WordPress XML-RPC + WP-LOGIN Bruteforce [10 Macros] v2.11

WordPress XML-RPC + WP-LOGIN Bruteforce [10 Macros] v2.11 is a specialized security assessment tool designed to test the resilience of WordPress websites against brute-force attacks. By targeting both the traditional wp-login.php and XML-RPC endpoints, it helps identify weak credentials and misconfigurations that could lead to unauthorized access. This tool is strictly intended for ethical hacking and authorized penetration testing.

What is WordPress XML-RPC + WP-LOGIN Bruteforce v2.11?

This tool is an advanced brute-forcing utility that simultaneously attacks WordPress sites through two common entry points: the default login page (wp-login.php) and the XML-RPC interface. It leverages 10 customizable macros to automate and optimize attack patterns, making it highly effective for security audits. Unlike malicious scripts, it is designed for legitimate vulnerability assessments to help administrators harden their WordPress installations.

Detailed Features

Dual Attack Vectors: Targets both wp-login.php and XML-RPC.php for comprehensive testing.
10 Custom Macros: Pre-configured and user-editable attack patterns for varied brute-force strategies.
Proxy Rotation Support: Automatically switches between proxies to bypass IP-based rate limiting.
User-Agent Spoofing: Randomizes or customizes HTTP headers to evade basic security filters.
Session Throttling: Adjusts request timing to avoid triggering WordPress security plugins.
Multi-Threading: Concurrent login attempts for faster credential testing.
Custom Wordlist Integration: Supports personalized password dictionaries for targeted attacks.
CAPTCHA Bypass (Basic): Attempts to circumvent simple CAPTCHA implementations.
Logging & Reporting: Saves successful login attempts and attack statistics for analysis.
HTTP/S Protocol Support: Works on both unencrypted and encrypted WordPress sites.
Brute-Force Delay Customization: Configurable delays between attempts to mimic human behavior.
Two-Factor Authentication (2FA) Testing: Basic probing for weak 2FA implementations.

Why Use This Tool?

Strengthen authentication security.
Enforce stricter password policies.
Disable unnecessary XML-RPC functionality if not in use.
Improve monitoring against brute-force attempts.

Additional Information & Education

Mitigation Strategies:

Limit XML-RPC access via .htaccess or security plugins.
Implement strong password policies and mandatory 2FA.
Use Web Application Firewalls (WAFs) to block repeated login attempts.
Monitor logs for unusual authentication activity.

Download Link 1

Download Link 2

Download Link 3