Secureaks Blog - Pentest and cybersecurity

WordPress powers more than 43% of the world's websites today, making it the most widely used content management platform (CMS). But this popularity also makes WordPress a prime target for cyber attacks.

Vulnerabilities in extensions, outdated themes, weak configurations... A poorly protected WordPress can easily become an attacker's entry point. Fortunately, there are some simple and effective best practices to reduce the risks.

In this article, we'll take a look at how to secure a WordPress site, with practical advice you can apply today.

When performing a security audit on a web application, it is essential to identify publicly exposed resources, such as files, folders or API endpoints. Enumerating these elements can uncover potential security flaws and expand the attack surface.

There are several tools available for this task, including FFuF (Fast Fuzzing), which we'll discuss here.

Penetration testing, or pentesting, is an essential step in assessing the security of web applications. It involves simulating attacks in order to identify and correct potential vulnerabilities. Different approaches to pentesting exist, each offering a unique perspective on system security. The main methods are blackbox, greybox and whitebox testing.

If you love cybersecurity and want to start web pentesting, you're in the right spot.

I'm excited to share a list of resources and platforms that helped me start and continue in my career.

You'll find guides, training platforms, and GitHub repositories here.

WPScan is an open-source tool that allows you to scan a WordPress site to find vulnerabilities and security issues. In this article, I will explain how to install and use WPScan to secure your WordPress sites.

To fix an XSS on formatted text, it is not possible to simply encode the data, as this would remove all possibility of text formatting. This is where the "sandbox" parameter of the HTML "iframe" tags will make our life easier. Indeed, this parameter is designed to automatically clean what is in the iframe from anything that could be dangerous, while keeping the harmless HTML tags.