اتک از سایت های هک شده وردپرسی

[jahromweb]

بله, ما چند روز پیش یکی از مشتریهامون دچار این حمله شده بود,

بررسی کردیم و مثل این دوستمون متعجب شده بودیم!! بعد از بررسی دقیق تر مشاهده شدیم متاسفانه یک باگ بسیار ساده! که برای Ping back گرفتن در وردپرس استفاده شده بود این اجازه رو میده که به وب سایت هدف درخواست ارسال کنه!
احتمالا هکر یه مجموعه بزرگی از این سایت ها رو پیدا کرده( که البته نباید کار سختی باشه)!!
توی گوگل عبارت
WordPress XML-RPC Pingback DDoS Attack جستجو کنید تا به نتایج بیشتری برسید.

باسلام
راه حل برای رفع ارایه میدهید؟
یا لینک درصورت امکان.
باتشکر

[yastheme]

باسلام
راه حل برای رفع ارایه میدهید؟
یا لینک درصورت امکان.
باتشکر

راه حل این متود بسیار ساده است

http://www.ddos-guard.ir/%D8%A7%D9%8...7%D9%88%D9%84/

[jahromweb]

راه حل این متود بسیار ساده است

http://www.ddos-guard.ir/%D8%A7%D9%8...7%D9%88%D9%84/

باتشکر
برای جلوگیری از این که این حملات توسط سایت های روی سرور ایجاد نشود چه راه حلی است؟

[Ashkankamangar.ir]

Test Yourself

You can test to see if your site was used in the WordPress Pingback Botnet by using Sucuri’s WordPress DDoS scanner. This is what I got back:

Protect Yourself

Sucuri posted a code snippet which will get you out of the woods:
add_filter( ‘xmlrpc_methods’, function( $methods ) { unset( $methods['pingback.ping'] ); return $methods; } );

1 2 3 4

add_filter( ‘xmlrpc_methods’, function( $methods ) { unset( $methods['pingback.ping'] ); return $methods; } );

And then Jeff, over at the Tavern, cleaned it up a bit to make it work with more versions of PHP.
But I was still not happy.
This bit of code is too important to be part of your functions.php file! When you change themes at some point in the future, you can unknowingly open yourself up to become part of the next WordPress Pingback DDoS Botnet.
So I created a simple little plugin with this same code and posted the code on GitHub. It is also available on the WordPress.org plugin repo : Remove XMLRPC Pingback Ping.
Download the zip of the plugin now and activate it.
Test Yourself Again!

If you are paranoid like me, I wanted to make absolutely sure that even after I activated my Remove XMLRPC Pingback plugin, that I was protected. So after a little digging, I managed to figure out how to test my site.
Follow these steps and replace http://YOUR-SITE-URL.com with the URL of your site:

1. Install the Chrome extension PostMan
   
2. As your request URL, enter http://YOUR-SITE-URL.com/xmlrpc.php
   
3. Make sure you are doing a POST
   
4. Set your request body to be RAW with the following content:
   <methodCall>
   <methodName>pingback.ping</methodName>
   <params>
   <param><value><string>http://YOUR-SITE-URL.com</string></value></param>
   <param><value><string>http://YOUR-SITE-URL.com/hello-world/</string></value></param>
   </params>
   </methodCall>
   
5. Make sure the second param is a valid blog post URL that exists in your WordPress site
   
6. Send the request!

If you get back a response saying the pingback from http://YOUR-SITE-URL.com to http://YOUR-SITE-URL.com/hello-world/ was registered, then your site is wide open. Here is a screenshot from POSTMAN:

After activating this plugin, sending through the same request as above should result in an error response from the website server error. requested method pingback.ping does not exist., as seen in this screenshot: