Protecting Preventing Sql Injection Attack Protecting Websites

Hello Friends in this tutorial we will discuss "Protection Of Website From sqli Attack" ,We All Know that Sqli Is Simple But Can Be Used As A Deadlier way so don't wrry if u don't know php, this is php friendly :)
Lets Begin

There are usually two types of attacks :

1. URL based
2. Form based

Major reason for both of them is 'badly architectured parametres'
many say That remove/rename or unlink the database configuration file, ofcourse this will work but this is NOT the solution, as it will halt the functionality of the site, your
Dynamic website will turn into just html pages in seconds, this is anologus to condition like, because of fear of robbery you don't buy anything for yourself too: P
what we will be doing is sanitizing and validating php variables, we have make sure That our critical global arrays like get, post, files, session, cookies etc allow data which we
Want them to store and nothing else, because we can't trust the fact that users will enter expected data. What we mean is suppose you have site script like this:

blabla.com/news.php?id=8

Now what dis means is, in our "news.php" script (in global GET array) we have an array location $_GET[id] which contains the value which is being passed via URL,
In our case it is '8', what usually careless admins do is, pass on the get[] as it is to the database query which is to be executed so that proper content for id=8
Can be extracted from database and thrown on the user screen, SQL query can be like :

$news_query = "SELECT * FROM news WHERE NEWS ='".$_GET['id']."'";

Now if we manipulate the URL and write 'something' in place of 'expected' integer then we may break normal query and can execute our own queries!
by breaking a query i mean, as in the above example we wrote

NEWS ='$_GET[id]'

if instead of expected id we write something like ==> 8'; eval_query; #
now what our new url is ==> blabla.com/news.php?id=8'; eval_query; #
our new query becomes ==> $news_query = "SELECT * FROM news WHERE NEWS ='8'; eval_query; #';
# is used to comment out query part after it, so now as u can see our "eval query" will be executed with normal expected query, eval query can be { DROP TABLE news} which will drop the "news"!
we can prevent this if instead of directly using get[] variable in query we first validate them and then use them, by validating I mean, we make sure that URL variables contains
only that data which we want them to store and nothing else (in this case, we want integers for id values), this depend on the programming of the script, we may sometimes want alphabets(lower case or upper case or both),
numbers, some special characters etc . . . php gives us some function to do the same :
in this case we can use "preg_replace" or maybe 'ereg_replace', i advertise preg_replace cause it has lot more functionality and is faster than ereg :) [you can search php.net if you want details about them]
so here we want only numbers in id fiels so we wil add this line before querying it :

$id = $_GET['id'];
$vald_id = preg_replace('#[^0-9]#i', '', $id);

first line is getting id variable from url via get and storing it in local variable $id, next we are cleaning it using preg_replace, so that it only contains numbers from 0-9 (if anything else is there it will replace it with a blank.space) and nothing else, we will use this cleaned variable
$vald_id in our query.
if we want some(defined) special characters along with alphabets we can write (in place of [^0-9]) :

preg_replace('#[^A-Za-z,.?$@!]#i', '', $id);
Now how to patch panels/forms of sites against sql
suppose there is an admin panel say

blabla.com/admin/

hit [ctrl+u] view source, crawl source and search for [action=], cause every html form will be processin and submitting form elements using php scripts, if its written something like
action="" ==> this means php script is calling itself and its processing is done in same script
if instead there ist written :
action="login.php" [it can also call lol.php dosn't matter :P]
this means all form data goes to login.php processed there and then sent to database. Main culprit is login.php because it is not filtering variables correcty!
go to login.php, it wil be having lines looking like

$username = $_POST['user'];
$pass=$_POST['pass'];
$loginquery = "SELECT * FROM tbl_admin WHERE username ='$username' AND password = '$pass'";
$result = mysql_query($loginquery);

so we need to clean POST array elements before using them in a query
we will use preg_replace as before and we will also use
strip_tags as we don't want any html javascript elements in our form data,
basic syntax is ==> strip_tags($variable)
if you want to allow certain tags like
then we can also do that as ==> strip_tags($var, '
')
i intended to make a short tut but i failed :p hope you

Thanks For Reading 

Keep Visiting :- indicyborg

Read More

Protecting Preventing Sql Injection Attack Protecting Websites

This tutorial we will discuss "Protection Of Website From sqli Attack" ,We All Know that Sqli Is Simple But Can Be Used As A Deadlier way so don't wrry if u don't know php, this is php friendly :)
Lets Begin

