IT technologies and concepts explorer and analyser in the web.

  • RSS
  • Delicious
  • Digg
  • Facebook
  • Twitter
  • Linkedin

New IT Concepts

Share Your Comments

  • Virtualization - The new technology evelution

    Virtualization, in computing, is the creation of a virtual (rather than actual) version of something, such as a hardware platform, operating system, a storage device or network resources.....

  • http://ittechnologies.blogspot.com/2011/04/common-security-vulnerabilities-in-e.html

    Security Vulnerabilities in E-Commerce Systemin

    Most of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software and poor design of such websites. Other factor is user awareness of security vulnerabilities.

  • VPN - Virtual Private Network

    VPN is a technology which is making secure private network through the public accessible network infrastructure. Virtual Private Network represent by the short name VPN. ...

  • Saas - Cloud Computing

    The cloud computing : is based on this three concepts. IaaS (Infrastructure as a service), PaaS (Platform as a Service) and SaaS (Software as a Service).

Showing posts with label Internet. Show all posts
Showing posts with label Internet. Show all posts
Posted by Priyan Fernando - - 0 comments

Multi-Protocol Label Switching (MPLS) provides a mechanism for forwarding packets for any network protocol. It was originally developed in the late 1990s to provide faster packet forwarding for IP routers (see RFC 3031). Since then its capabilities have expanded massively, for example to support service creation (VPNs), traffic engineering, network convergence, and increased resiliency.
MPLS is now the de-facto standard for many carrier and service provider networks and its deployment scenarios continue to grow.
Traditional IP networks are connectionless: when a packet is received, the router determines the next hop using the destination IP address on the packet alongside information from its own forwarding table. The router's forwarding tables contain information on the network topology, obtained via an IP routing protocol, such as OSPF, IS-IS, BGP, RIP or static configuration, which keeps that information synchronized with changes in the network.
MPLS similarly uses IP addresses, either IPv4 or IPv6, to identify end points and intermediate switches and routers. This makes MPLS networks IP-compatible and easily integrated with traditional IP networks. However, unlike traditional IP, MPLS flows are connection-oriented and packets are routed along pre-configured Label Switched Paths (LSPs).
The evident power of the basic MPLS concepts led the industry to define generalized extensions to MPLS, or Generalized MPLS (GMPLS). This work extended the MPLS concept of a label to include implicit values defined by the medium that is being provisioned, for example a wavelength for a DWDM system or a timeslot for a SONET/SDH device. So with GMPLS, there is no need for a switch to "read" the label in each packet header. The label is an inherent part of the switch fabric and the switching operations depend on wavelength, or timeslot etc. This permits the benefits of MPLS to be shared by many different types of switching platform.


How Does MPLS Work?

MPLS works by tagging the traffic, in this example packets, with an identifier (a label) to distinguish the LSPs. When a packet is received, the router uses this label (and sometimes also the link over which it was received) to identify the LSP. It then looks up the LSP in its own forwarding table to determine the best link over which to forward the packet, and the label to use on this next hop.
A different label is used for each hop, and it is chosen by the router or switch performing the forwarding operation. This allows the use of very fast and simple forwarding engines, which are often implemented in hardware.
Ingress routers at the edge of the MPLS network classify each packet potentially using a range of attributes, not just the packet's destination address, to determine which LSP to use. Inside the network, the MPLS routers use only the LSP labels to forward the packet to the egress router.
Router A uses the destination IP address on each packet to select the LSP, determining the initial label and hop for each packet, then router B uses these labels to determine the next hops and labels.  Lastly the egress routers strip off the final label and route the packet out of the network.
The diagram above shows a simple example of forwarding IP packets using MPLS, where the forwarding is based only on packet destination IP address. LSR (Label Switched Router) A uses the destination IP address on each packet to select the LSP, which determines the next hop and initial label for each packet (21 and 17). When LSR B receives the packets, it uses these labels to identify the LSPs, from which it determines the next hops (LSRs D and C) and labels (47 and 11). The egress routers (LSRs D and C) strip off the final label and route the packet out of the network.
The above is only one use of MPLS. Since MPLS uses only the label to forward packets, it is protocol-independent, hence the term "Multi-Protocol" in MPLS. It can be used to carry any content (not only packets) over any link technology (using different label encoding for each layer 2 link type).


