Why it’s important to update your blogging software!

Hey there,

some days ago I made a small penetration test for some SEO-Software which is quite known here and since the developer was also a BHW member, I did help him for free =).



*cough* would be happy for a free lifetime license*cough* jk


Note: not every guy who discovers an exploit will help you or show you what the exploit is, so it's important to update and keep your software up to date!



Now back to the lecture, I'm just going to show you how I did and which tools I used, but you won't be a master hacker after at this and that this paper is only for educational use, I'm don't support blackhat hacking and I won't be responsible for you damages which you inflict yourself.



Tools:

Firefox (You could take any browser it's not that important, which you take)



1. Identifing your target
a. Just look at the site you want to test

2. Gathering Informationen

a. Footprinting

Now this is an easy one, most of the modern CMS make a generator Tag in the rss-feeds which shows the CMS version, some hide it better and some worse.

Joomla:

[FONT=&amp]<generator>Joomla! 1.5 - Open Source Content Management</generator>[/FONT]

Wordpress:

<generator>http://wordpress.org/?v=3.3.1</generator>
Now where is the problem?
Most likely you won't be able to delete this feature or let the tag vanish or you just don't care.
But with this simple footprinting you can easily search for exploits.
3. Checking for exploits
The probably easiest is to check a exploit on a withehat site like:
After some searches you will mostly find an exploit which you can test or better you find nothing.


4. Exploiting
The exploit which i found at his site was an user emuration, this means i could get the password and emails for his users (hashed passwords), but since you muste likely will use your password severeal times, you know where im going for this.


Hope you learnt something


Q&A

And im open for questions, just post what you want to know

Basically info gathering or just a loophole test? I think there are a lot of plugin now a days which can provide robust security with these type of penetration test? Correct me if i am wrong.

Good reminder. I had a few Wordpress sites hacked a few weeks ago. Was a pain to get them restored...but we have auto backups which means we didn't lose any data and it just slowed us down a little.

Keep everything updated folks!

webso said:

Basically info gathering or just a loophole test? I think there are a lot of plugin now a days which can provide robust security with these type of penetration test? Correct me if i am wrong.

Click to expand...

This is just a small demo of how easy people can footprint your wordpress blog. You wont be a hacker if you can do that, lol.

And since i didnt wanted to get to much into the hacking a wordpress stuff i left alot of things out, like programs, scanners etc.

But most of the plugins will do

necro said:

This is just a small demo of how easy people can footprint your wordpress blog. You wont be a hacker if you can do that, lol.

And since i didnt wanted to get to much into the hacking a wordpress stuff i left alot of things out, like programs, scanners etc.

But most of the plugins will do

Click to expand...

Dude but this seems interesting , wordpress security is the main thing which most developers outlook , happy to know someone highlighted about it so impressively.

webso said:

Dude but this seems interesting , wordpress security is the main thing which most developers outlook , happy to know someone highlighted about it so impressively.

Click to expand...

Somebody got to do it .

Would you like an free vunerabilitie scan?

Greetz