Hackeroid

SQL Injection: What is it?

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<header class="entry-header" style="background-color: white; color: #1b2426; font-family: 'Open Sans', sans-serif; font-size: 14px; text-align: justify;">SQL Injection is one of the many web attack mechanisms used by hackers to steal data from organizations. It is perhaps one of the most common application layer attack techniques used today. It is the type of attack that takes advantage of improper coding of your web applications that allows hacker to inject SQL commands into say a login form to allow them to gain access to the data held within your database.</header><br />
<div class="entry-content" style="background-color: white; color: #666666; font-family: 'Open Sans', sans-serif; font-size: 14px; text-align: justify;">
<div style="color: rgb(27, 36, 38) !important;">
In essence, SQL Injection arises because the fields available for user input allow SQL statements to pass through and query the database directly.</div>
<div style="color: rgb(27, 36, 38) !important;">
<strong>SQL Injection: An In-depth Explanation</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
Web applications allow legitimate website visitors to submit and retrieve data to/from a database over the Internet using their preferred web browser. Databases are central to modern websites – they store data needed for websites to deliver specific content to visitors and render information to customers, suppliers, employees and a host of stakeholders. User credentials, financial and payment information, company statistics may all be resident within a database and accessed by legitimate users through off-the-shelf and custom web applications. Web applications and databases allow you to regularly run your business.</div>
<div style="color: rgb(27, 36, 38) !important;">
SQL Injection is the hacking technique which attempts to pass SQL commands (statements) through a web application for execution by the backend database. If not sanitized properly, web applications may result in SQL Injection attacks that allow hackers to view information from the database and/or even wipe it out.</div>
<div style="color: rgb(27, 36, 38) !important;">
Such features as login pages, support and product request forms, feedback forms, search pages, shopping carts and the general delivery of dynamic content, shape modern websites and provide businesses with the means necessary to communicate with prospects and customers. These website features are all examples of web applications which may be either purchased off-the-shelf or developed as bespoke programs.</div>
<div style="color: rgb(27, 36, 38) !important;">
These website features are all susceptible to SQL Injection attacks which arise because the fields available for user input allow SQL statements to pass through and query the database directly.</div>
<div style="color: rgb(27, 36, 38) !important;">
<strong>SQL Injection: A Simple Example</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
Take a simple login page where a legitimate user would enter his username and password combination to enter a secure area to view his personal details or upload his comments in a forum.</div>
<div style="color: rgb(27, 36, 38) !important;">
When the legitimate user submits his details, an SQL query is generated from these details and submitted to the database for verification. If valid, the user is allowed access. In other words, the web application that controls the login page will communicate with the database through a series of planned commands so as to verify the username and password combination. On verification, the legitimate user is granted appropriate access.</div>
<div style="color: rgb(27, 36, 38) !important;">
Through SQL Injection, the hacker may input specifically crafted SQL commands with the intent of bypassing the login form barrier and seeing what lies behind it. This is only possible if the inputs are not properly sanitised (i.e., made invulnerable) and sent directly with the SQL query to the database. SQL Injection vulnerabilities provide the means for a hacker to communicate directly to the database.</div>
<div style="color: rgb(27, 36, 38) !important;">
The technologies vulnerable to this attack are dynamic script languages including ASP, ASP.NET, PHP, JSP, and CGI. All an attacker needs to perform an SQL Injection hacking attack is a web browser, knowledge of SQL queries and creative guess work to important table and field names. The sheer simplicity of SQL Injection has fuelled its popularity.</div>
<div style="color: rgb(27, 36, 38) !important;">
<strong>Other contents:</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
<a href="https://www.acunetix.com/websitesecurity/sql-injection/#why" style="color: #e00a14; text-decoration: none;">Why is it possible to pass SQL Queries to the database even though this is hidden behind a firewall?</a><br />
