Archive for category: Uncategorized

SQL injection is a common hack used to run statements on your database server. If a hacker gains access to your SQL database, he can steal, delete or insert information. SQL injection hacks are tedious and complex to fix, so it’s best if a website owner takes precautions before becoming a victim. Before you can protect a website, you need to know how SQL injection works.

 

Understanding SQL

 

Before you can understand how SQL injection works, you need some background on the SQL language. SQL is the language for MySQL, SQL Server, and Oracle. These three database engines have slightly different syntax, but all of them use four basic functions: INSERT, DELETE, SELECT, and UPDATE. Hackers can use any one of these functions to manipulate your data, so you must protect against any type of SQL injection.

 

Let’s take a basic SQL example. Take a look at the following code:

 

select * from customer

 

The above statement queries all records in the customer table and returns them all including every column in the table. Basically, this query returns all of your customer information. For most queries, you don’t want to return all records and columns. You use the SQL WHERE clause to filter records with only a specific set of values. For instance, the following SQL code returns all records where the customer’s first name is “Joe”:

 

select * from customer where first_name=’joe’

 

The above code returns only records where the first name is “joe,” and this type of statement is where hackers take advantage.

 

SQL Injection Syntax

 

SQL injection can be very complex, but let’s take a look at some simple examples. Once you understand simple concepts, you can dive deeper into more complex SQL injection attacks.

 

SQL injection usually happens through your form submissions. The following code is an example of a form that asks the user to enter a first name.

 

<form method=”post”>

<input type=”test” name=”first_name” id=”first_name”>

<input type=”submit” value=”Submit Form”>

</form>

 

Typically, you’d expect the user to enter a first name and submit the form. However, this is where hackers take advantage of poorly constructed website code. Suppose this form inserts a new record into your tables. The following SQL code is an example of an INSERT statement:

 

insert into customer (first_name) values (‘ + $_POST[“first_name”] + ‘);

 

The above code builds a SQL statement from the form’s first_name variable. Incidentally, the above syntax used is PHP, but this method works with any language. The semicolon terminates the statement and lets you place multiple SQL statements within the same line of code.

 

 

The trick to SQL injection

 

The apostrophe character opens and closes string values in SQL. Hackers prematurely terminate strings and run their own SQL statements. Suppose the hacker entered the following value into the form’s first_name input text box:

 

‘ ); select * from customer; —

 

This example would then build the following SQL statement and run it on your database:

 

insert into customer (first_name) values (” ) ; select * from customer; —

‘);

 

If you’re new to SQL, this can be difficult to understand. Notice that there are two apostrophe characters built in the INSERT statement. The hacker’s SQL statement inserts a blank value into the first_name column, but then the statement is terminated with a SELECT statement appended to the end. The SELECT statement then retrieves all the data in your customer table. The goal with this SQL injection hack is to steal your data.

 

Hackers can also delete data, which means you need to recover data from backups. The hacker can replace the SELECT statement with the following SQL code:

 

drop table customer;

 

Building the SQL statement, you now have the following code:

 

insert into customer (first_name) values (” ) ; drop table customer; —

‘);

 

The “drop table” statement completely wipes the table from your database. The only way to recover the data is to pull it from your backups. If your backup is a week old, you’ve just lost a week’s worth of data. This issue can be devastating to your business, especially if you work with orders.

 

How Do You Defend from SQL Injection Attacks?

 

Even developers who think they’ve protected a website from SQL injection can be surprised when a hacker finds a hole in security. The best way to defend against SQL injection is to use stored procedures. These are called “prepared statements” in PHP. Stored procedures are pre-designed SQL functions that you can reuse throughout your entire website code. They make it faster to create websites that use backend databases, because you don’t need to recreate SQL code for each page. Stored procedures take more time to set up initially, so most coders choose the faster way of development and build dynamic statements such as the one used in the SQL injection examples.

 

When a hacker attempts to use SQL injection and you use stored procedures, the apostrophe characters are sent as literals. This means that instead of terminating a string and executing malicious SQL, the database inserts the apostrophe as part of the data’s value.

 

Each programming language has its own form of stripping or escaping special characters in SQL statements. You must use these functions when you don’t use stored procedures in dynamically built SQL code. For instance, most WordPress developers use dynamically built SQL statements in their plugins. Poorly formed SQL statements are why WordPress is constantly a target of attack from hackers.

 

If you own a WordPress site

Update your WordPress installation often. New versions patch any current security issues. You should also update any plugins. Plugins are written by seasoned as well as new developers, so be wary of the plugin you install on your site. Even big plugin developers have found security flaws in their software. If the plugin developer does not keep up with the latest WordPress versions, you should probably choose a different plugin for website functionality.

 

You can also use penetration tools to help identify security holes such as SQL injection in a website. Most hackers use automated scripts that run through your forms and identify where you are susceptible. Decent PenTesters however, will do quite a bit more.  These penetration tools perform the same methods. Just make sure the penetration tools have several SQL scripts that identify simple and complex SQL injection vulnerabilities.

