How to protect against Unexpected Inputs

written by: Yoko Jelkovich; article published: year 2006, month 08;


In: Categories » Computers and technology » Data security » How to protect against Unexpected Inputs

When you surf the Internet, you download one of two types of Web pages to your computer: static or dynamic. A static Web page sits on a Web server until a client computer sends a request for it. Once requested, the Web page is then downloaded to the client computer exactly as it was created, where the Web browser then views the page. A static Web page is really nothing more than a brochure or advertisement, and does not allow the true power of the Internet to be expressed. However, a static page is relatively safe from hackers.

In contrast, dynamic Web pages only exist in a partial state before they are requested. Using scripting languages, a Web server actually fills in all the missing parts and creates the Web page before it is sent to the client's computer. This type of dynamic Web page creation allows for database interaction, shopping carts, and customized parts of a Web page, such as colors, names, and formatting layouts.

A search engine Web page, or front end, is a perfect example of dynamic scripting. The basic search engine is nothing more than a small program that queries a database (or more specifically, a table in the database) for any matching information based on the criteria that you have given. For instance, if you want to find out about dogs, you simply type dogs in the text box and hit search.

Most databases are based on the Structured Query Language (SQL). This language is primarily used to manipulate information in a database. Using SQL, you can query, update, add, delete, and perform other actions on data in a few short lines of code.

Here is another common use for database-driven Web sites. Have you ever been required to type in a username or password to access a Web page? Quite often, your entry is compared to a database table, where your user name and password are validated. If there is an account for the entered user name, and the password matches, you will be granted access.

To illustrate, let's take a closer look at the process, as follows:

  1. The user is asked to type in account information.

  2. The user enters the following:

    User=Tom   Pass=tompass 
  3. The entered information is sent to Web server.
  4. An SQL query is created using the entered account information:
    "SELECT * FROM tblUsers WHERE USER='Tom' and PASS='tompass'" 
  5. The database returns the results.
  6. An algorithm is used to determine whether access is permitted.
  7. If results are found, access is enabled, and if no results are found, access is restricted.
  8. The user is either sent into the Web site or sent back to the login page.

This awesome technology can have limitless uses. However, a clever hacker can exploit this technology to access the data without proper authentication. For example, suppose our hacker performed the following steps instead of the previously listed ones.

  1. The hacker is asked to type in account information.

  2. The hacker enters the following:

    User=' or ''   Pass=' or '' 
  3. Entered information is sent to Web server.
  4. A SQL query is created using the entered account information:
    "SELECT * FROM tblUsers WHERE USER='' or '' and PASS=''or '' 
  5. The database returns the results.
  6. An algorithm is used to determine whether access is permitted.
  7. If results are found, access is enabled, and if no results are found, access is restricted.
  8. The hacker gains access because the database returned a list of all users!

As you can see, thanks to the hacker's manipulation of the query on the database, he now has access to the secured Web site.

There are many ways this type of attack can be used. Hackers can delete, insert, update, and view data by tricking the Web server into requesting extra information from a database. Although this does take a solid understanding of the SQL language, many hackers already know it as a result of their work requirements.

Exploiting Web Forms

The previously discussed type of hacking technique can also be used in exploiting Web forms. Quite often, Web-based forms have "hidden" fields that contain information that is sent to a Web server without the client ever seeing it. A recent example is a popular "shopping cart" software program that was found to have hidden fields containing the prices of the items available for purchase online. All a hacker had to do was download the Web page to her computer and edit the hidden Price field to any value she wanted. This new and improved value was then sent to the shopping cart software for processing. If there were no alert humans involved with processing the purchases, the hacker would have no problem cheating an online store out of thousands of dollars.