How Does GMPLS Work?

GMPLS is conceptually similar to MPLS, but instead of using an explicit label to distinguish an LSP at each LSR, some physical property of the received data stream is used to deduce which LSP it belongs to. The most commonly used schemes are
  • using the timeslot to identify the LSP, on a Time Division Multiplexed (TDM) link
  • using the wavelength to identify the LSP, on a Wavelength Division Multiplexed (WDM) link
  • using the fiber or port on which a packet is received.
LSPs are therefore implicitly labeled in a GMPLS network.
GMPLS can be used to establish LSPs for circuit traffic (in addition to packet traffic). Using the TDM and WDM examples above, the LSP traffic is switched based on a continuous, constant property of the data stream – the data stream is not switched one packet at a time. This allows for a very efficient implementation in the data plane with zero per-packet lookups, making GMPLS a highly suitable protocol to run in high bandwidth networks.
Other than this, the forwarding operation of the LSRs in a GMPLS network is similar to the MPLS example discussed above. At each LSR, the implicit label on received data determines the outgoing interface and the implicit label with which to transmit onwards data.


MPLS and GMPLS Protocols

MPLS defines only the forwarding mechanism; it uses other protocols to establish the LSPs. Two separate protocols are needed to perform this task: a routing protocol and a signaling protocol. These are described below.
It is also possible to establish MPLS LSPs with static provisioning. This involves configuring each network element along the LSP route with the appropriate ingress / transit / egress information. Static provisioning has not been very widely deployed to date, but it can have a role in the access network. It is also likely to be one of the operating modes for MPLS Transport Profile (MPLS-TP).

MPLS and GMPLS Routing Protocols

The routing protocol distributes network topology information through the network so that the route of an LSP can be calculated automatically. An interior gateway protocol, such as OSPF or IS-IS, is normally used, as MPLS networks typically cover a single administrative domain.
However, these routing protocols only distribute network topology. When traffic engineering is required to establish LSPs with guaranteed QoS characteristics and backup LSPs that avoid any single point of failure, the traffic engineering (TE) extensions to these protocols are used. These extensions distribute QoS and Shared Risk Link Group (SRLG) information on each link in the network. This information enables the route calculator to determine routes through the network with guaranteed QoS parameters, and backup LSPs that traverse different links and/or network elements from the primary path.
Various mechanisms to extend this traffic engineering to inter-area and inter-carrier routing have been proposed, but none is yet universally accepted. Our White Paper on "Inter-Area Routing, Path Selection and Traffic Engineering" provides a detailed discussion of this topic.

MPLS and GMPLS Signaling Protocols

The signaling protocol informs the switches along the route which labels and links to use for each LSP. This information is used to program the switching fabric. For MPLS, one of three main signaling protocols is used, depending on the application.
  • LDP is used for
    • MPLS transport where traffic engineering is not required
    • certain MPLS services, for example pseudowires
  • RSVP-TE is used for
    • MPLS transport where traffic engineering is required
    • all GMPLS transport
  • BGP is used (as a signaling protocol) for certain MPLS services, for example BGP/MPLS Layer 3 VPNs.
[ Read More ]

