Hacking Web Applications
By Abir Atarthy
This writing is totally intended for educational purpose and does not in anyway encourage hacking. The real purpose of this site is prevention from hack attempts. Read the disclaimer section of the site for details.
Web applications are programs that reside on a web server to give the user functionality beyond just a website. Database queries, webmail, discussion groups, and blogs are all examples of web applications. In a web application the browser you use is basically client and the webserver is basically a server. Attackers may try to deface the website, steal credit card information, inject malicious codes, exploit server side scriptings, and so on
Now the question is why hackers target web applications. The reason is simple:To get confidential data.
Web applications are critical to the security of a system because they usually connect to a database that contains
information such as identities with credit card numbers and passwords. Web application vulnerabilities increase the threat that hackers will exploit the operating system and web server . Hacking a webserver means basically hacking a website.
To hack a webserver you can follow five steps.
Web Application Threats
Many web application threats exist on a web server. The following are the most common threats:
Cross-site scripting :- Cross-site scripting occurs when an attacker uses a web application to send malicious
code; generally JavaScript
SQL injection : - SQL Injection is one of the many web attack mechanisms used by
hackers to steal data from organizations. It is perhaps one of the most common application layer attack techniques used today. It is the type of attack that takes advantage of improper coding of your web applications that allows hacker to inject SQL commands into say a login form to allow them to gain access to the data held within your database.
Command injection :- The hacker inserts programming commands into a web form.
Cookie poisoning and snooping :- The hacker corrupts or steals cookies.
Buffer overflow :- Huge amounts of data are sent to a web application through a web form to execute commands. Almost all known web servers, application
servers, and web application environments are susceptible to attack (but not Java and J2EE environments
Directory traversal :- The hacker browses through the folders on a system via a web browser or Windows explorer.
Zero-day attacks :-take place between the time a vulnerability is discovered by a
h researcher or attacker and the time that the vendor issues a corrective patch
Hacking Tools:-
There are many tools/programmes you can write to hack different web applications, web servers etc. Being an Ethical hacker i won't discuss them. but i will mention one tool here
called Brup that hackers useses for attacking and testing web applications.
Countermeasures:-
Following are the countermeasures for different of the web application vulnerabilities.
Cross-site scripting :-Validate cookies, query strings, form fields, and hidden fields.
SQL injection : - 1) Check the user’s input provided to database queries
2) Validate and sanitize every user variable passed to
Command injection :-Use language-specific libraries for the programming language.
Cookie poisoning and snooping :-1) Do not store plain text or weakly encrypted password in a
cookie
2) Implement cookie’s timeout
3)Cookie’s authentication credentials should be associated with
an IP address.
Buffer overflow :- Check bounds and maintain extra care when using loops to copy data
Directory traversal :- Define access rights to the protected areas of the website
Zero-day attacks :-1 ) No security solution can claim that they will totally protect
against all zero-day attacks
2)Enforce stringent security policies
Remember that hacking webapplications is basically not easy. Its a vast subject. I have just given an brief idea. You have to work very hard to hack any web applications.
By the way let me introduce you with one of our hackingheart team member Somenath Singh, has done a nice job in this weebly.com blog site. There is huge collection of different types of very useful softwares links. A extremly useful site for all. Thanks Somnath for your work.
Click here to visit
