How to HACK 455 MILLION Websites | WordPress Hacking

[@Certbros]

BIG thank you to Hack The Box for making this video happen. Check them out below and start HACKING! 👇 Learn to hack with HackTheBox Academy ▶ www.certbros.com/HTBAcademy Start the Bug Bount Hunter Training ▶ www.certbros.com/HTB_CBBH Put your skills to the test with HackTheBox ▶ www.certbros.com/HackTheBox

[@huangzeyong]

haha,dhcp. dns

[@KEEN2999]

Do you have a case if the site does not support wordpress

[@femijude6129]

Can you do a tutorial on how to hack Gmail password

[@JacobBilson]

I want to start learning how to hack from today can you help me with any app that can help me get hacker's sense like you

[@hnp-tv]

Show me 1 Website, what you hacked with a Wordlist? Before you speak about 455 Million Websites. This Video is not realistic. It will not works.

[@Louis_H_]

455 million websites meaning they run on WordPress and it has a lot of vulnerabilities, of course you can't hack all of them and probably a lot of them don't contain that interesting of info, but a lot of them probably have sub par security because they're based on Wordpress

[@siavash_id]

maybe you can't by using a word list , but the governments or people with lots of power and money can easily brute force it by big GPUs ... I'm just kidding! you can hack it yourself by using a cloud GPU with a hundred times more power than a desktop GPU like 4090 and just 3/Hour is the bill you have to pay...

[@Mike-xm1hl]

WordPress is be exploited daily. Trust me. Easy money for hackers

[@thiyamsuresh4918]

​@@siavash_idwhat if the password are not in the word list?

[@Idkfornowlol]

@@thiyamsuresh4918bruteforce then

[@SumanRoy.official]

Please Note : A situation where a 0-day is discovered wpscan won't upload the documentation for it, because they like to give the vendor some time to mitigate the issue. Timeframe is usually 30 days. By that time it gets patched, making the vulnerability useless to exploit and hackers won't be able detect it via wpscan because it won't get reported in your scans until that patch window expires. Only the sites which did not patch it because the users are unaware of it can then be exploited.

[@Dear_LotterySambad]

tomar Instagram id pete pari?

[@SumanRoy.official]

@@Dear_LotterySambad i don't do insta, nor facebook

[@superstrongninja]

@@SumanRoy.official tele?

[@Free.Education786]

Please, if possible, cover these advanced topics like How to bypass Drupal CMS or other secured CMS? How to bypass HARD WAF protection that stops HTML, SQL, and XSS injection payloads? Payload single-double-triple encoding using Cyber-Chef? How to find the real origin IP of secured websites behind Cloudflare, Akamai, ModSecurity, AWS CDN, etc.,? How to bypass Hard WAF using SQLMAP or Burpsuite? How to find hidden vulnerable parameters and endpoints inside the .js and .jason files? How to find hidden admin pages, cPanel pages, and WHM pages ? Please cover these important topics. Thanks

[@zadekeys2194]

Do you know that you can ask Google or most Ai tools these questions and start learning for yourself? :) Learn nMap, Burp Suite , Wazuh.

[@powerseostrategy]

Now there's 810 Million Wordpress sites.

[@jasgarcha4783]

Great share for those interested in Hacking - ethically, of course 😊. Thank you.

[@Certbros]

Thank you Jas!

[@KEEN2999]

Do you have a case if the site does not support wordpress

[@viktorsalamaha1219]

Most wordpress sites use random passwords, where can I get sheets with these passwords? I think nowhere)

[@kSITHerland]

it would stand to reason that these passwords would be inculded inwhole or in part buy some of the bigger lists published of such breaches , which ones they are though i wouldnt begin to know

[@paulvargas7406]

Exactly what I was looking for. Cheers!

[@agnesanu.v886]

Sir.... could you please help me to hack a website

[@danielruzicka3858]

You look like that guy who played Edward Snowden in Snowden movie

[@mohamedizhag9832]

You are right, there is a great similarities.

[@mohamedizhag9832]

I have seen the movie and it is inspiring and wonderful.

[@SunilKumar-wp7st]

Om Pls help hack site..& help us recover our initial booked usdt

[@nikosdimou7291]

you dont need bf if is lfi attack you can call the ssh file and take the rsa key

[@MSLTV-je6bn]

any one can help me?

