You're viewing the y.diskcat.com public feed.

Federated feed Local feed

nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 9:31 PM
@amy @mhoye
i guess a waf that actually works then lol. i just soent a long time looking at the sword of requests I was getting and patterns between them and then wrote something that eventually got them all.

but yeah wp themselves have some "unusual" views as to what is acceptable security-wise. i *think* they finally (in the last 12mo) changed it so that the json endpoints dont expose all the user details anymore but when i reported that along with a poc tool that scraped usernames and email addresses of users from a "standard" wp install, they replied "that's intended behaviour" 🤯🤦🏼‍♀️

hypothetically if one were looking to break into a wp site, a good first step would be to have a list of usernames and whether those are admin or not and the json endpoints gave you exactly that, plus email addresses in case you needed a target to socially engineer/phish further access 👌#goodtimes
💬 1🔄 0⭐ 0

Replies

amy :neocat_cofe:amy@sk.girlthi.ng
Oct 22, 2026, 9:34 PM
@nflux@gts.exile.social @mhoye@cosocial.ca i'm equal parts shocked and unsurprised that it's trivial to scrape that from WP, and that they dismissed it

wish we could have something better
💬 1🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 9:38 PM
@amy @mhoye

check /wp-json/wp/v2/users/1

vary the last number to scan thru the users.

my "note to self" email about this is from 2018 and my test "canary" for this only stopped responding in the last 12mo (tho maybe they upgraded their security, idk and havent bothered to check any other sites).

it's trivial to disable access but shocking that it isnt by default.
💬 1🔄 0⭐ 0
amy :neocat_cofe:amy@sk.girlthi.ng
Oct 22, 2026, 9:43 PM
@nflux@gts.exile.social @mhoye@cosocial.ca doesn't seem to work on a random wordpress demo thing i found, it lists 1 of the users (the initial one) but returns an error for other users. not convinced this is fully patched on a vanilla instance. let me pull from docker and see
💬 4🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 10:17 PM
@amy @mhoye there are often gaps so the userids are often not just 1,2,3,4 etc, may be more like 1,7,15,19 etc but with a script it's simple enough to scan eg the first thousand userids
💬 0🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 10:21 PM
@amy @mhoye you can do a similar trick on the author pages of the site to match userids to usernames (link to author usually on each blog post, if that isnt disabled).

i kept noticing that attackers were trying real usernames but our display names were always deliberately different and I was confused as to where they were getting them from so again went on a bit of a dig about this and built a few poc tools to try and recreate their results (so that I could then block them to infinity)
💬 0🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 10:23 PM
@amy @mhoye *also the initial one is usually an admin, at which point they're one badly configured spf record (and/or missing dmarc) away from getting spoofed+phished, and both of those records are, again, public. you dont generally have to look very far to find a site with shoddy spf/dmarc either., though big mail providers recently *requiring* dmarc to be configured actually helped quite a lot there.
💬 1🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 10:38 PM
@amy @mhoye also the venn diagram of PBN sites on expired+revived domains and badly configured wp sites is basically a circle.

*for everyone else: pbn sites are "personal blog network" sites which is an seo trick where you find an expired site like davestyreshop.com who were popular & well ranked but then dave retired/died/went bust & his domain expired but all the backlinks he accrued over his 20 years in business still exist. you use yandex & some other tools i forget the name of to find domains like that in the first place & also all the existing backlinks and then set up a new site with pages to match those old backlinks so they dont 404. you then scatter links thru that site to yourtyreshop.com (which you're actually trying to promote) & reap the benefit of Dave's 20 years of link building. repeat 3-5x for plenty of organic traffic (albeit relatively low quality, & imho it's better to just write good original content rather than resort to shitty tricks)
💬 1🔄 0⭐ 0
xyhhx :bunny_sunglasses:xyhhx@treehouse.systems
Oct 22, 2026, 11:03 PM
@nflux @amy rip dave
💬 0🔄 1⭐ 1
nflux back in exilenflux@gts.exile.social
Oct 22, 2026, 11:07 PM
@xyhhx @amy *dave actually just dipped out and is living under a new identity after running up huge credit card bills and doing a runner.
💬 1🔄 0⭐ 0
xyhhx :bunny_sunglasses:xyhhx@treehouse.systems
Oct 23, 2026, 12:32 AM
@nflux @amy i wont snitch dw dave
💬 0🔄 0⭐ 1
nflux back in exilenflux@gts.exile.social
Oct 23, 2026, 12:36 AM
@xyhhx @amy 😂
💬 0🔄 0⭐ 0
amy :neocat_cofe:amy@sk.girlthi.ng
Oct 22, 2026, 11:34 PM
@nflux@gts.exile.social @mhoye@cosocial.ca so i did a little bit of hackering. i've got a way to enumerate users based on their ID (which leaks not much more than you get publicly, if anything), though it does allow for easy automation. looks like they have patched some of those holes.
💬 1🔄 0⭐ 0
amy :neocat_cofe:amy@sk.girlthi.ng
Oct 22, 2026, 11:37 PM
@nflux@gts.exile.social @mhoye@cosocial.ca https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L504-L510 this is what stops you enumerating it normally, ie what i ran into on the demo instance

and this is what's stopping me from enumerating all the juicy fields from a user. you need "edit" permission to do that

https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-controller.php#L588-L596

i will possibly have another look tomorrow because this code does seem overly complex and potentially prone to error. i already found a way to request specific users through the api (with the only pre-req being that they've ever written a post, with my current findings)
💬 1🔄 0⭐ 0
amy :neocat_cofe:amy@sk.girlthi.ng
Oct 23, 2026, 12:02 AM
@nflux@gts.exile.social @mhoye@cosocial.ca i should go the fuck to sleep. not like i would be inclined to contribute patches to wp anyways, fun little nerd snipe though. there's probably something to this if someone really wants to
💬 1🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 23, 2026, 12:12 AM
@amy @mhoye well it's good that they've somewhat patched some of these things. the dismissive attitude i got when i reported it put me off pursuing it further, and to some extent my sites' survival depended on not being the easiest pickings, and their policy helped with that.

i guess if they patched it (eventually) perhaps my report *was* actually valid then hmm, whaddya know 🤔

am i allowed to be a bit smug about that, as a treat?
💬 1🔄 0⭐ 0
amy :neocat_cofe:amy@sk.girlthi.ng
Oct 23, 2026, 12:19 AM
@nflux@gts.exile.social @mhoye@cosocial.ca what's really interesting is i cannot see the patch in which they added these checks. the context flag "edit" has always existed since the feature was added

wonder if you had also some kind of auth bypass going on at the time lollll

https://github.com/WordPress/WordPress/blob/e4a7c0a397b07764999aae94f4bf1567ebf4a9d1/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L826
💬 1🔄 0⭐ 0
nflux back in exilenflux@gts.exile.social
Oct 23, 2026, 12:45 AM
@amy @mhoye i have no idea. i tested it on random sites periodically to which i had no access and it nearly always worked, both as a way of establishing "do these ppl im considering dealing with have their shit together" and also as a potential freebie to offer them by way of getting freelance work in a "did you realise all your stuff was exposed"-sorta way 🤷🏼‍♀️ (almost always no and no).
💬 0🔄 0⭐ 0