JD11NL - Joomla! Security 101
•
1 gostou•742 visualizações
How secure is your Joomla! site? Are you employing the most basic security principles to protect it? Learn all about it in an easy to follow presentation suitable even for beginners.
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (15)
Último
Último (20)
JD11NL - Joomla! Security 101
- 1. Joomla! Security 101 What to do before disaster strikes http://akeeba.info/security-101 Πέμπτη, 31 Μαρτίου 2011
- 2. Hi, I’m Nicholas Dionysopoulos and I bet you can’t pronounce my last name http://akeeba.info/me Πέμπτη, 31 Μαρτίου 2011
- 3. The basics What we’re supposed to do and rarely do it Πέμπτη, 31 Μαρτίου 2011
- 4. Frequent, tested backups Would you jump off a plane without a parachute? http://akeeba.info/backup Πέμπτη, 31 Μαρτίου 2011
- 5. Update, yesterday Yesterday’s code is tomorrow’s hack http://akeeba.info/basic-security Πέμπτη, 31 Μαρτίου 2011
- 6. Protect your backend The login is not enough Πέμπτη, 31 Μαρτίου 2011
- 7. 777: The number of the beast Permissions are doors; don’t leave them open http://akeeba.info/777 Πέμπτη, 31 Μαρτίου 2011
- 8. Sensible permissions Ask your host to enable suPHP or Apache’s mod_itk Site root 0755 or 0700 Directories 0755 Files 0644 If you “must” use 0777 (don’t!) protect with .htaccess: order deny, allow deny from all Πέμπτη, 31 Μαρτίου 2011
- 9. Don’t be a sitting duck It’s duck season! Πέμπτη, 31 Μαρτίου 2011
- 10. Mind your prefix Nobody wants to be a jos_ http://akeeba.info/prefix Πέμπτη, 31 Μαρτίου 2011
- 11. 62 reasons to fire your Super Administrator or 42, depending on Joomla! version... http://akeeba.info/62-reasons Πέμπτη, 31 Μαρτίου 2011
- 12. Security Kung-Fu You can’t kill a Ninja http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 13. Visual fingerprinting Seeing is believing and then some tm pl= of fl in e p =1 t y mplate= ja_purit http://akeeba.info/ninja te Πέμπτη, 31 Μαρτίου 2011
- 14. Visual fingerprinting RewriteCond %{QU ERY_STRING} (&|% 3F){1,1}tp= [OR] RewriteCond %{QU ERY_STRING} (&|% 3F){1,1} template= [OR] RewriteCond %{QU ERY_STRING} (&|% 3F){1,1}tmpl= [NC] RewriteRule ^(.* )$ - [R=404,L] http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 15. PHP has a big mouth and that’s not water cooler gossip! http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 16. PHP has a big mouth http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 17. PHP has a big mouth http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 18. PHP has a big mouth RewriteCond %{QU ERY_STRING} ^%3F =PHPE9568F36- D428-11d2-A769-0 0AA001ACF42 [OR] RewriteCond %{QU ERY_STRING} ^%3F =PHPE9568F34- D428-11d2-A769-0 0AA001ACF42 [OR] RewriteCond %{QU ERY_STRING} ^%3F =PHPE9568F35- D428-11d2-A769-0 0AA001ACF42 [OR] RewriteCond %{QU ERY_STRING} ^ %3F=PHPB8B5F2A0- 3C92-11d3-A3A9-4 C7B08C10000 RewriteRule ^(.* )$ - [R=404,L] http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 19. Blind Elephant Meet your supervillain http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 20. Blind Elephant http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 21. Blind Elephant nicholas@teapot:~/blindelephant$ ./BlindElephant.py mysite.com joomla Loaded /home/nicholas/projects/3rdparty/blindelephant/trunk/src/build/lib.linux-x86_64-2.6/blindelephant/ dbs/joomla.pkl with 33 versions, 3696 differentiating paths, and 122 version groups. Starting BlindElephant fingerprint for version of joomla at http://joomla.ubuntu.web Hit http://joomla.ubuntu.web/media/system/js/validate.js Possible versions based on result: 1.5.17, 1.5.18 Hit http://joomla.ubuntu.web/includes/js/joomla.javascript.js Possible versions based on result: 1.5.17, 1.5.18 Hit http://joomla.ubuntu.web/media/system/js/caption.js Possible versions based on result: 1.5.17, 1.5.18 Hit http://joomla.ubuntu.web/media/system/js/openid.js Possible versions based on result: 1.5.17, 1.5.18 Hit http://joomla.ubuntu.web/templates/rhuk_milkyway/css/template.css Possible versions based on result: 1.5.17, 1.5.18 Fingerprinting resulted in: 1.5.17 1.5.18 Best Guess: 1.5.18 http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 22. Blind Elephant RewriteRule ^(im ages/stories/*. (jpe[g,2]?|jpg| png|gif|bmp|css| js|swf|htm[l]?)) $ $1 [L] RewriteCond %{RE QUEST_FILENAME} -f RewriteCond %{HT TP_REFERER} !^ht tp[s]{0,1}://(.+ .)?www.example .com [NC] RewriteRule .(j pe[g,2]?|jpg|png |gif|bmp |css|js|swf|htm[ l]?)$ - [R=404,L ] http://akeeba.info/ninja Πέμπτη, 31 Μαρτίου 2011
- 23. More protection for you e! re Master 5 € f The 1 Admin Tools .htaccess Professional http://akeeba.info/master- http://akeeba.info/atpro htaccess use coupon code JDNL11 Πέμπτη, 31 Μαρτίου 2011
- 24. That’s me... and this is the perfect time to ask me questions! Πέμπτη, 31 Μαρτίου 2011
- 25. That’s all folks! Want the slides? http://akeeba.info/security-101 Πέμπτη, 31 Μαρτίου 2011