How to effectively check backdoors in Wordpress? [plugins/themes]

scanningthru said:
Trouble is you need to compare it to the original clean file, which the author supplies.
Click to expand...
w001y said:
Yep, that's what I thought, now I'm looking the way to see the official checksum. Also could be that although being from different no official sources could be the same infected file
Click to expand...

No aaaaaaaaaaaaaaaaaaaaaaaaaand no -_-

Like I said, you don't need a clean version. You just need two copies from two different sources. Two different nulled websites or 1 website and 1 Forum or whatever. All you need is two different sources. So, even if both of them were infected, there is no way they are infected with EXACT SAME code. So, when compared, they both will show their difference, which is the backdoor php code.

When I was younger, I used to look for each nulled website backdoor, create a fingerprint and find all the websites they infected. Good Days
 
Advertise on BHW
KHer0 said:
No aaaaaaaaaaaaaaaaaaaaaaaaaand no -_-

Like I said, you don't need a clean version. You just need two copies from two different sources. Two different nulled websites or 1 website and 1 Forum or whatever. All you need is two different sources. So, even if both of them were infected, there is no way they are infected with EXACT SAME code. So, when compared, they both will show their difference, which is the backdoor php code.

When I was younger, I used to look for each nulled website backdoor, create a fingerprint and find all the websites they infected. Good Days
Click to expand...
This is why I like BHW. Someone knows something I don't, and I learn. So take a like
 
Anything strange happens to your site such as new link attached to a new site or redirection done not by you or read the codes of what you get is useful or smart normally.

You would best to not buy themes or plugins of fiverr many are hacked so if you ever annoy the person they can often take control of your site you would be better or just buying theme or plugin direct from the creator so you have more protection normally.
 
if you have 2 versions you can use the "diff" comand in linux to easily compare the files. it will show you the differences.
 
What if I uninstall the suspicious plugin, will the backdoor code get uninstalled or does it remain on the server?
 
KHer0 said:
No aaaaaaaaaaaaaaaaaaaaaaaaaand no -_-

Like I said, you don't need a clean version. You just need two copies from two different sources. Two different nulled websites or 1 website and 1 Forum or whatever. All you need is two different sources. So, even if both of them were infected, there is no way they are infected with EXACT SAME code. So, when compared, they both will show their difference, which is the backdoor php code.

When I was younger, I used to look for each nulled website backdoor, create a fingerprint and find all the websites they infected. Good Days
Click to expand...
Let's say there is a plugin on a forum, and I have a website where "I sell premium plugins". If I take the plugin from the forum and simply upload it to my website, it will have the same checksum because the file has not been modified, right?

Obviously everyone would be interested in having their own backdoor, but I have seen several cases trying to resell pirated material with the credits, even virus from another people.

vin42 said:
What if I uninstall the suspicious plugin, will the backdoor code get uninstalled or does it remain on the server?
Click to expand...
From what I understand, it is assumed that once they have entered they have full control in most cases. They can even take control of the sites sharing the server, in case it's shared and there is no good isolation between them by the provider.
 
vin42 said:
What if I uninstall the suspicious plugin, will the backdoor code get uninstalled or does it remain on the server?
Click to expand...
It has nothing to do with the plugin. As long as the code on your server, it will work and any respected hacker should escalate after infecting the server. Means trying to take control of the whole server or even network and hide his traces.

From what I understand, it is assumed that once they have entered they have full control in most cases. They can even take control of the sites sharing the server, in case it's shared and there is no good isolation between them by the provider.
Click to expand...

This why I said two free resources. Anyway, it's really easy to find clean websites for nulled plugins and themes. Just look for those active webs/forums with tons of replies and strict moderation.
 
KHer0 said:
It has nothing to do with the plugin. As long as the code on your server, it will work and any respected hacker should escalate after infecting the server. Means trying to take control of the whole server or even network and hide his traces.
Click to expand...
So that means that the malicious code is inserted when we install the nulled plugin or theme? I had recently installed a plugin shared here that I desperately needed. However I had run the file through virustotal and it was clean. Is there any firewall or antivirus that blocks the installation of unauthorized php files?
 
KHer0 said:
It has nothing to do with the plugin. As long as the code on your server, it will work and any respected hacker should escalate after infecting the server. Means trying to take control of the whole server or even network and hide his traces.



This why I said two free resources. Anyway, it's really easy to find clean websites for nulled plugins and themes. Just look for those active webs/forums with tons of replies and strict moderation.
Click to expand...
I didn't find it easy since I am just starting in this world, anyway there are sites where the moderator analyzes vulnerabilities of shared files?

If you are so kind could you share with me some of these sources?
Maybe reputable people from this forum?

You can use private messages too.
Thank you very much in advance
 
w001y said:
I didn't find it easy since I am just starting in this world, anyway there are sites where the moderator analyzes vulnerabilities of shared files?

If you are so kind could you share with me some of these sources?
Maybe reputable people from this forum?

You can use private messages too.
Thank you very much in advance
Click to expand...
You can get WP themes and plugins from @Festinger. He is one of the most trusted guys here.
 
After researching on this forum I found out that someone has suggested to install all suspicious plugins / themes on a standalone or local server and then monitor the traffic using a network monitor like wireshark. However most people don't have the knowledge what to look for in the network traffic logs and how do we know what is suspicious traffic. Any other simpler solutions?
 
It is very difficult to check. The backdoor can be not only in PHP code, for example in images/javascripts, need to check all files.
 
The source where you got the plugin/theme matters most. I always used to compare the files modification date with the change log on the particular plugin/theme site. This helps me till now.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top