payload mode break

[j4vaovo]

#3459

wordpress-weak-credentials.yaml 这个模板会发送大量请求进行暴力破解,即使/wp-login.php文件不存在 Status为404

这样似乎很浪费时间 能否优化下 比如 状态码为404就跳过？

感谢projectdiscovery TEAM

nuclei -u http://testphp.vulnweb.com/ -t c:\temp\nuclei-templates\fuzzing\wordpress-weak-credentials.yaml -debug -stats

POST /wp-login.php HTTP/1.1
Host: testphp.vulnweb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 18
Content-Type: application/x-www-form-urlencoded
Origin: http://testphp.vulnweb.com
Referer: http://testphp.vulnweb.com
Accept-Encoding: gzip

log=adm&pwd=111111
[DBG] [wordpress-weak-credentials] Dumped HTTP response http://testphp.vulnweb.com/wp-login.php

HTTP/1.1 404 Not Found

[MetzinAround]

@princechaddha we have a question about templates here.

wordpress-weak-credentials.yaml This template will send a large number of requests for brute force cracking, even if the /wp-login.php file does not exist, the Status is 404

This seems to be a waste of time. Can you optimize it, such as skipping if the status code is 404?

[ehsandeep]

@j4vaovo I got what you mean, I will create a follow-up ticket for this.