<a href="https://www.acunetix.com/websitesecurity/sql-injection/#is" style="color: #e00a14; text-decoration: none;">Is my database at risk to SQL Injection?</a><br />
<a href="https://www.acunetix.com/websitesecurity/sql-injection/#what" style="color: #e00a14; text-decoration: none;">What is the impact of SQL Injection?</a><br />
<a href="https://www.acunetix.com/websitesecurity/sql-injection/#example" style="color: #e00a14; text-decoration: none;">Example of a SQL Injection Attack</a><br />
<a href="https://www.acunetix.com/websitesecurity/sql-injection/#how" style="color: #e00a14; text-decoration: none;">How do I prevent SQL Injection attacks?</a></div>
<div style="color: rgb(27, 36, 38) !important;">
<strong><a href="https://draft.blogger.com/blogger.g?blogID=510460206084563917" id="why" name="why" style="color: #e00a14;"></a>Why is it possible to pass SQL queries directly to a database that is hidden behind a firewall and any other security mechanism?</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
Firewalls and similar intrusion detection mechanisms provide little or no defense against full-scale SQL Injection web attacks.</div>
<div style="color: rgb(27, 36, 38) !important;">
Since your website needs to be public, security mechanisms will allow public web traffic to communicate with your web application/s (generally over port 80/443). The web application has open access to the database in order to return (update) the requested (changed) information.</div>
<div style="color: rgb(27, 36, 38) !important;">
In SQL Injection, the hacker uses SQL queries and creativity to get to the database of sensitive corporate data through the web application.</div>
<div style="color: rgb(27, 36, 38) !important;">
SQL or Structured Query Language is the computer language that allows you to store, manipulate, and retrieve data stored in a relational database (or a collection of tables which organise and structure data). SQL is, in fact, the only way that a web application (and users) can interact with the database. Examples of relational databases include Oracle, Microsoft Access, MS SQL Server, MySQL, and Filemaker Pro, all of which use SQL as their basic building blocks.</div>
<div style="color: rgb(27, 36, 38) !important;">
SQL commands include SELECT, INSERT, DELETE and DROP TABLE. DROP TABLE is as ominous as it sounds and in fact will eliminate the table with a particular name.</div>
<div style="color: rgb(27, 36, 38) !important;">
In the legitimate scenario of the login page example above, the SQL commands planned for the web application may look like the following:</div>
<div style="color: rgb(27, 36, 38) !important;">
<span style="color: blue;">SELECT count(*)<br />FROM users_list_table<br />WHERE username=’FIELD_USERNAME’<br />AND password=’FIELD_PASSWORD”</span></div>
<div style="color: rgb(27, 36, 38) !important;">
In plain English, this SQL command (from the web application) instructs the database to match the username and password input by the legitimate user to the combination it has already stored.</div>
<div style="color: rgb(27, 36, 38) !important;">
Each type of web application is hard coded with specific SQL queries that it will execute when performing its legitimate functions and communicating with the database. If any input field of the web application is not properly sanitised, a hacker may inject additional SQL commands that broaden the range of SQL commands the web application will execute, thus going beyond the original intended design and function.</div>
<div style="color: rgb(27, 36, 38) !important;">
A hacker will thus have a clear channel of communication (or, in layman terms, a tunnel) to the database irrespective of all the intrusion detection systems and network security equipment installed before the physical database server.</div>
<div style="color: rgb(27, 36, 38) !important;">
<strong><a href="https://draft.blogger.com/blogger.g?blogID=510460206084563917" id="is" name="is" style="color: #e00a14;"></a>Is my database at risk to SQL Injection?</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
SQL Injection is one of the most common application layer attacks currently being used on the Internet. Despite the fact that it is relatively easy to protect against SQL Injection, there are a large number of web applications that remain vulnerable.</div>
<div style="color: rgb(27, 36, 38) !important;">
According to the Web Application Security Consortium (WASC) 9% of the total hacking incidents reported in the media until 27th July 2006 were due to SQL Injection. More recent data from our own research shows that about 50% of the websites we have scanned this year are susceptible to SQL Injection vulnerabilities.</div>
<div style="color: rgb(27, 36, 38) !important;">
It may be difficult to answer the question whether your web site and web applications are vulnerable to SQL Injection especially if you are not a programmer or you are not the person who has coded your web applications.</div>
