v2.1 // WordPress offensive framework
Exploit·Enumerate·Own
One bad plugin.
Total compromise.
hwp is a WordPress exploitation framework built for people who get paid to
break things on purpose. 323 exploit modules, a scanner that fingerprints the
whole stack, and adapters that turn a shrug-worthy alert(1) into demonstrated
code execution. Point it at something you're authorized to test and stop guessing.
Authorized testing & training only — read the rules
Why this exists
A screenshot of a JavaScript popup gets filed under "low, will fix next quarter." A webshell
sitting in /wp-content/uploads/ gets fixed on a Saturday. hwp is built around
that difference: prove impact in the language the person holding the budget actually
understands, then hand them the evidence and the remediation.
The core is hardened and audited. The problem was never the core — it's the seventeen plugins bolted on top, four of which were last updated when the maintainer still cared. hwp targets reality: 304 plugin modules, 16 theme modules, 3 core modules.
Scan, match, chain, deliver, report. No copy-pasting a python2 gist from a dead forum, no five-step manual auth dance. The framework resolves the chain, handles the session, and tells you what actually happened.
"It's probably fine" is not a security control.
The kit
Every one of them belongs in a scoped engagement with a signed authorization. Used anywhere else, they're a crime — and a boring one at that.
Fingerprints core version, active theme, installed plugins with versions, enumerated users,
and the misconfigurations nobody meant to ship — XML-RPC, exposed debug.log,
open registration, directory listing, wp-cron, missing headers. -a probes 1,500
popular slugs. -aa throws the entire vuln database at it.
Run hwp with no arguments and you get a full-screen operator console:
multi-select exploits, live filtering, payload matching, argument forms, and the exact
command line it's about to run printed at the bottom. No guessing.
Scan a target, then open the TUI — hwp cross-references the results. Matching versions get flagged « confirmed, maybes get « possible, both sort to the top. Hit F2 to hide everything that doesn't apply to this target.
AUTH runs first, PRIVESC second, then the chain resolves right-to-left: payload → transformer → delivery. Object injection into a POP gadget into RCE is one command, not an afternoon of manual plumbing.
admin_user, bash, db_debug, file_read, filebrowser, php, revshell, webshell. Each declares which capabilities it can ride, so the framework picks
the right delivery vector instead of you.
Harvest a session once and it's cached in ~/.hackwp/sessions for every run
after. Feed it a cookie, feed it credentials, or let an AUTH exploit go get one. Scan
results cache too — the TUI reads them automatically.
The cockpit
No arguments needed. The TUI is the front door — every exploit, every payload, every argument, one keyboard away.
The arsenal
Every exploit declares exactly one thing: the capability it hands to the chain. That's the whole contract. The framework does the rest — matching payloads, resolving transformers, escalating roles. Here's what's in the box today.
Counted straight from the module tree on v2.1 — 324 capability declarations across 323 modules, referencing 153 distinct CVEs. This page re-reads the repo every day, so it is never out of date. Missing something? Write the module and send a pull request.
The party trick
Two framework-core adapters, toggled by the operator, that carry an RCE payload through a vector that isn't RCE. This is the difference between a finding that gets triaged and a finding that gets fixed.
The payload is stored as admin-context JavaScript. When an authenticated admin loads the
injected page, the JS drops the payload's PHP on the server — trying plugin upload, theme
upload, media upload, then editor sinks — and triggers it. Add --lhost and a
server-side beacon proves execution happened on the box, not in a browser.
Already holding an admin session? Skip the exploit entirely — the session is the
vector. Same sinks as the XSS adapter, driven straight from your machine over
authenticated requests. Run an AUTH exploit once, then deliver payloads all day with
nothing but --payload.
Quickstart
Python 3.10+. Four dependencies. No installer, no daemon, no telemetry, no account. Clone it, link it, aim it at your own lab.
Drop hwp on your $PATH so it's one word from anywhere.
packaging, requests, rich, textual, httpx. That's the lot.
A throwaway WordPress in Docker, a vulnerable VM, a target with a signed scope. Not a stranger's blog.
Recon first — the scanner tells the TUI which exploits are worth your time.
Rules of engagement
We write loud copy because breaking things is fun. The legal position is not loud, and it is not negotiable: hwp exists for authorized penetration testing and for learning in a safe environment you control. Nothing else. There is no clever reading of this page that says otherwise.
DISCLAIMER — hwp (the "Software") is provided for authorized security testing and educational purposes only. The Software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and non-infringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software.
By downloading, running or otherwise using the Software you agree that: you will use it only against systems you own or have explicit written permission to test; you are solely responsible for your actions and for any consequences of using it; and the author(s) accept no liability for misuse, damage, data loss, downtime or any illegal activity performed with it. Exploitation is inherently destructive — it can and does corrupt data and take systems offline. Assume every run is irreversible and keep backups.
Unauthorized access to computer systems is a criminal offence in most jurisdictions. If you do not have authorization to test a target, do not point this at it. Full terms: hackwp.io/legal.
hackwp