security

How to Protect Uploads, if User is not Logged In?

by

Only checking if the cookie exists, is not much of a strict protection. To get a stronger protection, you can pass or “proxy” all requests to the uploaded folder (exemplary uploads in the following example) through a php script: RewriteCond %{REQUEST_FILENAME} -s RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L] All requests to uploaded files (which includes images in … Read more

Verifying that I have fully removed a WordPress hack?

by

Have you identified the exploit vector? If not, you may be leaving yourself open to future exploit. Other things to consider: Change WordPress admin user passwords – done Change Hosting account user password Change FTP passwords Change MySQL db user password – done Change the db table prefix Update your wp-config nonces/salt Check your directory/file … Read more

Hide the fact a site is using WordPress?

by

The biggest WordPress giveaways are between the <head> </head> tags. Example WordPress head content output by The Twentyten Theme and how to remove: <link rel=”profile” href=”http://gmpg.org/xfn/11″ /> Remove directly from header.php <link rel=”stylesheet” type=”text/css” media=”all” href=”http://example.com/wp-content/themes/twentyten/style.css” /> Hide WordPress by calling your stylesheet from another location and change the wp-content directory. WordPress requires your theme … Read more

Is moving wp-config outside the web root really beneficial?

by

Short answer: yes The answer to this question is yes and to say otherwise is probably irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at … Read more

How can bcrypt have built-in salts?

by

This is bcrypt: Generate a random salt. A “cost” factor has been pre-configured. Collect a password. Derive an encryption key from the password using the salt and cost factor. Use it to encrypt a well-known string. Store the cost, salt, and cipher text. Because these three elements have a known length, it’s easy to concatenate them and store them … Read more

Where does Internet Explorer store saved passwords?

by

I found the answer. IE stores passwords in two different locations based on the password type: Http-Auth: %APPDATA%\Microsoft\Credentials, in encrypted files Form-based: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2, encrypted with the url From a very good page on NirSoft.com: Starting from version 7.0 of Internet Explorer, Microsoft completely changed the way that passwords are saved. In previous versions (4.0 … Read more