Flagged by Fortinet’s: http://urlquery.net/report.php?id=1496865669555
Sucuri’s gives 54 instances as potentially suspicious, because
Severity: Potentially Suspiciouskicking up such errors as
Reason: Detected procedure that is commonly used in suspicious activity.
Details: Too low entropy detected in string [[‘a[href*=“.jpg”],a[href*=“.jpeg”],a[href*=“.jpe”],a[href*=“.jfif”],a[href*=“.gif”],a[href*=“.png”],a[’]] of length 326 which may point to obfuscation or shellcode.
error: line:3: SyntaxError: missing ; before statement:This is caused by javascript not being wrapped up inside a XML document properly or empty script for Lightbox on Word Press.
error: line:3: { a.inArray(a(this).attr(“rel”),b) === -1%26%26b.push(a(this).attr(“rel”)) } ); a.each(b,function(b,c) { a(‘[rel="’+c+‘"]’).iLightBox(d) } ); a(‘a[href*=“youtu.be/”],a[href*=“youtube.com/watch”],a[h
error: line:3: …^
error: line:3: SyntaxError: missing } in XML expression:
error: line:3: olbar:1,fullAlone:0,social: { start:0 } }; (b.parents(’.gallery’).length || b.parents(‘.tiled-gallery’).length || b.parents(‘.ngg-galleryoverview’).length)||b.iLightBox(c) } ); var b=,d= { skin:‘smooth’,innerToolbar:1,fullAlone:0,social: { st
error: line:3: …
Info Credits go to StackOverflow’s T.J. Crowder.
See: https://www.virustotal.com/pl/url/c11ae783a87751c50c94a66020f19da5b7cdca01a30be2cb26cf96203f0fd6bf/analysis/1496868234/
but an expected error on the response…
Given the all green here: https://sitecheck.sucuri.net/results/ghost1227.com#sitecheck-details
Re: http://retire.insecurity.today/#!/scan/76dafa530027d7f0370f3be67a4786d702eff8c867b7b82e14382911b8d30854
1 vulnerable library detected:
Issues with WordPress plug-ins: fantazy-sidebar 1.5.0 latest release (1.5.2) Update required
http://jakiboy.github.io/
easy-profile-widget 1.0 latest release (1.3) Update required
https://wordpress.org/plugins/easy-profile-widget
widget-options 1.0 latest release (3.3.1) Update required
https://widget-options.com/
Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.
ID User Login
1 Dan Griffiths dgriffiths
2 None
It is recommended to rename the admin user account to reduce the chance of brute force attacks occurring. As this will reduce the chance of automated password attackers gaining access. However it is important to understand that if the author archives are enabled it is usually possible to enumerate all users within a WordPress installation.
1 issue: Stylesheets 1 issues
Tag Result
Souces and sinks here:
Re: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fghost1227.com%2Fwp-includes%2Fjs%2Fjquery%2Fjquery.js%3Fver%3D1.12.4
polonus (volunteer website security analyst and website error-hunter)