Posted by Priyan Fernando - - 0 comments

Most of us are very curious to know a method to send anonymous emails to our friends for fun. But the question is, is it possible to send anonymous emails in spite of the advanced spam filtering technology adopted by email service provides like Gmail, Yahoo etc? The answer is YES, it is still possible to bypass their spam filters and send anonymous emails to your friends. For example, you can send an email to your friend with the following sender details.
From: Bill Gates <billg@microsoft.com>
The art of sending this kind emails is known as Email Spoofing. In my previous post on How to Send Fake Email I insisted on using your own SMTP server to send anonymous emails. This method used to work successfully in the past, but today it has a very low success rate since Gmail and Yahoo(all major email service providers) blocks the emails that are sent directly from a PC. In this post I have come up with a new way to send anonymous emails (spoofed emails) that has 100% success rate. If you have to successfully send an anonymous email or spoofed email, you should send it using a relay server.
What is a Relay Server?
In simple words, a relay server is an SMTP Server that is trusted by Google or Yahoo as an authorised sender of the email. So, when you send an email using a relay server, the email service providers like Yahoo and Gmail blindly accept the emails and deliver it to the inbox of the recipient. If the SMTP server is not authorised, Google and Yahoo will reject all the emails sent from this SMTP server. This is the reason for which using our own SMTP server to send emails fail.
So What’s Next?
Now all we have to do is, find a trusted SMTP server to Send Spoofed Emails. Usually all the emails that are sent from web hosting providers are trusted and authorised. So, you have to find a free web hosting provider that allows you to send emails. But, most of the free Web Hosts disable the Mail feature and do not allow the users to send emails. This is done just to avoid spamming. However all the paid hosting plans allow you to send any number of emails. Once you find a hosting service that allows to send emails from their servers, it’s just a cakewalk to send anonymous emails. All we have to do is just modify the email headers to insert the spoofed From address field into it.
I have created a PHP script that allows you to send emails from any name and email address of your choice. Here is a step-by-step procedure to setup your own Anonymous Email Sender Script
1. Goto X10 Hosting  and register a new account.
2. Download my Anonymous Email Sender Script (sendmail.rar).
3. Login to your FreeWebHostingArea Account and click on File Manager.
4. Upload the sendmail.php, pngimg.php and bg1.PNG files to the server.
5. Set permissions for sendmail.php, pngimg.php and bg1.PNG to 777.
6. Now type the following URL
http://yoursite.x10hosting.com/sendmail.php
NOTE: yoursite must be substituted by the name of the subdomain that you have chosen during the registration process.
7. Use the script to send Anonymous Emails. Enjoy!!!
Tell me whether it worked or not. Please pass your comments…

WARNING: ALL THE INFORMATION PROVIDED IN THIS POST ARE FOR EDUCATIONAL PURPOSES ONLY. I AM NOT RESPONSIBLE FOR ANY MISUSE.
[ Read More ]

Posted by Priyan Fernando - - 0 comments

Almost every user on the Internet sends/receives hundreds of emails per day. However only a handful of them know what is BCC and what are the advantages of using BCC while sending an email. If you are one such Internet user who is unaware of BCC then this is the post that you should definitely read!
 

What is BCC?

 
BCC stands Blind Carbon Copy. It refers to the practice of sending an email to multiple recipients without disclosing the individual emails addresses. While sending the same email/message to multiple recipients, it is a common practice for most users to separate the email addresses by using comma or semi-colon and insert all those addresses in the To: filed. When emails are sent in this way, each receiver is able to see the complete list of recipient email addresses to which the same message if being sent to. Unlike To:, the BCC: option allows you to hide the recipients in email messages. In other words, when emails are sent using BCC:,  the receiver will not be able to see the list of recipient email addresses. Thus using BCC is a smart way to protect the privacy of the recipients.
 

Why should you use BCC?

 
Here are the reasons for using BCC:
Privacy – BCC provides an easy and simple option for protecting the privacy of your recipients. Under many circumstances it is necessary for us send an email without letting the recipients know who else is receiving the same message. Also it is highly recommended that you use the BCC: while forwarding a joke or a funny email to a list of your friends.  If you are sending email on behalf of a business or organization, it may be especially important to keep lists of clients, members, or associates confidential. So don’t forget to use BCC: in instances wherever privacy matters.
Respect for you recipients- While forwarding email messages, people often do not bother to remove the list of previous recipients.  As a result, messages that are repeatedly sent to many recipients may contain long lists of email addresses.  This makes it easy for the spammers to collect and target those emails for spamming.
In order to avoid the risk of spammers, it is necessary that you encourage people/friends to use BCC: while forwarding any message to you. This prevents your email address from appearing in other people’s inboxes thereby keeping yourself less exposed to spammers. You may also refer How to Protect an Email Account from SPAM for more information on spamming.
 

