0wn WordPress Exploits and Spam

Post by AskApache | May 08, 2016  

Secure WP Super Cache, Anti-exploits, Mitigation techniques..

PHP fsockopen for FAST DNS lookups over UDP

Jan 28, 2014  

While reading up on gethostbyaddr on PHP.net, I saw a nice idea for using fsockopen to connect over UDP port 53 to any Public DNS server, like Google DNS 8.8.8.8, and sending the reverse addr lookup in oh about 100 bytes, then getting the response in oh about 150 bytes! All in less than a second. This is how/why to read/write data directly to the wire! This would be extremely valuable for use in things like my online header tool because it's faster than any other method. As usual, I went a bit overboard optimizing it to be lean and fast.

DNS fsockopen gethostbyaddr Google networking OpenDNS PHP socket udp UltraDNS

Fsockopen Magic

Dec 17, 2013  

PHP's fsockopen function lets you open an Internet or Unix domain socket connection for connecting to a resource, and is one of the most powerful functions available in the php language.

fsockopen PHP socket strace udp Unix

Get Number of Running Proccesses with PHP

Dec 16, 2013  

Recently I had to setup a script to curl 10k urls, but it could only do 500 requests at any one time. In order to work under that limit, I created a function that returns the number of currently running processes on the machine in an extremely fast and efficient way, thus allowing the curl_multi requests to queu themselves such as GNU xargs.

/proc clearstatcache Hard link PHP Process stat version_compare

Getting the Mimetype of an Image with PHP

Mar 24, 2013  

This is awesome. I was so fed up with trying to find a fail-proof, cross-platform way to find the mime type of an image using PHP that I wrote a quick function that utilizes the same technology as the exif_imagetype, getimagesize, and finfo functions do. Ahh the joys of low-level.

file filetype images mime mimetype

Using PHP shorthand and short_open_tag

Sep 19, 2012  

I hope this will pursuade you to stop using PHP short_open_tag syntax.

<?= or <?

PEAR wordpress

PHP to handle HTTP Status Codes for ErrorDocument

Nov 18, 2010  

Fast, HTTP Protocol, protection. If you are reading this article, you already know enough about the benefits of making sure your site can handle HTTP Protocol Errors. This is a nice single php file with no dependencies or requirements, will work on anything. Optimized for minimizing bandwidth and resource-hogging connections from bots and spambots.

<?php
ob_start();
@set_time_limit(5);
@ini_set('memory_limit', '64M');
@ini_set('display_errors', 'Off');
error_reporting(0);

ErrorDocument HTTP PHP

Creating an Offline Version of Page

Oct 22, 2010  

So, here's what I hacked together last night, that is being used today. It's essentially 2 files.

1. A php file that scrapes uses curl to scrape all the urls for the page (favicon, css, images, pdfs, etc..)
2. A simple bash shell script acting as a cgi that creates a zip file of all the urls, and a self-extracting exe file for those without a winzip tool

Htaccess HTTP PHP

PHP Session File Hacks

Jun 24, 2010  

What they say about kung-fu is true..

It can be attained by anyone through hard work over time. You can become as good as the amount of work you put in. Here's a short look at a basic technique that I use. Simply reverse engineering the source code and taking notes along the way...

static void php_session_send_cookie(TSRMLS_D)
  if (SG(headers_sent)) {
          if (output_start_filename) {
                  php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot send session cookie - headers already sent by (output started at %s:%d)",
                          output_start_filename, output_start_lineno);
          } else {
                  php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot send session cookie - headers already sent");
          }
          return;
  }
 
  /* URL encode session_name and id because they might be user supplied */
  e_session_name = php_url_encode(PS(session_name), strlen(PS(session_name)), NULL);

PHP Session Session ID

Adding Akismet Anti-Spam Protection Anywhere

May 07, 2008  

Wouldn't you love to have Akismet Anti-spam protection for non-wordpress forms and pages?

PHP Sessions/Cookies On The Fly

Mar 28, 2008  

This article shows how to save and modify php session data, cookies, do anything really... without using ajax or iframes or forcing the user make a request.

Faster Form Submission and Processing with fsockopen

Mar 04, 2008  

Part II: Example illustrating how to speed up GET/POST form submissions. Uses fsockopen to initiate a server-side background request to process the submitted data, so that the result page of the form is displayed to the client lightningly quick.

Faster POST and GET Form Submissions… Shazam

Feb 12, 2008  

Just a very brief look at speeding up form submission by delegating the processing and bandwidth to your server, not your client.

bottleneck cURL form fsockopen PHP snoopy

Simple PHP Anti-Spam Captcha Script

Nov 28, 2007  

Prevent automated web robot tools and spammers from taking advantage of your site with this simple php script that I hacked up earlier today to use on my Advanced HTTP Header Viewer.

The Latest and Greatest php.ini

Nov 25, 2007  

Grab the latest php.ini developmental version and discover new or previously hidden php runtime configuration settings... ahead of everyone else!

Downloading Multiple Files with Curl Simultaneously

Sep 05, 2007  

Wouldn't it be great if you could use php and curl to download multiple files simultaneously using built-in curl functions? You can!

PHP htaccess tips and tricks

Apr 10, 2007  

Htaccess php tips and tricks for the Apache HTTPD Web Server, mostly these tips show you how to run customized versions with customized php.ini files, I require custom php.ini files because they are so useful!

Use php.ini to replace html with anything

Mar 09, 2007  

Use php.ini to add HTTP Headers to output

Sending POST form data with php CURL

Feb 21, 2007  

CURL Guide for sending POST data form request with PHP and CURL

Custom PHP.ini tips and tricks

Feb 05, 2007  

• When php run as Apache Module (mod_php)
• When php run as CGI
• When cgi?d php is run with wrapper (for FastCGI)

CGI Htaccess PHP php.ini