Nulled themes got malicious code?

[xcodes]

in most of the cases these things can detect any harm malicious code in php or html or others.
Virus total, Windows Defender simply scan the script folder to null sometimes we compromise api data which leads to malware alter but you dont need to worry about such things. incase you find UTF-8 format then its really fishy they allow hackers to browser your entire website dir with one link they can upload anything to do their stuff

Good luck.

 

[tum01]

Most of them have left backdoors which will be used later by hackers if your website suddenly gets big

 

[Meerakat]

There is no way to scan the files for malicious codes unless someone here makes a scanner. However, the scanner has to be very-very efficient and it won't be exactly like a normal virus scanner that just requires a simple signature.

For wordpress, you need to learn basic programming in PHP. You need to check files for anything that sends an API request or is obfuscated. Sometimes there is also a hidden shell (you can directly access the server from web itself by visiting the root directory) so look for any files that sound or seem weird and have weird file names.

The most basic tips are:

• Look for lines that are encoded with base64 (these are the easiest ones to decode, trust me). After decoding, look for line that sends an API request to a specific website, if there is none then it's safe. However you need to manually check other files and sending an API request doesn't mean it's "malicious", it could be for various other reasons. As a white-hat hacker myself, I would send an API request to my website which would download and upload a shell in your web directory, so try to maybe look for lines like these and that is only if you learn programming.

• Look for shells, as mentioned above they allow you to access your server directly. So look for anything that has weird file name or a code that allows you to upload files, change MySQL details, etc..

• If there is a malicious code, it will only be in the plugin folder or a theme will be in the theme folder and not other Wordpress files, although if required I could even write a code that could infect your other Wordpress files. (Install a plugin if there is any, that allows you to see changes made in your files). If possible install a revert plugin which will immediately revert your Wordpress to the most recent backup.

If I go on, this will turn into an article; I'd rather keep it short. There are the most basic tips you should follow.

 

[DomBrave]

That is why I always check through some online virus checking site like virus total. But yes, there will always be some risk no matter even if the sand show that the file is alright.

 

[Sitaram jatt]

I used some nulled plugins from wplocker, till now never faced any issue. but dont use nulled themes. and you should scan the file in virus total befor uploading it to your server, but virus total only detect some basic type of malicious things.

 

[alienbaba]

Don’t download nulled themes. There’s coronavirus hidden in them..

 

[Gogol]

That is why I always check through some online virus checking site like virus total. But yes, there will always be some risk no matter even if the sand show that the file is alright.

VT doesn't do shit for checking backdoor. Check my previous post in the thread.

 

[darksoultrip]

Don’t download nulled themes. There’s coronavirus hidden in them..

There's coronavirus in everything. x.x

 

[milk_and_cake]

You should avoid using nulled-themes in general.
Always check the source of theme you are using.

Locating malicious code inside the theme/plugin can be either super easy or difficult task.
The malicious code if often obscured or simply coded with elegance into some file.

There are some situations where server-wide antivirus software can pick something up but you shouldn't rely on this.

 

[SamAnton]

all generalizations are false including this one.

 

[SamAnton]

if you have some web development experience just take a look at the code before using it.

 

[TooCorny]

Absolutely,

You can check @Festinger Vault of WP Themes and Plugins to get almost unlimited stuff for about 14$ a month

Saludos de España jejeje

 

[SirLouen]

You can use Astrogrep to search for injected URLs but others are more sneaky and inject base64 or some shit.

This is the most common practice nowadays.

In fact, one of the best practices to search for malware is to grep for base64_decode function, which is very unlikely to be used by plugins/theme by default and extremely common on nulled themes.

I'm sure someone could do a test batch to find common pieces, just as antivirus brands do, although some coding skills are required to interpret the results.

 

[JimobJones]

They can do everything from hack financial credentials to divert your sites traffic and harvest emails. I wouldn't recommend it. And just because you might be paying money for the privilege of nulls, don't expect them to be free from such modifications they've made.
Bits of change are not how these guys will be making their money - they'll be making money selling on or using data that you've worked so hard to try and put together.

Esp since most people using the stuff are going to be non the wiser about it all anyway - won't have the first clue what to look out for and where.

So obviously not ideal if someone is stealing your valuable data from right under your nose, but invisible to you, just because you wanted to save a few dollars.

 

[JimobJones]

I would say, unless they have something legally binding to confirm their code is kosher and matches what original repos file in all other ways, proceed with caution!