aress31 / xmlrpc-bruteforcer

Multi-threaded XMLRPC brute forcer using amplification attacks targeting WordPress installations prior to version 4.4.
Apache License 2.0
116 stars 41 forks source link

Maximum # of system.multicall() calls #10

Open ajmeese7 opened 2 years ago

ajmeese7 commented 2 years ago

Hey aress31, could you provide me with the resource you used to determine that the maximum # of calls per system.multicall() is 1999? I'm curious to see if there is a way to circumvent this, my server currently blocks an IP after one failed XMLRPC call and I would like to push the entire rockyou.txt file in that one request to make the most out of it and see if it can crack my password.

Thanks!