This website uses cookies to ensure you have the best experience. Learn more

The Purpose Of This Assignment Is To Analyse Source Code And Look For Vulnerabilities. The Vulnerabilities Identified Will Be Exploited With A

1475 words - 6 pages

3.1 Exploit XSS Vulnerabilities

The standard javascript code to test for XSS vulnerabilities is :
.
The script is entered on the register page in the email address input. The script must be entered in the email input when the user registers. The attack is amended with the SQL injection added at the end. The standard javascript attack works but the SQL injection at the end add a value in the field.
' or '1'='1' -- '.
The script allows the javascript to be embeded in the source code and the pop-up to show. The SQL injection allows the email field to be filled with a value of " ' OR 1=1 -- ". The original code failed because no value was entered for the email address. The registered ...view middle of the document...

(See Figure 4-1 below).

Figure 4-1 Real escape strings Index page

Using real escape strings prevents SQL injection on the client side, in the index page in the username and password login fields. The attack using " ' OR 1=1 -- " fails. (See Figures 4-2 & 4-3 below).
Figure 4-2 SQL injection attack.

Figure 4-3 SQL injection attack prevented.

A RIPS scan of the code shows that the code is still vulnerable to SQL injection on the server side.
(See Figure 4-4 below).

Figure 4-4 RIPS scan still vulnerable to SQL Injection.

SQL injections can be easily stopped by using prepared statements. Prepared statements don't use metacharacters, and without metacharacters SQL injection is impossible. PreparedStatements represent a precompiled SQL statement that can be executued many times without having to recompile it for evey execution. Example of common metacharacters used in SQL query statements are semi-colons, single quotes, and double quotes.

The config file contains no code that's vulnerable to SQL injection but the code must be amended with a prepared statement because every page is linked together. The image below shows the original mysql code. (See Figure 4-5 below).

Figure 4-5 Mysql config code.

The config file is edited with a prepared statement known as PHP Data Objects (PDO). The variable $db stands for database and this variable will be called in the other files. The try and catch statement catchs any PDO exceptions.
(See Figure 4-6 below).

Figure 4-6 Config file using PreparedStatement.

The mysql code thats vulnerable to SQL injection on the index file is shown in the image below.
(See Figure 4-7 below).

Figure 4-7 Mysql code Index file.

The PDO prevents SQL injection by removing the metacharacters. The metacharacters removed are the double and single quotes and the concatenation.
Without the metacharacters SQL injection is impossible. Prepared statements have the added advantage of automatically making the data used in the placeholders safe from SQL injection attacks. BindParam bind PHP variables to the parameter markers. The execute function runs a prepared statement which allows you to bind...

Find Another Essay On The purpose of this assignment is to analyse source code and look for vulnerabilities. The vulnerabilities identified will be exploited with a

In this discussion we will look at the meaning and nature of the social contract as seen from the point of view of political theorists, Thomas Hobbes and John Locke

2024 words - 8 pages collectively." So the use of a social contract is a give and take negotiation -usually. Because of this, it is excepted that the individual does have rights to begin with, but by entering a community or starting a society, he agrees that certain individual rights will be overridden for the greater good of the society.Social Contract via HobbesOne of the curious things about doing research concerning Thomas Hobbes is that he is invariably labeled a

Impressionism and the Twentieth Century (Important) I cant remember if I have submitted this essay or not so...I guess You will have to look it up website dudes!!!

7717 words - 31 pages and republican Rome. Later, as Napoleon rose to power in France, the style was modified to serve his propagandistic needs. With the rise of the romantic movement), a preference for personal expression replaced an art based upon fixed, ideal values.Avant-Garde, sector of the arts that draws its inspiration from the invention and application of new or unconventional techniques and is therefore on the vanguard or cutting edge of new styles. Participants in the creative process can be considered members of the avant-garde.Sources:(Groves Dictionary of Music)(The Harvard Companion of Music)

VoIP: A New Frontier for Security and Vulnerabilities

2668 words - 11 pages utilizes the Internet to transmit data, much like web browsers, email, or any other networked application. In that case, security should definitely be a major concern for anyone who is considering the adoption of VoIP telephone service. As Korzeniowski (2005) writes, “VoIP features all of the security problems inherent with IP communications and adds a few new items to the mix.” The Internet      The benefits that voice over

Information Security: The Strength and Vulnerabilities of The Trusted Platform Module

1318 words - 5 pages verification. When the Trusted Platform Module is implemented as a hardware mechanism, it is a microchip detached from the central processor, but still connected to the motherboard. The Trusted Computing Group requirement states the Trusted Platform Module must provide for resistance from tampering. Every Trusted Platform Module chip contains a pair of RSA keys termed the Endorsement Key (EK). This RSA key pair is kept inside the chip and cannot be

Should Manganese Nodules Be Exploited As A Source Of Metal? Should We Continue Exploiting Manganese Nodules As A Source Of Metal, Taking Into Consideration All The Moral Aspects

1797 words - 8 pages the International Seabed Authority in Jamaica, any technological advances in sea mining is shared, thus providing countries such as Gabon, South Africa and India an opportunity to extract their vast undersea resources without the risk of technological failures.In general, I believe that the manganese nodules should be exploited as a source of metal. Unimaginable technologies and knowledge await us, and I believe that undersea mining will lead to a huge industrial development wherever manganese nodules are in possession, regardless of the country's economical status.

