{"id":11,"date":"2026-04-13T20:28:52","date_gmt":"2026-04-13T20:28:52","guid":{"rendered":"https:\/\/blog-api.minpox.com\/?p=11"},"modified":"2026-04-13T20:28:52","modified_gmt":"2026-04-13T20:28:52","slug":"%eb%82%b4-wordpress-%ec%84%9c%eb%b2%84%eb%a5%bc-%ec%a7%81%ec%a0%91-%ed%95%b4%ed%82%b9%ed%95%b4%eb%b4%a4%eb%8b%a4-%ec%85%80%ed%94%84-%eb%b3%b4%ec%95%88-%ea%b0%90%ec%82%ac-%ed%9b%84%ea%b8%b0","status":"publish","type":"post","link":"https:\/\/blog-api.minpox.com\/?p=11","title":{"rendered":"\ub0b4 WordPress \uc11c\ubc84\ub97c \uc9c1\uc811 \ud574\ud0b9\ud574\ubd24\ub2e4 \u2014 \uc140\ud504 \ubcf4\uc548 \uac10\uc0ac \ud6c4\uae30"},"content":{"rendered":"\n

\uc11c\ube44\uc2a4\ub97c \uc624\ud508\ud558\uae30 \uc804, \uc9c1\uc811 \ub9cc\ub4e0 \ubcf4\uc548 \uc2a4\uce90\ub108\ub85c \ub0b4 WordPress \uc11c\ubc84\ub97c \uc810\uac80\ud574\ubd24\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

\uacb0\uacfc\ub294 \uaf64 \ud765\ubbf8\ub85c\uc6e0\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

\n\n\n\n

## \uc65c \uc9c1\uc811 \ub9cc\ub4e4\uc5c8\ub098?<\/strong><\/p>\n\n\n\n

\uae30\uc874\uc5d0 WPScan \uac19\uc740 \ub3c4\uad6c\ub4e4\uc774 \uc788\uc9c0\ub9cc, \ub0b4 \uc11c\ubc84 \uad6c\uc870(GCP + Nginx Proxy Manager + WordPress)\uc5d0 \ub9de\uac8c \ucee4\uc2a4\ud130\ub9c8\uc774\uc9d5\ud558\uace0 \uc2f6\uc5c8\uc2b5\ub2c8\ub2e4. \uadf8\ub798\uc11c Python\uc73c\ub85c \uc774\ubca4\ud2b8 \ub4dc\ub9ac\ube10 \ubc29\uc2dd\uc758 \ubcf4\uc548 \uc2a4\uce90\ub108\ub97c \uc9c1\uc811 \uad6c\ud604\ud588\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

\uad6c\uc870\ub294 \ub2e8\uc21c\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

Recon(\uc815\ubcf4 \uc218\uc9d1) \u2192 Scan(\ucde8\uc57d\uc810 \ud0d0\uc9c0) \u2192 Validate(\uac80\uc99d)<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

\uac01 \ub2e8\uacc4\ub294 \uc774\ubca4\ud2b8 \ubc84\uc2a4\ub85c \ud1b5\uc2e0\ud558\uba70 \uc11c\ub85c \ub3c5\ub9bd\uc801\uc73c\ub85c \ub3d9\uc791\ud569\ub2c8\ub2e4. \ub355\ubd84\uc5d0 \uc0c8\ub85c\uc6b4 \uccb4\ud06c \ud56d\ubaa9\uc744 \ucd94\uac00\ud560 \ub54c \uae30\uc874 \ucf54\ub4dc\ub97c \uac74\ub4dc\ub9ac\uc9c0 \uc54a\uc544\ub3c4 \ub429\ub2c8\ub2e4.<\/p>\n\n\n\n

\n\n\n\n

## \uc2e4\uc81c \uc2a4\uce94 \uacb0\uacfc<\/strong><\/p>\n\n\n\n

\uc2a4\uce90\ub108\ub97c \ub3cc\ub9ac\uc790 \uba87 \ucd08 \ub9cc\uc5d0 \uacb0\uacfc\uac00 \ub098\uc654\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

[RECON] WordPress version: 6.x.x<\/p>\n\n\n\n

[SCAN] XML-RPC Enabled \u2192 MEDIUM<\/p>\n\n\n\n

[SCAN] wp-cron.php Publicly Accessible \u2192 LOW<\/p>\n\n\n\n

[VALIDATE] 2 confirmed<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

\ucd1d 11\uac00\uc9c0 \ud56d\ubaa9\uc744 \uccb4\ud06c\ud588\uace0, \ucde8\uc57d\uc810\uc740 2\uac1c \ubc1c\uacac\ub410\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

