be ending that matter.
So in this, we need to define the method name, which method you want to actually call my third name.
So I call this one the name.
And then what you need to do is you need to set the method so that all the methods available on a system
in the system, not just the methods.
So we need to set the parameters.
The parameters are empty for this method and you can just set this up.
So this should be fine motor car, the naming system method and then in does not send the request.
Passerelle page, far from.
Let me see whether the syntax error.
But you have to this.
OK, there is some spelling mistake here, I'm sorry for that.
So now you can see we got all the metal and multicar.
Well, that's true.
I would allow you to run multiple methods in one request and.
So if you got this, I'll put a stating that these methods are then only you need to proceed to further
know what I can do.
I can send them all back.
So let me copy this one and I can say, no Democrats here.
Hello.
I'm calling that function and I'll send this and you'll get the return trip.
So now we have to start and we can take advantage of these methods.
And one thing is, uh, you can, uh, the denial-of-service on the server, so.
But I don't encourage you to do this.
Um, being back, not being.
So ping, ping back, that ping requires, uh, two parameters, so inside the parameters we need to
declare as spectrum one parameter and it's, uh, where you use of string.
Right.
So we need to send, uh.
OK, so let me create a temporary hook.
So that said, it creates a temporary end point to receive any requests.
So this no paste here, after posting this, cross the string and then value.
So this is one parameter.
OK, let's copy the whole parameter here and paste here.
You know, to send the second parameter as a normal blog, request something a link to a normal blog.
So if you send this one so you can see some far zero for string and let's go to the book, and we did
not see any request here because my application was not allowed to access 2012.
But if you try on the normal server, it will send the request to this lab and other piece.
You can change the, uh.
Content.
Content type.
Content babies, uh, ritzier, that is texta.
So that's why maybe sort of try again.
So there is no recourse here because my sister was not allowed to connect to the outside network, so
I'm pretty sure if you try your normal server, it should get a ping back from this server to this level.
So I'm just quoting this.
So this is only the more.
And Plissken performing Internet service on the server.
OK, now what we can do is we can.
So, again, system that my thoughts.
So let's cut this one, cut these parameters and let's end this, so now these are our values.
That's one important method that exactly takes username and password as a parameter, since you don't
get your.
You can also, uh, pretty soon get push.
Get that.
So the method starting with that are called letters and the method starting with the set targets letters.
So you can try and other method here.
So you need to pass the parameter so that the p dot get.
Not get users whelks.
Users box and the parameters beyond the party's parameters.
Those are, uh, username and password, it's admin and the password is going to be WordPress.
So let's try this.
But I'm Parum sperm value string where you, Pam?
I think they should go below that.
Send the request and you can see your incorrect username and password.
Now, let me change this WordPress to admit and admit that the correct credentials and you can see we
got some, uh, other than incorrect username and password, you got the easy admin.
The value boolean is true and the order and you can see the title takes your name and the string.
I tried.
This is a criminal procedure.
So that means you can, uh, put the placeholders here and you can for this one.
So let me say, I mean, uh, bu and you can see in character is the name or password so you can send
this to improve the.
And clear our placeholders and put the over here and click on it.
And now let's add a few pillows.
It's a WordPress.
I've been to admin three admin and then it's a WP admin password, password, one, two, three, and
hit enter.
Now, let's start there.
Attack.
So the two parties, four, not three, and you can see four.
You can also do the and you can see the 200 status edman in the Capuzzo.
So why do we need to put 467000 pissy when you have the login page so that maybe your important question,
because the WordPress Web site can prevent you from setting a number of requests if you prefer for again,
because then after that, it keeps you Brocki.
So that's why it will be very painful when dealing with the, uh, when there is a limit to for sending
the request so that we can use this examiner.
So there will be no time limit for this.
So there is no limit for this.
You can just send them, uh, like five strings at the same time in one request.
OK.
Since this conversation, uh, we have only one threat.
Right.
So what we're going to do is we are going to write the simple Python script.
So let's import our request module.
So what we're going to send let's, uh, put the you are here.
So this is the water and like some other data.
So what is the maximum you can use that three quotations to denote the Multiple-entry?
And you can just simply copy this one, copy this and paste here.
I think Rick Mirabeau, the space newlines.
She made sure these are these, uh.
Eggs are quoted correctly and unable to properly even one mistake can, uh, you get the error.
So we need to put this one place, the order here and we can say password's.
And for now, I'm going to use a few passwords.
Normally you can download a record accurately and you can place this in windows and then you can open
the file as a file handler and you can put every time in a loop here so that you can also do that.
So that's what piece.
Admin, too, and the current one is the admin and then it's the admin and it's add another value password.
One, two, three, one, two, three.
So, OK, this is our second request that post staff you order.
So what you need to post this data that I use our XML data available to use XML data and printout for
that.
Oh, OK, let's move this one.
Who Deb and Ferritin Password's.
So I even tried to do that every element of possible list and here that's, uh, not far Microfit.
So they should be.
So let me go and run this.
So Peyton will press a similar policy is the filename and no to.
So now you can see the first one is in Gutta, second one is incorrect and third one is correct.
What is the third one that is adamant so you can filter through the responses so the normal error contains
incorrect.
OK, so that's common this.
If not.
In correct in order xD So bring to the valley of the password password found.
Not for Mackoff, right?
And then we can sit back because we already got the password.
So let me it later run this again, create the screen and run this.
So you're not get any help because we have comment at this time and we can see a password from Edmond,
so you can see this Python script is definitely faster than community if we are professional.
I recommend you to go for it because, uh, it may be faster than normal python.
So that's what this video, this video we have seen how to brute force the username and password.
Uh, you are busy.
So indiscernible we can do the dangerous service and you can also go for the usernames and passwords
without any, uh, limit.