wp-scanner online v1.2 released
64 Blogs have been tested since wp-scanner v1.1 was launched a couple days ago with half of them having severe flaws; however, v1.1 was more of a pilot really and was not very user friendly. v1.2 includes some initial warnings as well as links to helpful articles, it also includes 15 new plugin checks as well as some bug fixes.
Below are some screenshots of a test against one of our demo WordPress installs:
Enjoy!
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
Matt, we are only just getting warmed up; we’ll work out the quirks as we go; however, You are the only one using the latest trunk thus far, hence the bug.
Thanks for your feedback.
No matter which address I enter, I only get the error message:
Invalid address.
I tried two different browsers. Any ideas what I could have done wrong?
ChristianS,
There are restrictions on what the address can look like and what characters are supported.
If you send me the address you are trying to scan via the Contact form, I’ll have a look for you.
[...] das Blog auf potentielle Sicherheitslücken (siehe auch Screenshot 1 und Screenshot 2). (via BlogSecurity | [...]
WP Scanner online…
Um die Sicherheit seiner Wordpress Installation/Blogs zu testen, bietet BlogSecurity einen Online WP-Scanner an. Um keine böse Überraschungen zur erleben, nutzt diesen Scanner Leute und testet eure WP Blogs.
(Via: bueltge.de | SW-Guide | BlogSecurit…
Seams to be very cool staff.
I´m interested in the automatic test of XSS vulnerabilities? What do you test, only the search form or also URL manipulation?
Regards
H. Lennarz
Hendrik,
I based the concept around a paper I released on GNUCITIZEN titled generic XSS worms.
In short, we basically attack generic vulnerabilities in PHP’s environment variables (i.e. PHPSELF). We don’t do any URL manipulation.. we may in future releases, although this might be out of the scope of what we are trying to achieve.
Thanks for your feedback, its the first in over 300 blogs tested so far :)
[...] BlogSecurity wurde ein neuer Scanner in Version 1.2b veröffentlicht. Es handelt sich dabei um ein [...]
doesnt help me a lot. it suggests updating to the latest WP version, but I WONT do that, because I dont like some stuff WP 2.2+ does different from 2.0.x.
a better way to help me would be to point out possible security flaws in this version so I’m able to fix it myself.
cu, w0lf.
fwolf, wp-2.0.10 is the latest stable release for 2.0.x trunk, wp-scanner just doesn’t identify this as yet. I think you’ll be just fine if you maintain the latest release within the 2.0.x trunk.
It is not entirely accurate. I tested my blog and it said it was vulnerable, even though it’s running the latest trunk and is not.