These are some of the most popular types of malicious exploits on the Internet. Thanks to all the different types of user interfaces and dynamic content on the Internet, hackers are easily finding holes. FTP programs, SQL server programs, remote login programs, scripting languages and even HTML itself all have been found to be vulnerable to unexpected input that results in the disclosure of sensitive information. All it takes is one hacker with a thorough understanding of a software program, or even a script kiddie with a pre-made program that finds the holes, and another host of computer systems can go down in flames.

legal disclaimer

1) Our website is not responsible for the information contained by this article as well for any and all copyright infringements by authors and writers. E-articles is a free information resource. If you suspect this article for any copyright infringements, please read the Terms of service and contact us to investigate the problem.
2) The E-articles directory team is not responsible for inaccuracies, falsehoods, or any other types of misinformation this tutorial may contain and will not be liable for any loss or damage suffered by a user through the user's reliance on the information gained here. Please read the Terms of service

Useful tools and features

Translate this article to...    Send this article to you or to a friend

Link to this article from your page   
If you like this article (tutorial), please link to it from your web page using the information above. Linking to this page, this is the only way to help us improve our service, the same time providing your visitors with a way to improve their online experience.

related articles

1. What are Buffer Overflows
Exploiting a buffer overflow is an advanced hacking technique. However, it is a leading type of security vulnerability. To understand how a hacker can use a buffer overflow to infiltrate or crash a computer, you need to understand exactly what a buffer is. A computer program consists of many different variables, or value holders. As a program is executed, these different variables are assigned a specific amount of memory as required by the type of information the variable is expected to hold. For example, a short integer ...

2. Protecting the Security of Information
The first and best line of defense against unwarranted intrusions into personal privacy is for individuals to employ e-commerce technology to protect themselves. Industry-developed and supplied encryption technologies and firewalls, for example, provide individuals with substantial tools to guard against unwarranted intrusions. Encryption is technology, in either hardware or software form, which scrambles e-mail, database information, and other computer data to keep them private. Using a sophisticated mathemati...

3. Why Is Authenticated SSL Necessary
Notions of identity and authentication are fundamental concepts in every marketplace. People and institutions need to get to know one another and establish trust before conducting business. In traditional commerce, people rely on physical credentials (such as a business license or letter of credit) to prove their identities and assure the other party of their ability to consummate a trade. In the age of e-business, authenticated SSL certificates provide crucial online identity and security to help establish trust between ...

4. Virus Prevention ~ How to protect against Internet Viruses
There are several elements to a good virus defense. The most important element requires some self-control—you must NEVER open a file/program unless you are 100% sure it is not infected. No matter how attractive the file is, where it came from, or what it promises you, you can never assume that a file is what it claims to be. For example, the Melissa virus reproduced through email and sent copies of itself to every one in the victim's address book. Because of this, relatives and friends of the victim were soon infected as ...

5. How to protect against Hostile Web Pages and Scripting
The dangers of Trojans and viruses are well known. However, many computer users are completely unaware of the dangers involved in viewing Web pages. Through scripting languages, Web page operators can upload and download files to your device (PC/PDA). They can also install mini-programs or grab information from you that can be used to destroy or take over your computer. Every time you go to a Web page, you actually download the full document to your computer. This includes all text, pictures, and even any code that is r...

6. Features of Windows Encrypting File System (EFS)
• Only available on Windows 2000 and Windows XP operating systems using NTFS partitions and volumes. (NTFS v5). • Encryption is transparent to the user. • Uses public-key encryption. Using a public key from the user’s certificate encrypts keys that are used to encrypt the file. The list of encrypted fileencryption keys is kept with the encrypted file and is unique to it. When decrypting the file encryption keys, the file owner provides a private key that only he has. ...

7. What are Denial of Service Attacks (DOS attacks) and how to protect against them
Hackers can wreak havoc without ever penetrating your system. For example, a hacker can effectively shut down your computer by flooding you with obnoxious signals or malicious code. This technique is known as a denial-of-service attack. Hackers execute a denial-of-service attack by using one of two possible methods. The first method is to flood the target computer or hardware device with information so that it becomes overwhelmed. The alternative method is to send a well-crafted command or piece of erroneous data that crash...