A friend’s site was hacked…

PS — I was able to determine that she is using WordPress version 2.8.6

Found and fixed the bad code. They had injected the script tags into header.php and 404.php inside the theme.

Once I had backed up the site to my local hard disk, I was able to use a findfile tool to search the entire site and locate the offending code pretty easily. Searching for <script> quickly located the code, because all of the real/good script tags used by wordpress typically don’t close the tag without specifying a text/javascript type.

So the important lesson I learned was to use a traffic sniffer (like FIDDLER) to quickly see what’s going on

I would still appreciate it if some kind expert could help my friend harden her site.

Thanks

Terry

Couldn’t you have just right clicked, then viewed the page source? I think a traffic sniffer is perhaps overkill for this particular problem, but if it worked for you, great! Did you check the sql database itself too by the way?

Anyway, why was she hacked? Not keeping her version of WordPress up to date? Rubbish host? Other insecure script? Obvious password?

There’s a good hack clean guide here:
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/

Hardening wise, think about htpasswd protecting her wp-admin folder. If you can limit access to a certain IP, even better.

Make sure there’s a good backup routine in place. You can download plugins to do this automagically, ie:
https://www.ads-software.com/extend/plugins/wp-db-backup/

Change all passwords, admin, database and FTP to something strong.

Have a read of this too:
https://codex.www.ads-software.com/Hardening_WordPress