 

SQL injection is a serious security flaw on the web, so always make sure your site is secured. If you think you’re not a target, think again. Hackers just need to run scripts to automate a search on the web to find vulnerable sites. It doesn’t take much to protect from SQL injection, but it can take days or even weeks to recover if you are successfully hacked.

 

There are numerous WiFi hacking tools available on the web today that are capable of helping anyone hack into wireless networks. Some of the most popular wireless hacking tools include Aircrack, CoWPAtty, AirSnort, and Kismet.

 

The most popular WiFi protocols are WEP, WPA, and WPA2 systems. WPA2 systems are typically the most secure system, however most WiFi systems installed over five years ago are likely to run on WPA. WiFi hacking is far easier than it seems, and organizations are advised to either take massive steps to boost WiFi security or rely on more secure wired connections for security purposes.

 

You literally only need a basic laptop to hack a WiFi network

 

The most common types of Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) networks are hacked within a matter of minutes with a simple laptop and free software that can be easily downloaded off the net. These old networks use a smaller key that reduces the strength of data encryption in comparison to a WPA2 network. For example, with Aircrack-ng or AirSnort, a hacker can rapidly recover the encryption keys of a WEP network in minutes.

 

WiFi protocols have become progressively secure

 

The WPA was developed to address the problems with WEP and it initially achieved this by relying on TKIP. It added a few security features such as key mixing function and a re-keying mechanism to increase the strength of WiFi networks. However, by 2009, this network was no longer secure, and WPA2 had make significant inroads in the market, having been released in 2004.

 

Security flaws in the WPA2 led to the development of WiFi Protected Setup (WPS) in 2006. WPS was created for home users to setup secure networks without being bogged down by technical details. Unfortunately, WPS added security flaws to wireless networks and made it easier for hackers to bypass and access WPA2 networks. WPS is susceptible to brute force attacks as well as the presence of pre-shared keys passes on the vulnerabilities. One of the only remedies is to turn off the WPS, which is not always feasible.

 

Features of Good WiFi Hacking Tools

 

Most good WiFi hacking tools actually share a great deal of similarities. Legit software is able to hack all protocols and is safe to buy from reputable vendors. If you seek to download WiFi hackers, be extremely careful about the type of hackers you are downloading. Avoid the dark web as malicious hackers may include unwanted viruses adversely affecting security.

 

With software such as AirSnort and WireShark, you can easily capture live packets and analyze network traffic at the micro-level. You may require some degree of technical knowledge to hack a normal home network. However, you will certainly need good technical knowledge to attack a secure, corporate network. Networks that run over Ethernet, may opt for software such as Fern to determine the viability and security.

 

This post is meant for educational purposes only, it is illegal to hack equipment you do not own without written authorization.

Nessus is one of the most popular vulnerability assessment tools. Capable of running more than 1,200 checks and scans it is great starting point for enumerating your security apparatus.

 

It is free to use for personal users in a non-enterprise setting, and has consistently been rated as one of the best vulnerability scanners in the world. Furthermore, it is estimated that Nessus is used by over 75,000 organizations across the globe.

 

How does Nessus work?

 

In essence, Nessus scans for DOS attacks, default passwords, misconfiguration, and threats that could allow external hackers to access sensitive data. It can also help an enterprise prepare for PCI DSS audits. Nessus will protect your online space by running malware detections, scanning web applications, as well as even running compliance checks.

 

Nessus will assess the health of the TCP/IP stacks to prevent possible denial of service attacks. Organizations have access to multiple scanning modes and computers in the network can share scanning resources in order to increase the efficiency of the process. The Nessus plugin field enables enterprises to guard themselves against new threats and the field is constantly updated. The security scanner integrates password vault solutions and mobile device management (MDM) to complement its vulnerability assessment program.

 

Features of Nessus

 

The current version of uses a web server that provides the exact functionality as the client and it makes no assumptions about network or computer server configurations. This ensures that it can track vulnerabilities that lesser scanners could miss. It also allows users to develop specific tests for their networks by providing scripting language. In addition, the software comes with a plugin interface, and users can also download some plugins for free. Enterprises can download specific plugins to deal with specific threats. Essentially, the software allows a firm to extend its level of functionality.

 

Nessus makes it extremely simple to operate both the users and the product itself. It is comprised of two parts: a server named nessusd and a client. The server component runs tests and scans. The client is provides the server with operational details. As the server exists for Unix/Linux platforms, individual administrators need to constantly schedule tests through a client written for the platform in question. The clients are available for all platforms.

 

Nessus functions by initially conducting a port scan via one of its internal port scanners. This allows the product to determine which ports are exploitable and it attempts to infiltrate the ports in various manners.  Security engineers often use Nessus to audit systems to ensure proper configuration for particular policies. Which is especially important for large-scale firms and government organizations.

