Content: WordPress 3 Ultimate Security
WordPress 3 Ultimate Security
Credits
About the Author
Acknowledgement
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers and more
Why Subscribe?
Free Access for Packt account holders
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the example code
Errata
Piracy
Questions
1. So What's the Risk?
Calculated risk
An overview of our risk
Meet the hackers
White hat
Black hat
Botnets
Cybercriminals
Hacktivists
Scrapers. Script kiddiesSpammers
Misfits
Grey hat
Hackers and crackers
Physically hacked off
Social engineering
Phone calls
Walk-ins
Enticing URLs
Phishing
Social networking (and so on)
Protecting against social engineering
Weighing up Windows, Linux, and Mac OS X
The deny-by-default permission model
The open source advantage
System security summary
Malwares dissected
Blended threats
Crimeware
Data loggers
At loggerheads with the loggers
Hoax virus
Rootkits
Spyware
Trojan horses
Viruses
Worms
Zero day
World wide worry
Old browser (and other app) versions. Unencrypted trafficDodgy sites, social engineering, and phish food
Infected public PCs
Sniffing out problems with wireless
Wireless hotspots
Evil twins
Ground zero
Overall risk to the site and server
Physical server vulnerabilities
Open ports with vulnerable services
Access and authentication issues
Buffer overflow attacks
Intercepting data with man-in-the-middle attacks
Cracking authentication with password attacks
The many dangers of cross-site scripting (XSS)
Assorted threats with cross-site request forgery (CSRF)
Accessible round-up
Lazy site and server administration. Vulnerable versionsRedundant files
Privilege escalation and jailbreak opportunities
Unchecked information leak
Directory traversal attacks
Content theft, SEO pillaging, and spam defacement
Scraping and media hotlinking
Damn spam, rants, and heart attacks
Summary
2. Hack or Be Hacked
Introducing the hacker's methodology
Reconnaissance
Scanning
Gain access
Secure access
Cover tracks
Ethical hacking vs. doing time
The reconnaissance phase
What to look for
How to look for it
Google hacking
Sites and links
Finding files
Keyword scanning
Phone numbers
More on Google hacking. Scouting-assistive applicationsHacking Google hacking with SiteDigger
WHOIS whacking
Demystifying DNS
Resolving a web address
Domain name security
The scanning phase
Mapping out the network
Nmap: the Network Mapper
Using ping sweeps to map out a network
Checking for open ports on a network device
Checking for vulnerable services on a network device
Secondary scanners
Scanning for server vulnerabilities
Nessus
Creating policies with Nessus
Assessing problems
OpenVAS
GFI Languard
Qualys
NeXpose and Metasploit
Scanning for web vulnerabilities
Wikto
Paros Proxy
HackerTarget.