Wordpress Mass Defacement Tool

Wordpress as being one the widely used CMS platform is one the favorite target of hackers now a days along with WHMCS, Instead of directly targeting wordpress fucntionalities and vulnerable plugins, it has been observed that the hackers are targeting a vulnerable website on the same server and using it they are able to bypass server restrictions in order to get the configuration file and hence hacking in to the wordpress. This method is commonly known as Symlink Bypassing in Black Hat World and server bypassing in White hat community.
Now it's a difficult task for an attacker to manually connect to the database and then manually replace the index file of worpdress for a successful defacement. Therefore hackers use Mass defacers. These are tools used by hackers to change the index files of all the websites present on the server with their own defacement page, This usually happens when the hacker has root level access on the server.

Recently, The admin of Team Root "Mauritania Attacker" mailed me his tool for the review, Which can be used by attackers to deface all the wordpress websites present on the same server.

How Does It Work?

For this tool to work the only requirement would be that the server is vulnerable to symlink bypass, This tool will automatically symlink all the wordpress websites on the server and replace their indexes with the page you will provide (.html or .PHP).

How To Use It?

The usage is extremely simple and i really don't see purpose of creating a tutorial, however this blog is mostly read by newbies, So I will add some screen shots.

Requirements

1. Shell On The Server
2. The shell should not be secured from Symlink Bypassing.
3. Wordpress Mass Defacement Tool

Once you have completed all the above requirements, Just upload the Mass Defacement tool to the webserver, it will look some thing like this, Now replace the contents of index url with your own defacement page.

Next you will see the results for the websites, yo have been able to deface:

And finally you can view the list of all the websites, you were able to deface:

How To Protect Your Self?

In order to protect your website from being defaced, All you need to do is to change the permissions of your index files to 400. So no one will be able to change them, however if an attacker has root level access on the server, there is no way of protecting your website, since the attacker can manually change the permissions. 

Read more

by Malik korrich ~ vendredi 7 décembre 2012 0 commentaires

Wordpress Plugin Easy Comment Uploads Vulnerability - Thousands Of Websites Vulnerable

Wordpress as you might know is one of the most widely used blogging platforms, As a reason of which it has became the favorite target of hackers. Wordpress itself is quite secure, however the plugins make it unsecure resulting in hack attacks, data loss etc, when they are created the developers do not think of the security or do not know how to write the secure code, hence skipping lots of necessary checks making the plugins vulnerable to attacks like SQLInjetion, Remote File inclusion etc.


One of those popular vulnerable plugin is Easy Comment Upload plugin, The version 0.61 and prior versions are affected with Arbitrary File Upload Vulnerability. The plugin fails to check the upload file type as a reason of which it can be exploited by uploading a Phtml file.

There are thousands of wordpress blogs still vulnerable to this attack. The vulnerability can be fixed by updating the wordpress easy comments plugin to version 0.71.

If you want to know more about Protecting your wordpress blog from hackers you can refer the following posts, If you still think your blog is vulnerable drop me an email and I will perform a security assessment on your blog.

• How To Secure Your Wordpress Blogs?
• How To Find The Wordpress Version Of A Website/Blog

Read more

by Malik korrich ~ jeudi 19 janvier 2012 0 commentaires

Securing The Wp-Config File To Prevent Your Wordpress Blog From Getting Hacked

If your blog has been hosted on wordpress then your blog is more vulnerable than other blogging platgorms, The reason is that by default the wordpress security is very low and can be compromised easily, Before writing this post I made a little search on the web related to "Wordpress Security" and really found some foolish tips out there which would really not help you in any means. So I decided to write a post own my own, There are lots of wordpress admins who use plugins such as login lockdown along with many other plugins to prevent brute force attacks on wordpress, The problem is that now a days a hacker will not use a bruteforce attack or dictionary attack for hacking a wordpress blog, because now a days almost every one atleast has a password of more than 8 characters, and even if some one has a weaker password too, the brute force attacks and Dictionary attacks will be automatically blocked by your webserver, As they have iDS and IPS configured to these kinds of requests automatically.

