WordPress base configuration files on GitHub

https://github.com/search?utf8=%E2%9C%93&q=filename%3Awp-config.php+&type=Code&ref=searchresults

by ishener • 11 years ago

165 84 11 years ago

chayesfss• 11 years ago

Thought it was going to be template stuff for a min, clicked on the first one and saw "/ MySQL database password */ define('DB_PASSWORD', 'JasxkvpY72KKCdttdBqt');"

mahouse• 11 years ago

150,000,000+ database passwords, of which 99.9999%+ are from local development servers.

rocky1138• 11 years ago

How many of those change when they go live?

cstuder• 11 years ago

And how many of those MySQL passwords are also used by the WordPress admin account?

Even if it's just 0.1%, that would be still 150'000 valid passwords.

mattgibson• 11 years ago

Excluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000:

https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...

sarciszewski• 11 years ago

Excluding localhost will exclude a lot of legitimate installs.

austenallred• 11 years ago

Most wordpress devs support multiple environments in their .wpadmin (dev -> localhost, prod -> some server). So this is creating a lot of false negatives.

onion2k2• 11 years ago

localhost in the case of Wordpress just means the database is running on the same machine as the web server. Practically every WP instance is set up that way.

bdcravens5• 11 years ago

Which would be 99.99926% :-)

hobs• 11 years ago

Keep clicking, because I found what appear to be two valid passwords in 5 different config files (with public hosts.) Obviously I didnt test them, so you might be right that they change or are in dev mode, but that smells like a lot more than 6 9s.

JosephRedfern2• 11 years ago

How can you tell that? Just because it specifies "localhost" doesn't necessarily mean it's a dev box.

ishener• 11 years ago

Exactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.

userbinator2• 11 years ago

I'd guess that a large portion of those which aren't localhost are also firewalled or otherwise inaccessible from the public Internet.

0xffffabcd• 11 years ago

Found several working username+password for FTP accounts.

ins0• 11 years ago

I agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)

reustle• 11 years ago

Don't store sensitive data in git, or don't store sensitive data on public github repos?

onion2k2• 11 years ago

If you're the sort of developer who puts a wp-config.php file in a git repo (eg no proper deploy process.. otherwise that file wouldn't exist in the repo, or no reference to the config file in .git-ignore), you're probably the sort of developer who'll use the same password on your local dev machine and your live site because "setting up MySQL users is hard."

Cthulhu_• 11 years ago

And the other 95% doesn't allow external connections.

JosephRedfern2• 11 years ago

A majority of these results aren't actually wp-config.php files. If you sort by date indexed, you'll see that the results include all manner of files.

    filename:"wp-config.php" "define('DB_NAME'," extension:php

seems to give better results

_bozo• 11 years ago

Hmm. If you alter the search to "filename:wp-config.php FTP_PASS" you start getting some that look like ... legit. For those who don't know, WordPress has some level of access to hosting server via FTP, for upgrades and plugin installs.

Pertinent config globals are FTP_BASE, FTP_CONTENT_DIR, FTP_PLUGIN_DIR, FTP_PUBKEY, FTP_PRIKEY, and of course, FTP_USER, FTP_PASS, FTP_HOST.

waffl• 11 years ago

In a similar vein, things like this https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa... are also why passwording your private keys is very important. Tons of these keys (why are people committing these to public repositories??) aren't passworded. It astounds me that someone has the technical knowledge to create an ssh key/pair, commit to github, and manage to send their unencrypted private key off into the public sphere.

z92• 11 years ago

Which is why I don't use any database password if the database is listening on localhost only, which is the case most of the time.

cubehouse• 11 years ago

I don't think this is a good idea, even if the database is just listening to localhost. Say a malicious script gets uploaded to the machine, it will be able to dump the entire database without any need to seek out credentials.

degenerate• 11 years ago

Agree... it's better to still have credentials, but ALSO only listen locally. At least that way the credentials need to be found first!

efriese• 11 years ago

There are also salts/hashes in many of these configs...not such a great place to store those =)

chrisxcross2• 11 years ago

1500 Results on Google: https://www.google.com/search?q=%22define%28+%27DB_PASSWORD%...

userbinator2• 11 years ago

Does anyone else get a CAPTCHA on the next search after browsing through those results?

knd775• 11 years ago

I didn't.

kiproping• 11 years ago

I got it too, I think its flagged because some people crawl google with those search terms looking for vulnerable systems.

verelo• 11 years ago

I love how, for me, the first result is a backup of a/the MIT website

nadams3• 11 years ago

You do know that you can play the same game with other languages as well?

https://github.com/search?utf8=%E2%9C%93&q=filename%3Asettin...

I feel like people don't accept the fact that people do stupid stuff in other languages.

mjolk• 11 years ago

I think you're being oversensitive about PHP.

Wordpress, and by extension, its predictably-named settings file, is an easy search-target because it's very popular among novice/new developers.

bdcravens5• 11 years ago

Not to mention that a knock on Wordpress isn't necessarily a knock on PHP, since many non-developers (or companies that do zero dev in PHP) install Wordpress.

nadams3• 11 years ago

I think you're being oversensitive about PHP.

I'm just tired of seeing the same search on github for PHP config files.

its predictably-named settings file

So does every other popular application and framework on the planet. This isn't something specific to wordpress - we can play this game all day with different applications, frameworks, and languages.

https://github.com/search?q=mysql+user&type=Code&utf8=%E2%9C...

eterm• 11 years ago

.net equivalent:

https://github.com/search?utf8=%E2%9C%93&q=filename%3Aweb.co...

brightball• 11 years ago

At what point do developers get criticized/held responsible for using public repositories for private websites? I get it, people like github but when you can get a private repo on bitbucket for free there's no excuse for this.

n0us• 11 years ago

or just a bare repo on your server. I personally don't see the appeal of Github for private projects at all.

bdcravens5• 11 years ago

Many hosted solutions integrate with private Github (OpsWorks, Codeship, CircleCI, CodeClimate, and many more).

melvinram• 11 years ago

PRs, Issues, Wikis, etc.

aikah2• 11 years ago

people like github but when you can get a private repo on bitbucket for free there's no excuse for this.

Absolutely, Github public repos have always been a blackhat gold mine. But I guess a lot of people have never heard of Bitbucket, since Github is advertised everywhere , on education blogs, books , ... I'm sure some noobs using it don't even realize repositories are public and searchable.

bdcravens5• 11 years ago

Github does have a wider set of services that integrate with it. That said, if you have to go Github, private repos aren't that expensive. (And more services seem to be recognizing that Bitbucket is an increasingly popular options)

purephase• 11 years ago

They are if you have to manage a lot of them.

I love GH, but I only use it for my public projects. Limiting private repos ($200 for 125?) seems insane to me, and it will drive people to make public items that shouldn't be.

For any private projects, or ones involving clients, I use BitBucket and make all repos private. It's a difference of $190 for me (I use the $10/mth plan with BB and host well over 125 private repos).

krapp• 11 years ago

This isn't a problem with public/private repositories. It's possible to commit the config files for Wordpress without exposing your passwords - you just have to not be lazy about it, and store the actual values in the environment or pull them from a file you don't commit with everything else.

aikah2• 11 years ago

What is there to say ... developers , don't dump your projects on github public repositories ... use bitbucket and free private repos if you can't afford to pay FOR GOD SAKE !!! ...

!!! How many of them use the same credentials for their emails ? facebook ? twitter ? for their AWS account ? this is a nightmare.

dataker• 11 years ago

Just as bad, I see many developers leaving their Rails app with production secret key.

It just takes more time.

getdavidhiggins2• 11 years ago

"Passwords" in the title is a bit misleading. Most of these are staging files with little or no sensitive information there. However there is the odd bit of interesting data there if you look hard enough.

Github search is an untapped resource just like Algolia Search is on Hackernews. Infact I have largely replaced my Google searches with these ones for more refined and curated results.

erikb2• 11 years ago

What do you mean with staging files, what is not sensitive about username and password of the database?

getdavidhiggins2• 11 years ago

Well a Wordpress production site is a rare and precious thing to find on Github. There are some that exist, but then even if I do find it:

1.) Password will be changed

2.) Possible honeypot

3.) Boring site is boring. No need to hack it. Not popular enough

Same goes for other databases on there. An enormous amount of cruft to wade through to get anything remotely juicy/interesting. And the same heuristics apply above: is it really so great that I logged into a boring MYSQL database that is probably being monitored and has nothing interesting in there in the first place?

