Page 166 - Hands-On Bug Hunting for Penetration Testers

Framework and Application-Specific Vulnerabilities Chapter 9

Once you've logged in for the first time, navigate over to the plain MPDBMIPTU and view
the actual home page of your WP site:

Keep in mind that you can't ping MPDBMIPTU from XQTDBO because it's executing from
inside the Docker container. In order to feed our Dockerized WP instance to our Dockerized
WPScanning service, we need to use the URL of the Docker container running WordPress.

We can find the Docker host IP by using EPDLFS QT to find the container ID of the Docker
process running WP. We can then run EPDLFS JOTQFDU $0/5"*/&3@*% to return some
JSON with the IP address. For us, that IP address is . Then, we run this
command to scan our vulnerable WordPress site. If we were targeting a site on the public
internet, we could simply skip this step:
wpscan --url 172.17.0.2:80

Running the preceding command, this is what the output of our scan looks like:

[ 151 ]