This Is A College Essay On The Code Of Ethics For Social Workers, Pros And Cons

828 words - 4 pages This paper will look for the way in which the code of ethics for Human Services expresses such values as Integrity, Respect for others, Responsibility, Justice, Beneficence and nonmaleficence, and compassion."The primary mission of the social work profession is to enhance human well-being and help meet the basic human needs of all people, with particular attention to the needs and empowerment of people who are vulnerable, oppressed, and living

Software Application Vulnerabilities and Controls

1893 words - 8 pages for calling that memory location and executing the code. The results can range from crashing the application to remotely executing code, which generates a shell back to the attacker. There are many tools available to attackers that will allow them exploit potential stack buffer overflow vulnerabilities in remote systems, but these can often be fragmented across many platforms and require significant reworking of code to make them functional

The author of this essay will be discussing a patient with type 2 Diabetes Mellitus

3083 words - 12 pages IntroductionThe author of this essay will be discussing a patient with type 2 Diabetes Mellitus and will also be discussing the nursing care that will be received by the patient following a hypoglycaemic attack.The patient being described is a fictitious seventy year old lady called Mabel Gordon; she lives in a flat in a city centre with her husband Bert. Mabel has had type 2 diabetes for years which has been poorly controlled by medication and

Cloning Needs to Be Illegal This paper was written for the purpose of proving why a social issue must be changed

2634 words - 11 pages will give birth to a baby that is a clone of the cloning subject at the end of a normal gestation period. This is the type of procedure that was used to produce the sheep, Dolly. Dolly was the first large animal to be cloned from an adult cell. Dolly was the only lamb born from 277 fusions of oocytes with mammary cells. By the year 2000, the lists of other mammals that have been cloned include mice, cattle, pigs, rats and rhesus monkeys (Human

You are employed by a UK publisher to work with them on the launch of a magazine. The magazine is to be launched in Eastern Europe, including Russia and will be particularly targeted at the children’s...

2043 words - 8 pages Assignment Title You are employed by a marketing agency who has recently been asked by a UK publisher to work with them on the launch of a magazine. The magazine is to be launched in Eastern Europe, including Russia and will be particularly targeted at the children's market.You are required to produce a 2000 word report covering the following areas of concern:The company is aware that the landscape for global marketing is changing particularly

What is the purpose of a business plan and why is it an essential first step for a start-up firm? This essay also addresses commom problems with small businesses

804 words - 3 pages What is the purpose of a business plan and why is it an essential first step for a start-up firm? A business plan can get you in to action when just beginning to plan the future of your business. Starting a business can seem like a long, intimidating and drawn out process. A business plan will help you ease this task by setting things apart so that they may be seen more clearly. It also helps by breaking the process into pieces. So, writing a

Similar Essays

This Essay Takes A Look At The Rise And Fall Of The Last City Of The Ancient World, Tenochtitlan. Has A Three Primary Source Bibliography

596 words - 2 pages TenochtitlanThe city of Tenochtitlan was one of the largest and most powerful cities of Mesoamerica. It was the Aztec capital city, and is thought of to be the last major ancient city. It only lasted around 200 years, but it was described as "magnificent" by the outsiders who saw it.The god of war, Huitzilopochtli, appeared in an Aztec leaders dream one night. He told them to find the cactus with the bird perched on top. Finally, after traveling

Year 11 Ancient History Assignment Analyse The Reverence Of Poseidon In Ancient Greek Society And Contrast This To His Symbology In Christianity

1862 words - 7 pages water he was seen to be punishing humans or a single being for making him angry. He was also a very greedy god and such greed resulted in many disputes over land ownership.[2]One such case is that of the ownership of Athens. Poseidon fought Athena, the god of war, to be patron deity of Athens, so to contend with Athena he struck the ground with his trident that produced a salt water spring in the middle of the Acropolis, to demonstrate his kindness

Look At The Opening Sequence Of Baz Luhrmann's Film Version Of 'romeo And Juliet'. Analyse This Scene And Discuss The Techniques The Director Uses To Convey His Interpretation Of The Text

1462 words - 6 pages side of Jesus. This tells us that religion seperates them, rather than unify them. However it might also be argued that Luhrmann is using Jesus to draw them together through Romeo and Juliet.We know that some action is about to take place as the city is swarming with police cars and a few helicopters. This lends the opening sequence a sense of urgency and desperation. Then the Montague boys are shown entering. They seem brash and disrespectful

This Assignment Outlines The Advantages And Disadvantages Of Reflection In Nursing And Will Use Evidence From Literature And A Few Examples From Practice

2608 words - 10 pages . I had watched the staff nurse carry out this procedure before and I was confident I would be able to do it. I asked the nurse for assistance and this added to my confidence. Through reflecting on the experience I feel I carried out the procedure well and would not alter anything I did. Carrying out wound dressings using a no touch aseptic approach is now a procedure I can do with confident.Improving quality of careThe nurse can create practice