\n\n\n\n

## \ubc1c\uacac\ub41c \ucde8\uc57d\uc810\uacfc \uc870\uce58<\/strong><\/p>\n\n\n\n

### 1. XML-RPC \ud65c\uc131\ud654 (MEDIUM)<\/strong><\/p>\n\n\n\n

**XML-RPC\uac00 \ubb54\uac00\uc694?**<\/strong><\/p>\n\n\n\n

\uc624\ub798\ub41c WordPress \uc6d0\uaca9 \uc81c\uc5b4 API\uc785\ub2c8\ub2e4. \uc608\uc804\uc5d0\ub294 \uc2a4\ub9c8\ud2b8\ud3f0 \uc571\uc774\ub098 \ub370\uc2a4\ud06c\ud1b1 \uc571\uc5d0\uc11c \ube14\ub85c\uadf8 \uae00\uc744 \uc62c\ub9b4 \ub54c \uc0ac\uc6a9\ud588\uc9c0\ub9cc, 2016\ub144 REST API\uac00 \ub3c4\uc785\ub41c \uc774\ud6c4\ub85c\ub294 \uc0ac\uc2e4\uc0c1 \uc4f8 \uc77c\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

**\uc65c \uc704\ud5d8\ud55c\uac00\uc694?**<\/strong><\/p>\n\n\n\n

`system.multicall`\uc774\ub77c\ub294 \uae30\ub2a5\uc744 \uc774\uc6a9\ud558\uba74 \ud55c \ubc88\uc758 HTTP \uc694\uccad\uc73c\ub85c \uc218\ucc9c \uac1c\uc758 \ube44\ubc00\ubc88\ud638\ub97c \ub3d9\uc2dc\uc5d0 \uc2dc\ub3c4\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc77c\ubc18\uc801\uc778 \ub85c\uadf8\uc778 \uc2dc\ub3c4 \uc81c\ud55c\uc744 \uc6b0\ud68c\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n

**\uc870\uce58 \ubc29\ubc95**<\/strong><\/p>\n\n\n\n

WordPress \uad00\ub9ac\uc790 \u2192 \ud50c\ub7ec\uadf8\uc778 \u2192 \uc0c8\ub85c \ucd94\uac00 \u2192 `Disable XML-RPC` \uac80\uc0c9 \ud6c4 \uc124\uce58.<\/p>\n\n\n\n

\ucf54\ub4dc \ud55c \uc904 \uc548 \uac74\ub4dc\ub9ac\uace0 \ud574\uacb0\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n

\n\n\n\n

### 2. wp-cron.php \uc678\ubd80 \uc811\uadfc (LOW)<\/strong><\/p>\n\n\n\n

**wp-cron\uc774 \ubb54\uac00\uc694?**<\/strong><\/p>\n\n\n\n

WordPress\uc758 \uc608\uc57d \uc791\uc5c5 \uc2e4\ud589\uae30\uc785\ub2c8\ub2e4. \uc608\uc57d \ubc1c\ud589, \uc790\ub3d9 \uc5c5\ub370\uc774\ud2b8 \uccb4\ud06c, \ubc31\uc5c5 \ud50c\ub7ec\uadf8\uc778 \ub4f1\uc774 \uc774\uac78 \ud1b5\ud574 \ub3d9\uc791\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n

\uc791\ub3d9 \ubc29\uc2dd\uc774 \ub3c5\ud2b9\ud55c\ub370, \ub204\uad70\uac00 \uc0ac\uc774\ud2b8\ub97c \ubc29\ubb38\ud560 \ub54c\ub9c8\ub2e4 “\uc9c0\uae08 \uc2e4\ud589\ud560 \uc608\uc57d \uc791\uc5c5\uc774 \uc788\ub098?” \ub97c \uccb4\ud06c\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n

**\uc65c \uc704\ud5d8\ud55c\uac00\uc694?**<\/strong><\/p>\n\n\n\n

`\/wp-cron.php`\ub97c \uc678\ubd80\uc5d0\uc11c URL\ub85c \uc9c1\uc811 \ubc18\ubcf5 \ud638\ucd9c\ud558\uba74 \uc11c\ubc84\uc5d0 \ubd88\ud544\uc694\ud55c \ubd80\ud558\ub97c \uc904 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