There are usually two types of attacks :

1. URL based
2. Form based
Major reason for both of them is 'badly architectured parametres'
many say That remove/rename or unlink the database configuration file, ofcourse this will work but this is NOT the solution, as it will halt the functionality of the site, your
Dynamic website will turn into just html pages in seconds, this is anologus to condition like, because of fear of robbery you don't buy anything for yourself too: P
what we will be doing is sanitizing and validating php variables, we have make sure That our critical global arrays like get, post, files, session, cookies etc allow data which we
Want them to store and nothing else, because we can't trust the fact that users will enter expected data. What we mean is suppose you have site script like this:

blabla.com/news.php?id=8

Now what dis means is, in our "news.php" script (in global GET array) we have an array location $_GET[id] which contains the value which is being passed via URL,
In our case it is '8', what usually careless admins do is, pass on the get[] as it is to the database query which is to be executed so that proper content for id=8
Can be extracted from database and thrown on the user screen, SQL query can be like :

$news_query = "SELECT * FROM news WHERE NEWS ='".$_GET['id']."'";

Now if we manipulate the URL and write 'something' in place of 'expected' integer then we may break normal query and can execute our own queries!
by breaking a query i mean, as in the above example we wrote

NEWS ='$_GET[id]'

if instead of expected id we write something like ==> 8'; eval_query; #
now what our new url is ==> blabla.com/news.php?id=8'; eval_query; #
our new query becomes ==> $news_query = "SELECT * FROM news WHERE NEWS ='8'; eval_query; #';
# is used to comment out query part after it, so now as u can see our "eval query" will be executed with normal expected query, eval query can be { DROP TABLE news} which will drop the "news"!
we can prevent this if instead of directly using get[] variable in query we first validate them and then use them, by validating I mean, we make sure that URL variables contains
only that data which we want them to store and nothing else (in this case, we want integers for id values), this depend on the programming of the script, we may sometimes want alphabets(lower case or upper case or both),
numbers, some special characters etc . . . php gives us some function to do the same :
in this case we can use "preg_replace" or maybe 'ereg_replace', i advertise preg_replace cause it has lot more functionality and is faster than ereg :) [you can search php.net if you want details about them]
so here we want only numbers in id fiels so we wil add this line before querying it :

$id = $_GET['id'];
$vald_id = preg_replace('#[^0-9]#i', '', $id);

first line is getting id variable from url via get and storing it in local variable $id, next we are cleaning it using preg_replace, so that it only contains numbers from 0-9 (if anything else is there it will replace it with a blank.space) and nothing else, we will use this cleaned variable
$vald_id in our query.
if we want some(defined) special characters along with alphabets we can write (in place of [^0-9]) :

preg_replace('#[^A-Za-z,.?$@!]#i', '', $id);

Now how to patch panels/forms of sites against sql
suppose there is an admin panel say

blabla.com/admin/

hit [ctrl+u] view source, crawl source and search for [action=], cause every html form will be processin and submitting form elements using php scripts, if its written something like
action="" ==> this means php script is calling itself and its processing is done in same script
if instead there ist written :
action="login.php" [it can also call lol.php dosn't matter :P]
this means all form data goes to login.php processed there and then sent to database. Main culprit is login.php because it is not filtering variables correcty!
go to login.php, it wil be having lines looking like

$username = $_POST['user'];
$pass=$_POST['pass'];
$loginquery = "SELECT * FROM tbl_admin WHERE username ='$username' AND password = '$pass'";
$result = mysql_query($loginquery);

so we need to clean POST array elements before using them in a query
we will use preg_replace as before and we will also use
strip_tags as we don't want any html javascript elements in our form data,
basic syntax is ==> strip_tags($variable)
if you want to allow certain tags like
then we can also do that as ==> strip_tags($var, '
')

Read More

Hacking Articles and Revealing the Secrets of hacking Art

Here friends this an article that describe hacking in my word and real experience.also the introduction part of my book.
So lets Start ...

How to become a hacker?

Before entering into hacking stuff lets know What Is a Hacker?

