Mudanças entre as edições de "Segurança no wordpress"

De MochilaWiki
Ir para navegaçãoIr para pesquisar
m
Linha 9: Linha 9:
 
unzip /root/tools/wordpress/plugins/timthumb-vulnerability-scanner.zip -d .
 
unzip /root/tools/wordpress/plugins/timthumb-vulnerability-scanner.zip -d .
  
 +
Vulnerable 1.09 timthumb.php
 +
Up to Date 2.8.3 timthumb.php
  
  

Edição das 20h25min de 6 de abril de 2012

Helo command rejected: need fully-qualified hostname


não usar wp_ como prefixo http://www.websitedefender.com/wordpress-security/wordpress-database-security-tables-prefix/

unzip /root/tools/wordpress/plugins/antivirus.zip -d . unzip /root/tools/wordpress/plugins/wp-security-scan.zip -d . unzip /root/tools/wordpress/plugins/timthumb-vulnerability-scanner.zip -d .

Vulnerable 1.09 timthumb.php Up to Date 2.8.3 timthumb.php


trocar a senha do banco de dados


https://api.wordpress.org/secret-key/1.1/

entre em wp-config.php e troque


- TimThumb Vulnerability Scanner AntiVirus Timthumb Scanner WP Security Scan


rm readme.html


touch .htaccess touch wp-admin/.htaccess chmod 0600 wp-admin/.htaccess chmod 0600 wp-config.php chmod 0600 .htaccess chmod 0700 wp-admin chmod 0600 wp-admin/index.php chmod 0700 wp-admin/js chmod 0700 wp-content/themes chmod 0700 wp-content/plugins chmod 0700 wp-content chmod 0700 wp-includes chmod 0700 $PWD


find -name \*\.tmp -exec rm {} -fr \; find -name lmdex.php -exec rm {} -fr \; find . -name \*\INFECTED.php -exec rm {} -fr \;

find -name sitemaps.php find -name template_rss.php find -name flash.php

wget http://downloads.wordpress.org/plugin/antivirus.zip wget http://downloads.wordpress.org/plugin/timthumb-vulnerability-scanner.zip wget http://downloads.wordpress.org/plugin/wp-security-scan.zip

chown -R www-data.www-data . find ./ -type d -exec chmod 755 {} \; find ./ -type f -exec chmod 644 {} \;

esse comando acusar ter ou não "base64" grep -r base64 * |awk -F : '{print $1}' |sort |uniq


igual o comando acima, mas removendo os arquivos encontrados for x in `seq 9`; do find -name w$x*.php -exec rm {} \;; done;