Babiato Resources getting hacked or malicious codes? Do THESE NOW!

[Escanor64]

Hi @Escanor64, thank you for pointing us in the right direction.
If it's not too much trouble, would you kindly share the links to the plugins you found?

Many Thanx

Yeah, will do. I actually realized that some of the plugins are not exactly ideal as they block some important parts of your website's functionality. I should create another thread with a proper walkthrough today.

 

[Escanor64]

All Security plugins are USELESSSSS, depending on who is targeting you.. Yea that's right!
Learn how to use Cloudflare to protect your website and sleep with your 2 eyes closed

All of my site's are routed through Cloudflare. I still didn't prevent them from getting hacked.

 

[RoninHood]

All of my site's are routed through Cloudflare. I still didn't prevent them from getting hacked.

You need to bind your VPS to Cloudflare through IPTables rules by creating a rules set for a tunnel, this way crawlers like censys.io etc aren't able to see your real IP address in very first place!

BTW I've nulled WP Hide Security Enhancer Pro v4.4 a few minutes ago for those who use it: https://babia.to/threads/wp-hide-security-enhancer-pro.13969/post-1055750

 

[Escanor64]

You need to bind your VPS to Cloudflare through IPTables rules by creating a rules set for a tunnel, this way crawlers like censys.io etc aren't able to see your real IP address in very first place!

BTW I've nulled WP Hide Security Enhancer Pro v4.4 a few minutes ago for those who use it: https://babia.to/threads/wp-hide-security-enhancer-pro.13969/post-1055750

Sweet! Thanks. I'll have a look at this later and try to implement this.

 

[RoninHood]

All Security plugins are USELESSSSS, depending on who is targeting you.. Yea that's right!
Learn how to use Cloudflare to protect your website and sleep with your 2 eyes closed

Not properly so, what about HTTP Request Smuggling attacks? Plugins are useful, a good web server configuration following proper hardening best practices even more (i.e. IPTabes Rules, Strict CSP, etc.), especially while using HTTP/3 QUIC.

 

[corimba7]

 

[icebear]

Thank you for the post!

 

[thambyz]

What the purpose of xmlrc file? Can you please share how did you delete that file?

I use apache include file to block at server level, so xmlrpc will be blocked in all sites.

<Files xmlrpc.php>
Order allow,deny
Allow from 192.0.64.1/192.0.127.254
Deny from all
Satisfy All
ErrorDocument 403 http://127.0.0.1/
</Files>

The allowed IP addresses are related to Jetpack plugin.

 

[xLab]

I always scan the files in virus total after downloading from here.

Bro,
Are you working in the NSA?

 

[bluvia]

Actually I have installed wordfence and until now I didnt face any issue .

 

[3xploit]

All of my site's are routed through Cloudflare. I still didn't prevent them from getting hacked.

check your dns zone, set up properly

intoDNS: checks DNS and mail servers health

intoDNS checks the health and configuration of DNS and mail servers.

intodns.com

 

[RoninHood]

All of my site's are routed through Cloudflare. I still didn't prevent them from getting hacked.

And if you need the perfect scanner to check the security of your website, use Sudomy: https://github.com/screetsec/Sudomy - it uses many services like the following:

https://censys.io
https://developer.shodan.io
https://dns.bufferover.run
https://index.commoncrawl.org
https://riddler.io
https://api.certspotter.com
https://api.hackertarget.com
https://api.threatminer.org
https://community.riskiq.com
https://crt.sh
https://dnsdumpster.com
https://docs.binaryedge.io
https://securitytrails.com
https://graph.facebook.com
https://otx.alienvault.com
https://rapiddns.io
https://spyse.com
https://urlscan.io
https://www.dnsdb.info
https://www.virustotal.com
https://threatcrowd.org
https://web.archive.org

It works directly from your CLI, it provides you with a list of Matches found after each scan in order to patch them, it's open-source and well documented!

Additionally, if you use WordPress, you can check for vulnerabilities to patch using one of this tools:

• WPScan (CLI Tool)
• WPSec (SaaS with Free Tier for your own website)

Enjoy