I have been asked by a client to look into penetration testing and prepare a report for them on a MODX site hosted through a Centos WHM/cpanel server.
What tools (preferably open source) are people using to do penetration test on there sites? Which ones give client friendly reports?
I have used Vega (
https://subgraph.com/vega/) and OWASP ZAP (
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project).
What can be done in order to harden the security on a MODX site? I tend to use a advanced install with a renamed manager and core above the public level of the site.
Happy for any advice Glyn
Glyn Szasz
Sydney, Australia
Happy to help (when can) and happy to learn
If you are a Sydney based MODX developer would love to hear from you. Please contact me.
discuss.answer
Rename the manager should always happen, that dump Vulnerability Scanner don't get the Site at the first Hit.
Also core should protected via server rules or moved.
We had several hacked modx Systems until now. And we traced all sources of theses attacks in (guessing numbers)
70% the manager
20% unprotected core folders
7% snippets from the repository (mostly Gallery / phpthumbof direct-calls)
3% quick & dirty custom made snippets
For example in order of security we also build an CRSF-Hook for FormIt.
Google is your friend (using your exact words):
harden the security on a MODX site.
Many thanks Michael and Bob
Glyn Szasz
Sydney, Australia
Happy to help (when can) and happy to learn
If you are a Sydney based MODX developer would love to hear from you. Please contact me.
