Category: Web

Distributed Brute Force Attack On WordPress wp-login.php

April 15, 2013

Over the last few days many WordPress websites have encountered problems due to a massive distribute brute force attack on the wp-login.php script. The hackers are using a network (botnet) of compromised servers (bots) to repeatedly attempt to login to WordPress using common usernames and weak passwords. The botnet may contain as many as 90,000 unique IP addresses. The scale of the attacks has created problems at some hosting companies: IX Web Hosting http://status.ixwebhosting.com/2013/04/11/global-server-wordpress-issues/ Hostgator http://blog.hostgator.com/2013/04/11/global-wordpress-brute-force-flood/ Daniel Cid at Sucuri Blog discusses how these attacks have increased over the last few days: http://blog.sucuri.net/2013/04/mass-wordpress-brute-force-attacks-myth-or-reality.html There are a number of ways to mitigate the attacks including: Password Protect wp-login.php This is a good solution if you have a limited number of people who have to login to WordPress. Here are instructions from Hostgator on how to add password protection: http://support.hostgator.com/articles/specialized-help/technical/wordpress/wordpress-login-brute-force-attack Other hosts and control panels should be similar. Rename wp-login.php This solution

Find TimThumb Versions

March 11, 2013

Versions of the TimThumb script prior to 1.34 have a serious security vulnerability. Here’s a one liner to find the versions of all TimThumb installs on a server:


find -name '*.php' -exec grep -q TimThumb {} \; -exec grep "'VERSION'" {} \; -print

find -name '*.php' -exec grep -q TimThumb {} \; -exec grep "'VERSION'" {} \; -print

Discourage HTTPS On WordPress

January 16, 2013

Recently we had a WordPress site where that used HTTPS (SSL) on the login/admin areas. But we wanted to discourage HTTPS for non-admin URL. Here are the rewrite rules that ended up using in a .htaccess file:


RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^\/wp\-admin
RewriteCond %{REQUEST_URI} !^\/wp\-login.php
RewriteCond %{REQUEST_URI} !^\/wp\-includes
RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

RewriteEngine On

RewriteCond %{HTTPS} on

RewriteCond %{REQUEST_URI} !^\/wp\-admin

RewriteCond %{REQUEST_URI} !^\/wp\-login.php

RewriteCond %{REQUEST_URI} !^\/wp\-includes

RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins

RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Find All WordPress Instances On A Server

July 11, 2012

Here’s a handy one-liner to find all instances of WordPress on a server as well as their version numbers:


find . -name 'version.php' -path '*wp-includes/*' -print \
   -exec grep '$wp_version =' {} \; -exec echo '' \;

find . -name 'version.php' -path '*wp-includes/*' -print \

-exec grep '$wp_version =' {} \; -exec echo '' \;

This is not original, I found it here.

Determine Magento Commerce Version

July 7, 2012

While urgently patching dozens of Magento Commerce installations for the latest security alert, I needed a quick way to determine the version without logging into the admin. I found the answer in a note on the bottom of this wiki page: http://www.magentocommerce.com/wiki/groups/227/check_magento_version Just open app/Mage.php and look for the getVersionInfo() function. You’ll see something like this:


public static function getVersionInfo()
    {
        return array(
            'major'     => '1',
            'minor'     => '7',
            'revision'  => '0',
            'patch'     => '0',
            'stability' => '',
            'number'    => '',
        );
    }

public static function getVersionInfo()

{

return array(

'major' => '1',

'minor' => '7',

'revision' => '0',

'patch' => '0',

'stability' => '',

'number' => '',

);

}

Here’s a Perl one liner to extract the version:


perl -ne 'print if /function\ getVersionInfo/../\}/' app/Mage.php

perl -ne 'print if /function\ getVersionInfo/../\}/' app/Mage.php

Thanks to Peteris Krumins for a great blog full of Perl one-liners. The one above was derived from this article: http://www.catonmat.net/blog/perl-one-liners-explained-part-six/ BTW … here’s the security alert: http://www.magentocommerce.com/blog/comments/important-security-update-zend-platform-vulnerability/ If you’ve not already patched then you should really get it done right away or contact Reliable Penguin for assistance.