Requested modx be added to wappalyzer

Wapalyzer was offline. Back now.

I would LOVE to have a way to figure out how many MODx sites are deployed, but I don’t think there should be markers in the output by any means. Makes it too easy for script kiddies to scan for MODx sites and attack.

Heh, I had suggested this a few days ago as well.

Quote from: rthrash at Jan 15, 2009, 06:50 AM

Get Satisfaction.com was listed as the largest MODx user but that isn’t a MODx site?

I noticed that, it’s because David pasted that

var MODX_MEDIA_PATH = "media";

..in his post (I fixed this in the next version, not really a priority).

Quote from: rthrash at Jan 15, 2009, 08:36 AM

[..] I don’t think there should be markers in the output by any means. Makes it too easy for script kiddies to scan for MODx sites and attack.

Security through obscurity? Sounds like you’re not to confident about the code. I think you’re pretty safe as long as you don’t show version numbers, it will help MODx built a name for itself.

Quote from: Soshite at Jan 15, 2009, 03:01 PM

Heh, I had suggested this a few days ago as well. 

Great minds think alike

When I searched getsatisfaction.com before I submitted though, there was no results...

Quote from: rthrash at Jan 15, 2009, 08:36 AM

I would LOVE to have a way to figure out how many MODx sites are deployed, but I don’t think there should be markers in the output by any means. Makes it too easy for script kiddies to scan for MODx sites and attack.

Yeah, well, I agree about forcing no markers and sure it’s extra security to make it harder to figure out which app a given website is running... on the other hand so far we were pretty easy to figure out for those who knew a bit about modx with MODX_MEDIA_PATH or quickedit (when enabled) but we didn’t suffer from that many security notices.

And for instance TYPOlight has markers in the form of comments (which you can’t remove without hacking) but very few security issues (2 secunia advisories in 4 years).

Most of modx security issues are eto legacy (like MCPUK) or bad server configurations (like register_globals on), and more likely than not Revolution will not suffer any similar problems. Though I am not in favor of forcing markers, I don’t think having a default template marker (removable) would be such an issue.

Quote from: ElbertF at Jan 15, 2009, 03:10 PM

Security through obscurity? Sounds like you’re not to confident about the code. I think you’re pretty safe as long as you don’t show version numbers, it will help MODx built a name for itself.

Edit : I was still writing when you added this, but see my comments above...

I say it’s security through multiple levels
- obscurity
- good code

There will always be vulnerabilities. Sometimes now we dont always need to upgrade the site (if the client knows the risk). I had some joomla sites a few years back- some security patches came out - bam the next day i had 3 sites hacked through the same vulnerability.

so it’s good not to have a marker (at least for me)

You’re right of course, phpBB got in trouble this way a few years ago. But that was mainly because they had the name of the software and version number visible in the footer, it was easy to find vulnerable versions by doing a simple search on Google. A generator meta tag or even a comment in the HTML is different though.

Anyway, there is a way to find MODx sites now.. Sorry.

http://wappalyzer.com/search.php?app=56

Ignore the top result, I’ll remove it soon.

Are the sites submitted or crawled? There’s definitely a way to figure out if a site is running MODx now, but that will be changeable with Revo and Evo (eventually).

Neither, pages are scanned client side by the Firefox add-on. The name of the application and domain is then transmitted to wappalyzer.com.

I could be wrong as I am neither a programmer or security expert but can’t crackers just download MODx check for common output or detectable output like /manager or login.php in default installs. (yes the manager will be renameable in Revolution).

I do see that tracking as being valuable but adding obscurity is not in the stead of good code but a bonus layer.

Finding balance will be hard. I am sure more proggie folks could sort a tracking point that would be isolated and version independent.