Is this spam hack link flagged? Again WordPress insecurity at the culprit of it!

polonus · 2017-04-11T21:38:28.000Z

See: htxp://ballybagayoko.com/wp-content/cisco-6509-e-slots/

The scan found some terms that are commonly used in spam hacks. Suggest you check through the content listed out below for anything suspicious. Next, this link will do another scan with the User Agent Googlebot to check for inserted spam content.

The tool found a number of terms, casino, poker, online casino, that are common terms found in spam hacks. Check through the code listed below for the terms (should be highlighted) and make sure they are legit!
If the terms should not be there see Spm Hacks, Phrmcy, Pydy Lons, P0rn, etc. for some tips on cleaning up spam hacks .
https://aw-snap.info/articles/spam-hacks.php

And again Outdated WordPress: WordPress Version
4.7
Version does not appear to be latest 4.7.3 - update now.

Warning Directory Indexing Enabled
In the test we attempted to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is an information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

/wp-content/uploads/ enabled
/wp-content/plugins/ enabled
Directory indexing was tested on the /wp-content/uploads/ and /wp-content/plugins/ directores. Note that other directories may have this web server feature enabled, so ensure you check other folders in your installation. It is good practice to ensure directory indexing is disabled for your full WordPress installation either through the web server configuration or .htaccess.

See: https://urlscan.io/result/a01cb4f8-1612-4c9b-bdf6-97449be4f8c3#summary

Result It looks like 2 cookies are being set without the "HttpOnly" flag being set (name : value):
mediaplanBAK : R129297363
mediaplan : R3721135442
Unless the cookie legitimately needs to be read by JavaScript on the client, the “HttpOnly” flag should always be set to ensure it cannot be read by the client and used in an XSS attack. → https://webcookies.org/scan/3257789 → https://webcookies.org/cookies/ballybagayoko.com/3257789

PHP test exploit: https://gist.github.com/allyshka/14559b28993b3daec63e90335f1a7ad3 (PHP/5.6.30).

polonus (volunteer website security analyst and website error-hunter)

polonus · 2017-04-11T21:53:49.000Z

And here we see the flagged vulnerability could mean a real threat as could be followed there: -http://www.domxssscanner.com/scan?url=http%3A%2F%2Fballybagayoko.com%2Ftest.php

(That’s why I blocked links here for the unaware and ill-adviced ;)).

→ -http://wXw.topgood.xyz/March/320jc1283/goyz.php?ballybagayoko.com/test.php
Opening up to → Results from scanning URL: htxp://www.reklamamobilna.com.pl/pytania/
Number of sources found: 1
Number of sinks found: 146

Vulnerability with test.php could mean a real threat on android.

D

Announcements