<div style="color: rgb(27, 36, 38) !important;">
Our experience leads us to believe that there is a significant chance that your data is already at risk from SQL Injection.</div>
<div style="color: rgb(27, 36, 38) !important;">
Whether an attacker is able to see the data stored on the database or not, really depends on how your website is coded to display the results of the queries sent. What is certain is that the attacker will be able to execute arbitrary SQL Commands on the vulnerable system, either to compromise it or else to obtain information.</div>
<div style="color: rgb(27, 36, 38) !important;">
If improperly coded, then you run the risk of having your customer and company data compromised.</div>
<div style="color: rgb(27, 36, 38) !important;">
What an attacker gains access to also depends on the level of security set by the database. The database could be set to restrict to certain commands only. A read access normally is enabled for use by web application back ends.</div>
<div style="color: rgb(27, 36, 38) !important;">
Even if an attacker is not able to modify the system, he would still be able to read valuable information.</div>
<div style="color: rgb(27, 36, 38) !important;">
<strong><a href="https://draft.blogger.com/blogger.g?blogID=510460206084563917" id="what" name="what" style="color: #e00a14;"></a>What is the impact of SQL Injection?</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
Once an attacker realizes that a system is vulnerable to SQL Injection, he is able to inject SQL Query / Commands through an input form field. This is equivalent to handing the attacker your database and allowing him to execute any SQL command including DROP TABLE to the database!</div>
<div style="color: rgb(27, 36, 38) !important;">
An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. Depending on the back-end database in use, SQL injection vulnerabilities lead to varying levels of data/system access for the attacker. It may be possible to manipulate existing queries, to UNION (used to select related information from two tables) arbitrary data, use subselects, or append additional queries.</div>
<div style="color: rgb(27, 36, 38) !important;">
In some cases, it may be possible to read in or write out to files, or to execute shell commands on the underlying operating system. Certain SQL Servers such as Microsoft SQL Server contain stored and extended procedures (database server functions). If an attacker can obtain access to these procedures, it could spell disaster.</div>
<div style="color: rgb(27, 36, 38) !important;">
Unfortunately the impact of SQL Injection is only uncovered when the theft is discovered. Data is being unwittingly stolen through various hack attacks all the time. The more expert of hackers rarely get caught.</div>
<div style="color: rgb(27, 36, 38) !important;">
<strong><a href="https://draft.blogger.com/blogger.g?blogID=510460206084563917" id="example" name="example" style="color: #e00a14;"></a>Example of a SQLInjection Attack</strong></div>
<div style="color: rgb(27, 36, 38) !important;">
Here is a sample basic HTML form with two inputs, login and password.</div>
<div style="color: rgb(27, 36, 38) !important;">
<span style="color: blue;"><form method="post" action="http://testasp.vulnweb.com/login.asp"></span></div>
<div style="color: rgb(27, 36, 38) !important;">
<input name="tfUName" type="text" id="tfUName"></div>
<div style="color: rgb(27, 36, 38) !important;">
<input name="tfUPass" type="password" id="tfUPass"></div>
<div style="color: rgb(27, 36, 38) !important;">
</form></div>
<div style="color: rgb(27, 36, 38) !important;">
The easiest way for the login.asp to work is by building a database query that looks like this:</div>
<div style="color: rgb(27, 36, 38) !important;">
<span style="color: blue;">SELECT id<br />FROM logins<br />WHERE username = '$username'<br />AND password = '$password’</span></div>
<div style="color: rgb(27, 36, 38) !important;">
If the variables $username and $password are requested directly from the user's input, this can easily be compromised. Suppose that we gave "Joe" as a username and that the following string was provided as a password: anything' OR 'x'='x</div>
<div style="color: rgb(27, 36, 38) !important;">
<span style="color: blue;">SELECT id<br />FROM logins<br />WHERE username = 'Joe'<br />AND password = 'anything' OR 'x'='x'</span></div>
<div style="color: rgb(27, 36, 38) !important;">
As the inputs of the web application are not properly sanitised, the use of the single quotes has turned the WHERE SQL command into a two-component clause.</div>
<div style="color: rgb(27, 36, 38) !important;">
The 'x'='x' part guarantees to be true regardless of what the first part contains.</div>
<div style="color: rgb(27, 36, 38) !important;">
This will allow the attacker to bypass the login form without actually knowing a valid username / password combination!</div>
</div>
</div>

