Publications
How To Test SQL Injection
SQL injection is a web security vulnerability that replaces the OWASP (Open Web Application Security Project) Top 10 every year. In shortly, SQL injection is caused by the fact that the data from the user is directly included in the SQL query.
In the example below, there is a simple login page written in asp language.
FUsername = Request.Form("username")
FPassword = Request.Form("password")
Set RsLogin = SQLConn.Execute("SELECT * FROM Members WHERE username = '" & FUsername & "' AND Password = '" & FPassword & "'")
If RsLogin.EOF AND RsLogin.BOF Then
Response.Redirect "/error.asp"
Else
Session("login") = RsLogin("user_id")
Response.Redirect "../"
End If
Let’s examine this code.
Brute Forcing SSH with Hydra
The secure shell, SSH protocol is a network protocol that is used to establish an encrypted channel across an open network between a server and a client. In general, a public/private key pair allows users to log in to a system without requiring the password. The public key is present on all systems that require a secure connection. The authentication is based on the private key, well SSH verifies the private key against the public key. On the target systems, the public key is verified against a list of authorized keys that are permitted to remotely access the system. This supposedly secured the communication between the client and the server. SSH is vulnerable to a Brute-Force Attack that guesses the user’s access credentials. For this example, we will use a tool called Hydra. It also supports attacks against the greatest number of target protocols. Let’s start cracking. There are two versions of Hydra. The command-line version, and the GUI version, which is called Hydra-GTK. So for this example, we will invoke Hydra from the command line.
How to Disable Recursion on Windows DNS Server
Hackers have noticed that many DNS servers on the internet have accepted requests for external recursive queries, that the administrators did not pay attention to them. Then, they created fraudulent queries for these servers and attacked the servers and the target DNS server with recursive queries. DOS attacks increased with the growth of packet sizes. We can set DNS server to not respond to these queries as follows.
1.Right-click on the DNS Server name and enter the Properties field.
Useful Linux Commands-2
Files
| Command | Description |
| ls -la | Lists files l: Use a long listing format a: List all entries including those starting with a dot |
| pwd | Displays working directory |
| rm | is used to delete files. When used recursively, it may be used to delete directories. |
| rm -r | Removes directories and their contents recursively. |
| rm -f | Ignores nonexistent files, and never prompt before removing. |
| rm -rf | forces the directory to delete |
| cp | is makes copies of files and directories. |
| cp -r | Copıes directories recursively. |
| mv | moves, or renames, files and directories on your filesystem. |
| ln -s | Creates a symbolic link |
| touch | is also an easy way to create empty files. |
| cat | reads data from files, and outputs their contents. |
| more | is a filter for paging through text one screen at a time. |
| head | Displays first 10 lines of the file content |
| tail | Displays the last 10 lines of the contents of the file |
| tail -f | Displays the last 10 lines of the contents of the file in real time |
Processes
Useful Linux Commands-1
I compiled useful linux commands
System
| Command | Description |
| uname -a | Displays system information |
| uname -r | Displays kernel version |
| uptime | Gives a one-line display the current time, how long the system has been running, how many users are currently logged on, the system load averages for the past 1, 5, and 15 minutes |
| hostname | Displays the system host name |
| last reboot | Display last reboot times |
| date | Displays the system date and time |
| cal | Display the calendar for this month, with today highlighted |
| w | Displays a list of logged on users and their processes as shown below |
| whoami | Displays the name of the user who runs the command |
| finger itech | Display information about the user itech |
Hardware