Year: 2021

wp_create_nonce does not secure you against CSRF or XSRF

Author wefightforsecurityPosted on March 31, 2021March 31, 2021Categories csrf, wordpress functions security, wp securityTags , , , , , , ,

What is wp_create_nonce and what is it for?

wp_create_nonce is a function for theme and plugin developers using WordPress. The majority of developers understandably believe this secures their forms from cross site request forgery, unfortunately it doesn’t. WordPress is great at making functions for developers that any reasonable person would believe has security built-in. When it comes to WordPress that isn’t the case.

How do I secure forms from hackers?

wp_create_nonce is a good starting point, but you have to use wp_verify nonce, to validate that the form protection against CSRF will actually work. If you just do wp_create_nonce, it is like putting a lock on a door, with tape, that anyone can remove. When you use wp_verify_nonce in your code, it is like properly securing the lock, which should’ve happened in the first place.

Why should my forms be secure against CSRF & hackers?

Forms interact with the users database, and many admin forms don’t prevent from malicious content being submitted. So, an attacker could inject their own malicious code, damage your site, or do anything they want as that user.

Now I can hear you rolling your eyes and saying CSRF isn’t a problem, because it requires a logged in developer to go to a malicious site. That isn’t true, yes, it requires a logged in developer going to a site, but it doesn’t have to be one that is inherently malicious. Also, interaction isn’t required, if you properly automate things. Their site can be attacked while they look at a picture or play a game. It is deceptively easy to misuse insecure forms. While CSRF isn’t as bad as sql injections or how most developers use is_admin(), it certainly needs to be secured.

In conclusion, secure all your code.

What is a SQL Injection? Is My Site safe?

Author wefightforsecurityPosted on March 31, 2021March 31, 2021Categories sql injections

What is a SQL injection?

A sql injection put simply is when someone injects their own code or information into your site or apps database. The way this happens is usually due to a vulnerable piece of code that didn’t put in security measures around the interaction allowed with the database.

What is a database?

A database stores everything you write, all your images, everything. Personal information including usernames, and any personally identifying information is stored there.

How do I know if my site can be hacked with a sql injection?

If you aren’t a developer and don’t know how to read code, the short answer is you don’t know. Many developers tell you everything is secure, when it certainly most isn’t. 3rd party companies like ourselves are able to check the security of your site for you and coordinate with the developers to make it more secure.

Do sql injections cause bad publicity or put companies out of business?

Yes, they do. Whenever you hear a company has been breached and the database has been compromised, that most likely was a sql injection. While there are other ways to get into the database, a persistent xss, a sql injection is very common and quite often the culprit.

WordPress is_admin unsafe & On Your Site

Author wefightforsecurityPosted on March 30, 2021March 31, 2021Categories wp security

What is WordPress is_admin and how is it on my site?

is_admin is a WordPress function used for plugins and themes, which developers misunderstand. The WordPress function is_admin sounds like code that would make sure the user is an admin, but that isn’t the case. Instead is_admin() checks to see if you’re on an administrator page. Unfortunately, WordPress designed some administrator pages, that anyone can access without being logged in. This makes is_admin useless as a security measure, which they note on the documentation page.

How is it on my WordPress site? Is this a WordPress vulnerability?

The majority of plugins developers don’t understand exactly how is_admin works, so your site is extremely likely to be unsafe. Is it a WordPress vulnerability? Yes! WordPress invented is_admin as a function for themes and plugins, despite warnings from the community, that this would confuse developers. They didn’t care or try to patch it. A vulnerability is a weakness, so by that definition, yes, WordPress created a weakness that impacts most sites. It’s worth noting that WordPress thought putting in the documentation that it is insecure was a good enough safety measure, unfortunately that isn’t the case.

How can WordPress plugin and theme developers make things only for admins?

Our favorite method to secure WordPress administrator only code is using WordPress roles and capabilites. Roles and capabilities breaks down who and what can access certain areas. Our favorite function for security is current_user_can. One capability exclusive only to admins is manage_options. If you write if(current_user_can(“manage_options”) ) this means only the admin can access that code.

If you want to write as bullet-proof code as possible, we have even stronger versions that you can write listed below.

if(current_user_can(“manage_options”) && is_user_logged_in() )

// write your code here

We handle people who don’t fit the code snippet by using the exclamation mark. In PHP the exclamation mark means “not”. So, if(!current_user_can(“manage_options”) && !is_user_logged_in() ) then you can assign a different level of access for users who aren’t admins and aren’t logged in. You can tell people to leave, after the if statement just write die(“You don’t have access to this area.”);

Now if you want a different level of access for logged in users, who aren’t admins, you write if(!current_user_can(“manage_options”) && is_user_logged_in() ) . So now they are logged in and not an admin.

What if I adopted an old plugin that uses is_admin and I don’t want to re-write the entire thing?

