WordPress base configuration files on GitHub

#1

Post by ishener » Mon, Aug 17, 2015, 1:20 PM UTC

WordPress base configuration files on GitHub
github.com

Re: WordPress base configuration files on GitHub

#2

Post by chayesfss » Mon, Aug 17, 2015, 1:40 PM UTC

Thought it was going to be template stuff for a min, clicked on the first one and saw "/ MySQL database password */ define('DB_PASSWORD', 'JasxkvpY72KKCdttdBqt');"

Re: WordPress base configuration files on GitHub

#3

Post by mahouse » Mon, Aug 17, 2015, 1:40 PM UTC

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

Re: WordPress base configuration files on GitHub

#4

Post by rocky1138 » Mon, Aug 17, 2015, 1:47 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

How many of those change when they go live?

Re: WordPress base configuration files on GitHub

#5

Post by JosephRedfern » Mon, Aug 17, 2015, 1:49 PM UTC

A majority of these results aren't actually wp-config.php files. If you sort by date indexed, you'll see that the results include all manner of files.

    filename:"wp-config.php" "define('DB_NAME'," extension:php

seems to give better results

Re: WordPress base configuration files on GitHub

#6

Post by _bozo » Mon, Aug 17, 2015, 1:50 PM UTC

Hmm. If you alter the search to "filename:wp-config.php FTP_PASS" you start getting some that look like ... legit. For those who don't know, WordPress has some level of access to hosting server via FTP, for upgrades and plugin installs.

Pertinent config globals are FTP_BASE, FTP_CONTENT_DIR, FTP_PLUGIN_DIR, FTP_PUBKEY, FTP_PRIKEY, and of course, FTP_USER, FTP_PASS, FTP_HOST.

Re: WordPress base configuration files on GitHub

#7

Post by cstuder » Mon, Aug 17, 2015, 1:50 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

And how many of those MySQL passwords are also used by the WordPress admin account?

Even if it's just 0.1%, that would be still 150'000 valid passwords.

Re: WordPress base configuration files on GitHub

#8

Post by mattgibson » Mon, Aug 17, 2015, 1:50 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

Excluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000:

https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...

Re: WordPress base configuration files on GitHub

#9

Post by hobs » Mon, Aug 17, 2015, 1:52 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

Keep clicking, because I found what appear to be two valid passwords in 5 different config files (with public hosts.) Obviously I didnt test them, so you might be right that they change or are in dev mode, but that smells like a lot more than 6 9s.

Re: WordPress base configuration files on GitHub

#10

Post by JosephRedfern » Mon, Aug 17, 2015, 1:52 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

How can you tell that? Just because it specifies "localhost" doesn't necessarily mean it's a dev box.