Username:
Password:
Remember me:
Register
Back to the menu

Back to forum: Web Programming (HTML, JS, CSS, PHP, MySQL)


Search forums via Google


1 Users appreciate this thread.

[PHP/MYSQL/SECURITY] Web Vulnerabilities List
Started by CoolApps
(2014-07-25 11:23:56)
CoolApps (2014-07-25 11:23:56)
In this thread, I will cover some web vulnerabilities, I will also add more when I do get some straight forward information on how to attack and prevent.

The reason I've made the thread is so that web developers can understand these vulnerabilities more and can then solve these type of issues with clear knowledge of how it works. If they know how it works then they can find the right things to sort them out easily without just randomly grabbing some script online to fix it.

Please note that the intention of this thread is for you to test your site, patch anything that needs patching and as I've said for web developers who need to know how they work, this means NOT hacking and altering any databases on a persons site using a tool (SQLMAP etc) or manually (URL) without permission.

Disclaimer: I'm not responsible for any actions applied on ANYTHING by reading this, basically you're responsible for any damage caused and I shall not be involved. This doesn't make you an ultimate HAX0R, ok?, be mature with this knowledge.



1. SQL Injection
Yeah, you saw this coming. This is the most basic thing you should sort out because of its results being deadly if your site uses a database.
The reason I said that is because people can possibly execute ANY SQL Query which you can on phpMyAdmin (some queries are not allowed such as deleting the database unless it's going to be done manually).

How to cause show
You can do this in a few ways, most often via POST and GET parameters. To do a quick test, enter a single quote in a text field or URL (?id=1' and press enter. If you got an error then you can try entering doing a space after the single quote and enter a SQL query. Remember that the errors can be different. You can try doing 1=1' (meaning user ID 1, you can change the one's to two's to select user 2) as well. If you get a boolean SQL error then not only it shows that your vulnerable but the page was selecting a row which could be text only and not integer so it couldn't return true nor false.

How it works show
So lets say you've set up a new form and you've got a text box which selects and returns the results. The query can be 'SELECT * FROM results WHERE id='$idsub'' so it's currently empty (no input yet). If you submit with a single quote, the query won't look right as it returns SELECT FROM results WHERE id='''. The problem is now that the query has a early close and you can possibly execute an other query. There are many methods of injecting.

How to prevent? show
You have to real escape your query before it gets inserted into the query.
So using the function mysql_real_escape_string() or mysqli_real_escape_string() will escape the quotations for you. This will make ' into \'.


Cookie-based SQL Injections:
This one is the same as SQL Injection but instead stored on a cookie which can be more effective.
How to cause show
All you do is do the same as SQL injections but instead do 1=1' or something else within a cookie using a cookie editor.

How to prevent? show
Real escape your cookies.


Cookie Hijacking:
Cookie hijacking is in many forms, most popularly known from MITM (Main-In-The-Middle) attacks (this is a local network attack). You should be able to easily solve that using SSL but I'm not wanting to talk about that though.
The cookie hijacking type I want to talk about is to do with altering the content of the cookies.
You may not want this to happen on your site since anyone can login as anyone.
How to cause show
You need a cookie editor to preform this, I use 'EditThisCookie' on Chrome. All you need to do is right-click on the site you want to test it on (should be yours unless you've got permission to do so), click on 'EditThisCookie' and edit the username to someone elses.

How to prevent? show
You have to select the username and password in the query and check if the column is not 1 by using mysql_num_rows() or mysqli_num_rows(). You can use an IF statement and set up a logout this way or place your own message, who knows?


XSS Injection:
I have not researched much of this so some information *MAY* be wrong. If you do have things to add on to this then please do explain.
XSS Injection is a bit like SQL injecting but instead of singular quotes, it's JavaScript being submitted. This is deemed to stay persistent on the server (remember, I haven't looked much into this).
If your site does get this injected, then you and any other user will always get that JavaScript executed. Remember that people can use src for JavaScript so they can link your page to an infected script.
How to cause it show
As I've said above, all you do is submit (By GET (?user= <script>alert("Hello!"</script> or POST (just plain JavaScript in a text field)) some JavaScript code.

How it works show
Again, I don't know about the persistent part but I do know that the special characters (<> etc) do get rendered as actual tags.

How to prevent? show
I use htmlspecialchars() to do the job. It replaces the actual thing with a HTML code assigned to it so it doesn't get rendered as a tag.


This is just a basic guide. If you know some valid ones which aren't listed, be sure to mention it and I'll look into it.

This post has been edited one or more times, the last time was:
2014-08-04 16:36:35
Newer account: NodePoint
DrakeJericho (2014-07-26 16:40:08)
cool
 

Log in to submit a comment

This topic's ID: 72877

Back to forum: Web Programming (HTML, JS, CSS, PHP, MySQL)



Total registered users: 8321
New registered users today: 7
Newest registered user: ElegantVulpes

©  Copyright 2026 3DSPlaza. All Rights Reserved