Common types of Web application attacks

Common types of Web application attacks.

Source : ibm.com/software/rational/offerings/testing/webapplicationsecurity

Description	Common causes	Preventive measures
Impersonation
Typing a different user’s credentials or changing a cookie or parameter to impersonate a user or pretend that the cookie originates from a different server	Using communications based authentication to allow access to any user’s data Using unencrypted credentials that can be captured and reused Storing credentials in cookies or parameters Using unproven authentication methods or authentication from the wrong trust domain Not permitting client software to authenticate the host	Use stringent authentication and protection for credential information using: Operating system (OS)-supplied frameworks Encrypted tokens such as session cookies Digital signatures
Tampering
Changing or deleting a resource without authorization (e.g., defacing a Web site, altering data in transit)	Trusting data sources without validation Sanitizing input to prevent execution of unwanted code Running with escalated privileges Leaving sensitive data unencrypted	Use OS security to lock down files, directories and other resources Validate your data Hash and sign data in transit (by using SSL or IPsec, for example)
Repudiation
Attempting to destroy, hide or alter evidence that an action occurred (e.g., deleting logs, impersonating a user to request changes)	Using a weak or missing authorization and authentication process Logging improperly Allowing sensitive information on unsecured communication channels	Use stringent authenti-cation, transaction logs and digital signatures Audit
Information disclosure
Revealing personally identifiable information (PII) such as passwords and credit card data, plus information about the application source and/or its host machines	Allowing an authenticated user access to other users’ data Allowing sensitive information on unsecured communication channels Selecting poor encryption algorithms and keys	Store PII on a session (transitory) rather than permanent basis Use hashing and encryption for sensitive data whenever possible Match user data to user authentication
Denial of service (DoS)
Flooding—sending many messages or simultaneous requests to overwhelm a server Lockout—sending a surge of requests to force a slow server response by consuming resources or causing the appli-cation to restart	Placing too many applications on a single server or placing conflicting applications on the same server Neglecting to conduct comprehensive unit testing	Filter packets using a firewall Use a load balancer to control the number of requests from a single source Use asynchronous protocols to handle processing-intensive requests and error recovery
Elevation of privilege
Exceeding normal access privileges to gain administrative rights or access to confidential files	Running Web server processes as “root” or “administrator” Using coding errors to allow buffer overflows and elevate application into a debug state	Use fewest-privileges context whenever possible Use type-safe languages and compiler options to prevent or control buffer overflows

Menyimpan data ke database dengan ajax

Menyimpan data ke database dengan ajax

Dikesempatan ini saya akan mencoba menjelaskan bagaimana cara menyimpan data ke database menggunakan AJAX dan PHP sebagai jembatannya. Saya beranggapan anda telah memiliki dasar-dasar PHP dan javascript. Saya akan mencoba menjelaskannya langkah demi langkah agar mudah dimengerti. Baiklah saya akan mulai dengan menjelaskan bagaimana menyimpan data dengan cara klasik dengan menggunakan php (tanpa ajax).

Jika anda memiliki sebuah tabel dalam database MYSQL, misalnya nama tabel anda adalah "customer_tb" dan nama database anda adalah "customer_db". Table anda (customer_tb) digunakan untuk menyimpan data customer, dengan struktur misalnya seperti dibawah ini.

Nama Field	Tipe Data
email	varchar(20) *
first_name	varchar(50)
last_name	varchar(50)
address	text
gender	char(1)

Jika anda menggunakan PHP untuk menyimpan data ke dalam tabel maka setidaknya anda akan menggunakan form seperti dibawah ini:

Email
First Name
Last Name
Address
Gender	Laki-Laki           Perempuan

Script dari form diatas misalnya sperti di bawah ini:

Script Form:

Email
First Name
Last Name
Address
Gender	Laki-LakiPerempuan

dari script form di atas terlihat bahwa setiap anda menyimpan data dengan menekan tombol submit ada akan memanggil sebuah file yang namanya "save_data.php". Setidaknya file save_data.php ini akan berisi script php seperti di bawah ini:

File save_data.php :

//file save_data.php 

$email=$_POST['email'];
$first_name=$_POST['fname'];
$last_name=$_POST['lname '];
$address=$_POST['address'];
$gender=$_POST['gender'];
//konneksi ke data base
$conn= mysql_connect("localhost","root","root"); //host, user name, password 
mysql_select_db("customer_db");
$query="insert into customer_tb('email','first_name','last_name','address','gender')values('$email','$first_name','$last_name', '$address','$gender')";
mysql_query($query,$conn);
echo "Data Tersimpan"; 
?>

dengan melakukan hal di atas untuk menyimpan, setiap kali anda menyimpan data dengan menekan tombol submit maka browser akan meload file save_data.php berkali kali. Untuk menghindarinya anda dapat menggunakan ajax. Anda hanya perlu melakukan sedikit perubahan pada cara di atas . Pertama buatlah sebuah file dengan nama "ajax.js " dan ketikkan script dibawah ini:

File ajax.js

var sendReq = getXmlHttpRequestObject();
var _documentid='content';
function getXmlHttpRequestObject() {
if (window.XMLHttpRequest) { 
return new XMLHttpRequest();
} else if(window.ActiveXObject) {
return new ActiveXObject("Microsoft.XMLHTTP");
} else {
alert('Status: Cound not create XmlHttpRequest Object. Consider upgrading your browser.');
}
}
function doSaveCustomer(){
if (sendReq.readyState == 4 || sendReq.readyState == 0) {
sendReq.open("POST", 'save_data.php', true);
sendReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
sendReq.onreadystatechange =function() {
if (sendReq.readyState == 4 && sendReq.status == 200) {
alert(sendReq.responseText);
}
}
var param = 'email=' + document.getElementById('email').value;
param += '&fname=' + document.getElementById('fname').value;
param += '&lname=' + document.getElementById('lname').value;
param += '&address=' + document.getElementById('address').value;
param += '&gender=' + document.getElementById('gender').value;
sendReq.send(param);
document.getElementById(_documentid).innerHTML = 'Loading....';
document.getElementById('email').value='';
document.getElementById('fname').value='';
document.getElementById('lname').value='';
document.getElementById('address').value='';
}
}

Langkah selanjutnya adalah mengubah script form anda menjadi sperti dibawah ini :

Script Form baru:

 

Email
First Name
Last Name
Address
Gender	Laki-LakiPerempuan

Langkah terakhir adalah "SELAMAT MENCOBA". Saya berharap semoga tutorial ini bermanfaat untuk anda. Jika ada sesuatu yang salah syla mohon maaf yang sebesarnya.