Hacking Wordpress with Python in seconds (using Dark Web and Telegram data)

Key Takeaways

May this be a warning to both you and your family. This is based on a true story. My team and I have created a Python script that can hack WordPress sites very, very easily. So, I'm going to use Python to run the Flare API script. Press enter. Web browser is opened. Automatic attempts are made to log to the WordPress website. And there you go. I've been able to log in. This is a test website that we created for this demonstration. We own this website. I've given myself permission to hack this website. Very important. Never hack websites that you do not have permission to attack. This script leverages leaked credentials on the dark web and Telegram channels to try different usernames and passwords to attack the website. In this example, the password that succeeded included the binary number 001 001. So in other words, 9 in decimal. This is a real password that was leaked on the dark web. Now, to protect the person's identity, let's call him Harry. Hi, I'm Harry. No, not that Harry. This Harry's passwords were leaked in the Adobe breach of 2013. That information was used to hack his company's website. This was a real company. They defaced his company's website, which was a WordPress website, very similar to what I'm showing you here. Fortunately for him, he had a backup of the website locally, so he could restore the website. But obviously this was a massive nightmare for them. A real company's website got hacked using leaked credentials from the dark web. Now once Harry's website got hacked, he started using really strong passwords. The passwords that he'd been using to this date weren't very good, but he started using like 30 character passwords. So he thought he was safe, but that's not enough. He was storing those passwords in a file on his computer. A really bad idea. highly recommend that you use a password manager rather than storing the files in a text file as an example on your computer because malware could be used to steal your passwords and cookies from your computer. So, you want to use 2FA. This stuff is so important. Make sure that people are aware of this. Now, you may know this, but there are many, many people out there that are not aware of the issues of passwords being leaked on the dark web and in Telegram channels. But the question for a lot of companies and a lot of people is, how do you know that your credentials have been leaked? Where do you go? Do you need to run tour to go and find those credentials? Do you need to try and access Telegram channels or, you know, how do you find these details? I really want to thank Flare for sponsoring this video. We've been using their software for a while now. It's amazing how much information is leaked out there. It's actually very easy to do this and get notifications of leaked credentials. I can go to identifiers. At the moment, we're running various identifiers against davidbombell.com. I'll create an identifier. Now you could specify a domain, name, keyword, other options, but I'll simply specify email here. I'll put in the person's email address. I could create an alert to get a notification if a password associated with that email address has been leaked. And I'll create an identifier. And now it's as simple as clicking on events. And you can see right here, high severity passwords have been leaked. And going through this, I can see passwords for this person. So as an example here, you can see his password was leaked in the 2013 Adobe breach. Companies are being hacked all the time. You could put your email address into Have I been pawned as an example? So in this example, we can see that this account has been pawned. There's the Adobe breach as mentioned on Troy Hunt's have I been pawned website. You can see Canva email address or password was affected. So on the Adobe breach, it was username, email, and encrypted password and a password hint in plain text that was leaked. Canvas suffered 137 million record breach and it goes on and on and on. Various websites were compromised including LinkedIn and Twitter. So your usernames and your passwords are probably out there. The users in your company's passwords are probably out there. In this Python script example, what we're doing is leveraging the API of Flare. So, we're connecting to the Flare API, searching for a username or an email address or something. In this example, the email address was was searched for and then we are creating a leaked credentials JSON file which is then used by the Python script to try and log into the website. So, here's the JSON file that was created by leveraging the Flare API. And we can see an email address. And then we can see other information in this file. And that is what we use once again to attack the website. Now this script is 373 lines of code. Allows us to attack WordPress websites by simply searching for instance for an email address, leveraging the Flare API, pulling the information back, and then opening up a web browser using Selenium and actually logging into the website. So I'll run that script again. So firstly I'll log out of the WordPress website. I'll shut down Chrome. I'll run the script again. And what you'll notice script starts running. It's connecting to the API. It opens a web browser. Goes to the admin login page of the WordPress website and then attempts to log in. And there you go. I've been able to log in. Now the great thing about FL once again is you can get notifications of breaches like this on my website davidbble.com if I look at events I can see various events taking place and then I can filter for the events for instance to only see high and critical severity events and see if there are attacks against my domain. Now, to get you started, we've created a PDF which I've linked below that shows you how to log into Flare and how to create identifiers and get notifications of leaks and breaches. But just be aware, this is not just the dark web that's been searched by Flare. It's also Telegram channels. And one of the big problems you need to be aware of is stealer logs. Malware can be used to get active usernames and passwords. So stealer logs are generated when a device such as your laptop as an example has malware on it and that's harvested to get sensitive information. This could include cookies as an example, browser history, your username, your passwords and other personal information. And the problem here is this is actual information. It's not old usernames and passwords. You might have changed your password on a site after a breach because you got a notification or an email telling you that you need to reset your password. The problem here is unlike other data breaches, this information is live and very dynamic. When I interviewed Tom at Cisco Live, he told me that one of the biggest problems today in cyber security is this issue of the leaked credentials. Why would an attacker or hacker try and hack in when they can simply log in using breached or leaked credentials as I've demonstrated in this video? Now, the Flair team asked me to highlight this. They've been asked many, many times, can flare be used for personal use and the answer is no. This is a business product. It's a threat intelligence product to help businesses better protect themselves and their employees. It hasn't been created specifically for individuals. So, let's get a bit more technical and I'll show you a little bit more about the script. As we've noted in the script information here, you shouldn't store your API key in your script. Store it in an ENV file. And that's what we've done here. We are going to load the API key for Flare from the ENV file rather than storing it in our Python script. So what the script is doing once again is it's using the API key to access the Flare API retrieving information for a user, in this case an email address, and then it uses the Chrome web driver to open up a web browser and access a website. You can see that we're running a loop here. So for the credential information such as email, we are trying the email address and then we are trying passwords. So once again looping through the different passwords and sending the password and then clicking on the website. So we are submitting the username and the password to the login path to log to the WordPress website. So here you can see once again send the email, send the password, click on the website to login. If we successfully log in then we break the script. So here we define API related information. We get the API key. We specify our tenant ID. We specify the URL which in this case is API.flare.io. We're getting our JWT token here. Now to ensure that we don't abuse the API, they've limited us to only sending requests every second. So we sleep for a while and then we try and run the request again. We open this file, the leaked credentials JSON file. So once again, that's the file with the credentials in. And then we write the credentials to the file, which we can then use to log into the WordPress website. It does that by creating a dictionary of the credentials and then loops through the credentials. So you can see it's looking for the email. It's looking for the password and then visiting this website to login using the Chrome web browser. Okay, so I think that's enough for this video. I wanted to show you the power of Flare and big shout out to them once again for sponsoring this video, for allowing me to better protect myself and the people that work with me. It's really important that you realize that your passwords are out there because of data breaches. You need to use unique passwords on every website. Don't reuse your passwords. Use a password manager to make sure that your passwords are unique and that you store them in a secure location. Use two-factor authentication because if your password does get out there, hackers can't simply log in because of 2FA. Okay, let me know what you think. Hopefully, you enjoyed this video. Please put your comments below. Would you like us to teach you more about using Python to do these kind of things? Would you like to learn more about Flare and how we can find elite credentials on Telegram channels as well as the dark web? I'm David Bumble. I want to wish you all the very best. [Music]