Suppose your website uses a WYSIWYG html editor. You need image upload feature too in that. Your website is developed with dot net. Your developer made the dot net part of that image upload plugin secure, but the plugin contains code for php, Perl etc. too. Your server might support these extra codes which can be used by the hacker to easily upload\/delete files on your server.<\/li>\n<\/ol>\n3. Third party software\/code\/plugins from untrusted sources <\/b><\/h2>\n
These days all or most of the websites use a lot of third-party libraries for additional features. That code becomes a part of your website. That code needs to be from some trusted source and constantly updated for security fixes. Third party plugins from untrusted sources can lead to malicious code in your website making it easy for a hacker to breach. It also matters if the third party libraries are implemented in your software the way they should be. A wrong implementation may also invite security issues.<\/p>\n
\u00a04. SQL Injection<\/b><\/h2>\n
Almost all the websites these days use some type of database to store the data. SQL injection is a way to manipulate the database queries written by your programmer. Your programmer creates database queries by combining some predefined strings and user input data. Hacker can input some additional data which modifies the meaning of query written by the programmer if it is not handled properly.<\/p>\n
For example:<\/b> The following is a query written to authenticate a user\u2019s username a password. Your programmer writes query like<\/p>\n
SELECT {field1}, {field2} FROM {usertable} WHERE username = \u2018{posted_username}\u2019 AND password = \u2018{posted_password}\u2019;<\/i><\/p>\n
Now, suppose a hacker enter username as:\u2019 or \u2018\u2019 = \u2018 and same password.Then your programmer\u2019s SQL query will become<\/p>\n
SELECT {field1}, {field2} FROM {usertable} WHERE username =\u2019\u2019 or \u2018\u2019 = \u2018\u2019 AND password = \u2018\u2019 or \u2018\u2019 = \u2018\u2019; <\/i><\/p>\n
Which is true always. Hence, the hacker will manage login into your system most probably as an administrator because the administrator is the first user of any system normally. Then he can change anything the administrator can for your website.<\/p>\n
Or in case of say a page where query is like
\nSELECT * FROM content WHERE id = {id_passed_in_url}<\/i><\/p>\n
Your developer, in this case, expected the url to be something like
\npage.php?id={some_number}<\/i><\/p>\n
but the hacker makes url like page.php?id=3;update content SET content_text = \u2018Website is moved to hackersite.com\u2019<\/i><\/p>\n
This may change content of all the pages of your website to \u201cWebsite is moved to hackersite.com\u201d<\/p>\n
\u00a05. XSS (Cross site scripting)<\/b><\/h2>\n
In this case, the attacker tries to change the content on your webpage by posting some JavaScript or some content at other allocated resource. Let\u2019s take a simple example:<\/p>\n
Suppose your webpage has an article and below it there is a form where the visitor can post comments on the article. Now a hacker may write comments in the comment box and also write some JavaScript like:<\/p>\n
<script type=\u201dtext\/javascript\u201d>
\n$(\u2018#mainbody\u2019).append(\u2018This article was taken from the_hackers_website.com\u2019);
\n<\/script><\/i><\/p>\n
Or he may write a code there to display a form in the main content of your page which says enter your email ID and phone number but the information would be sent to the hacker, not you.<\/p>\n
6. Hosting with bad websites<\/b><\/h2>\n
If your website is hosted on a shared server and another website on the same server machine is compromised, your website can also become vulnerable.<\/p>\n
7. Accessing your websites ftp or control panel from a compromised machine<\/h2>\n
If your machine or your developer\u2019s machine is compromised and you access ftp accounts or control panel of your website from that machine, the website credentials may be at risk. So, you should always use genuine and latest updated software on your machine and also be careful to keep your machine secure.<\/p>\n
This was a brief discussion about a very few basic things to be taken care. Which points and up to what extent your website should be tested depends on several factors like technologies used, the base of the framework used, features of website etc. Also, it matters a lot if you’ve access to the code of the website. But at a minimum your website must be tested for SQL injections and XSS at the first stage.<\/p>\n
Website security should never be taken for granted and proper steps should always be taken to avoid intrusion. FATbit Technologies realizes the importance of website security and incorporated security policies to ensure the optimal security of its client’s websites.<\/p>\n