Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Getting Shells at Terminal Velocity with Wopper

netspi.com | blog | #php | #wordpress | #red-team | #webshell | #wopper | #exploitation-tools

Summary

Wopper is a NetSPI tool that automates WordPress code execution from admin credentials: it uploads, executes, obfuscates, and self-deletes PHP files in seconds, replacing manual plugin upload steps.
Published
Collected

original ↗

Related coverage

tool · github.com
Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)
Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.
blog · wiz.io
Exploitation in the Wild of wp2shell
Wiz Research observed in-the-wild exploitation of wp2shell, a pre-auth RCE chain in WordPress Core (CVE-2026-63030, CVE-2026-60137), used to install persistent webshells and backdoor plugins.
research · github.com
dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoC
This research and reproducible lab validates a critical PHP object-injection POP chain in GiveWP, enabling security teams to test exposure, assess detections, and verify the 4.16.7.2 patch.
blog · netspi.com
Linux Hacking Case Studies Part 3: phpMyAdmin
Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.
blog · netspi.com
Establishing Registry Persistence via SQL Server with PowerUpSQL
Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.
blog · netspi.com
Adding Web Content Filter Exceptions for Phishing Success
Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.
back