There is a community, a shared culture, of expert programmers and networking wizards that traces its history back through decades to the first time-sharing minicomputers and the earliest ARPAnet experiments. The members of this culture originated the term ‘hacker’. Hackers built the Internet. Hackers made the Unix operating system what it is today. Hackers run Usenet. Hackers make the World Wide Web work. If you are part of this culture, if you have contributed to it and other people in it know who you are and call you a hacker, you're a hacker.
The hacker mind-set is not confined to this software-hacker culture. There are people who apply the hacker attitude to other things, like electronics or music — actually, you can find it at the highest levels of any science or art. Software hackers recognize these kindred spirits elsewhere and may call them ‘hackers’ too — and some claim that the hacker nature is really independent of the particular medium the hacker works in. But in the rest of this document we will focus on the skills and attitudes of software hackers, and the traditions of the shared culture that originated the term ‘hacker’.
There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.
The basic difference is this: hackers build things, crackers break them.
If you want to be a hacker, keep reading. If you want to be a cracker, go read the alt.2600 newsgroup and get ready to do five to ten in the slammer after finding out you aren't as smart as you think you are. And that's all I'm going to say about crackers.

The Hacker Attitude

Hackers solve problems and build things, and they believe in freedom and voluntary mutual help. To be accepted as a hacker, you have to behave as though you have this kind of attitude yourself. And to behave as though you have the attitude, you have to really believe the attitude.Hackers love to expose the hidden unknown feature.
But if you think of cultivating hacker attitudes as just a way to gain acceptance in the culture, you'll miss the point. Becoming the kind of person who believes these things is important for you — for helping you learn and keeping you motivated. As with all creative arts, the most effective way to become a master is to imitate the mind-set of masters — not just intellectually but emotionally as well.
Or, as the following modern Zen poem has it:
To follow the path:

look to the master,
follow the master,
walk with the master,
see through the master,
become the master.

So, if you want to be a hacker, repeat the following things until you believe them:

1. The world is full of fascinating problems waiting to be solved.

Being a hacker is lots of fun, but it's a kind of fun that takes lots of effort. The effort takes motivation. Successful athletes get their motivation from a kind of physical delight in making their bodies perform, in pushing themselves past their own physical limits. Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence.
If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval.
(You also have to develop a kind of faith in your own learning capacity — a belief that even though you may not know all of what you need to solve a problem, if you tackle just a piece of it and learn from that, you'll learn enough to solve the next piece — and so on, until you're done.)
 
2. No problem should ever have to be solved twice.

Creative brains are a valuable, limited resource. They shouldn't be wasted on re-inventing the wheel when there are so many fascinating new problems waiting out there.
To behave like a hacker, you have to believe that the thinking time of other hackers is precious — so much so that it's almost a moral duty for you to share information, solve problems and then give the solutions away just so other hackers can solve new problems instead of having to perpetually re-address old ones.
Note, however, that "No problem should ever have to be solved twice." does not imply that you have to consider all existing solutions sacred, or that there is only one right solution to any given problem. Often, we learn a lot about the problem that we didn't know before by studying the first cut at a solution. It's OK, and often necessary, to decide that we can do better. What's not OK is artificial technical, legal, or institutional barriers (like closed-source code) that prevent a good solution from being re-used and force people to re-invent wheels.
(You don't have to believe that you're obligated to give all your creative product away, though the hackers that do are the ones that get most respect from other hackers. It's consistent with hacker values to sell enough of it to keep you in food and rent and computers. It's fine to use your hacking skills to support a family or even get rich, as long as you don't forget your loyalty to your art and your fellow hackers while doing it.)

3. Boredom and drudgery are evil.

Hackers (and creative people in general) should never be bored or have to drudge at stupid repetitive work, because when this happens it means they aren't doing what only they can do — solve new problems. This wastefulness hurts everybody. Therefore boredom and drudgery are not just unpleasant but actually evil.
To behave like a hacker, you have to believe this enough to want to automate away the boring bits as much as possible, not just for yourself but for everybody else (especially other hackers).
(There is one apparent exception to this. Hackers will sometimes do things that may seem repetitive or boring to an observer as a mind-clearing exercise, or in order to acquire a skill or have some particular kind of experience you can't have otherwise. But this is by choice — nobody who can think should ever be forced into a situation that bores them.)

4. Freedom is good.

Hackers are naturally anti-authoritarian. Anyone who can give you orders can stop you from solving whatever problem you're being fascinated by — and, given the way authoritarian minds work, will generally find some appallingly stupid reason to do so. So the authoritarian attitude has to be fought wherever you find it, lest it smother you and other hackers.
(This isn't the same as fighting all authority. Children need to be guided and criminals restrained. A hacker may agree to accept some kinds of authority in order to get something he wants more than the time he spends following orders. But that's a limited, conscious bargain; the kind of personal surrender authoritarians want is not on offer.)
Authoritarians thrive on censorship and secrecy. And they distrust voluntary cooperation and information-sharing — they only like ‘cooperation’ that they control. So to behave like a hacker, you have to develop an instinctive hostility to censorship, secrecy, and the use of force or deception to compel responsible adults. And you have to be willing to act on that belief.

