Firewall applicativo
Ispeziona URL, body e User-Agent prima che WordPress esegua la richiesta. Non è un WAF DNS: gira sull'endpoint.
Campioni
Regole
SQL injection UNION/SELECT
(union(\s|/\*.*\*/)select)|or\s+1=1|sleep\s*\(|benchmark\s*\(
XSS script / onerror
<script|javascript:|onerror\s*=|onload\s*=
Path traversal
(\.\./|\.\.\\|%2e%2e)
Tentativo wp-config.php
wp-config\.php
xmlrpc.php system.multicall
system\.multicall|xmlrpc\.php
User-Agent scanner (sqlmap, nikto, nmap)
sqlmap|nikto|nmap|acunetix|dirbuster|masscan
Wrapper PHP pericolosi
php://(filter|input)|expect://|data://text
Local/Remote file inclusion
(etc/passwd|proc/self|wp-config|allow_url_include)
Enumerazione utenti REST
wp-json/wp/v2/users
Enumerazione /?author=
[?&]author=\d
readme.html / license.txt
(readme\.html|license\.txt)
wp-login.php (monitoraggio)
wp-login\.php
PHP in wp-content/uploads
wp-content/uploads/.*\.(php|phtml|phar)
PHPUnit eval-stdin (RCE)
phpunit|eval-stdin\.php|vendor/phpunit
WP File Manager / Connector
wp-file-manager|elfinder|file-manager/lib
Webshell nota in richiesta
FilesMan|c99shell|WSO_VERSION|eval-stdin|p0wny@shell|AlfaTeam
TimThumb / old crop
timthumb\.php|thumb\.php\?src=
Eventi
Nessun evento. Prova un campione sopra.