Logic problems of a substation on Renren

Still all evil wordpress, although the core code security factor is very high, but the logical defects lead to brute force cracking problem domain name: http://fed.renren.com OK, can automation fuzz 1, http://ued.aili.com /? Author = * (1, 2, 3 ,...) Get the username 2, http://ued.aili.com/wp-login.php using the user name has been obtained to crack 3, get the background weak password zhiliang. lv: 111111 4. log on to the backend and edit the appearance and plug-ins to get shell 5, remove pants, escalate permissions, and penetrate the Intranet (I am only yy, never do it, haha) you can edit PHP files in the background it seems that someone has already been (sorry this dear friend, but for the security of the Internet, you will be wronged) shell address: http://fed.renren.com/wp-content/themes/fednew/404.php (please delete) is the Intranet machine Oh, what is penetration? I am sorry.


Solution:1. Do not open the background address. 2. Restrict login errors. 3. Enhance password strength. 4. Strictly control account permissions. 5. strictly define the read and write permissions for different directories on the server.