How to BCC an email message?

 
Most email clients provide the BCC: option under a few lines below the To: field. All you have to do is just enter the list of recipients in the BCC: field instead of entering in the To: field. You may enter only your own email address in the To: field. Once you do this just hit the Send button.
The moral is that you should use BCC: while sending bulk messages so as to protect the privacy of your recipients.
[ Read More ]

Posted by Priyan Fernando - - 0 comments

How to get face book Hack






 Wondering to know how to hack Facebook password? Well, before you can do that, it is very much necessary to understand the real ways of hacking that actually work and also those that are simply scam and do not work. So in this post, we’ll look at some of the possible ways to hack Facebook password!
Every day I get a lot of emails from people requesting me to hack Facebook passwords of their spouse, girlfriend or boyfriend so as to reveal their secret relationships (if any). Most of them are even willing to pay for the service. However, I strongly deny any such requests since I do not provide any paid hacking service. But anyhow, I have decided to write down this post so that you can learn the tricks for yourself and implement everything at your own risk.
With my experience of over 7 years in the field of ethical hacking and security, all I can tell you is that there are only two ways to successfully hack Facebook password.

Possible Ways to Hack Facebook Password


1. Keylogging – The Easiest Way!

Keylogging refers to simply recording each and every keystroke that is  typed on a specific computer’s keyboard. This is possible with the use of a small computer program called keylogger (also known as spy software). Once installed, this program will automatically load from the start-up, runs in the invisible mode and start capturing each and every keystroke that was typed on the computer. 
Some keyloggers with advanced features can also capture screenshots and monitor every activity of the computer. One doesn’t need to have any special knowledge in order to install and use a keylogger. That means, anyone with a basic knowledge of computer can install and use this software with ease. Hence for a novice computer user this method is the easiest way to hack Facebook password. I recommend the following keylogger as the best for gaining access to Facebook account.
Easily Access any Email
SniperSpy (TESTED) is a revolutionary product that will allow you to easily access *ANY* online account or password protected material such as MySpace, Facebook, Yahoo, Gmail or Hotmail. There are absolutely *NO* limitations to what accounts or websites this software can access!
Why SniperSpy is the best?
Today there exists hundreds of keyloggers on the market but most of them are no more than a crap. However, there are only a few that stand out of the crowd and SniperSpy is the best among them. I personally like SniperSpy for it’s REMOTE INSTALLATION FEATURE. With this, you can install it on a remote computer without the need for having physical access to it. It operates in a complete stealth mode so that it remains undetected.
Here is a summary of benefits that you will receive with Sniperspy software:
1. Access ANY Password
With SniperSpy you can hack any password and gain access to Facebook or any other online account.
2. Monitor Every Activity
You can monitor every activity of the target computer, take screenshots and record chats & IM conversations.
3. Never Get Caught!
SniperSpy operates in a total stealth mode and thus remains undetectable. Therefore you need not have the fear of being traced or getting caught.
4. Remote Installation Feature
With the Remote Install feature, it is possible to install it even on computers for which you do not have physical access. However, it can also be installed on a local computer.
5. Extremely Easy to Use
Installing and using SniperSpy is simple and needs no extra skill to manage.
6. Completely Safe to Use
This software is 100% safe to use since it does not collect any personal information from your computer. SniperSpy is a reputed, trustworthy and reliable company which offers 100% privacy for it’s users.
7. Works on both Windows and Mac
Fully compatible with Windows 2000/XP/Vista/7 and Mac.
So what are you waiting for? If you are really serious to hack Facebook password then SniperSpy is for you. Go grab it now and expose the truth!

