Update Cheat Sheet.md

This commit is contained in:
ARZ 2021-02-13 00:49:42 +05:00 committed by GitHub
parent f549e0e497
commit 28c76d812a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -256,6 +256,11 @@ To bruteforce passwords
After logging into the wordpress dashboard , we can edit theme's 404.php page with a php revershell
`http://<ip>/wordpress/wp-content/themes/twentytwenty/404.php`
To get a RCE
* Goto `Appearance` -> `Editor` Select the 404.php template of the current theme and paste php reverse-shell.
* Then navigate to `http://ip/wp-content/themes/twentyfifteen/404.php` (theme name can be twentytwenty for the latest one)
# Wordlists
### Directory Bruteforcing