Blog

Home / Blog
Password Guessing Attacks: Attack-Defend WordPress

Password Guessing Attacks: Attack-Defend WordPress

Attack-Defend
If you have a WordPress site, someone is likely trying to guess your username and password combination. It is easily the most common attack against these sites. This is because it's an easy attack to automate and undoubtedly it pays off occasionally.  In this post, I'll show you some common methods attackers use to guess your username and password, and then show what happens when you implement simple defenses. What is a WordPress Password Guessing Attack? Simply, this attack is when someone tries to guess your password. An attacker will use a program to guess the most common variations of usernames and passwords on your site. It will use your login form to enter the most common username:password combination (that's admin:admin, btw). If that fails, the program moves on to…
Read More
WordPress Vulnerability Roundup: Week 32

WordPress Vulnerability Roundup: Week 32

Vulnerabilities
The WordPress Vulnerability Database has once again bestowed her gifts upon us. We have fresh new offerings, 3 from @ethicalhack3r, 2 from @_8bitsec and one from Omaid Faizyar. The affected themes and plugins are: Salutation Response Theme (Premium) Ultimate Affiliate Pro (Premium) Formcraft (Premium) Simple Custom JS and CSS Popup Maker WP Live Chat Support Details on the New Vulnerabilities Salutation Responsive WordPress 5500+ sales on Themeforest XSS - https://wpvulndb.com/vulnerabilities/8875 by @ethicalhack3r - https://dewhurstsecurity.com/ 1st Vulnerability Reported ever for this theme Fixed in version 3.0.16 Ultimate Affiliate Pro WordPress Plugin 2100+ sales on CodeCanyon xss - https://wpvulndb.com/vulnerabilities/8876 by @_8bitsec - http://www.8bitsec.io 1st Vulnerability Reported ever for this plugin FormCraft - Premium WordPress Form Builder 12,000+ sales on CodeCanyon XSS - https://wpvulndb.com/vulnerabilities/8877 by @_8bitsec - http://www.8bitsec.io 1st Vulnerability Reported ever for…
Read More
Attack/Defend WordPress: Security Scanners

Attack/Defend WordPress: Security Scanners

Attack-Defend
In this installment of the Attack/Defend WordPress series, I'm going to give you an introduction to the wide world of security scanners. A security scanner is a tool that an attacker can run to gather information about your site. Usually they harmless by themselves, only returning information about how your site is set up and where it is vulnerable to attack. The attacker will then use that information to conduct the real attack. As a site owner or defender, this information is super valuable. You generally want three things: The ability to gather the information yourself To prevent attackers from being able to gather the same information Instructions for closing security holes that the scanners find Defending Against Attackers with Scanners Running and interpreting the results of security scanners is…
Read More
Newest WordPress Vulns: WP Rocket and YouTube Embed

Newest WordPress Vulns: WP Rocket and YouTube Embed

Vulnerabilities
We have two new vulnerabilities in WordPress plugins to tell you about. New Vulnerabilities WP Rocket, a caching plugin which claims over 260K paid users, has a LFI (Local FIle Inclusion) vulnerability in versions up to 2.10.3. This is the first public vulnerability for this plugin. And it's fixed, so do your update. YouTube Embed, which somehow seems to embed YouTube videos for 100K+ sites, has a CRSF vulnerability in versions up to 11.8.1. This is also fixed in the latest release. Your Best Defense: Update Your Plugins Technical details are now public, so you should assume attackers are trying this out on every website they can find. Update your plugins, folks. Better yet, learn how to do it automatically.
Read More
Attack/Defend: Why test your WordPress site?

Attack/Defend: Why test your WordPress site?

Attack-Defend
Welcome to the first post in the attack/defend series. This series shows you some techniques for testing your WordPress site defenses. The goal is to give yourself the peace of mind that your defenses are configured correctly and working. And you'll do this by simulating attacks. Fun, right? Attack tools If you are going to follow along with this series, I strongly recommend that you take the time to install Kali Linux. The tools we are using come pre-installed and your life will be much simpler, even if you are not familiar with Linux. Use it in a VirtualBox virtual machine. I went ahead and Googled how to do that for you. I'll link to the source pages for the individual tools we'll use. Some of them support Windows and…
Read More
WP Statistics… Again

WP Statistics… Again

Vulnerabilities
WP Statistics, with over 300K downloads, has patched another XSS vulnerability. XSS is cross-site scripting, where an attacker is able to compromise a web page to run their own evil code. This is the 3rd such patch from WP Statistics in a month. The good news is that they seem to continue to respond to the bug reports quickly, the bad news is that they seem to have a disturbing rash of bugs. Overall, it gives me confidence in the team that they respond quickly and transparently to the bug reports. Your Best Defense: Update Your Plugins Technical details are now public, so you should assume attackers are trying it out on every website they can find. Update your plugins, folks. Better yet, learn how to do it automatically.
Read More
Defense in Depth: SSL

Defense in Depth: SSL

Defense In Depth
SSL is the encryption technology for the web. In your browser address bar, you can tell whether a site is encrypted or not if it has the little lock. This site is encrypted, as are over half of the web sites people visit nowadays. Your site should be too. Why Encrypt The clearest way to demonstrate the importance of encryption is to imagine yourself at a coffee shop, connected to their wifi. You may not have thought about it, but the data you generate in that coffee shop is visible to everyone there. Your wifi card just sends it out and hopes the router can hear it. If the data is unencrypted, then an attacker next to you can read that data too. If you and the attacker happen to…
Read More
6 New Vulnerabilities from WPScan

6 New Vulnerabilities from WPScan

Vulnerabilities
@ethicalhack3r, aka Ryan Dewhurst, continues his march of awesomeness across WordPress plugins. He found 5 new vulnerabilities that got published this week. Also published was one from @log_oscon. The current versions of each plugin fixes these issues. Vulnerability List Shortcodes Ultimate: Directory Traversal vulnerability. This plugin has 600K+ downloads. This is its first known vulnerability. Responsive Lightbox: Cross-site scripting vulnerability. This plugin has 200K+ downloads. It's been two years since a vulnerability was published for this plugin. WordPress Download Manager: Cross-site scripting and open redirects. 90K sites have downloaded this plugin and it's had a string of 4 vulnerabilities published this year. Seems like a lot, just sayin'. WP Members: Cross-site scripting. 70K downloads. First vulnerability reported this year. DSubscribers: SQL Injection. Only 100+ downloads. It's their first known vulnerability.…
Read More
WP Statistics Vulnerability

WP Statistics Vulnerability

Vulnerabilities
Published this week are two vulnerabilities in the WP Statistics plugin. This is a plugin that captures and displays website visitor statistics. WordPress has the user count at 300K+. Both issues allowed a straight-forward path to access admin privileges on sites and are fixed in the latest version. Two Sets of Vulnerabilities The first issue (discovered by Sucuri) was a SQL injection vulnerability. This allowed any register user to create new users with admin privileges. They could then sign in as that admin user and create havoc. The second issue was a Cross-Site Scripting vulnerability (discovered by Ryan Dewhurst). This type of attack would allow the attacker to execute code with the same level of privilege as the person viewing the site. So if you are an admin and viewed…
Read More

Not sure whether you need the extra security?

We can run a scan on your site to show you what hackers can see before they attack. Just fill out the form below to get started.