2. Phishing – The Difficult Way

The other common way to hack passwords or online accounts is via Phishing. This is the most widely used technique by many hackers to gain access to Facebook and other social networking websites. This method will make use of a fake login page (often called as spoofeed webpage) which will exactly resemble the original one. Say for example, a spoofed webpage of Facebook looks exactly same as that of the original page. This page is actually created by the hacker and is hosted on his own server. Once the victim enters his/her password in such a fake login page, the login details are stolen away by the hacker.
Most Internet users would easily fall prey to such online phishing scams. Thus phishing scams trick users in such a way that, they themselves give away their passwords. But phishing requires specialized knowledge and high level skills to implement. Hence it would not be possible for a noob user (perhaps like you) to attempt this trick. It is a punishable offense too. So, I would recommend that you stay away from phishing and make use of the keyloggers to hack Facebook password since it is the easiest and the safest way.

Facebook Hacking Methods that Do Not Work! 


Today, there are hundreds of scam websites out there that are waiting to rip off your pockets by making false promises. These websites claim to be the experts in the field of hacking and boast to instantly obtain any password for you. Most people fall victim to these websites and lose their hard earned money. Thus the idea behind this post is to expose the truth behind hacking the Facebook (or any email password) so that you can learn how to do it for yourself and stay away from all those scam websites. The following are some of the hacking methods that actually do not work:
1. Many scam websites claim to exploit a certain vulnerability of Facebook website as a means to crack the password. Unfortunately, there is no such vulnerability in Facebook (or any other online account) that can be exploited to crack the password. I advise you to stay away from such scam websites.
2. There is no ready-made software program that is available to hack Facebook password except the keylogger (spy software). In fact, keyloggers are pretty generic and meant to record the keystrokes of a computer which obviously includes the password also. Keep in mind that apart from the keylogger, there is no such program that is specifically designed to gain access to Facebook accounts. Stay away from any website that claim to sell such program.
3. Beware! On many websites and Internet forums you will often see fake articles about Facebook hacking. Most of them will tell you something like this: “you need to send an email to passwordretrieve@facebook.com along with your username and password” (or something similar). Never give away your password to anyone nor send it to any email address. If you do so, you will lose your password itself in attempt to hack somebody else’s password.
I hope this post will help you avoid scams and choose the right approach to accomplish your goal.
[ Read More ]

Posted by Priyan Fernando - - 0 comments

INTRODUCTION

The tremendous increase in online transactions has been accompanied by an equal rise in the number and type of attacks against the security of online payment systems. Some of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software. Other attacks have used vulnerabilities that are common in any web application, such as SQL injection or cross-site scripting.



Consumer privacy is becoming the most publicized security issue replacing theft and fraud as top concerns in e-commerce. The DDOS attacks demonstrated that business sites did not maintain adequate security protection and intrusion detection measures. Some of the sites did not detect the compromise, which occurred months before the DDOS attacks. The hackers who penetrated these sites had the ability to deliver a data integrity attack on the compromised business for the same amount of time. Businesses were spared simply because the hackers chose not to attack them in that manner. No customer will want to use a business that distributes sensitive customer data such as credit card information, SSN information or credit limits without the knowledge or permission of the customer.

User and system administrator awareness is becoming more important in the effort to counter e-commerce attacks. Consumers are slowly becoming aware of some security features such as encrypted web transactions, privacy statements by companies, etc. Internet service providers are becoming more responsive to complaints about Internet abuse originating from their sites.

E-commerce security needs to be addressed not only at the business site with its servers/network, but also on the client side, which includes direct connected home computers. It is this group of computers that are the most vulnerable to attack because the level of user security training or awareness is not high at all.


 The tremendous increase in online transactions has been accompanied by an equal rise in the number and type of attacks against the security of online payment systems. Some of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software. Other attacks have used vulnerabilities that are common in any web application, such as SQL injection or cross-site scripting. 

Today rapidly increasing using online transaction on online payment systems.the attacks for such systems is increasing more than that. Most of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software and poor design of such websites. Other factor is user awareness of security vulnerabilities.

Today there many types of attacks for e-commerce applications. such ass SQL injection, denial of service attacks, Cross-site Scripting (XSS) attack ant etc.


  • SQL Injection - this will use sql quarries to get information, update or damage the system.attacker's queries are executed by the back-end database.SQL injection techniques differ depending on the type of database being used.


