WordPress XML-RPC + WP-LOGIN Bruteforce [10 Macros] v2.11

WordPress XML-RPC + WP-LOGIN Bruteforce [10 Macros] v2.11 is a specialized security assessment tool designed to test the resilience of WordPress websites against brute-force attacks. By targeting both the traditional wp-login.php and XML-RPC endpoints, it helps identify weak credentials and misconfigurations that could lead to unauthorized access. This tool is strictly intended for ethical hacking and authorized penetration testing.

What is WordPress XML-RPC + WP-LOGIN Bruteforce v2.11?

This tool is an advanced brute-forcing utility that simultaneously attacks WordPress sites through two common entry points: the default login page (wp-login.php) and the XML-RPC interface. It leverages 10 customizable macros to automate and optimize attack patterns, making it highly effective for security audits. Unlike malicious scripts, it is designed for legitimate vulnerability assessments to help administrators harden their WordPress installations.

Detailed Features

Dual Attack Vectors: Targets both wp-login.php and XML-RPC.php for comprehensive testing.
10 Custom Macros: Pre-configured and user-editable attack patterns for varied brute-force strategies.
Proxy Rotation Support: Automatically switches between proxies to bypass IP-based rate limiting.
User-Agent Spoofing: Randomizes or customizes HTTP headers to evade basic security filters.
Session Throttling: Adjusts request timing to avoid triggering WordPress security plugins.
Multi-Threading: Concurrent login attempts for faster credential testing.
Custom Wordlist Integration: Supports personalized password dictionaries for targeted attacks.
CAPTCHA Bypass (Basic): Attempts to circumvent simple CAPTCHA implementations.
Logging & Reporting: Saves successful login attempts and attack statistics for analysis.
HTTP/S Protocol Support: Works on both unencrypted and encrypted WordPress sites.
Brute-Force Delay Customization: Configurable delays between attempts to mimic human behavior.
Two-Factor Authentication (2FA) Testing: Basic probing for weak 2FA implementations.