Security for other Platforms

We are working on other Platforms for bringing maximum security on any website!

Actually, we have 3 main work in progress...

• WordPress
• Drupal
• Joomla!

---

WordPress

Results

We have secured WordPress 2.0 installation, we have tested the code below on the setup explained.

You can test it in different setup that fit your environment.

As expected, the code block all attacks (Subgraph Vega and OWASP Zap as test suites)

You may found false positives, test the alerts you find before modify the code.

Obviously, if you find a security concern either with the code, let us know!

The results can be different on different environments, because you may have an hardware firewall that block malformed requests.

Let us know about everything!

Unify The Web!

---

For WordPress Installation, we are preparing an installation of XAMPP with this procedure:

• An installation of Xampp (5.5 Windows Version)
• In Xampp we are installing a vanilla WordPress installation (2.0 version)
• After WordPress is downloaded, we are applying "security code":
• $_REQUEST = preg_replace("/[^a-zA-Z0-9_ +!#$%&'*=?^`{|}~.@€,]/", "", $_REQUEST); $_REQUEST = str_ireplace("char", "", $_REQUEST); $_REQUEST = str_ireplace("alter", "", $_REQUEST); $_REQUEST = str_ireplace("begin", "", $_REQUEST); $_REQUEST = str_ireplace("cast", "", $_REQUEST); $_REQUEST = str_ireplace("create", "", $_REQUEST); $_REQUEST = str_ireplace("cursor", "", $_REQUEST); $_REQUEST = str_ireplace("declare", "", $_REQUEST); $_REQUEST = str_ireplace("delete", "", $_REQUEST); $_REQUEST = str_ireplace("drop", "", $_REQUEST); $_REQUEST = str_ireplace("end", "", $_REQUEST); $_REQUEST = str_ireplace("exec", "", $_REQUEST); $_REQUEST = str_ireplace("fetch", "", $_REQUEST); $_REQUEST = str_ireplace("insert", "", $_REQUEST); $_REQUEST = str_ireplace("kill", "", $_REQUEST); $_REQUEST = str_ireplace("open", "", $_REQUEST); $_REQUEST = str_ireplace("select", "", $_REQUEST); $_REQUEST = str_ireplace("sys", "", $_REQUEST); $_REQUEST = str_ireplace("table", "", $_REQUEST); $_REQUEST = str_ireplace("update", "", $_REQUEST); $_REQUEST = str_ireplace("query", "", $_REQUEST); $_GET = preg_replace("/[^a-zA-Z0-9_ +!#$%&'*=?^`{|}~.@€,]/", "", $_GET); $_GET = str_ireplace("char", "", $_GET); $_GET = str_ireplace("alter", "", $_GET); $_GET = str_ireplace("begin", "", $_GET); $_GET = str_ireplace("cast", "", $_GET); $_GET = str_ireplace("create", "", $_GET); $_GET = str_ireplace("cursor", "", $_GET); $_GET = str_ireplace("declare", "", $_GET); $_GET = str_ireplace("delete", "", $_GET); $_GET = str_ireplace("drop", "", $_GET); $_GET = str_ireplace("end", "", $_GET); $_GET = str_ireplace("exec", "", $_GET); $_GET = str_ireplace("fetch", "", $_GET); $_GET = str_ireplace("insert", "", $_GET); $_GET = str_ireplace("kill", "", $_GET); $_GET = str_ireplace("open", "", $_GET); $_GET = str_ireplace("select", "", $_GET); $_GET = str_ireplace("sys", "", $_GET); $_GET = str_ireplace("table", "", $_GET); $_GET = str_ireplace("update", "", $_GET); $_GET = str_ireplace("query", "", $_GET); $_POST = preg_replace("/[^a-zA-Z0-9_ +!#$%&'*=?^`{|}~.@€,]/", "", $_POST); $_POST = str_ireplace("char", "", $_POST); $_POST = str_ireplace("alter", "", $_POST); $_POST = str_ireplace("begin", "", $_POST); $_POST = str_ireplace("cast", "", $_POST); $_POST = str_ireplace("create", "", $_POST); $_POST = str_ireplace("cursor", "", $_POST); $_POST = str_ireplace("declare", "", $_POST); $_POST = str_ireplace("delete", "", $_POST); $_POST = str_ireplace("drop", "", $_POST); $_POST = str_ireplace("end", "", $_POST); $_POST = str_ireplace("exec", "", $_POST); $_POST = str_ireplace("fetch", "", $_POST); $_POST = str_ireplace("insert", "", $_POST); $_POST = str_ireplace("kill", "", $_POST); $_POST = str_ireplace("open", "", $_POST); $_POST = str_ireplace("select", "", $_POST); $_POST = str_ireplace("sys", "", $_POST); $_POST = str_ireplace("table", "", $_POST); $_POST = str_ireplace("update", "", $_POST); $_POST = str_ireplace("query", "", $_POST);
• After "security code" is applied, then we are installing WordPress.
• If software mantains all functionalities without break, then we are publishing here.
• If you have security concern about our work, you can test it in a virtual machine.
• Because you may have another webserver installed on your machine, we are deploying the Xampp installation with the ports:
• MySQL: 3306
• HTTP: 3307
• HTTPS: 3308
• Let us know every improvement, suggestion, critic or fix about this procedure and if it works for you!

Coming soon we will publish the procedure for Drupal and Joomla!

Unify The Web!