SQL Injection: What is it?

SQL Injection is one of the many web attack mechanisms used by hackers to steal data from organizations. It is perhaps one of the most common application layer attack techniques used today. It is the…

21 Mar 2014

How to Create a Strong Password?

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUnJW40KV04PWjbBlDVCxH5e12PS0LklYtbUrQRK6sTPoyv-YGWM6PYoCyBfc98UhKXHsOPrnGXLPmzNdlGqGROfEuRTQI-1oSBWgfpCpvgo18buybgWtdZtleQ2cjcHgv5fjIgUl3qog/s1600/strong-passwords.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUnJW40KV04PWjbBlDVCxH5e12PS0LklYtbUrQRK6sTPoyv-YGWM6PYoCyBfc98UhKXHsOPrnGXLPmzNdlGqGROfEuRTQI-1oSBWgfpCpvgo18buybgWtdZtleQ2cjcHgv5fjIgUl3qog/s400/strong-passwords.jpg" width="400" /></a></div>
<br />
For safe keeping of your personal accounts and email id's you need to keep a<i><u> strong password</u></i>. <br />
Always people keep <i>password</i> which are easy to remember. They don't understand thar these easy passwords can also be guessed by hacker. <br />
So in this Post I'm going to help you make the simple passwords strong one.<br />
<b><u>Step 1:</u></b><b> Take your Password:</b> <br />
I'll take an example : <b><u>compared</u></b><br />
<i>We know</i><i> </i><i>that</i> <u><b>compared</b></u> is a simple password and it can be <i>hacked </i>by <i>hackers.</i><br />
It can be made a <i>strong </i>Password.<br />
<u><b>Step 2: </b></u><b>Modify your Password :</b><br />
I have taken my <i>Passwor</i><i>d </i>as <b><u>compared</u></b>.<br />
Take key words that will be same as your password like (a→@ ) so you can make your password like this:<br />
<b><u>comp@red</u></b><br />
It is a fairly strong password and you won't forget it either. <br />
You can make even <i>harder </i>Password by adding more symbols :<br />
<b><u>comp@r£d</u></b><br />
I have used <b>£ </b>instead of <b>e </b>(<b>e →£)</b>. <br />
<u><b>Step 3: </b></u><b>Simpler but effective:</b><br />
If you have troubles in remembering and replacing <i><u>words</u></i> with <i><u>symbols</u></i>. <br />
Then i will give you a simple advice add exclamatory mark in your <i>password</i> :<br />
<b><u>compared!!!</u></b><br />
This is also a strong password. You could try even question marks if you'd like to. <br />
Create your own sets of password which can be in hackable. [<i>My piece of advice is </i><b>be creative</b>]. Enjoy!!!...<br />
</div>

How to Create a Strong Password?

For safe keeping of your personal accounts and email id's you need to keep a strong password. Always people keep password which are easy to remember. They don't understand thar these easy passwords …

25 Feb 2013

Want to know about Kundapura?

Want to know about Kundapura?

If you want to know about Kundapura then visit Kundapura City.com This Blog will give the full detail of Kundapura and its current events. …

11 Feb 2013

Microsoft has launched a scathing attack on Google’s privacy practices in an attempt to win customers over to Outlook.

<p>Microsoft has launched a scathing attack on Google’s privacy practices in an attempt to win customers over to Outlook. The tactic looks to be the work of a former political advisor to Bill and Hillary Clinton.</p>
<p>The campaign is the continuation of a previous attack on the Google Shopping tool. Microsoft is trying to combine both attacks under a somewhat clunky slogan suggesting that customers have been “Scroogled.” <br>
The point of contention here is the way Google’s computers scan the contents of Gmail messages to deliver more relevant advertising at the top of the screen when you read the message. Microsoft contends this is a complete invasion of privacy and that many users are unaware of it. It also stresses that Outlook doesn’t use such tactics.<br>
A dedicated website for the campaign cites a survey of Gmail users that shows 87 percent “believe using email content to serve ads is an invasion of their privacy.” Rather oddly the same survey found that 71 percent of Gmail users were unaware of the practice.<br>
That appears to mean that nearly one in five Gmail users known what Google is doing, think it’s an invasion of privacy, and use the service anyway. It’s certainly a comprehensive piece of work, complete with statistics, quotes (Google chief Eric Schmidt saying “The Google policy on a lot of things is to get right up to the creepy line and not cross it”) and dramatic videos.<br>
One of these even shows a close- up of a face with the eyes reacting to the contents of an e-mail, heavily implying that a human<br>
being reads through Gmail messages. Google says that doesn’t happen, and it’s  certainly a practical impossibility that it’s standard practice. The attacks are said to have had some input from Mark Penn, a former political campaigner who now works for Microsoft. He’s previously told the Wall Street Journal that Microsoft needs to do more to get die-hard Google users to consider breaking their habits. It doesn’t seem as if consumers are too taken with the issue however. As part of the campaign Microsoft has set up a petition trying to force Google to stop scanning e mails. At the time of writing, a mere 2,186 people had signed it.</p>
<div class='separator' style='clear: both; text-align: center;'> <a href='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfmhmYOIzhTmhTt5ipKbi_ZaPMb2AHlj-eYpTCP0qyXAm9O_KQSbblSamx4YXagMAXOZUWHNZArs_d1Pry4a2gGOro2eV-dQZ-qW7AONY_sMWL6O_Rg9L7j-eIdhaw81tPOSdJ8Mht4ao/s1600/scroogled.png' imageanchor='1' style='margin-left: 1em; margin-right: 1em;'> <img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfmhmYOIzhTmhTt5ipKbi_ZaPMb2AHlj-eYpTCP0qyXAm9O_KQSbblSamx4YXagMAXOZUWHNZArs_d1Pry4a2gGOro2eV-dQZ-qW7AONY_sMWL6O_Rg9L7j-eIdhaw81tPOSdJ8Mht4ao/s640/scroogled.png" /> </a> </div>

