This is alpha code and is not intended for those unfamiliar with PHP and/or the WordPress API.

You will also need to be familiar with the WordPress widget API.

1. Create a Facebook badge
2. Copy the script code they provide following a successful build

   <script src="http://badge.facebook.com/badge/xxxxxxx.js"></script>
   <noscript>
   	<a href="http://www.new.facebook.com/people/xxxxxx/xxxxxxx">Facebook profile</a>
   </noscript>

3. Add the following PHP function into your widget.php file with the generated code between the badge tags

   function widget_facebook($p)
   {
   ?>
   <li>
   <!-- Facebook Badge -->
   <script src="http://badge.facebook.com/badge/xxxxxxx.js"></script>
   <noscript>
   	<a href="http://www.new.facebook.com/people/xxxxxx/xxxxxxx">Facebook profile</a>
   </noscript>
   <!-- /Facebook Badge -->
   </li>
   <?
   }

4. Register the widget with your sidebar in the function.php script

   if ( function_exists('register_sidebar_widget') )
   {
   		register_sidebar_widget(__('Facebook'), 'widget_facebook', '');
   }

5. Make sure you have dynamic sidebar enabled in your sidebar.php script

   <div class="sidebar">
   <ul>
   <?php
   	if (function_exists('dynamic_sidebar'))
   	{
   		dynamic_sidebar(1);
   	}
   ?>
   </ul>
   </div>

6. Finally, update your stylesheet to override the Facebook style settings.

   .fb_root_vert
   {
   	width:195px !important
   }
    
   .fb_vert
   {
   	width:193px !important
   }
    
   .fb_object table tr td
   {
   	width:185px !important
   }
    
   .fb_badge > a
   {
   	display:block !important;
   	padding-left:50px !important;
   }
    
   .fb_badge
   {
   	background:#3B5998 !important;
   	margin-bottom:8px !important;
   }

Now that you have the code, you can add the widget to your sidebar through the WordPress widget administration screen.

That’s all. Enjoy.

I have been using WordPress as my blogging platform for a few years now. Before that was a hybrid of PHPBB and custom PHP application I wrote. WordPress works great and has robust features that make blogging a snap for the more technical (such as myself, ehem) and also for the less technical netizens out there. Now, one of these great features is the ability to upload pictures and files (content) through a web interface. What a great concept (this is where the epiphany came in) except if you weren’t planning on listing up the contents of your entire uploads folder to the world. which happens to be the case with some (okay a lot of) default installations of WordPress.

Lets say you “Google” the “Index of” any WordPress uploads folders (/wp-content/uploads). You don’t have to be a rock scientist (yes, that was a joke) to realize the possible implications. Let me give you an idea of the figure as of tonight: 4,143,000 indexes. That’s 4,143,000 WordPress installations that have directory indexes enabled and are completely wide open to crawlers and spiders that can pilfer (argh) their content.

Try it yourself: http://www.google.com/search?q=Index+of+%2Fwp-content

There are plenty of other “Index of” combinations out there:

1. “Index of /admin”
2. “Index of /password”
3. “Index of /mail”
4. “Index of /” +passwd
5. “Index of /” password.txt

Now obviously if someone is using WordPress and uploading content, it’s more than likely related to their blog, and perfectly okay for the world to sneak a peak. However, for those sites that are using WordPress as a corporate platform, with confidential information (don’t ask me why you would want to do this with WordPress…), this is a huge security issue.

Moral of the story, unplug your computer, no one is safe.

Here are a bunch I found in a forum while actually doing a search on _vti (Front Page extensions).

filetype:htpasswd htpasswd
intitle:"Index of" “.htpasswd" -intitle:"dist"
           -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurl:passlist.txt (para encontrar listas de passwords)
intitle:"Index of..etc" passwd
intitle:admin intitle:login
“Incorrect syntax near" (SQL script error)
intitle:"the page cannot be found" inetmgr
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result"
_vti_pvt password intitle:index.of
inurl:backup intitle:index.of inurl:admin
“Index of /backup"
index.of.password
index.of.winnt
inurl:"auth_user_file.txt"
“Index of /admin"
“Index of /password"
“Index of /mail"
“Index of /" +passwd
Index of /" +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin"
allintitle: “index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurl:passwd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"Index of" passwd
intitle:"Index of" people.1st
intitle:"Index of" pwd.db
intitle:"Index of" etc/shadow
intitle:"Index of" spwd
intitle:"Index of" master.passwd
intitle:"Index of" htpasswd
intitle:"Index of" members OR accounts
intitle:"Index of" user_carts OR user _cart