Tag Archives: wordpress security

WPforce – wordpress pen-testing tool..

Just found this wordpress penetration-testing tool – looks pretty handy, especially since it seems to have some follow-up tools to do stuff once you’ve gained access. Another one for the testing arsenal!

How-to guide by DoxSec here: https://doxsec.wordpress.com/2017/04/13/wpforce-wordpress-attack-suite/

and a youtube vid demoing it too..

Hosting & Web development

I’m a freelance coder, web-developer and general number-cruncher based in the UK.

I don’t aim to have many clients but the clients I have I try to look after properly. To me this is more than just building someone a site and letting them get on with it – I try to help them develop and grow it into a successful business and that often covers things like e-commerce, Adwords and marketing/social-media/seo strategy as well as building the actual site.

I run a few small servers and nowadays mostly work in wordpress, for which I’ve written a number of little plugins and addons to help expand functionality and also protect the sites I host.

Nowadays much of my work is done in the background (which is how I’ve come to like it) and yet other parts are confidential so you won’t see a any details here, but by now I’ve been doing this over a decade and have “ghost”-written code for government bodies, law enforcement as well as the odd blue-chip client here and there. Nowadays though I tend to focus mostly on my own projects and the few SME clients I keep.

If you’re interested in reasonably priced, managed wordpress hosting or other wordpress/IT-related problem-solving, then feel free to drop me an email at [email protected].

As you can probably tell from my blog I am also interested in information security (particularly wordpress security), privacy etc as well as how those things can be (and are) misused, and I also enjoy tinkering with Linux and solving problems with scripting – particularly using Raspberry Pis (which I love!) 🙂

This: Brute Force Attacks Build WordPress Botnet

Brute Force Attacks Build WordPress Botnet

I am seeing this sort of activity every day and the scale has gone bonkers recently. One of my sites was seeing an attack with several thousand intrusion attempts per hour, but each from unique IPs. Each IP was only used once or twice at most. I had to turn off the blacklist email notifications from our bot filter so that I didn’t go through my monthly sending quota in a matter of hours.

Thankfully we’re still standing because it was relatively easy to make adjustments to our bot filtering system but still. yikes.

I realise this isn’t exactly news (given the date of the article) but this fight has been ongoing for a while now.  Recently things seem to have escalated though as both defensive and offensive sides have been upping their game. WordPress security is now something you actually need to have a plan for or prepared to become a casualty. Not if but when.

WordPress is great in so many ways, but its popularity makes it attractive as a botnet platform, as well as the bandwidth from the nice always-on servers vs compromised pcs, which tend to get switched off and have crappy upload speeds.

It’s so easy to get going with wordpress (by design) that it ensures the “botherders” have an almost endless source of potential zombies by way of folks who haven’t yet figured out that wordpress security is actually a thing.

Krebs’ was apparently taken down recently by a DDOS from IoT devices so imagine what you could do with a network of wordpress sites…

death-star-destroys-alderaan-o

If you run a wordpress site and don’t run somesort of defences, the chances are you’re probably not monitoring login notifications either which means that you’re not seeing the potentially thousands of intrusion attempts on your site that are happening all the time and at best occupying your server by making it load the page thousands of times for someone who’s trying to harm you.

So basically you won’t even know that anything’s going on until it’s already happened.