GoFuckYourself.com - Adult Webmaster Forum - How to protect WP from XSS or cross site scripting

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - How to protect WP from XSS or cross site scripting (https://gfy.com/showthread.php?t=1222105)

lakerslive

10-17-2016 10:56 AM

How to protect WP from XSS or cross site scripting

Should i just remove all plugins and just go with default wp theme and thats it?

(yes, i always update but it still not enough) tnx

ive tried alot of the plugins,ex wordpence = junk

but they are still about to insert these effing files into my wordpress folders with encoded crap and turn my vps into a spam bot. I'm really desperate now.

lakerslive

10-17-2016 11:01 AM

Quote:

Originally Posted by lakerslive (Post 21228196)

Has anyone tried using wordpress without any plugins? how did that turn out for u guys

Sarn	10-17-2016 11:21 AM

noscript plugin + firefox good work for XSS detection.
make backups, read logs, fix problem

Barry-xlovecam

10-17-2016 11:25 AM

Keep the server's MySQL version patched and up to date. If you cannot do it yourself -- find a shared host that keeps their servers up to date.

That is the first line of defense.

gnawledge

10-17-2016 11:26 AM

What are the permissions set on those folders?

I use a lot of WordPress sites and never have those issues. I don't know if your host has permissions set differently. Because I have a server that's SUPHP and one is DSOHANLDER and I have to mess around with permissions to get things working right.

I googled your conundrum... take a look at this. Maybe you saw it maybe not.

https://hackertarget.com/xss-tutorial/

just a punk

10-17-2016 11:29 AM

Quote:

Originally Posted by lakerslive (Post 21228196)

How to protect WP from XSS or cross site scripting

The only 100% solution is to stop using all the vulnerable plugins. Unfortunately there is no universal solution which will give you a 100% guaranty. Also you can hire a coder who will check your plugins/themes for the XSS vulnerability and fix it if needed.

Quote:

Originally Posted by Sarn (Post 21228283)

noscript plugin + firefox good work for XSS detection.
make backups, read logs, fix problem

https://66.media.tumblr.com/92421b13...lq7lo1_250.gif

Colmike9

10-17-2016 11:40 AM

You could put this in php.ini to stop it (But if the site relies on any of these functions then you'll have to find an alternate or allow individually if necessary)

Code:

allow_url_fopen = off

allow_url_include = off

disable_functions = "apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, ini_get_all, ini_restore, inject_code, mysql_pconnect, openlog, passthru, php_uname, phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode, phpAds_xmlrpcEncode, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_setuid, posix_uname, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, syslog, system, xmlrpc_entity_decode"

Then remove the base64 code that you see, de-encode it if you want to see what it's doing.
Then update things, remove plugins that you don't need or use, set your permissions to a safe level, etc.

Sarn	10-17-2016 12:02 PM

Quote:

Originally Posted by CyberSEO (Post 21228325)

Что тебе не нравится клоун? ты уже посоветовал не использовать твой плагин и еще фейспалмишь мне? :1orglaugh

PornDiscounts-V

10-17-2016 12:07 PM

It sounds like your server has dozens of backdoor scripts added to it. Your best bet is to export your posts via export tool, then delete everything. All of it. Then recreate it and import the posts. Then stop using themes from crappy sources and only use plugins you actually need.

just a punk

10-17-2016 12:27 PM

Quote:

Originally Posted by sarn (Post 21228406)

Что тебе не нравится клоун? ты уже посоветовал не использовать твой плагин и еще фейспалмишь мне? :1orglaugh

Клоун это ты. Читай посты людей выше и учи английский уже, дебил блять.

P.s. Или дело не в английском? Ты может вообще ущербный и даже по-русски не понимаешь, что такое "защитить wp сайт от xss"? Так хрена ли ты вообще делаешь на этом форуме?

lordaRaG0n

10-17-2016 12:31 PM

If you're on an Apache 2 server try using the recommendations from securityheaders.io.
You should be able to implement the following without tweaks:
X-XSS-Protection
X-Frame-Options
X-Content-Type-Options

But for Content-Security-Policy you must whitelist in the headers every host/script that's allowed to use src= queries in your code. This is a bit tricky because you really need to review your code and you'll end up with a very long header if you got code from third parties and not internal, but it's doable.

The basic code without Content-Security-Policy can look like this in your .htaccess:

<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
Header set X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
Header set Strict-Transport-Security "max-age=31536000; includeSubdomains"
</IfModule>

Also using mod_rewrite you can set additional restrictions on very specific strings which will help if you don't set a Content-Security-Policy:

RewriteEngine On
RewriteCond %{QUERY_STRING} base64_encode.*$.*$ [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index_error.php [F,L]
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

You can replace index_error.php to whatever error page you wish the use.

