How to Find XmlRpc Vulnerability and Exploit it ! | Bug bounty poc

in this video i am going to show you how to find wordpress xmlrpc vulnerability and how to exploit it.
This video is only for Education purpose only.
#xmlrpc #bugbounty
Disclaimer: This video is for strictly educational and informational purpose only. I own all equipment used for this demonstration. Hacking without permission is illegal so always ensure you have proper authorization before using security tools in any network environment. thanks.

[@points7824]

Fun fact. xmlrpc is a faster way to bruteforce useraccounts, and tools such as wpscan uses it as default if possible to speed things up.

[@lostsecc]

yes you can send unlimited data in one single request like 1000+ passwords in just one request thats why its so much powerful..

[@Mohammed_TURKI66]

I learned a lot from you, thanks

[@lostsecc]

my pleasure ❤️😇

[@tpevers1048]

Bro is this xxe vulnerability and where you get these payloads

[@lostsecc]

its xmlrpc bug

[@user-nq2cq5fl4q]

Dude that's amazing!
learned very much from this channel alone.
thx

[@lostsecc]

❤️😇 thanks for supporting more advance practicle comming soon..

[@moviesupdates99]

Brother, I filed a report, but they are saying that it will not be accepted and marked as not applicable. When I checked, they had fixed it. Please help me.

[@lostsecc]

xmlrpc are nowdays outofscopes

[@moviesupdates99]

@@lostsecc thanks for reply man i hope you are my inspiration

[@darkmix4192]

Bro, i hav one doubt, this xmlrpc vulnerability what impact create?

[@lostsecc]

yes but for bbp its not in scope nowdays

[@shaiksharif9697]

good

[@CywerLearning]

But it’s dns pingback ?? Kya ye apki ip hai ?

[@lostsecc]

its from server

[@gddiscover7897]

can i get payload

[@lostsecc]

dm in telegram

[@gddiscover7897]

​@@lostsecc pls check @th3y_callme_gd

[@apple_00]

Blind ssrf ?

[@lostsecc]

yes

[@Rimuruux]

great video! is this job worth to work in it?

[@lostsecc]

ys

[@Rimuruux]

@@lostseccthanks

[@youjsyt]

Na/ there's no internal impact

[@lostsecc]

now days it n/a

[@Shapeshiftshow]

I have found this vuln and got duplicated 🙂

[@lostsecc]

keep going duplicate means you doing good but not so early..

[@Shapeshiftshow]

@@lostsecc yeah, and thanks for the all videos and telegram group brother. Iam a beginner in bug hunting and learnt a lot from you. Keep going ✨

[@lostsecc]

soon i uploading full deep hunting video from start recon to end

[@Shapeshiftshow]

@@lostsecc that's nice! I have a doubt while I fuzzing a search input parameter for xss it shows 200 status code but it's not reflecting on the web page, could you please help?

[@mdfarhad8939]

which program hackerone/bugcrowd ?

[@lostsecc]

not bountty program

[@Inexizp]

​@@lostsecc do u contact th em without a bounty program ?

[@ShamsUlhadi-cg6uo]

hey sir
can you give me responce on your gmail

[@lostsecc]

[e-mail]

[@ShamsUlhadi-cg6uo]

give responce on gmail.please

[@ShamsUlhadi-cg6uo]

why you not give responce