Web Applications : The Cyber Security Risks That Exploit The Vulnerabilities That Lies With It

Security is a major factor in computing today with so many companies if not all nowadays with a computer system of some sort from a basic customer database to a say confidential hospital

Simply put, cross-site scripting refers to the malicious injection of scripting code, into a given web server or application, in order to exploit or extract information and/or data, or even modify the contents of the targeted web server or application. Regarding cross-site scripting, cross-site scripting attacks utilize the process of cross-site scripting, and may be classified into two categories: persistent, or stored, and non-persistent, or reflective.

The Aim Higher college has recently had some issues of sensitive information being stolen from students when registering for classes. I believe that the web application that the student information system is using is a problem named SQL injection. A SQL injection attack is an attack where the attacker can run malicious SQL queries against a web application’s database server and it can be a danger for the users who access the web page because the hacker will look for their personal information records, then delete it or modify the information gained. This type of attack is no joke we have to take action and create a plan to resolve this vulnerability on our database, so the students will register for their courses with our security on their side.

Security misconfiguration is possible at any level of the application stack that includes custom code, web server, framework, application server, and the platform. Interior attacks are also possible as existing users try to wreak havoc on the system while trying to hide their actions. They can access insecure directories and files, unused pages, default accounts, and other assets.

Abstract – With data, now more than ever, being stored on databases instead of in filing cabinets, the awareness of SQL Injection attacks need to be raised. The goal of this document is to provide a basic understanding of SQL attacks, how they are executed, and what preventative measures can be taken to prevent such a dangerous attack from happening.

Injection through user input: the attackers inject SQL statements by giving reasonably user input. A web application can read user data based on the environment in which application is deployed. This helps the attacker to get the user data directly from them.

SQL injection is a technique where malicious users inject SQL commands into an SQL statement, via web page input. Injected SQL commands can alter SQL statement and compromise the security of a web application. SQL injection is one of the oldest, most prevalent and dangerous of web application vulnerability. I believe attackers could steal information by following methods. Most web pages have users or given user id to login, and original idea

“Branch Locator” page is vulnerable to SQL injection attacks. This is a serious vulnerability which involves inserting malicious SQL statements into an input field for execution. By appending SQL statements to the URL of the Branch Locator page, information about the structure of the underlying database was collected. This information was then used to generate further malicious statements. The list of database objects, tables and columns were returned. The

Injection Attacks where the attacker deposits the scripts into a web request to execute at the client-end (Wadlow, 2009).

Web applications are nowadays serving as a company’s public face to the internet. This has created the need to identify threats and attacks directed to data servers and web applications. Hackers exploit vulnerabilities in input validation and authentication affecting the web application in order to gain illegal access and disclose sensitive data or manipulate it to their benefits.

During the year 2012, National Vulnerability Database (NVD) stated 50056 vulnerabilities (Steinke, G., Tundrea, E., & Kelly, K., 2011). Moreover, (NVD) report derived more data about three common threats that Cross-Site Scripting data are kept increasing and still in the top list, SQL injection still remains high and Cross-Site Request Forgery attack decreases the presence in 2009(Steinke, G., Tundrea, E., & Kelly, K., 2011).

SQL injection attacks discloses delicate database data by exploiting input validation vulnerabilities in a Web webpage. Usually, Web sites validate all user inputs before sending queries to the database. If this is not done properly for every input (might be thousands), an intruder may modify data/values in a Web request to in turn modify queries sent to a back-end database. The results of these unapproved requests are then shown as an HTML response with possibly a large amount of compromised data.

SQL Injection Attacks occur when an attacker is able to insert a series of SQL statements in to a ‘query’ by manipulating user input data in

In today’s complicated world of internet security, securing a website or a web-application against hacking is a major task faced by all organization. Aside from static website, webpages have morphed into complex dynamic sites that utilizes vast resources and APIs, all the while communicating with database in real time and also that stores millions of its customers’ information. Among the various forms of attack techniques employed by hackers, Cross Site Scripting (XSS) and SQL Injection had risen to the top and possess the greatest risk in the amount of data and intellectual property loss faced by any corporations who wants to reach out or provide services to its customers in the world wide web. OSWAP (Open Web Application Project), an

Abstract— SQL injection is a technique where malicious users can inject SQL commands into an SQL statement through user input. SQL Injection is one type of web attack mechanisms used by malicious user to steal data from organizations. It is among one of the most common application layer attack techniques used normally. It is one of the types of attack which takes advantage of improper coding to inject SQL commands into form through user input to allow them to gain access to the data.