Hope it helps :D

PornDiscounts-V

10-17-2016 12:33 PM

His problem isn't xss. It is that he got hacked and they dropped shells all over his server.

lakerslive

10-17-2016 12:37 PM

not just 1 server, 2 different servers.. they not even linked to each other. I am not a server literate type guy.

I know some whm things... installing wp, customizing it, i knowledge here and there. But i have server knowledge of a 10 year old

just a punk

10-17-2016 12:42 PM

Quote:

Originally Posted by vvvvv (Post 21228502)

His problem isn't xss. It is that he got hacked and they dropped shells all over his server.

In this case the suggestion is as simply as this: don't download any themes/plugins from the unknown sources. According to the recent reports, over 90% of all that nulled/hacked shit floating online is stuffed with built-in backdoors.

lakerslive

10-17-2016 12:42 PM

just found out my server software is not upto date since i moved with liquidweb a month ago, when i first started them , there wasnt many xss injections, but a month later, they all started showing up,

lakerslive

10-17-2016 12:43 PM

i only use plugins from wordpress admin.. =(

just a punk

10-17-2016 12:46 PM

Quote:

Originally Posted by lakerslive (Post 21228556)

i only use plugins from wordpress admin.. =(

From what? :eek7 You have to download them from wordpress.org (not every plugin is seriously tested even there) and from the trusted 3rd-party sources only.

Sarn	10-17-2016 01:06 PM

Quote:

Originally Posted by CyberSEO (Post 21228490)

а ты еще и буйный дурачек :1orglaugh И проблема не в языке а в твоей тупости.
что я делаю на форуме тебя вообще не должно ебать, понимаешь?
Любое решение проблем с безопастностью начинается с диагностики и чтения логов, чтобы из за пары идиотов не переделывать работу дважды а то и больше. Поэтому вешаешь плагин носкрипт лазишь по сайту и смотришь откуда у тя xss - далее читаешь логи и смотришь куда что залили. Далее фильтруешь в коде баги.

just a punk

10-17-2016 01:14 PM

Quote:

Originally Posted by Sarn (Post 21228607)

что я делаю на форуме тебя вообще не должно ебать, понимаешь?

Да мне насрать. Тут и без тебя дураков хватет. Одним - больше, одним - меньше.

Quote:

Originally Posted by Sarn (Post 21228607)

Любое решение проблем с безопастностью начинается с диагностики и чтения логов, чтобы из за пары идиотов не переделывать работу дважды а то и больше.

А, ну да, ну да... Стандартный анализ на XSS уязвимость это ж ни о чем, да? ;)

Quote:

Originally Posted by Sarn (Post 21228607)

вешаешь плагин носкрипт

hdbuilder

10-17-2016 08:16 PM

If both of your servers are hacked your home PC is probably the source, run ComboFix on it, then change all servers panel, FTP, root... passwords, then you can clean your servers

Venum

10-17-2016 09:36 PM

Serve cached pages. Use nginx as a proxy cache to the front of the web, and keep infra behind proxy.

The Porn Nerd

10-17-2016 09:54 PM

This thread is filled with nerds. LOL

EvgenUA

10-18-2016 07:26 AM

and russian hackers

Coup	10-18-2016 08:45 AM

OP I would suggest that you search for the names of the plugins and themes that you use here:

https://wpvulndb.com/plugins
https://wpvulndb.com/themes

Remove any that you find listed. You're likely using one or more that is a security vulnerability.

xXXtesy10

10-18-2016 08:59 AM

cyberseo trash garbage junk shit

just a punk

10-18-2016 09:03 AM

Quote:

Originally Posted by xXXtesy10 (Post 21230452)

cyberseo trash garbage junk shit

Put that slogan into your signature and link it to my site. I will give you $10, which is enough to feed up all your village :winkwink:

Sarn	10-18-2016 09:47 AM

Quote:

Originally Posted by EvgenUA (Post 21230275)

and russian hackers

white hat. because who has not cracked the can not protect.
but if Putin asked:1orglaugh

PS:restrict access to the admin panel wordpress only with your ip, even if you lose all your password all be safe. but it is better to detect and Fix xss in php code

.htaccess
<Files "wp-login.php">
Order deny,allow
Deny from All
Allow from 8.8.8.8
</Files>

8.8.8.8 - you static ip

All times are GMT -7. The time now is 08:57 PM.