  • Price Manipulation - This is almost completely unique to online shopping carts and payment gateways.attacker can get and change the hidden information while transaction.
  • Buffer overflows - Sending in a large number of bytes to web applications can damage and get important information while the application is generating the errors.


  • Cross-site scripting XSS - The XSS attack requires a web form that takes in user input, processes it, and prints out the results on a web page, which also contains the user's original input.
  • Remote command execution - When CGI script allows an attacker to execute operating system commands due to inadequate input validation. This is most common with the use of the 'system' call in Perl and PHP scripts. 


Vulnerabilities                                                                 

There are a number of reasons why security vulnerabilities arise in shopping cart and online payment systems. The reasons are not exclusive to these systems, but their impact becomes much greater simply because of the wide exposure that an online website has, and because of the financial nature of the transactions.
One of the main reasons for such vulnerabilities is the fact that web application developers are often not very well versed with secure programming techniques. As a result, security of the application is not necessarily one of the design goals. This is exacerbated by the rush to meet deadlines in the fast-moving e-commerce world. Even one day's delay in publishing a brand new feature on your website could allow a competitor to steal a march over you. It is found that there are cases where e-commerce sites need to add functionality rapidly to deal with a sudden change in the business environment or simply to stay ahead of the competition. In such a scenario, the attitude is to get the functionality online; security can always be taken care of later.
Another reason why security vulnerabilities appear is because of the inherent complexity in most online systems. Nowadays, users are placing very demanding requirements on their e-commerce providers, and this requires complex designs and programming logic.
Let’s look at the common security vulnerabilities that have been discovered in E-Commerce sites.

Using denial of service attacks                                      

The denial of service attack is one of the best examples of impacting site availability. It involves getting the server to perform a large number of mundane tasks, exceeding the capacity of the server to cope with any other task. For example, if everyone in a large meeting asks you your name all at once, and every time you answer, they ask you again. You have experienced a personal denial of service attack.

Distributed DoS is a type of attack used on popular sites, such as Yahoo!®. In this type of attack, the hacker infects computers on the Internet via a virus or other means. The infected computer becomes slaves to the hacker. The hacker controls them at a predetermined time to bombard the target server with useless, but intensive resource consuming requests. This attack not only causes the target site to experience problems, but also the entire Internet as the number of packets is routed via many different paths to the target.

SQL Injection                                                                   

SQL injection refers to the insertion of SQL meta-characters in user input, such that the attacker's queries are executed by the back-end database. Typically, attackers will first determine if a site is vulnerable to such an attack by sending in the single-quote (') character. The results from an SQL injection attack on a vulnerable site may range from a detailed error message, which discloses the back-end technology being used, or allowing the attacker to access restricted areas of the site because he manipulated the query to an always-true Boolean value, or it may even allow the execution of operating system commands.
SQL injection techniques differ depending on the type of database being used. For instance, SQL injection on an Oracle database is done primarily using the UNION keyword and is much more difficult than on the MS SQL Server, where multiple queries can be executed by separating them with the semi-colon. In its default configuration, MS SQL server runs with Local System privileges and has the 'xp_cmdshell' extended procedure, which allows execution of operating system commands.

 

 

Price Manipulation                                                          

This is a vulnerability that is almost completely unique to online shopping carts and payment gateways. In the most common occurrence of this vulnerability, the total payable price of the purchased goods is stored in a hidden HTML field of a dynamically generated web page. An attacker can use a web application proxy such as Achilles to simply modify the amount that is payable, when this information flows from the user's browser to the web server. Shown below is a snapshot of just such a vulnerability that was discovered in one of the author's penetration testing assignments.


Achilles web proxy

The final payable price (currency=Rs&amount=879.00) can be manipulated by the attacker to a value of his choice. This information is eventually sent to the payment gateway with whom the online merchant has partnered. If the volume of transactions is very high, the price manipulation may go completely unnoticed, or may be discovered too late. Repeated attacks of this nature could potentially cripple the viability of the online merchant.

