How to effectively check backdoors in Wordpress? [plugins/themes]

w001y

w001y

Newbie
Joined
Mar 31, 2021
Messages
42
Reaction score
14
Lately I hired some services in Fivver that include the installation of a premium plugin in the service.
Is there any way that these plugins are not infected or have backdoors?

I have also been tempted to use some that are shared here, sometimes they attach a virustotal scan, but I already read once on the forum that they are totally useless to detect any malicious php line.
On the other hand, I would also be interested to know how to leave a plugin pre-activated to be able to share it, without risking my license or purchase data.

Thank you very much in advance, for this doubt and for all the ones I have been able to solve thanks to the forum!
 
Advertise on BHW
w001y said:
I have also been tempted to use some that are shared here, sometimes they attach a virustotal scan, but I already read once on the forum that they are totally useless to detect any malicious php line.
Click to expand...
It all comes down to trust, do you trust the member that share a plugin, then download it, if not, buy a real license.
 
darksoultrip said:
I was a member of a blackhat forum called isdark, the owner disappeared. But he used to put backdoors in plugins and themes then share them on other BH forums. And yes, you're correct, the virus scans are useless against malicious php code. The backdoors are usually to give them full control of your website / server.
Click to expand...
Checking line by line? there must be something more sophisticated, right? I understand that the backdoor connects to external servers, then simply have a plugin that detects these strange connections.

Or something similar, I did not know the power of backdoors but sometimes I have feared even from Fivver trusted.

RoiBox said:
It all comes down to trust, do you trust the member that share a plugin, then download it, if not, buy a real license.
Click to expand...
I'm sorry but I sadly stopped believing in the man's word a long time ago, at least on some issues. It's not a matter of buying or not, it wouldn't be the first time that paid products have backdoors either.

RoiBox said:
It all comes down to trust, do you trust the member that share a plugin, then download it, if not, buy a real license.
Click to expand...
Oh by the way, I saw your signature, I was about to buy the service but I opted for another source, which I don't trust either.

I wonder what happens if someone comes to offer a good amount of money in exchange for putting a backdoor well done to the entire customer base, that could simply be done with an update of your base plugin no?

Well yes my friend, as you say it's all about trust, but it's often more difficult over the internet.
 
w001y said:
Oh by the way, I saw your signature, I was about to buy the service but I opted for another source, which I don't trust either.
Click to expand...
Just so you know, the signature is NOT my service, even if I trust the service provider.
 
w001y said:
Checking line by line? there must be something more sophisticated, right? I understand that the backdoor connects to external servers, then simply have a plugin that detects these strange connections.

Or something similar, I did not know the power of backdoors but sometimes I have feared even from Fivver trusted.
Click to expand...

It doesn't always have to ping back to the central.
It could be a backdoor that's left in the code very discreetly and once your site is indexed the attacker will find your site with the help of search engines and use the backdoor to gain entry to your server.
 
the thing is, there are so many ways to backdoor php code, there is no scanner that would detect everything.
there are some clever tricks that even a programmer wouldn't spot if he doesn't have a security background.
 
The best way to detect is have the original source downloaded in one folder and the suspected plugin in another. Use the software Atom to cross examine the files in the folders, you can compare files size, number of files, last modified dates, and lines of code file to file.

There is no wp scanner that will catch everything.
 
itz_styx said:
the thing is, there are so many ways to backdoor php code, there is no scanner that would detect everything.
there are some clever tricks that even a programmer wouldn't spot if he doesn't have a security background.
Click to expand...
these codes can put the server at risk, or the other sites I share the server with? or just the wordpres installation?


RoiBox said:
Just so you know, the signature is NOT my service, even if I trust the service provider.
Click to expand...

Why would you use that signature? do you use the service? btw I checked your giveaway, maybe I try oxygen, since time ago want to try if works better than elementor (what i don't think it's a challenge).

UpwardDescent said:
It doesn't always have to ping back to the central.
It could be a backdoor that's left in the code very discreetly and once your site is indexed the attacker will find your site with the help of search engines and use the backdoor to gain entry to your server.
Click to expand...

yes, I suppose the topic is pretty advanced by now, but I'm still surprised to learn about it

tidelow said:
The best way to detect is have the original source downloaded in one folder and the suspected plugin in another. Use the software Atom to cross examine the files in the folders, you can compare files size, number of files, last modified dates, and lines of code file to file.

There is no wp scanner that will catch everything.
Click to expand...

Do you mean the legit one and the suspicious? Or just 2 different plugins?

shuttershades said:
Use ClamAV or ImunifyAV to scan your files. The last one automatically scan and clean.
Click to expand...

