Comments on: Exploit Scanner 0.5

By: Donncha

Donncha — Wed, 17 Feb 2010 16:35:50 +0000

Originally the plugin searched for specific strings left by hackers but it has since expanded to show a lot more functions and code that might cause problems. You can already decide what “level” of scan to do so I may just add another, “exploits” with strings found from hacks and less commonly used functions that hackers use.

That would reduce the number of false positives by a huge amount, but of course might miss out something.

By: TexInWien

TexInWien — Wed, 17 Feb 2010 15:54:20 +0000

Hi, just ran it – works well except that it seems to want to go one step too far in the scan. I got this message at the end of the scan:

Working on 1100 to 1150 of 1088 files!
Warning: in_array() [function.in-array]: Wrong datatype for second argument in /www/wp-content/plugins/exploit-scanner/exploit-scanner.php on line 439

I also still get a whole bunch of warnings. I didn’t count, but I guess I got just as many warnings as I did with the production version. I’m still not sure how useful 1400 warnings are, when the few that I analyzed seem to be false positives. I’m trying to figure out how I can actually use the results.

A thought: maybe a feature that compares separate scans would help out. I could install a clean blog and run the scan. I could save the results with a name and date.

Then I could re-run the scanner after I install new plugins or after a certain amount of time passes, saving and renaming these scans, as well. On each scan, I could choose to mark all found items as false positives. On each subsequent scan, I could choose to suppress warnings previously marked as false positives. This way, if I run the scanner regularly or after major events (upgrading WP, installing a new theme or plugin, etc.), I could see a list of only the new warnings.

Or am I simply misunderstanding the purpose of this plugin? How would you go about analyzing a report that includes 1400 warnings?

By: Donncha

Donncha — Wed, 17 Feb 2010 15:32:02 +0000

Can you try the development version off the download page? I really need feedback on that as I restructured how it scans.

While it’s scanning you can even open the exploit scanner admin page in another browser tab and see the results that have already been collected.

By: TexInWien

TexInWien — Wed, 17 Feb 2010 15:28:02 +0000

Hi Donncha,

Thanks for the update. I’d love to install and use this plugin. It seems like a great tool, but 1400 warnings with no easy way to weed out the false positives is daunting. I’m guessing (and hoping) that all 1400 are false positives. That’s about all I can do at the moment, since analyzing each and every one is out of the question — especially when multiplied by several blogs!

I’ll keep an eye on the plugin and look forward to the next update. Keep up the good work!

By: Donncha

Donncha — Tue, 16 Feb 2010 11:36:01 +0000

I’m working on paging the scan so it breaks it down into 50 files at a time rather than the whole lot. I also discovered a bug in the hashes file for 2.9.1 – there was an extra dot in front of every filename listed. Don’t know how that got through.

Paging is working well though, I just need to store the results and present them correctly now!

By: TexInWien

TexInWien — Mon, 15 Feb 2010 12:08:58 +0000

I’d like to echo Joe’s request above. Thanks for the plugin, but I have to say that the results I get from the scan using version 0.94 on my WordPress 2.9.1 blog are somewhere between difficult and impossible to interpret.

If I copy the results of the scan to a plain text file, the file is 5496 lines long. That suggests on the order of 1400 messages with one of the following severities: Blocker, Severe, Warning or Note.

I’ve searched for a guide or support that would help me weed out the false positives and determine whether I have any actual vulnerabilities that need attention, but I haven’t found anything yet.

It would take ages to manually check every warning to decide whether it’s an actual hack or not. With no additional help or resources, I have to assume that the exploit scanner is either broken or displays too many false positives to be of any actual use at this time.

By: Diego

Diego — Tue, 27 Oct 2009 23:44:22 +0000

There is any script like that standalone? or just as a plugin for wordpress?

By: Donncha

Donncha — Tue, 27 Oct 2009 13:11:02 +0000

That bas64_decode is probably ok. Download the plugin from WordPress.org again and compare with the version you have on your server.

By: Johan Wowor

Johan Wowor — Tue, 27 Oct 2009 12:59:57 +0000

More than a month, i lost my traffics till 50% (normally, 50.000 – 60.000/day). I never found any clues that my site got hacked by spam link, database exploit or something like that …
Two days ago, after i found “base64_decode” at /wp-content/plugins/wp-super-cache/wp-cache.php, i disabled wp super cache plugin .. and today, my traffic is going to normal …
I’m using VPS for my site .. at normal situation (without being banned by Google), my server always got down if I don’t use wp super cache ..

I’m in a dilemma ..

By: Joe

Joe — Sun, 25 Oct 2009 15:31:43 +0000

Is there a resource available to help with interpreting the results (forum maybe)?

It seems that the vast majority of reported issues are actually non-issue ‘heads-ups’. It is hard for me to distinguish these small warnings from actual real security breaches.

Thanks.