You can write code to fix this, you simply put if(current_user_can(“manage_options”) && is_admin() ) and now only admins can access it. This can have a negative impact on users if it used to allow users to access an administrator page.

Does this mean never to use is_admin()?

is_admin can be used to say this is an administrator page, but as long as you don’t put security measures listed above, you’re risking a security breach. Some argue, accurately that is_admin is safe if you only write certain code that no one can engage with. The problem with this argument is that the majority of people do not know what people can and can not interact with, so the best technique is to always secure anything admin side.

In conclusion, it is better to use the best security methods always, because you never know when your code will change years down the road or if it is already vulnerable.

Beginners Advice for Cryptocurrency, Bitcoin & Doge

Author wefightforsecurityPosted on March 15, 2021March 15, 2021Categories Uncategorized

Written by Luciolle24, edited by Planet Zuda Staff

My First experience with Cryptocurrency, bitcoin and doge

So… Today we’re gonna talk about my experience as a new user to crypto.
Last time, after I did a job writing about cryptocurrency, I was paid in a new crypto currency called DOGE. It was my first experience with crypto. I recommend you take some time off to set up everything correctly, which I, of course, did not. It came back to bite me later, I figured out many things I could have figured out before.

During the first few days I just watched the amount of money from DOGE slowly go up until I made a few bucks. I waited for the perfect time and sold my DOGE for profit. That’s when the first beginner problem rose: what to do with the money ? I couldn’t easily withdraw it because I sold in USD (not my country’s currency). I bought some other crypto currency, mainly BTC, ETH and a few esoteric ones. That’s when I realized that crypto currency, especially as a beginner requires something : Time! Which I didn’t have a lot of.

As a new user I had no clue how the market worked and found myself really scared of losing everything. I was changing cryptocurrency often, which was scary as the price could fall. All while attempting to predict a market I had no clue about. I feel like that was my second mistake : I went into crypto with little to no knowledge on the subject. Now feel like I know more than most. I probably lost a lot by doing stupid rookie mistakes.

My advice to newcomers to cryptocurrency whether it be dogecoin or anything else?

  • Do your research!!! (don’t jump in with no clue about the value of certain coins…)
  • Don’t always go for the big coins : Some small, not so well-known coins can also win you money.
  • Only use money you won’t need because It’s really hard to withdraw. You can lose everything if you’re not careful.
  • Do your best and if it feels to stressful take a break, loosing 0.00001 dollars isn’t going to kill you.
  • Don’t aim for huge rewards, you’re not a professional, aim for a little profit and build up from there.

In the end I think using cryptocurrency is a good alternative to PayPal and Cashapp, you just have to have enough time, live in the USA and do your research. Editors note: Living in the USA is not required for use of cryptocurrency or dogecoin, but with some exchanges it is easier.

Have a good day and trade well!

What Are NFTS & How They Work For Artists

Author wefightforsecurityPosted on March 9, 2021March 9, 2021Categories Uncategorized

Written by Planet Zuda Staff and Luciolle24

NFT art public domain wikipedia

Non fungible tokens, also known as NFTs have exploded in popularity recently. The Covid pandemic has lead to artists trying to find new ways to make money and NFTS provide them with the creative outlet they need.

How do NFTS help artists make money?

Artists can sell original prints or copies of their art and digital art to people who are buying. They can list it on opensea.io or rarible.com, among many other sites. Our founder decided to experiment with rarible.com and put up some of his art, but sadly discovered it was pretty expensive (around $100 USD per piece of art uploaded), so only two pieces of art were uploaded as an experiment to Rarible.

When our founder wrote about this on twitter, his friend Alon Goren, who’s been working at Goren Draper And Holmes, decided to teach him how to use openminter with tezos, we will of course pass that knowledge on to you.

We are going to find out the cheapest way to upload your NFT art so you can make money during the pandemic and afterwards.

What does a NFT do for my art exactly?

NFT’s are a form of smart contracts for the block chain, which shows without a shadow of a doubt, that you purchased or uploaded that piece of art. This would help enforce your rights for that piece of art, you are also the ONLY one who gets any additional offerings that creators offer, like our founder offers animation for one piece.

What collector sites will be going to NFT?

It is rumored that Quidd will soon be moving to NFT’s in the near future for their digital collectible marvel cards, basketball cards, and a lot more awesomeness. Which our owner and our assistant writer are also experimenting with…

What is great about Quidd is as of the moment this was written you can still get free cards and cards for coins, the game in-app currency (you can earn that currency by watching ads or completing offers), which you can then sell for real money. That’s right, get free stuff, make real money. It is that simple.

NFTS Just Says I Own Something?

When you get down to the nitty gritty of it, yeah that is the simple answer. It links you to what you purchased and that token, so you own that non fungible token, which is linked to whatever you purchased.

We will continue updating this article with more info on NFTS, keep up-to-date with this article.