Follow for free plugins, new theme releases and theme news
Plugin Description
Floodspark Counterespionage Firewall (CEF) helps you block reconnaissance or otherwise illegitimate traffic. CEF is like a web application firewall (WAF) but protects against intelligence gathering. CEF focuses on pre-attack protection and is designed to complement security plugins such as Wordfence or Sucuri.
CEF can:
* Fake out WPScan and bots by hiding your real usernames, instead supplying them with fake ones they will never be able to log in with.
* Prevent bots from logging in even with your real password.
* Defeat WPScan’s aggressive plugin and theme scans, also causing the scanner to terminate.
…as well as detect:
* Tor browser, with minor delay
* Chrome Incognito, with minor delay, over HTTPS
* Firefox Private Browsing, with minor delay
* Chrome-Selenium in its default configuration, with minor delay
* cURL in its default configuration
* Wget in its default configuration
* HTTP methods other than GET, POST, and HEAD
* Proxy probing
How does this work?
So! A hacker’s usual approach for hacking into WordPress sites includes using a tool like WPScan to find out usernames as well as which plugins and themes are installed. They’ll try to guess passwords for the user account(s) and also check vulnerability/exploit databases for any known vulnerabilities in any of the installed plugins or themes, and then try to hack into the site through those.
But! We’re aiming to disrupt that information gathering step of the attack. So when WPScan scans for usernames, we give out fake ones that don’t exist. So all the password guessing attempts will be in vain. When WPScan scans for any of 88.5k plugins that might be installed, we respond that every one of them is installed. Same with themes–when WPScan scans for 400 themes, we assert that they too are all installed.
So the attacker then has so much data they don’t know what to trust. And they’ll launch attacks against plugins and themes that don’t exist, so the exploits will never work.
PS, WPScan is a legit tool that we love and just use as an example.
Cyber Intent Blog
The Floodspark Cyber Intent Blog uses this plugin and is all about just that, cyber intent. Here we will cover the art and science of it and the developments in the Counterespionage Firewall (CEF) portfolio (CEF for WordPress and CEF Full) that turn these ideas into reality.
Stay up to date
Stay up to date with developments in the Floodspark portfolio @Floodspark
Thank you
Feedback is greatly appreciated as we continue to shape Floodspark. Email us anytime – gs@floodspark.com.
Screenshots
Deceiving WPScan’s username hunting. Real usernames were “admin”, “admin2”, “admin3”, “admin4”, “admin5”. No hacker can log in with these faked usernames because they don’t actually exist.
Defeating WPScan’s plugin scan
Defeating WPScan’s theme scan
Error message the visitor will receive for banned behavior or devices.
Defeating hackertarget.com’s WordPress username enumeration scan
Recommended setting for Endurance Cache / Endurance Page Cache to avoid issues