Phising attacks are also not very common with wordpress blogs and I have seen very rare cases in which wordpress users have fallen for phishing attacks, but almost every time a wordpress user will login into the dashboard by manually adding wp-admin to the end of the url, There are possibliles that wordpress users can be attacked by phishing attacks, but bloggers are already a bit tech savy and won't fall for these types of attacks, Alternatively if the hacker is smarter and can implement more advanced types of phishing attacks like desktop phishing ,tabnabbing or Dns Spoofing then there are chances that the wordpress user will fall for these attacks.

So How Do Hackers Hack Into Wordpress Blogs?

Most of the skilled Hackers will target your wp-config as it's in an unsecure place by default. Wp-config file is the most important file present on your wordpress blog. It holds very sensitive information such as including your database access, table prefix and Secret Key, So in order to protect your wordpress blog from getting hacked you would need to harden your wp-config file. Here is how a wp-config file looks inside, As you can see from looking into it that it contains very sensitive information.

Protecting Wp-Config File From .htacess

The first step you should take write away is to add the following code to your .htacess file, This is the first step you should take in hardening your wordpress.

# protect wpconfig.php

order allow,deny
deny from all

Changing The Permission

Last week I came across a wordpress blog, whose permission for wp-config file was set to readable, All the hacker needed to do is to upload a mysql database and use those to access victim's wordpress blog. So the bottom line is that the permission should not be set to readable, it should be set to something like "400".

Security Keys

Security keys were added in wordpress 2.6 to ensure better encryption of information stored in the user's cookies, A secret key also includes makes it harder to crack your passwords, If some how the hacker gets hold of your wordpress hash, You can get your secret keys from here, All you need to do is to add these secret keys to your wp-config file.

Moving Your Wp-Config File

By default Wp-Config is located in the root folder, Wordpress themselves recommend users to move their wp-config file to some other place such as outside the root folder, This will prevent the Symlink bypassing attack to the some extent.

Moving To VPS Or Dedicated Host To Prevent Symlink Bypassing Attack

If your wordpress blog is on a shared host then it will be alot more vulnerable to symlink bypassing attack than on VPS or dedicated, If your blog is quite established and you can afford to move to VPS or dedicated hosting, Then I would recommend to move it right away.

I hope you have liked my post on Wordpress security, If you are looking for some more ways to protect your wordpress blog, I would recommend you reading the following post:

• How To Secure Your Wordpress Blogs?

Read more

by Malik korrich ~ jeudi 14 juillet 2011 0 commentaires

Wordpress 3.2 Released - Much More Secure

Wordpress has just released wordpress 3.2 a couple of hours ago, Wordpress 3.2 comes with lots of major and minor bug fixes. Wordpress 3.2 is much more secure than previous versions as it comes with lots of security patches and fixes. WordPress 3.2 requires a minimum of MySql 5.0.15 and PHP 5.2.4. If you are facing some errors kindly contact your hosting immediately.




Wordpress 3.2 also comes with a very neat and clean design, with a fully refreshed admin design, a full screen editor for distraction free blogging

According to WordPress officials:

WordPress 3.2 in 40 words or less: WordPress comes with a refreshed admin design, a full screen editor for distraction free blogging, a new default HTML theme and an extended admin bar.

Read more

by Malik korrich ~ mardi 5 juillet 2011 0 commentaires

How To Find The Wordpress Version Of A Website/Blog

When ever a hacker tries to attack a CMS(Content managing system) the first thing which he usually does is that he tries to find out the version number of that CMS, So he could go and search on Exploit databases for possible exploits, In a wordpress blog by default you can easily find out some one's version number by just viewing the source of that particular blog.

 Now it's not a good idea to expose your version number because it will make your Website/blog more vulnerable to hackers, There are couple of ways through which you can hide your version numbers, The simplest one is to add the following code inside your functions.php file

remove_action('wp_head', 'wp_generator');

Moreover there are couple of other plugins which can help you hide your wordpress plugin, Just google for them.

Readme.html File Bug

Well even if any one is using plugins to hide their wordpress version number, it is still possible for a hacker to determine your version number, All the hacker has to do is to add "/readme.html" after the websites URL.

Countermeasures

• Use a good plugin that can hide your wordpress version number.

• Always update your wordpress to the latest version.

• Either delete readme.html file or change it to some thing like readme.php file.

I hope you have learned something new today, Feel free to comment.

Read more

by Malik korrich ~ mardi 26 avril 2011 0 commentaires