How To Prevent SQL Injection

SQL injection vulnerabilities have been described as one of the most serious threats for Web applications. Web applications that are vulnerable to SQL injection may allow an attacker to gain complete access to their underlying databases.Because these databases often contain sensitive consumer or user information, the resulting security violations can include identity theft, loss of confidential information, and fraud. In some cases, attackers can even use an SQL injection vulnerability to take control of and corrupt the system that hosts the Web application.

SQL injection refers to a class of code-injection attacks in which data provided by the user is included in an SQL query in such a way that part of the user’s input is treated as SQL code. 

By lever-aging these vulnerabilities, an attacker can submit SQL commands directly to the database. These attacks are serious threat to any Web application that receives input from users & incorporates it into SQL queries to an underlying database. The cause of SQL injection vulnerabilities is relatively simple and well understood.

Types of SQL injection attacks:

1. Union Query:

In union-query attacks, an attacker exploits a vulnerable parameter to change the data set returned for a given query. With this technique, an attacker can trick the application into returning data from a table different from the one that was intended by the developer.

Attackers do this by injecting a statement of the form: "UNION SELECT". Because the attackers completely control the second/injected query, they can use that query to retrieve information from a specified table.

The result of this attack is that the database returns a dataset that is the union of the results of the original first query and the results of the injected second query. 1: 2: 3: SELECT accounts FROM users WHERE login='' UNION SELECT cardNo from CreditCards where acctNo=10032 -- AND pass='' AND pin=

Assuming that there is no login equal to , the original first query returns the null set, whereas the second uery returns data from the CreditCards table. In this case, the database would return column cardNo for account 10032. The database takes the results of these two queries, unions them, and returns them to the application. In many applications, the effect of this operation is that the value for cardNo is displayed along with the account information.

Read More

How To Trace an Email

Track any Email

As we know that Email is the electronic form of a mail. Just like ordinary mail, Email also have some path. It also have destination and source.  The one from which something is coming is known as sender and the one who get that something is known as receiver.

Generally, the path taken by an email while traveling from sender to receiver can be explained by following diagram.

Email path

 In the above diagram, it is clear that the message will go from sender to destination inbox. In between, there is a lot of servers and intermediates that helps mail to be transferred.

So here is the method of tracing the exact location from the email sent.I am showing the email tracing on yahoo here but gmail and other mail providing services have same concept.

Steps:

Step 1:

Open up your email account and click on your inbox.

Step 2: 

Now select any email that you want to trace.

Step 3:

After Opening scrool the mail at the end and in right corner you will see a option FULL HEADER click on it.

Step 4:

Now Closely Look at the the header you will find the whole detail that from which IP address it is sent.

Read More

Tips For Secured Online Shopping

Hello guys, there's every reason in the world to shop online. 

1. The bargains are there. 
2. The selection is mind-boggling.
3. The shopping is secure.
4. Shipping is fast.
5. Even returns are pretty easy, with the right e-tailors.

Most important, Shopping has never been easier or more convenient for consumers.

But what about the bad guys who lay in wait? IID's Third Quarter eCrime Report for 2011 indicates that use of phishing attacks (where thieves attempt to swindle you out of your sign-in credentials and even credit card info by pretending to be a real website, or even an online bank) is down, as much as eight percent since the second quarter and 11 percent since the third quarter of last year. That's great news—except the same report says sites with malware alicious code aimed at compromising your privacy) has increased by 89 percent since the second quarter.

Here are tips for staying safe online:

1. Use Familiar Websites

Start at a trusted site rather than shopping with a search engine. Search results can be rigged to lead you astray, especially when you drift past the first few pages of links. If you know the site, chances are it's less likely to be a rip off. We all know Amazon.com and that it carries everything under the sun; likewise, just about every major retail outlet has an online store, from Target to Best Buy to Home Depot. Beware of misspellings or sites using a different top-level domain (.net instead of .com, for example)—those are the oldest tricks in the book. Yes, the sales on these sites might look enticing, but that's how they trick you into giving up your info.

2. Look for the Lock

Never ever, ever buy anything online using your credit card from a site that doesn't have SSL re sockets layer) encryption installed—at the very least. You'll know if the site has SSL because the URL for the site will start with HTTPS:// (instead of just HTTP://). An icon of a locked padlock will appear, typically in the status bar at the bottom of your web browser, or right next to the URL in the address bar. It depends on your browser. Never, ever give anyone your credit card over email.

3. Don't Tell All

No online shopping store needs your social security number or your birthday to do business. However, if crooks get them, combined with your credit card number for purchases, they can do a lot of damage. The more they know, the easier it is to steal your identity. When possible, default to giving up the least amount of information.

4. Check Statements

Don't wait for your bill to come at the end of the month. Go online regularly during the holiday season and look at electronic statements for your credit card, debit card, and checking accounts. Make sure you don't see any fraudulent charges, even originating from sites like PayPal. (After all, there's more than one way to get to your money.)

5. Inoculate Your PC

Swindlers don't just sit around waiting for you to give them data; sometimes they give you a little something extra to help things along. You need to protect against malware with regular updates to your anti-virus program. We recommends Webroot Secure Anywhere Antivirus (4.5 stars, Editors' Choice, $39.95 direct), which has extras to help fight ID theft, or at the very least the free Ad-Aware Free Internet Security 9.0 (4.5 stars, Editors' Choice).

6. Use Strong Passwords

We like to beat this dead horse about making sure to utilize uncrackable passwords, but it's never more important than when banking and shopping online. Our tips for creating a unique password can come in handy during a time of year when shopping around probably means creating new accounts on all sorts of e-commerce sites.

Happy and safe shopping. Share our post with your friends and known so that they can also be aware of these tips for secured online shopping. Feel free to comment if you have any query.

Read More