Blogger Widgets
What are SQL Injection attacks?
SQL(Structured Query Language) injection attacks is a type of attack against websites where special constructed web request are used to control the site database. Web-servers and application servers interact with database servers anytime they need to store data or retrieve data, or change some data, or delete data; and most database have a variant of a language called SQL that is used to do this. So if an attacker is creating a SQL Injection attack they will actually build malicious SQL statements that are designed to be executed along
with the SQL statements that the site will be performing normally, and
this malicious statement will be included with otherwise be normal
request to the website
Why are they so prevalent?
SQL Injections attacks are increasingly prevalent as there's been a change in focus where attacks are no longer focusing only on web-servers,operating system or web-server software but also targeting the application layer and the custom code that runs the site. Of this application level attack, SQL injection is particular interesting because it's potentially very powerful if it's successful
What damage can be caused by a successful SQL injection attack?
A successful SQL injection attack could have a number of different outcomes:
A SQL Injection attack could be used to bypass the site authentication or authorization; so this will let the attacker view the records on the database which could be anything associated with that site, it could be customer data, credit card numbers, account credentials and be through the entire data-set could be taken.
SQL Injection attack could also be used to modify the application database;so this will be adding records, altering records or deleting records, adding a new account to the database, adding a transaction, removing a transaction and it could be not just to one part of the site, it could naturally be the site's entire database meaning that the entire database of that site could be destroyed. Even worse if the database with the database server is hosting content from multiple websites, the entire database with the data across all websites could potentially be infected either access, modify or delete completely.
In others circumstances SQL Injection attack could even potentially lead to a full compromise of the database server allowing operating system level access and total control of the server.
How do I know if my application are vulnerable to SQL Injection attacks?
Any of your applications that accept user input and store data in a back-end database are vulnerable to SQL injection attack.Across the web this is a very large class of applications if you think of banking sites,retail sites they all have those common characteristics of interacting with users, letting users provide information, but they also have databases in the back-end where they're working with that data as well.
To detect SQL Injection attacks you can test for it in a number of different ways:
You can use penetration testing or you can use static or binary analysis to detect. It's important also to have security as a part of your development life cycle so that new applications that are being build today already have the protection build in to prevent SQL injection from the start
How do you prevent SQL Injection Attacks?
So you can prevent SQL Injection attacks through a number of best practices:
- First of all you can use prioritized or prepared statements those limit the amount of influence that an attacker could possibly have against the queries run against the database
- Use input validation for the length,the type,the syntax or rather than the business rules of the input coming form the user and it's important there to whenever possible use known good validation versus known bad. It's alot easier to know that US zip code has a specific format comprised of digits and possibly a dash versus trying to eliminate all possible bad inputs such as trying to detect SQL statements mixed in with an address or something.
- The third, use the lowest possible privilege for the database account. This doesn't prevent SQL Injection attack but this will limit the possible damage as a result a successful SQL injection attack. If an attack is successful the only damage that will be possible is whatever damage could be done with that account; for example if this database hosts data for multiple websites and each website has it's specific user that can only access the data from that website, you don't have to worry about that cross contamination where the attack against one site could affect data of the second site.
1. Aptana Studio
• It supports latest Web technologies like HTML5 , CSS3, JavaScript,
Ruby on Rails, PHP, Python with information about the level of supports
for each element major Web Browsers.
• Syntax highlighting, auto- completion of code.
• Git integration
• Inbuilt deployment wizard to help pubils your Web application.
• Integrated debugger - the most important component of an IDE, lets you set breakpoint, variables and control execution.
• Build- in terminal to access OS commands.
2. Komodo Edit
• Also supports Cloud-based projects
• It uses the Mozilaa code-base, along with Scintilla. Also have a
Firefox type extention system for finding and installing add-ons.
• Suppots python, Perl, PHP, Ruby, HTML5, CSS3, JavaScripts, SQL, Tcl, XML.
• Syntax highlighting, auto- completion of code and call tips.
• Has added supports Node.js, CoffeeScripts, LESS, SCSS, EJS and epMojo.
• Has a inbulit FTP clients lets you access remotly hosted files
without having to create a project or download an entire directory tree.
If Firefox is your browser of choice, you would feel right at home with
Komodo.(Cyber Elite)
3. NetBeans
• It started as an IDE for Java programming, but now you can create
professional desktop, enterprise, Web, and mobile application with java
as well as C/C++, PHP, JavaScript, Groovy and Ruby.