5. Attitude is no substitute for competence.

To be a hacker, you have to develop some of these attitudes. But copping an attitude alone won't make you a hacker, any more than it will make you a champion athlete or a rock star. Becoming a hacker will take intelligence, practice, dedication, and hard work.
Therefore, you have to learn to distrust attitude and respect competence of every kind. Hackers won't let posers waste their time, but they worship competence — especially competence at hacking, but competence at anything is valued. Competence at demanding skills that few can master is especially good, and competence at demanding skills that involve mental acuteness, craft, and concentration is best.
If you revere competence, you'll enjoy developing it in yourself — the hard work and dedication will become a kind of intense play rather than drudgery. That attitude is vital to becoming a hacker.....

Read More

Free download FBI Inspection Tool worlds most Wanted Software

This a pack of system tools which are used by FBI to analyse and inspect other computers. These must be used only educational purpose, please don't misuse the tools.
These tools are worlds most wanted software now its for free...
these tool is being used by FBI For performing computer forensics activity.

Tools that are included in this pack are:

ADS Locator (Alternate Data Streams)
 
Historian 1.4 (Browser Analyze)
 
Disc Investigator 1.4 (File-Slack-Analyze)
 
Live View 0.6 (System Analyze)
 
MUI Cacheview 1.00 (Registry Analyze)
 
Network miner 0.85 (Network Analyze)
 
Regripper 2.02 (Registry Analyze)
 
System report 2.54 (PC Analyze)
 
USB-History R1 (USB-Stick-Analyze)
 
Windows File Analyzer (File Analyze)
 
Winpcap 4.02 (Network)

Now comes the download link part download it from link below.

FBI Internet Tool

Torrent download link

Read More

Download Anti- Hacking Tools for free

There is one ebook that should be used as a reference. This ebook titled "Anti-Hacker Toolkit [Third Edition]". In this book are described in detail how to use more than 100 "hacking tools". The explanation is technically quite easy to be understood and followed. Explains how to attack, survival, and detect the attack and overcome them (Attack & Defense).

Anti-Hacker Toolkit provides complete tutorials on the latest and most critical security tools, explains their function, and demonstrates how to configure them to get the best results. Completely revised to include the latest security tools, including wireless tools , New tips on how to configure the recent tools on Linux, Windows, and Mac OSX New case studies in each chapter

Book Download Link Here
Password For Zip File Is : www.free-7.net

Contents Of the Book Are

Part I - Multifunctional Tools

Chapter 1 - Netcat and Cryptcat
Chapter 2 - The X Window System
Chapter 3 - Virtual Machines & Emulators

Part II - Tools for Auditing and Defending the Hosts
Chapter 4 - Port Scanners
Chapter 5 - Unix Enumeration Tools
Chapter 6 - Windows Enumeration Tools

Chapter 7 - Web Hacking Tools
Chapter 8 - Password Cracking / Brute-Force Tools
Chapter 9 - Host Hardening
Chapter 10 - Backdoors and Remote Access Tools
Chapter 11 - Simple Source Auditing Tools
Chapter 12 - Combination System Auditing Tools

Part III - Tools for Auditing and Defending Your Network
Chapter 13 - Firewalls
Chapter 14 - Reconnaissance Tools
Chapter 15 - Port Redirection
Chapter 16 - Sniffers
Chapter 17 - Wireless Tools
Chapter 18 - War Dialers
Chapter 19 - TCP/IP Stack Tools

Part IV - Tools for Computer Forensics and Incident Response
Chapter 20 - Creating a Bootable Environment and Live Response Tool Kit
Chapter 21 - Commercial Forensic Image Tool Kits
Chapter 22 - Open-Source Forensic Duplication Tool Kits
Chapter 23 - Tool Kits to Aid in Forensic Analysis
Chapter 24 - Tools to Aid in Internet Activity Reconstruction
Chapter 25 - Generalized Editors and Viewers
Chapter 26 - Reverse Engineering Binaries

Part V - Appendixes
Appendix A - Useful Charts and Diagrams
Appendix B - Command-line Reference
How to Use the CD
List of Figures
List of Tables
List of Sidebars

Really Fantastic Book I Found While Must have if you want to learn Anti-Hacking .
Be a security Guy Stop Hacking.

Read More