**\uc870\uce58 \ubc29\ubc95**<\/strong><\/p>\n\n\n\n

Nginx Proxy Manager\uc758 Custom Nginx Configuration\uc5d0 \uc544\ub798\ub97c \ucd94\uac00\ud588\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

“`nginx<\/p>\n\n\n\n

location = \/wp-cron.php {<\/p>\n\n\n\n

deny all;<\/p>\n\n\n\n

return 403;<\/p>\n\n\n\n

}<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

WordPress\uc5d0 \ub3c4\ub2ec\ud558\uae30 \uc804\uc5d0 Nginx \ub808\ubca8\uc5d0\uc11c \ucc28\ub2e8\ud558\ub294 \ubc29\uc2dd\uc774\ub77c \uac00\uc7a5 \ud6a8\uc728\uc801\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n

\n\n\n\n

## \uccb4\ud06c\ud588\uc9c0\ub9cc \ubb38\uc81c\uc5c6\uc5c8\ub358 \ud56d\ubaa9\ub4e4<\/strong><\/p>\n\n\n\n

\uc624\ud788\ub824 \uc774 \ubd80\ubd84\uc774 \ub354 \uc548\uc2ec\uc774 \ub410\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

| \uccb4\ud06c \ud56d\ubaa9 | \uacb0\uacfc |<\/p>\n\n\n\n

|—|—|<\/p>\n\n\n\n

| \uc0ac\uc6a9\uc790 \uacc4\uc815 \ub178\ucd9c (REST API) | \uc548\uc804 |<\/p>\n\n\n\n

| \uc791\uc131\uc790 URL\uc744 \ud1b5\ud55c \uc0ac\uc6a9\uc790 \uc5f4\uac70 | \uc548\uc804 |<\/p>\n\n\n\n

| debug.log \ud30c\uc77c \ub178\ucd9c | \uc548\uc804 |<\/p>\n\n\n\n

| wp-config.php \ubc31\uc5c5 \ud30c\uc77c \ub178\ucd9c | \uc548\uc804 |<\/p>\n\n\n\n

| \uc5c5\ub85c\ub4dc \ud3f4\ub354 \ub514\ub809\ud1a0\ub9ac \ub9ac\uc2a4\ud305 | \uc548\uc804 |<\/p>\n\n\n\n

| .env \ud30c\uc77c \ub178\ucd9c | \uc548\uc804 |<\/p>\n\n\n\n

| \ub85c\uadf8\uc778 \ud398\uc774\uc9c0 \ubb34\ucc28\ubcc4 \ub300\uc785 \ub178\ucd9c | \uc548\uc804 |<\/p>\n\n\n\n

\n\n\n\n

## \uc2a4\uce90\ub108 \ucf54\ub4dc\ub294 \uc624\ud508\uc18c\uc2a4\ub85c<\/strong><\/p>\n\n\n\n

\uc774\ubc88\uc5d0 \ub9cc\ub4e0 \uc2a4\uce90\ub108\ub294 WordPress \uc678\uc5d0\ub3c4 FastAPI, Next.js \uc11c\ubc84\ub3c4 \uac01\uac01 \uc810\uac80\ud560 \uc218 \uc788\ub3c4\ub85d \uad6c\uc131\ud588\uc2b5\ub2c8\ub2e4. GitHub\uc5d0 \uc624\ud508\uc18c\uc2a4\ub85c \uacf5\uac1c\ud560 \uc608\uc815\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n

\uad00\uc2ec \uc788\uc73c\uc2e0 \ubd84\ub4e4\uc744 \uc704\ud574 \uae30\uc220 \uc2a4\ud0dd\uc744 \uac04\ub2e8\ud788 \uc18c\uac1c\ud558\uba74:<\/p>\n\n\n\n

– **\uc5b8\uc5b4:**<\/strong> Python 3.12<\/p>\n\n\n\n

– **HTTP \ud074\ub77c\uc774\uc5b8\ud2b8:**<\/strong> httpx (\ube44\ub3d9\uae30)<\/p>\n\n\n\n

– **\uc544\ud0a4\ud14d\ucc98:**<\/strong> \uc774\ubca4\ud2b8 \ub4dc\ub9ac\ube10 (\ubaa8\ub4c8 \uac04 \uc9c1\uc811 \uc758\uc874 \uc5c6\uc74c)<\/p>\n\n\n\n