• Is also know for its great Debugging.
4. Drupal
• Is just as Wordpress and Joomla. It lacks high-quality themes like
those available for the others two CMS, but it is unique in its own way,
and preferred for its good technique design and mantainability.
• Getting static pages on a Drupal site is easier than in Wordpress and Joomla.
• The Drupal module for social media integration is easier to work with than its counterpart for Wordpress or Joomla.
• Ubercart, the e-commerce tools for Drupal is excellent. You might
have a trouble working with the e-commerce tools for WordPress or
Joomla.
• Drupal, being old has grown a lot and has a large
community base, so you'll not be alone.Community support is very good in
my experience.
5. MySQL
• Is the most powerful and popular database and hardly needs introduction.
• However, its enterprise version is not free, but compared to other
enterprise solution, it is still the best choice for its price and the
supprot is awesome.
• The free version of MySQL servers as the foundation for the CMS and various other software.
• You can administer the database using the command-line utility mysql , with dozens of command for effective managment.
• You acn integrate it with the PHP, Java and other programmming languages to make an effective application.(Cyber Elite)
• You can use MySQL, Workbench which is a GUI tool for integration of
database design, administration and maintenance into a single IDE for
the MySQL database system.
6. Apache Web Server
• Popular WebServer since April 1996 and hosts nearly 60% of Web domains.
• Though devloped for UNIX -like OS's it also runs on Windos, Mac OS X and others.
• Common languages interface support PHP, Perl, Tcl and Python.
• Virtual hosting allows one Apache installation to server many differnt websites.
• Supports password authentication and digital certification authentication.(Cyber Elite)
• As its source code is available, you can modify it according to your needs, if you know what you are doing.
• Other features include Secure Sockets Layers, Transport layer Security support, a URL re-writer and custom log files.
7. Apache Tomcat
• As stated by its website, Apache TomCat is an open Source software
implementation of the Java Script and Java Server Page technologies.
• TomCat should not be confused with the Apache Server. TomCat is a Web
conatiner that servers Web pages written in Java, while Apache is an
HTTP server written in C.
• I have used it with Eclipse IDE,
and I can vouch for the fact tha it is pure plug-and-play; no
hard-and-fast configuration is needed.
8. Inkscape
• Inkscape is a vector- based graphics application, and by far the most
popular open source options for a graphics tools if you aim to decorate
your Website.
• The programe supports the standard Scalable Vector Graphics (SVG) file format, as well as many others.
• It imports files from many formats, including .jpg .png .tif and
others, and exports to numerous vector-basd formats and .png.
•
Dont compare it with its proprietary counterparts, as they are more
powerful but among free tools Inkscape is the Best and is being developed
further.
9. FileZilla
• Fre and Open source FTP, FTPS and SFTP clients. Also available as a
server if you want to make file available to others, but this works only
for Windows.
• Create in January 2001 by Tim Klosse as a class
project, Filezilla has gone on to become the fifth most important
popular download of all time from SourceForge.net
• Supprots FTP,FTP over SSL/TLS(FTPS) and SSH File Transfer Protocol (SFTP) (Cyber Elite)
• Being Cross Platform it runs on Windows , Linux, *BSD , Mac OS X and more.
• Supports resume and transfer of files larger than 4 GB.
• IPv6 support.
• Configurable transfer speed limits.
• Network configuration wizard.
• HTTP/1.1 ,SOCKS5 and FTP-Proxy supports.
• Synchronised directory browsing.
• But, your IDE lacks an in-builts FTP client for deploying websites.
10. XAMPP
• If you want to install a full LAMP or WAMP stack, it's hard to
configure them all and get the site live. XAMMP has changed this, with a
simple easy-to-install Apache distribution conataining MySQL, PHP,
Pearl for quickly setting up a devlopment envirnoment locally.
• XAMMP is supported on multiple OS : Windows , Linux, Solaris , Mac OS X
• It is designed with the Web devlopers in mind, giving you the power
and flexibility of a test Web Server without the hassle of setting up a
dedicated box running a special server operating system, just for site
testing.
• When it comes to throwing a server out into the
wild, however proper hardened security is a must and operating system
designed specifically for server should be used for public facing
production sites, instead of XAMPP.So. the simple advice is to give
XAMPP to stay confine in an internal LAN
P/S-Just click on the Open Source name to begin downloading
-----Thanks For Visiting----
