Wordpress Security Flaw: Reset Admin Password of Any Blog Without Confirmation!

This is just way too exciting! Wordpress which is THE CMS of choice for bloggeimagers did has such a big security hole! Someone has found a way to reset the admin password without any confirmation and this can have serious consequences.

The hack is still open and can even be applied to the latest Wordpress release 2.8.3

This is how it works:

The normal password reset page asks you to enter the username or email address and if that’s correct then a link is send to the email address associated with that account to reset your password but note that the password itself is not changed and you can just ignore the email and carry on.

But hackers have found a way in which they simply bypass that check and the password is reset by passing a special value in the key parameter of the reset page URL.

This is all you have todo:
http://www.domainname.com/wp-login.php?action=rp&key[]=

Replace domainname with any domain name of a blog hosted on Wordpress and see it for yourself!

Don’t waste time trying this on ProgrammerFish because I have already secured it.
If you also want to know the fix then better search it yourself or wait for my update and until that time let me test this on some more blogs.

Here is a list of blogs that I have tried this hack on. Sorry guys. You can always restore your passwords though.

1) Our very own ProgrammerFish. Cannot be exploited now though

2) TechToggle – I really like this blog though
image

3) TutPlus – Yeah yeah yeah! image

4) Tutorial9
image

5) Wordpress Founder’s Personal Blog! ma.tt [Am not sure whether its reset or not but I think it is]

6) Noupe
image

7) PKPolitics
image

There are a couple others I tried this on and none of them was protected!

Note: I have just tried this as a proof-of-concept and nothing more then that. You will get an email with your new password and can always reset it yourself again. And sorry guys, OpenSource is not the best thing on earth!

http://www.programmerfish.com/wordpress-security-flaw-reset-admin-password-of-any-blog-without-confirmation/

How to Create an Invisible Folder in Windows XP

You Can Make Any Folder Invisible Without Using Any Software Or Program Just Follow These Steps:

1. Right click where ever you want the invisible folder to be and select create a new folder.

2 Right Click on the folder and hit rename. Erase the name of the folder so there is nothing there.

3. If you try to stop here windows will tell you that you need to provide a name. So to get around this with the name field still active hold down ALT and press 0160 on the number pad (make sure Num Lock is on), release alt

You should now have a blank name with nothing but a folder next to it

4. Now click on the nameless folder and right click. Select Properties.

5. Go to the Customize tab.

6. Find and press the Change Icon button. Scroll through the icons until you find one that has no image.

7. Hit OK and you have an invisible folder!

With the invisible folder you can hide what ever undesirables you have. Be it video games at work, pictures of your family or anything else you can think of "wink".

The folder will show up for a brief second if you put it on your desktop. For that reason it might be smart to place it inside a folder or amongst a group of folders.