– **\ubcf4\uc548:**<\/strong> \ud0c0\uac9f URL\uacfc \uc778\uc99d \uc815\ubcf4\ub294 `.env`\uc5d0\ub9cc \uc800\uc7a5, \ucf54\ub4dc\uc5d0 \ud558\ub4dc\ucf54\ub529 \uc5c6\uc74c<\/p>\n\n\n\n

\n\n\n\n

## \ub9c8\uce58\uba70<\/strong><\/p>\n\n\n\n

\ubcf4\uc548\uc740 \ud55c \ubc88 \uc124\uc815\ud558\uace0 \ub05d\ub098\ub294 \uac8c \uc544\ub2c8\ub77c \uc9c0\uc18d\uc801\uc73c\ub85c \uc810\uac80\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n

\uc11c\ube44\uc2a4\ub97c \uc624\ud508\ud558\uae30 \uc804\uc5d0 \uc774\ub7f0 \uae30\ubcf8\uc801\uc778 \uc810\uac80\uc744 \uc9c1\uc811 \ud574\ubcf4\ub294 \uac83\ub9cc\uc73c\ub85c\ub3c4 \uaf64 \ub9ce\uc740 \uac78 \ubc30\uc6b8 \uc218 \uc788\uc5c8\uc2b5\ub2c8\ub2e4. \ud2b9\ud788 XML-RPC\ucc98\ub7fc “\uc6d0\ub798 \uc788\ub358 \uae30\ub2a5\uc778\ub370 \uc774\uc81c \uc548 \uc368\ub3c4 \ub418\ub294 \uac83\ub4e4”\uc744 \uc815\ub9ac\ud558\ub294 \uacfc\uc815\uc774 \ud765\ubbf8\ub85c\uc6e0\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n

\ub2e4\uc74c\uc5d0\ub294 FastAPI\uc640 Next.js \uc11c\ubc84 \uc810\uac80 \uacb0\uacfc\ub3c4 \uacf5\uc720\ud574\ubcf4\uaca0\uc2b5\ub2c8\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"

\uc11c\ube44\uc2a4\ub97c \uc624\ud508\ud558\uae30 \uc804, \uc9c1\uc811 \ub9cc\ub4e0 \ubcf4\uc548 \uc2a4\uce90\ub108\ub85c \ub0b4 WordPress \uc11c\ubc84\ub97c \uc810\uac80\ud574\ubd24\uc2b5\ub2c8\ub2e4. \uacb0\uacfc\ub294 \uaf64 \ud765\ubbf8\ub85c\uc6e0\uc2b5\ub2c8\ub2e4. ## \uc65c \uc9c1\uc811 \ub9cc\ub4e4\uc5c8\ub098? \uae30\uc874\uc5d0 WPScan \uac19\uc740 \ub3c4\uad6c\ub4e4\uc774 \uc788\uc9c0\ub9cc, \ub0b4 \uc11c\ubc84 \uad6c\uc870(GCP + Nginx Proxy Manager + WordPress)\uc5d0 \ub9de\uac8c \ucee4\uc2a4\ud130\ub9c8\uc774\uc9d5\ud558\uace0 \uc2f6\uc5c8\uc2b5\ub2c8\ub2e4. \uadf8\ub798\uc11c Python\uc73c\ub85c \uc774\ubca4\ud2b8 \ub4dc\ub9ac\ube10 \ubc29\uc2dd\uc758 \ubcf4\uc548 \uc2a4\uce90\ub108\ub97c \uc9c1\uc811 \uad6c\ud604\ud588\uc2b5\ub2c8\ub2e4. \uad6c\uc870\ub294 \ub2e8\uc21c\ud569\ub2c8\ub2e4. “` Recon(\uc815\ubcf4 \uc218\uc9d1) \u2192 Scan(\ucde8\uc57d\uc810 \ud0d0\uc9c0) \u2192 Validate(\uac80\uc99d) “` […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[15,14],"class_list":["post-11","post","type-post","status-publish","format-standard","hentry","category-it","tag-15","tag-14"],"_links":{"self":[{"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=\/wp\/v2\/posts\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11"}],"version-history":[{"count":1,"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=\/wp\/v2\/posts\/11\/revisions"}],"predecessor-version":[{"id":12,"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=\/wp\/v2\/posts\/11\/revisions\/12"}],"wp:attachment":[{"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog-api.minpox.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}