Hacker News

points by mdrzn 2 days ago | 0 comments

"Every Hatamoto install gets its own private admin address."

This might be more inconvenient than a feature, since if I deploy websites for customers I'd have to write down what's the equivalent of wp-admin for each website.

[–] zenincognito 2 days ago

The number one hit on most wordpress install and all other static site logs I have had has been /wp-admin and /wp-admin/install.php .. Infact, right not one of the hatamoto instances is reporting top hit as /wp-admin/install.php

[–] prepend 1 day ago

Right, me too. I assume everyone running PHP had tons of hits to that. Been that way for like 20 years, but that doesn’t mean probers get past that.

[–] nbajka 1 day ago

I once copied the wordpress files onto a new domain and a few minutes later a bot had already accessed /wp-admin/install.php and it helpfully installed the site for me using a database of their own to get RCE.