$bad_names extended

Resolved

(@szepeviktor)

Based on real world attacks:

'access',
'admin',
'administrator',
'backup',
'blog',
'business',
'contact',
'data',
'demo',
'doctor',
'guest',
'info',
'information',
'internet',
'master',
'number',
'office',
'pass',
'password',
'postmaster',
'public',
'root',
'sales',
'server',
'service',
'test',
'user',
'username',
'webmaster'

Source: https://github.com/szepeviktor/wordpress-plugin-construction/tree/master/wordpress-fail2ban/block-bad-requests

https://wordpress.org/plugins/gauntlet-security/

Viewing 6 replies - 1 through 6 (of 6 total)

Plugin Author Cornelius Bergen
(@cbergen)

11 years, 5 months ago

Thank you.

How was this list compiled? Do you have an original source or reference?

Thread Starter Viktor Szépe
(@szepeviktor)

11 years, 5 months ago

When an attack is detected my included PHP class (not a plugin, because it is executed from wp-config) logs attack internals:

https://github.com/szepeviktor/wordpress-plugin-construction/blob/master/wordpress-fail2ban/block-bad-requests/wp-login-bad-request.inc.php#L305-L314

Once in a botnet attack I’ve grep-ped the usernames tried.

Thread Starter Viktor Szépe
(@szepeviktor)

11 years, 5 months ago

Of course it is a prerequisite that you do not use role-like usernames, only real person names.
So no “dev” or “marketing” but “john” or “cornelius”.

Plugin Author Cornelius Bergen
(@cbergen)

11 years, 5 months ago

I will add these for the next release. Thanks Viktor!

Plugin Author Cornelius Bergen
(@cbergen)

11 years, 4 months ago

In the most recent update, I’ve added a few more common usernames using your list and the list here: http://simonfredsted.com/1260

Thread Starter Viktor Szépe
(@szepeviktor)

11 years, 4 months ago

Thank you!
I’ve updated my list also.

https://github.com/szepeviktor/wordpress-plugin-construction/blob/master/wordpress-fail2ban/block-bad-requests/wp-login-bad-request.inc.php#L25-L59

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘$bad_names extended’ is closed to new replies.