Microsoft has launched a scathing attack on Google’s privacy practices in an attempt to win customers over to Outlook.

Microsoft has launched a scathing attack on Google’s privacy practices in an attempt to win customers over to Outlook. The tactic looks to be the work of a former political advisor to Bill and Hillary…

10 Feb 2013

Judge refuses to triple billiondollar Samsung payout

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWdBwE53U8pZs63Tp2bUaTBJ2kqi4wDeNju6J1-EmoRROht1C0uPpAU6-zcyXlc00ekC-Sowb1Sw6Lscr_fe8cvsqujHLi2jwyQlMeoCVbgDLogID3jlc6Jn4riNViNFh-aHjux8ePhGs/s1600/Samsung-Logo.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Samsung Logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWdBwE53U8pZs63Tp2bUaTBJ2kqi4wDeNju6J1-EmoRROht1C0uPpAU6-zcyXlc00ekC-Sowb1Sw6Lscr_fe8cvsqujHLi2jwyQlMeoCVbgDLogID3jlc6Jn4riNViNFh-aHjux8ePhGs/s1600/Samsung-Logo.jpg" title="Samsung Logo" /></a></div>
<i><br /></i>
<i>A courtruling this week may save Samsung more than two billion dollars. That may not be much comfort though, as it still faces a billion dollar payout to Apple.</i><br />
<i>Judge Lucy Koh have made a series of rulings this week on the ongoing legal battles between the two companies. The various patent claims, based on alleged similarities between smartphones and tablets, are the subject of two totally separate trials, both overseen by Koh.</i><br />
<i>The first was the one that led to a $1.05 billion award against Samsung last year, while the second has yet to get to court and deals with devices released since the original dispute began.</i><br />
<i>On the original trial, Koh has issued four sets of rulings this week. The first is a simple rejection of Samsung’s suggestion that she throw the whole case out and start again because the way she ran the trial hearings wasn’t fair. The second ruling rejects Samsung’s claim that the Apple patents in question were simply too vague to be enforcable.</i><br />
<i>Koh’s third ruling involves the issue of whether Samsung committed its infringement wilfully, meaning it knew it was doing wrong. That can allow a judge to triple a damages award made by a</i><br />
<i>jury. Although the jury said Samsung had acted wilfully regarding five out of the seven cases, Koh has exercised her right to ignore this verdict and leave the damages award untouched. She says that although Samsung did indeed breach the patents and must pay the price for doing so, it reasonably (if incorrectly) believed it was acting within the law.</i><br />
<i>Finally Koh threw out a series of Apple objections that effectively asked her to overturn the jury’s decision to reject some of its patents, along with a request for an extra $400 million in compensation because, well, why not. </i><br />
<i>In effect then, Koh simply said everything decided in the original trial verdict stands. She still has to deal with a Samsung request that either she reduce the $1.05 billion or allow a new jury to decide a new figure, but this doesn’t look particularly likely to happen. Once that’s out the way we can move on to Samsung’s formal appeal against the original verdict.</i><br />
<i>Meanwhile, in the separate second case dealing with the later devices (which is set to make it to court in March 2014), Koh has refused an Apple application for a pre-trial sales ban on Samsung’s Galaxy</i><br />
<i>Nexus.</i><br />
<i>Perhaps inevitably, Apple plans</i><br />
<i>to appeal this ruling.</i></div>

Judge refuses to triple billiondollar Samsung payout

A courtruling this week may save Samsung more than two billion dollars. That may not be much comfort though, as it still faces a billion dollar payout to Apple. Judge Lucy Koh have made a series of r…

05 Feb 2013

Load more posts