Test Yourself
You can test to see if your site was used in the WordPress Pingback Botnet by using
Sucuri’s WordPress DDoS scanner. This is what I got back:
Protect Yourself
Sucuri posted a code snippet which will get you out of the woods:
add_filter( ‘xmlrpc_methods’, function( $methods ) { unset( $methods['pingback.ping'] ); return $methods; } );
1
2
3
4 |
add_filter( ‘xmlrpc_methods’, function( $methods ) {
unset( $methods['pingback.ping'] );
return $methods;
} ); |
And then Jeff,
over at the Tavern, cleaned it up a bit to make it work with more versions of PHP.
But I was still not happy.
This bit of code is too important to be part of your functions.php file! When you change themes at some point in the future, you can unknowingly open yourself up to become part of the next WordPress Pingback DDoS Botnet.
So I created a simple little plugin with this same code and
posted the code on GitHub. It is also available on the WordPress.org plugin repo :
Remove XMLRPC Pingback Ping.
Download the zip of the plugin now and activate it.
Test Yourself Again!
If you are paranoid like me, I wanted to make absolutely sure that even after I activated my
Remove XMLRPC Pingback plugin, that I was protected. So after a little digging, I managed to figure out how to test my site.
Follow these steps and replace
http://YOUR-SITE-URL.com with the URL of your site:
- Install the Chrome extension PostMan
- As your request URL, enter http://YOUR-SITE-URL.com/xmlrpc.php
- Make sure you are doing a POST
- Set your request body to be RAW with the following content:
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value><string>http://YOUR-SITE-URL.com</string></value></param>
<param><value><string>http://YOUR-SITE-URL.com/hello-world/</string></value></param>
</params>
</methodCall>
- Make sure the second param is a valid blog post URL that exists in your WordPress site
- Send the request!
If you get back a response saying the pingback from
http://YOUR-SITE-URL.com to
http://YOUR-SITE-URL.com/hello-world/ was registered, then your site is wide open. Here is a screenshot from POSTMAN:
After activating this plugin, sending through the same request as above should result in an error response from the website server error. requested method pingback.ping does not exist., as seen in this screenshot:
اتک از سایت های هک شده وردپرسی
پاسخ با نقل قول
نوشته اصلی توسط yastheme
