Hacker News Reader

Comment by HeckFeck | Hacker News Reader

Ah, I had a similar idea. There were too many bots or vulnerability scanners hitting /wp-admin.php on my blog. It was flooding my access logs with 404s because I don't rock wordpress. Irksome stuff.

So I threw up a little 'surprise' for the ahem penetration testers ahem, if you feel brave: https://www.thran.uk/wp-login.php

View on HN

My basic security measures for a simple wordpress site is to rename wp-admin to something else, rename the admin account to something else, and change the ssh port to something else. That already confuses 99% of login attempts / lazy bots.

Risky click of the day. No regrets.

> There were too many bots or vulnerability scanners hitting /wp-admin.php on my blog

There are moments I'm about to deploy something similar and by now what's stopping me are laziness and other higher priorities. I'm staring at these aggravating items in server log and maybe someday.

if you filter out requests that don't have a host defined that clears up pretty much all of those requests

This is fabulous and I intend to steal your idea.

This is absolutely amazing. More people should do this.

These attempts are almost entirely automated, so almost nobody will see it. But if you want to help, tarpitting any IP which requests that page will slow down the scanner with minimum resource usage on your side.

yeah, a quick failtoban rule is (as a server operator) every bit as satisfying.

does it respond with 42.zip upon submitting admin-admin?

42.gzip served directly as a response with Content-Encoding: gzip would be funnier :D

I'm working on maximising flow control of the payload.

That will make for a lot of sewage.

How about a JS fork bomb, on rotation with 42.zip?

Nice. I'd probably have settled for something simple like <form action="http://127.1/wp-login.php">. These days, you could serve a JS bitcoin miner instead.

if you watch this at work, mute your speakers to avoid any furrowed brows.

Omg! One random comment that did not only made my day, but my WEEK :-P

This made me nostalgic of the old ytmnd days

Safari offered to save the password lmao

Well that’s fun

omg! That scared the shit out of me!

Even in the source as a comment :)

Reply on news.ycombinator.com