WordPress base configuration files on GitHub • Hacker News Board

Re: WordPress base configuration files on GitHub

#11

Post by z92 » Mon, Aug 17, 2015, 1:52 PM UTC

Which is why I don't use any database password if the database is listening on localhost only, which is the case most of the time.

Re: WordPress base configuration files on GitHub

#12

Post by [deleted] » Mon, Aug 17, 2015, 1:54 PM UTC

JosephRedfern wrote: post #5

A majority of these results aren't actually wp-config.php files. If you sort by date indexed, you'll see that the results include all manner of files. filename:"wp-config.php" "define('DB_NAME'," extension:php seems to give better results

[deleted]

Re: WordPress base configuration files on GitHub

#13

Post by userbinator » Mon, Aug 17, 2015, 1:58 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

I'd guess that a large portion of those which aren't localhost are also firewalled or otherwise inaccessible from the public Internet.

Re: WordPress base configuration files on GitHub

#14

Post by efriese » Mon, Aug 17, 2015, 1:59 PM UTC

There are also salts/hashes in many of these configs...not such a great place to store those =)

Re: WordPress base configuration files on GitHub

#15

Post by 0xffffabcd » Mon, Aug 17, 2015, 2:01 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

Found several working username+password for FTP accounts.

Re: WordPress base configuration files on GitHub

#16

Post by ishener » Mon, Aug 17, 2015, 2:01 PM UTC

JosephRedfern wrote: post #10

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

How can you tell that? Just because it specifies "localhost" doesn't necessarily mean it's a dev box.

Exactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.

Re: WordPress base configuration files on GitHub

#17

Post by sarciszewski » Mon, Aug 17, 2015, 2:02 PM UTC

mattgibson wrote: post #8

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

Excluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000: https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...

Excluding localhost will exclude a lot of legitimate installs.

Re: WordPress base configuration files on GitHub

#18

Post by ins0 » Mon, Aug 17, 2015, 2:02 PM UTC

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

I agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)

Re: WordPress base configuration files on GitHub

#19

Post by austenallred » Mon, Aug 17, 2015, 2:03 PM UTC

mattgibson wrote: post #8

mahouse wrote: post #3

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

Excluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000: https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...

Most wordpress devs support multiple environments in their .wpadmin (dev -> localhost, prod -> some server). So this is creating a lot of false negatives.

Re: WordPress base configuration files on GitHub

#20

Post by chrisxcross » Mon, Aug 17, 2015, 2:03 PM UTC

1500 Results on Google: https://www.google.com/search?q=%22define%28+%27DB_PASSWORD%...