[@MarkoKozlica]

Hack the Box is a bit expensive and I would like to learn more about hacking Wordpress sites, any suggestions? thx

[@LennyMiller739]

Vulnhub has some stuff you can play with. Hard to figure out which one to do though as it's not curated

[@bharathnaidu107]

Learned so much about wpscan tool.Tha nk you ❤️

[@Certbros]

Great to hear it! Thank you

[@KEEN2999]

Do you have a case if the site does not support wordpress

[@KEEN2999]

@@Certbros Do you have a case if the site does not support wordpress

[@yassirdubad1386]

i'm too early damn!!!!!!!

[@Certbros]

You're right on time!

[@KEEN2999]

@@Certbros Do you have a case if the site does not support wordpress

[@KEEN2999]

Do you have a case if the site does not support wordpress

[@PenAce]

This will be covered in greater detail on my page!

[@KEEN2999]

Do you have a case if the site does not support wordpress

[@PenAce]

@@KEEN2999 There is always a way where there is an administrator. I'll be posting soon!

[@KEEN2999]

@@PenAce What happened with you

[@PenAce]

@@KEEN2999 What exactly do you mean?

[@ancour]

Instead of parrot, will these functions in other kali os

[@MSLTV-je6bn]

mean which place I put these prompt ?please tell me about it

[@nervall_revolt]

2:03 Ah, yes… My favourite CMS, *WordPess* xd Great video btw!

[@braimahchannel3639]

I love the hacking teaching, I wish you can teach me

[@qompete6537]

Location for your rockyoutext says does not exists or is not a file ???

[@-.-ahmed---ahmed-.-]

FROM algeria pro the. s is 👾👾

[@juniorferreira9635]

took me a while due to mistake, but it works thanks

[@donga6713]

Weak informations but useful

[@Wavy672]

wpscan detected 0 vulnerabilities (sorry if i misspelled it) 0 vulnerable plugins etc., what should i do?

[@Bakekun]

Nothing, If the website has no vulnerabilities then you cant use wpscan to hack it

[@zadekeys2194]

Scan with more tools.... Don't assume 1 tool can scan for all vulnerabilities OR that it didn't make a mistake...

[@MSLTV-je6bn]

hi sir where i put it in cmd?

[@domingosdias5988]

Ganhou um novo inscrito de Angola!

[@huangzeyong]

what is going on? i am using VPN ,

[@kman4658]

Hehehe 2:06 Word Pess

[@timecop1983Two]

Now 810 Million

[@thelasteffort6785]

hacker wont show his face...😂😂😂

[@omodesigner]

Ahahaha Ahahaha like it

[@full_automation]

Thank you❤️

[@conmcdon]

Excellent video!! Thanks so much for this. I was wondering if you would consider a follow-up that goes into the details of RCE via the theme editor. It's also in the Hack the Box lesson, but the instructions on how to utilize a web shell aren't very clear. For example, how does one utilize a web shell to access specific files on the server?

[@conmcdon]

I've just figured it out, actually. If anyone finds this comment in the future and is wondering how to solve that exercise: You need to set the command parameter equal cat with the location of whatever file you want to read. Because you can't have spaces in a URL, however, you have to append %20 to cat, just before the location. It'll look like this: cat%20/home/wp-user/flag.txt

[@jinminetics599]

Instead of replacing spaces with %20, just url-encode the payload/command. There would be other characters aside space you would have to handle. So encoding the payload is the best way to do it not manual replacements.

[@lisansarkar7949]

Most underrated content

[@visualmodo]

Very good video!

[@Certbros]

Thank you!

[@mahdidelavaran1099]

hi your ccna course was very good would you consider creating a security plus course

[@Certbros]

Thank you Mahdi! Great to hear you enjoyed the course. Yes absolutely! I would love to do a Security+ course. It's next on my list of courses

[@KEEN2999]

Do you have a case if the site does not support wordpress

[@KEEN2999]

@@Certbros Do you have a case if the site does not support wordpress

[@whysoserious483]

Celebrate the day who teach us to SWEAT MORE Happy Teacher's Day ❤️ man

[@Certbros]

Thank you very much! I really appreciate that 🙏 😀

[@3livesleft577]

Can this be used unethically? I have never used word press, but doesn't this encourage people to attempt to find credit card info or personal addresses? (I am new to this whole world of information technology)

[@Certbros]

The purpose of this video is to show people how WordPress can be targeted and the methods that can be used in legal pentests or bug bounties. Of course, I would never condone any malicious use.

[@mason-zi5yz]

next time you should say that you have to pay for it

[@JoseAbreuu]

could I use dirb instead of wpscan?

[@gniewko123456]

sure

[@mdforid2850]

Plesse Facebook hack video

[@GiancarloAndréRomeroMonroy]

🤣🤣🤣