 

Are you looking to make meaningful improvements to your security posture? Hire our renowned Ethical hackers Today!

SQL injection is a malicious code injection technique and is one of the most common hacking techniques on the web. Capable of attacking applications or websites that rely on an SQL-based database. It is also one of the oldest as well as one of the most dangerous types of threats.

An attacker will add, alter, or eliminate records thereby affecting data integrity. Hackers have been using SQL injection to steal and tamper with data throughout the history of the internet because it works. Ironically, it is actually incredibly easy to prevent.

 

How does an SQL injection work?

 

SQL injections typically exploit security loopholes in a website or application’s software. First and foremost, the hacker needs to locate an input within the application that uses an SQL query in order for a SQL injection to work. This is often a username or a password field.  Second, the user inputs an SQL statement allowed by the website. This task is often automated by the hacker to make it more effective as well as well as much less time consuming. At a high level that is about all it takes to perform an SQL injection attack…

 

How bad can an SQL injection be?

 

Since the programming language SQL was developed to manage data located in a Relational Database Management System (RDBMS). SQL injections are therefore primarily capable of maliciously altering the data stored in an RDBMS. Typically, SQL attacks are used to impersonate a user and bypass authentication tools and steps. SQL injections may also choose data on the basis of a query and output the query’s results.

 

Internal networks with poor security may be vulnerable to SQL injection attacks.  External threats are much more common wherein SQL is used to tamper with sensitive data in an RDBMS.

 

How can you prevent SQL injections?

 

As a common and well-known attack, it is not too difficult to shield yourself from SQL injections. You can start by reducing the number of permissions on database logins to shield some aspects of the system. Minimize login details allowing only what is necessary. Developers should avoid allowing dynamic queries and prevent user input from affecting the logic of the query.

 

Another common method is to use parametrized statements as they do not embed user input into a statement. Such statements are capable of only storing values of a specific type, and the placeholders involved do not store random SQL fragments. Hence, the SQL injection is considered an invalid parameter. In such cases, parameters are normally scalar in nature and the SQL statements are fixed.

 

The Data Protection Act (DPA) passed in 1998 by the Parliament of the United Kingdom.  It’s basically an update to how the data of living people is to be legally handled and utilized in the United Kingdom. The act was a direct response to the growth of the Internet and is intended to prevent misuse of valuable personal information. The original DPA was passed in 1984, and the updated act sought to include elements from the European Data Protection Directive. It governs the obtaining, usage, disclosure, and holding of ‘personal data.’

 

The act is one of the most complex legislative texts in the UK, and it consists of six major Parts, which are followed by sixteen explanatory Schedules. The Schedules are detailed explanations of all the Parts and they are filled with diverse legal interpretations and contingency situations where the application of the act may seem confusing.

 

Defining personal data

 

The act was created to allow individuals to have a greater say of how their data is handled.  “Personal Data”  is defined in the Act as any data that can be used to identify a living person. The act covers information held on computers and information stored in relevant filing systems as accepted under UK law. There are however some notable exceptions to this act and they are provided in Part IV of the legislative text. This is detailed in Sections 28, 29, and 36 and the exceptions are national security, crime & taxation, and domestic purposes respectively.

 

Fundamental principles of the Data Protection Act

 

The data protection act lists eight fundamental principles. They state that personal data shall be:

 

1. processed lawfully and fairly
2. updated periodically to reflect current formation
3. retained only while it is justifiably required
4. acquired only when there is a clear lawful need
5. adequate, relevant, and not excessive
6. processed while keeping in mind the rights of the individuals involved
7. guarded against unjust and authorized usage and against accidental damage, destruction, or loss
8. shielded from transfer outside the EEA unless the country or location specifically guarantees the rights of the data subjects

 

When can data be ‘processed’?

 

The first principle states that data must be ‘processed fairly and lawfully.’ Schedule 2 of the act covers the six conditions, one of which has to be met, that define what ‘fairly processed’ means.

 

These six conditions are when;

 

• An individual has provided consent for the act of processing
• Processing is required for contractual purposes
• Processing is needed for some form of legal obligation
• The interests and rights of the subject need to be guarded
• Some vital public function has to be undertaken
• Processing is required to follow through the legitimate, legal interests of a third party or a data controller

 

Only when one of these six conditions are met can data be processed.

 

Certain aspects are more strongly protected

 

In order to shield the rights of minorities and more vulnerable sections of the society, the act provides tougher legal protections for certain types of sensitive personal data such as sexual health, criminal rap sheet, ethnicity, religion, general health, and political viewpoints. All of these protections come under the term ‘sensitive personal data’ as defined by the legislative text. As most of this information is private and could easily be used to target or discriminate against certain sections of the population, it must be protected accordingly. Schedules 2 and 3 specifically deal with these issues.