Advertisement
bwall

Ballast Security Wordpress Honeypot Plugin v0.0.0.1

Jul 13th, 2012
132
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 1.19 KB | None | 0 0
  1. <?php
  2. /*
  3. Plugin Name: Ballast Security Wordpress Honeypot
  4. Description: This Wordpress plugin makes your active Wordpress into a honeypot that Ballast Security can use to help defeat threats.  You can view all the RFI payloads at https://firebwall.com/decoding/read.php
  5. Version: 0.0.0.1
  6. Author: @bwallHatesTwits
  7. Author URI: http://ballastsec.blogspot.com/
  8. License: GPLv2
  9. */
  10. ?>
  11. <?php
  12. add_action('init', 'SendRFIUrlToBallastSec');
  13.  
  14. function SendRFIUrlToBallastSec()
  15. {
  16.     $urls = array();
  17.     foreach($_GET as $name => $value)
  18.     {
  19.         if(preg_match('/(?<url>https?:\/\/[^<>[:space:]]+)/', $_GET[$name], $matches) > 0)
  20.         {
  21.             array_push($urls, $_GET[$name]);
  22.         }
  23.     }
  24.     foreach($_POST as $name => $value)
  25.     {
  26.         if(preg_match('/(?<url>https?:\/\/[^<>[:space:]]+)/', $_POST[$name], $matches) > 0)
  27.         {
  28.             array_push($urls, $_POST[$name]);
  29.         }
  30.     }
  31.     foreach($_COOKIE as $name => $value)
  32.     {
  33.         if(preg_match('/(?<url>https?:\/\/[^<>[:space:]]+)/', $_COOKIE[$name], $matches) > 0)
  34.         {
  35.             array_push($urls, $_COOKIE[$name]);
  36.         }
  37.     }
  38.    
  39.     foreach($urls as $index => $url)
  40.     {
  41.         $encoded = base64_encode($url);
  42.         file_get_contents("https://firebwall.com/decoding/submit.php?u=".urlencode($encoded));
  43.     }
  44. }
  45. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement