Scans for Wordfence Protected Websites, (Tue, Sep 29th)
SANS sensors saw sparse scans for wordfence-waf.php, likely probing Wordfence-protected WordPress sites.
The SANS Internet Storm Center reported that starting September 28 its sensors observed a small number of requests for wordfence-waf.php, a file created in a WordPress site root when Wordfence is installed. The requests were minimal, sending only a Host header set to the target IP address and no User-Agent. The file contains no secrets or configuration, but it loads scripts that run before WordPress code as part of Wordfence extended protection. Researcher Johannes Ullrich suggests the scans may enumerate protected sites or test direct-by-IP access that could bypass hostname-based firewall controls.
- Sensors saw a small number of requests for wordfence-waf.php starting September 28.
- Requests contained only a Host header set to the target IP address.
- The file supports Wordfence extended protection and stores no secrets.
- Likely aims are enumerating protected sites or probing WAF bypasses.
Full article262 words · extracted from isc.sans.edu · click to collapse
Starting yesterday, our sensors picked up a small number of scans for "wordfence-waf.php". This particular script is used by Wordfence, a solution to protect WordPress sites. During the Wordfence install, the wordpress-waf.php file will be created in the site's root directory [1].
The requests themselves are unremarkable, not including any headers like User-Agent. Just the bare minimum "Host" header, which is the IP address of the targeted site.
The file does not include any secrets or configuration parameters, but it includes other scripts intended to run before any WordPress code to assist with Wordfence's integration. My best guess is that attackers may attempt to enumerate Wordfence-protected sites to limit detection. Wordfence collects intelligence from the sites it protects and often publishes information about newly detected attacks. This, in turn, "burns" exploit techniques, as other sites will not be able to protect themselves as well.
Another possible option is that these scans attempt to bypass Wordfence. By using the IP address instead of the hostname, the attacker may attempt to identify Wordfence-protected sites that are directly reachable. This could be used to bypass Wordfence protection and expose sites that rely on it to delays in patching. Web application firewalls and "virtual patching" are only temporary fixes; please follow Wordfence's guidance on preventing the bypassing of its protection. But wordfence-waf.php is part of the "Extended Protection" feature, which is designed to help prevent this type of bypass.
[1] https://www.wordfence.com/help/firewall/optimizing-the-firewall/
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
Text extracted automatically; images, tables and formatting may be missing. Original: https://isc.sans.edu/diary/rss/33382