Question

How could a hacker use the following information to their advantage? Also provide a possible method to obtain it.

- Personal Web pages of Employees

Answer 1

Answer:-

In simple words, hacking is doing something which you are not allowed to do.
Hacking a website, or any system is done by various ways. Some of most common ways are -

• SQL Injection
• Remote Code Execution - RCE
• Session hijacking / poisoning
• Client Side Request Forgery

And many other ways.
There hell lot of tools that helps an attacker. Some of the free tools are -

• Metasploit
• Nessus
• Nexpose
• SQL map
• Netscan

More people have access to the internet than ever before. This has prompted many organizations to develop web based applications that users can use online to interact with the organization. Poorly written code for web applications can be exploited to gain unauthorized access to sensitive data and web servers.

In this article, we will introduce you to web applications hacking techniques and the counter measures you can put in place to protect against such attacks.

What is a web application? What are Web Threats?

A web application (aka website) is an application based on the client-server model. The server provides the database access and the business logic. It is hosted on a web server. The client application runs on the client web browser. Web applications are usually written in languages such as Java, C# and VB.NET Shop, PHP, ColdFusion Markup Language etc. the database engines used in web applications include MySQL, MS SQL Server, PostgreSQL, SQLite etc.

Most web applications are hosted on public servers accessible via the internet. This makes them vulnerable to attacks due to easy accessibility. The following are common web application threats.

• SQL Injection – the goal of this threat could be to bypass login algorithms, sabotage the data etc.
• Denial of Service Attacks– the goal of this threat could be to deny legitimate users access to the resource
• Cross Site Scripting XSS– the goal of this threat could be to inject code that can be executed on the client side browser.
• Cookie/Session Poisoning– the goal of this threat is to modify cookies/session data by an attacker to gain unauthorized access.
• Form tempering– the goal of this threat is to modify form data such as prices in e-commerce applications so that the attacker can get items at reduced prices.
• Code Injection – the goal of this threat is to inject code such as PHP, python etc that can be executed on the server. The code can install backdoors, reveal sensitive information etc.
• Defacement– the goal of this threat is to modify the page been displayed on a website and redirecting all page requests to a single page that contains the attacker’s message.