There isn't an official list of hashes from the plugins.
I mean, Elementor pro for example must provide a has from the original file I guess, I remember once I got a hash after purchasing the plugin, but maybe ypu have to purchase before getting the has from the original licensed plugin.
 
w001y said:
Why would you use that signature? do you use the service?
Click to expand...

Yes, I use it, because it is a well known member of this forum that runs it, he does not take a dump in his own livingroom.

w001y said:
btw I checked your giveaway, maybe I try oxygen, since time ago want to try if works better than elementor (what i don't think it's a challenge).
Click to expand...

Better buy it then, how can you trust me, you only known who I am for an hour or so ..
 
RoiBox said:
Yes, I use it, because it is a well known member of this forum that runs it, he does not take a dump in his own livingroom.



Better buy it then, how can you trust me, you only known who I am for an hour or so ..
Click to expand...
I did not say that the service was yours, nor did I say that the seller should be doubted. I just find it curious that you advertise for free.

Anyway clearly the subject of my message is to find security mechanisms, up there you have several messages that indicate that sometimes it can be really difficult to find backdoors and also that the moderator of another forum put backdoors himself.

I don't understand that much trouble unless you are 12 years old or your plugins have prize, I think I'm simply asking a question.

And when I mentioned oxygen I expected you to tell me about your experience, not to cry.

Best regards and thanks
 
w001y said:
I just find it curious that you advertise for free.
Click to expand...
Who said anything about me advertise it for free, don´t assume things you do not know anything about.
 
As others said, it's really hard finding malware in PHP. And yes, you'd have to audit custom code line by line.

Basically I trust WP core and that's all. Every other plugin or PHP file that goes in my servers get audited.

Some plugins are tiny and easy to read. You download their ZIP before installing and take a look.

Others like Yoast are gigantic pieces of code. Yoast is open source, which is great because lots of people audit it, just to give one example. Closed source plugins are the hardest ones to audit and trust.

Today I find most plugins are unnecessary. Core WP does most of what plugins used to do in the past.
 
Yes, I mean compare the legit one and the nulled. If you dont have access to the legit one, I suggest to buy it, compare and refund.
 
Best way file integrity check. Compare text in 2 same plugins from different sources. Doesn't have to be the original one. No one can hide from this
 
KHer0 said:
Best way file integrity check. Compare text in 2 same plugins from different sources. Doesn't have to be the original one. No one can hide from this
Click to expand...
Trouble is you need to compare it to the original clean file, which the author supplies.
 
tidelow said:
Yes, I mean compare the legit one and the nulled. If you dont have access to the legit one, I suggest to buy it, compare and refund.
Click to expand...
If I buy the legitimate one, I just use the legitimate one, don't I? What would be the point of comparing and still using the "nulled" one?

KHer0 said:
Best way file integrity check. Compare text in 2 same plugins from different sources. Doesn't have to be the original one. No one can hide from this
Click to expand...

Yep, that's what I thought, now I'm looking the way to see the official checksum. Also could be that although being from different no official sources could be the same infected file.


bartosimpsonio said:
As others said, it's really hard finding malware in PHP. And yes, you'd have to audit custom code line by line.

Basically I trust WP core and that's all. Every other plugin or PHP file that goes in my servers get audited.

Some plugins are tiny and easy to read. You download their ZIP before installing and take a look.

Others like Yoast are gigantic pieces of code. Yoast is open source, which is great because lots of people audit it, just to give one example. Closed source plugins are the hardest ones to audit and trust.

Today I find most plugins are unnecessary. Core WP does most of what plugins used to do in the past.
Click to expand...

But yoast has a paid version, doesn't it? Closed source plugins you mean the ones that have to connect to external servers to work?

I also have that doubt, because some premium plugins work without the activation key, but others seem not to.
Then there are also the pre-activated ones, which I don't understand much either.

If you know the subject I would be very grateful for a brief explanation, I understand the open source or proprietary, but not its impact on the operating conditions in wordpress.
 
w001y said:
But yoast has a paid version, doesn't it? Closed source plugins you mean the ones that have to connect to external servers to work?

I also have that doubt, because some premium plugins work without the activation key, but others seem not to.
Then there are also the pre-activated ones, which I don't understand much either.

If you know the subject I would be very grateful for a brief explanation, I understand the open source or proprietary, but not its impact on the operating conditions in wordpress.
Click to expand...

That's the cool thing about Yoast, the open version is the paid version. Yes, some paid plugins often load activation PHP code (not just a code, but the PHP code itself) remotely too, which adds to the insecurity, others just check your license or activation number.

Xenforo has a neat system to check for backdoors. Every PHP file has a checksum. If the file changes (e.g. gets malicious code injected), Xenforo will detect it and report it to the admins. Wordpress doesn't have this at runtime that I know of. This is the closest I've seen to automated malware detection in PHP.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top