Showing posts with label wordpress. Show all posts
Showing posts with label wordpress. Show all posts
Thursday, April 6, 2017
Twitter launched official WordPress plugin
Twitter launched official WordPress plugin
The new plugin brings a plenty of features; it consequently generates Twitter Cards for your pages, empowers Twitter Analytics, embeds videos and adds a tweet button to posts in the administrator interface.
Theres a choice that permits you to change the look of embedded tweets on your site, so it coordinates your topic, alongside various features that help clients begin with Twitter advertising.
Features offered by Official Twitter Wordpress Plugin:
- Embedded Tweet - customize backgrounds and color schemes to match your sites theme
- Embedded Twitter video - showcase video uploaded to Twitter
- Tweet button - simple sharing of your sites content on Twitter
- Twitter Cards - highlight your sites content when shared on Twitter
- Twitter Analytics - track impressions and top distributors of your sites content on Twitter
- Follow button - grow your Twitter audience
- Twitter ads conversion tracking - easily track actions on your WordPress site triggered by a Twitter ad or build a custom targeting audience
Twitters new plugin is accessible now, free of charge.
Source: Twitter Official Blog
Go to link for download
Monday, March 20, 2017
An Attack Platform Infecting WordPress Sites
An Attack Platform Infecting WordPress Sites
Amid a late examination of a huge infections we found a trove of assault tools that all indicated back a solitary "meta" script. This script was just two lines in length however furnished an attacker with an intense capability. When it completely introduces itself it gives what we are alluding to as an "attack platform".
We figured out the script and uncovered that it was downloading its full source code from pastebin.com which is a webpage where anybody can post any content anonymously. The attacker had posted the source on pastebin and the script would download itself from that point and execute. The impact of this is the starting disease is just two lines in length.
The platform once completely introduced furnishes an attacker with 43 attack tools they can then download, likewise from pastebin, with a single click. The usefulness these tools give incorporates:
- Complete attack shells that let you deal with the filesystem, access the database through a very much outlined SQL client, view framework information, mass taint the framework, DoS different systems, find and contaminate all CMSs, view and oversee client accounts both on CMSs and the nearby operating framework and considerably more.
- A FTP brute force attack tools
- A Facebook brute force aggressor
- A WordPress brute force attack script
- Tools to examine for config documents or sensitive information
- Tools to download the whole webpage or parts thereof
- The capacity to examine for different attackers shells
- Tools focusing on particular CMSs that let you change their design to have your own malicious code
On account of this disease, the source has all the earmarks of being a hacking bunch in Vietnam and one individual inside of that gathering.
To give you some understanding into the effective capability that this platform gives, Wordfence have made a video show where we taint a test virtual machine with the two line meta script and utilize it to download the tools it gives.
A Demonstration of a Meta Attack Tool Targeting WordPress sites from Wordfence.
Note that we did this showing inside a clean new virtual machine and incorporated our very own couple tools to avert further contamination and information exfiltration. These incorporate forcing all system activity from this machine by means of a proxy with the goal that we can see what is arriving and leaving from this infected test machine.
As should be obvious, attackers have grown inconceivably refined techniques and tools to trade off and abuse your site. As a site proprietor your first need ought to be to keep the aggressor from picking up section to your site. Wordfences WordPress Security Learning Center is an awesome asset for you to take in more about what moves you ought to be making to ensure yourself.
Your second need ought to be to distinguish a hack as fast as could be allowed ought to one happen. This article on recognizing a hack early contains an intensive rundown of steps you can take to minimize the time from disease to disclosure. Likewise, we emphatically prescribe moving up to Wordfence Premium in the event that you havent as of now. It permits you to timetable outputs to run regularly, enhancing your chances of getting a trade off right on time.
We trust you have found this showing accommodating. If you dont mind leave your remarks beneath and make certain to impart this post to the group.
(Source: Wordfence)
Go to link for download
Wednesday, March 8, 2017
Akismet XSS Vulnerability Wordpress Security Update
Akismet XSS Vulnerability Wordpress Security Update
A scientist from Sucuri told us of a XSS vulnerability in the Akismet WordPress plugin. This bug influences all versions of the Akismet WordPress plugin since 2.5.0, however we have no confirmation that it has been misused in nature. A vulnerability in Akismet found a week ago and due to fact that Akismet is a standout amongst the most broadly utilized plugins for WordPress, we needed to draw it out into the open.
Akismet is a comment spam channel for WordPress and when all is said in done, it makes an awesome showing. The Akismet team reported on their web journal a week ago that a cross website scripting (XSS) vulnerability had been found in all versions of Akismet since 2.5.0.
The vulnerability permits an hacker to post a remark on a WordPress site which will execute javascript in the WordPress administrator console. This is a normal XSS vulnerability example and one of the assaults it empowers would permit an aggressor to take a WordPress heads treats and increase regulatory access to a WordPress site.
There is no proof that the vulnerability has been abused in nature. The Akismet and WordPress teams instantly took the accompanying activities:
- They released updates for every single influenced version of Akismet.
- The WordPress.org team issued an automatic upgrade of the Akismet plugin on influenced sites. In the event that you saw that your WordPress site was automatically moved up to the freshest version of Akismet, that is the reason.
- The Akismet team adjusted their API so that if a hacker did attempt to endeavor a helpless version of Akismet, their API would shut the assault by sifting through the remark the hacker attempted to post. This means when the vulnerability was found and the Akismet team rolled out this improvement, even defenseless versions of Akismet were no more exploitable.
Kudos to the Akismet team for reacting to this so quickly and completely. In case youre running Akismet, we prescribe you sign into your WordPress site and ensure that Akismet has been redesigned to the most up to date version.
To update, visit the Updates page of your WordPress dashboard and take after the instructions. In the event that you have to download the plugin compress document straightforwardly, links to all versions are accessible in the WordPress plugins directory.
Go to link for download
Subscribe to:
Posts (Atom)