Buffer overflows                                                                                       


Buffer overflow vulnerabilities are not very common in shopping cart or other web applications using Perl, PHP, ASP, etc. However, sending in a large number of bytes to web applications that are not geared to deal with them can have unexpected consequences. In one of the author's penetration testing assignments, it was possible to disclose the path of the PHP functions being used by sending in a very large value in the input fields. As the sanitized snapshot below shows, when 6000 or more bytes were fed into a particular field, the back-end PHP script was unable to process them and the error that was displayed revealed the location of these PHP functions.


PHP timeout error
Using this error information it was possible to access the restricted 'admin' folder. From the structure of the web site and the visible hyperlinks there would have been no way to determine that there existed the 'admin' directory within the 'func' sub-directory below the main $DocumentRoot.

Cross-site scripting                                                    

The Cross-site Scripting (XSS) attack is primarily targeted against the end user and leverages two factors:

1.      The lack of input and output validation being done by the web application
2.      The trust placed by the end-user in a URL that carries the vulnerable web site's name.

The XSS attack requires a web form that takes in user input, processes it, and prints out the results on a web page, which also contains the user's original input. It is most commonly found in 'search' features, where the search logic will print out the results along with a line such as 'Results for <user_supplied_input>'.

In this case, if the user input is printed out without being parsed, then an attacker can embed JavaScript by supplying it as part of the input. By crafting a URL, which contains this JavaScript, a victim can be social engineered into clicking on it, and the script executes on the victim's system. A typical XSS attack URL would look like this: http://www.vulnerablesite.com/cgi-bin/search.php?keywords=&lt;script>alert("OK")&lt;script>. In this case, when the victim clicks on this link, a message box with the text "OK" will open up on his system.

 







Remote command execution                                         


The most devastating web application vulnerabilities occur when the CGI script allows an attacker to execute operating system commands due to inadequate input validation. This is most common with the use of the 'system' call in Perl and PHP scripts. Using a command separator and other shell meta-characters, it is possible for the attacker to execute commands with the privileges of the web server. For instance, Hassan Consulting's Shopping Cart allowed remote command execution, because shell meta-characters such as |;& were not rejected by the software. However, directory traversal was not possible in this software.




Weak Authentication and Authorization                        

 

Authentication mechanisms that do not prohibit multiple failed logins can be attacked using tools such as Brutus. Similarly, if the web site uses HTTP Basic Authentication or does not pass session IDs over SSL (Secure Sockets Layer), an attacker can sniff the traffic to discover user's authentication and/or authorization credentials.

Since HTTP is a stateless protocol, web applications commonly maintain state using session IDs or transaction IDs stored in a cookie on the user's system. Thus this session ID becomes the only way that the web application can determine the online identity of the user. If the session ID is stolen (say through XSS), or it can be predicted, then an attacker can take over a genuine user's online identity vis-à-vis the vulnerable web site. Where the algorithm used to generate the session ID is weak, it is trivial to write a Perl script to enumerate through the possible session ID space and break the application's authentication and authorization schemes.


Conclusion


The most important point is to build security into the web application at the design stage itself. In fact, one of the key activities during the design phase should be a detailed risk assessment exercise. Here, the team must identify the key information assets that the web application will be dealing with. These could include configuration information, user transaction details, session IDs, credit card numbers, etc. Each of these information assets needs to be classified in terms of sensitivity. Depending upon the tentative architecture chosen, the developers along with security experts must analyze the threats, impact, vulnerabilities and threat probabilities for the system. Once these risks are listed out, system countermeasures must be designed and if necessary the architecture itself may be modified. Countermeasures should also include strict input validation routines, a 3-tier modular architecture, use of open-source cryptographic standards, and other secure coding practices.

 

The vulnerabilities are not only present in shopping carts or online payment systems but also present in other types of web applications as well. However, in the case of e-commerce systems, the vulnerabilities acquire a graver dimension due to the financial nature of transactions. What is at stake is not only a direct loss of revenues, but companies may face a serious loss to their reputations as well. It is of paramount importance for designers and developers of web applications to consider security as a primary design goal and to follow secure coding guidelines in order to provide the highest possible degree of assurance to their customers.



 





























[ Read More ]