thekevan• 11 years ago

I think they mean that a majority of these are instances where someone installed WP to play with it and these are the testing files rather than an actual website they are using. When I installed WP recently, I know I just used a dummy password for testing.

edpichler2• 11 years ago

Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?

sirwolfgang• 11 years ago

[I not saying I am an expert] It is always a problem to expose passwords. Sure they can't use it from the outside, but what's the point of even having the password if its public? The password is to prevent unauthorized access. If they are able to get to a box, and pivots, that password becomes useful to the attacker.

dragonwriter2• 11 years ago

In any case where having passwords is relevant to security rather than just a hindrance to usability, exposing passwords is a security problem. If exposing a password isn't a security problem, you shouldn't require a password in the first place.

brown• 11 years ago

"Defense in depth" is a commonly accepted security principle that suggests otherwise:

https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

nocarrier• 11 years ago

It's not clear from your question if this hopefully hypothetical database server is exposed to the internet or if it's on a private network, but:

Yes, it's still a problem, because then you have to depend on the whitelist staying valid and never having an admin accidentally turn it off. And you also have to depend on none of the machines on the trusted IPs being compromised either. And you have to depend on many other things not happening as well.

Instead, you want what is called defense in depth--several layers of security so that an attacker needs to breach several defensive layers in order to get access to what they're looking for. Relying on just an IP whitelist as a single layer of defense is not considered to be a good practice.

https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

edpichler2• 11 years ago

I mean, if a database can be accessed only from a certain IP, like in Microsoft Azure.

hutch34• 11 years ago

Definitely a good idea to whitelist ips, and, I'm certainly no security expert, but I still would avoid putting any type of credentials in a repository. Someone could have an ip reset, use a VPN tunnel, or any number of scenarios. I think it is better practice to use environment variables or something similar. Correct me if I'm wrong for those of you who are in security.

chrisxcross2• 11 years ago

Maybe the password is the same for the wp-admin user. Password reuse is a really serious and common problem.

bdcravens5• 11 years ago

The first few repos I peeked at were several years since their last commit.

ErikAugust• 11 years ago

I've found something else in WordPress with this simple search method that I'd argue is worse.

blackbeard• 11 years ago

This is one reason we don't use cloud-based source code hosting. All it takes is one idiot fork or an accident and wham, code everywhere.

mondainx2• 11 years ago

I found this search more interesting than someone pushing their wp-config to a repo; also warning, some are nsfw https://github.com/search?p=100&q=filename%3Atits.jpg+&ref=s...

danielsamuels• 11 years ago

That link is a great example to demonstrate how much Github search sucks now. You've explicitly searched for filenames of "tits.jpg", but it's showing you a complete mishmash of different files.

mondainx2• 11 years ago

I was surprised that it worked at all; I assumed some filtering would kill it right away.

bussiere• 11 years ago

Is there a way to crap this ? Is there an api for github search ?

Regards

captn3m0• 11 years ago

Another one I posted about sometime ago is filezilla config files. Found lots of FTP servers with their passwords in the filezilla config files committed on github. [0]

[0] https://www.google.co.in/search?q=inurl%3Afilezilla+inurl%3A...

tvvocold• 11 years ago

That's why i am using https://Coding.net (Chinese Only), a China Startup, provide free and unlimited private repositories hosting service with lots of feature like Code reviews,Custom domains,WebIDE... Go private, guys!

red_admiral• 11 years ago

Apart from putting your wp-config on github, it's also a terrible idea to use short passwords like 'p@ss12' for a database password that will be sent from one machine/program to another most of the time - such passwords should at the very least look like 'jm0Y/ZGjxYZay2yraskQ5AbZ8Qe0r0pRVDdnEkaIvHU', computers can remember strings that long and developers can copy-paste if it's stored in a file already.

brewcore• 11 years ago

It's a good case for private repos, but an even better case for not committing passwords to a repository in the first place.

toxican• 11 years ago

I don't even bother committing any part of wordpress core. I just commit the wp-content directory because unless you're a mad man, you shouldn't be modifying anything outside of that directory. First rule of WordPress is don't touch core! wp-config is definitely an exception, but better safe than sorry to avoid issues like this.

anda-polito• 11 years ago

UNLOQ.io increases the security of your digital properties through a distributed authentication system that doesn’t require your users to remember any passwords.

WordPress base configuration files on GitHub

Related Stories