This document discusses hardening WordPress sites to prevent hacking. It defines hardening as securing a system to reduce vulnerabilities from illegal access. It identifies common attack vectors like XSS and SQL injection. It recommends keeping plugins updated, not using plugins from untrusted sources, and scanning sites for vulnerabilities. Quick hardening tips include restricting PHP execution in uploads, securing wp-config.php, and using security plugins. It also demonstrates how a vulnerable WordPress plugin could allow execution of system commands and obtaining a remote shell.

1. SECURITY
HARDENING
A WAY TO P R E V E N T A N D P R OT E C T Y O U R
W O R D P R E S S F R O M B A D G U Y S + H A C K I N G D E M O

2. PROFILE
Ida Bagus Budanthara
• IT Security Engineer/Analyst at Fortunato Development.
• Junior Penetration Tester at i-SIRIS.
• Member of Airavata CTF Team.
@budanthara
indonesiancyberx@gmail.com

3. WHAT IS HARDENING ?
Hardening is the process of securing a
system to reduce vulnerabilities from illegal
purposes.

4. KNOWN ATTACK VECTORS
1. XSS ( Cross-site scripting ).
2. CSRF ( Cross-site request forgery ).
3. SQL Injection.
4. RCE ( Remote Command Execution ).
5. RFI / LFI ( Remote / Local File Inclusion ).
6. Unauthenticated Access.
7. Multiple Attack Vectors.

5. WATCH YOUR PLUGINS!
Plugins are number one attack vector
being exploited by hackers.

6. Source: https://www.wordfence.com/wp-content/uploads/2016/03/hacked_website_how_compromised.png

7. VULNERABLE PLUGIN EXAMPLE

8. AVOIDING PLUGIN VULNERABILITIES
•Keep them updated.
•Don’t download any plugins from
untrusted source ( nulled source ).
•Don’t use plugins that haven’t been
updated over 5-6 months.

9. SCAN YOUR OWN SITE FROM
VULNERABILITIES!
•Use a quick penetration-testing tools called
WPScan
( https://wpscan.org/ ).
•Manual check vulnerable plugins or themes in
( https://wpvulndb.com ).

10. QUICK & SIMPLE HARDENING TIPS
• Disable any php code execution in /wp-content/uploads/
directory with .htaccess
<Files *.php> deny from all </Files>
• Change wp-config.php permission to 440 or 400 instead of
644 to prevent illegal users reading it from server.
• Use iThemes security ( https://ithemes.com/security/ ) plugin
( included anti brute-force, etc ).

11. HACKING DEMO
( FOR EDUCATIONAL PURPOSES ONLY! )

12. ATTACK SCENARIO
• A WordPress ( version 4.7.1 ) using INSERT PHP plugin to
execute a php code into the wordpress posts.
• An attacker able to execute system(), shell_exec(), exec()
php function and run ‘/bin/sh’.
• An attacker trying to exploit the website using automated
python code and load the malicious file which contains illegal
instruction by backconnecting the connection to obtain the
linux shell.

13. THANK YOU