Comments on: How I hacked a site, and how to defend properly http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/ Fri, 21 Nov 2008 04:43:52 +0000 http://wordpress.org/?v=2.6.2 By: A one day pause of posts… » - Jeff Kee Consulting || Vancouver, BC - http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-290 A one day pause of posts… » - Jeff Kee Consulting || Vancouver, BC - Sat, 10 Feb 2007 08:13:23 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-290 [...] How I hacked a site, and how to defend properly [...] [...] How I hacked a site, and how to defend properly [...]

]]> By: || Jeff Kee Consulting || Vancouver, BC - My Favorite Firefox Add-ons (especially for web developers!!!) » http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-135 || Jeff Kee Consulting || Vancouver, BC - My Favorite Firefox Add-ons (especially for web developers!!!) » Thu, 25 Jan 2007 21:06:50 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-135 [...] go on. It can do so many things. And it was also a crucial part of my hack as described in my previous post here! This tool is so perfect for troubleshooting of javascript, configuring your HTML and CSS for [...] [...] go on. It can do so many things. And it was also a crucial part of my hack as described in my previous post here! This tool is so perfect for troubleshooting of javascript, configuring your HTML and CSS for [...]

]]> By: Jeff Kee http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-117 Jeff Kee Tue, 23 Jan 2007 08:03:06 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-117 Yes, that's the method I use.. sometimes with more measures if necessary, such as cookies, matching MD5 hash etc. Yes, that’s the method I use.. sometimes with more measures if necessary, such as cookies, matching MD5 hash etc.

]]> By: Jared http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-114 Jared Tue, 23 Jan 2007 01:13:25 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-114 OK apparantly there is a protection scheme against writing out too much PHP code.. but anyhow. I use the If statements to check the auth level and go from there. OK apparantly there is a protection scheme against writing out too much PHP code.. but anyhow.

I use the If statements to check the auth level and go from there.

]]> By: Jared http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-113 Jared Tue, 23 Jan 2007 01:02:42 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-113 well that comment got cut off but the rest of it is here. if($session[’type’] well that comment got cut off but the rest of it is here.

if($session[’type’]

]]> By: Jared http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-111 Jared Tue, 23 Jan 2007 00:59:28 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-111 Do PHP Sessions work as a good security measure? I usually do something like this ... ... MySQL queries... $user = mysql_fetch_array($result); $session['type']=$user['type']; // user's level of authority $session['userid']=$user['id']; //user's unique ID in teh table for pointing $session['name']= $user['first_name']." ".$user['last_name']; // save the name for any kind of displays etc. And then each authorization page that requires users to be logged on, and at a certain security clearance, it displays the page or hides it depending on the results.. if($session['type'] Do PHP Sessions work as a good security measure? I usually do something like this …

… MySQL queries…

$user = mysql_fetch_array($result);

$session['type']=$user['type']; // user’s level of authority
$session['userid']=$user['id']; //user’s unique ID in teh table for pointing
$session['name']= $user['first_name'].” “.$user['last_name']; // save the name for any kind of displays etc.

And then each authorization page that requires users to be logged on, and at a certain security clearance, it displays the page or hides it depending on the results..

if($session['type']

]]> By: Jeff Kee http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-110 Jeff Kee Mon, 22 Jan 2007 21:58:11 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-110 Ya ya ya matt... SURE YOU DID. Please don't try though. Ya ya ya matt… SURE YOU DID. Please don’t try though.

]]> By: Housser http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-109 Housser Mon, 22 Jan 2007 21:54:54 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-109 Jeff Kee paid me $10 to leave this comment. PS I hacked your site ^_^ Jeff Kee paid me $10 to leave this comment.

PS I hacked your site ^_^

]]> By: Jeff Kee http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-108 Jeff Kee Mon, 22 Jan 2007 21:36:44 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-108 yes, I do have that one, I've fooled around with it a few times. These plug-ins are great... One of the top reasons why i prefer Firefox over IE, obviously.. especially from a developer's perspective. yes, I do have that one, I’ve fooled around with it a few times. These plug-ins are great… One of the top reasons why i prefer Firefox over IE, obviously.. especially from a developer’s perspective.

]]> By: Paul http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-107 Paul Mon, 22 Jan 2007 21:02:39 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-107 This particular hack was cross-browser, it took advantage of the fact that if you for example copy-and-paste the following: "javascript:alert('hi');" into your address bar in any browser, it will execute the actual javascript in the context of the current page. Add in some DOM modification and you can create a way to do hacks like this out-of-the box with any browser. By the way, have you tried the FireBug plug-in? It works well in conjunction with the developer toolbar, but it has more advanced debugging features. This particular hack was cross-browser, it took advantage of the fact that if you for example copy-and-paste the following: “javascript:alert(’hi’);” into your address bar in any browser, it will execute the actual javascript in the context of the current page. Add in some DOM modification and you can create a way to do hacks like this out-of-the box with any browser.

By the way, have you tried the FireBug plug-in? It works well in conjunction with the developer toolbar, but it has more advanced debugging features.

]]> By: Jeff Kee http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-106 Jeff Kee Mon, 22 Jan 2007 18:40:02 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-106 Yeah faking javascript is part of the Firefox extension as well. Of course, so far I've used it to test my javascript applications to trouble shoot and debug but... Yeah faking javascript is part of the Firefox extension as well.

Of course, so far I’ve used it to test my javascript applications to trouble shoot and debug but…

]]> By: Jeff Kee http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-105 Jeff Kee Mon, 22 Jan 2007 18:39:06 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-105 HA yes, there is a function after all!!! <strong>"Add Cookies"</strong> to add your own.. WOW> HA yes, there is a function after all!!! “Add Cookies” to add your own.. WOW>

]]> By: Paul http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-104 Paul Mon, 22 Jan 2007 16:08:21 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-104 One would hope... I remember a similar problem happened to Microsoft before the launch of live.com email - a "javascript:" pseudo-url was passed around the internet which added an option to the drop down box and allowed people to sign up for @live.com names before it was officially allowed. One would hope… I remember a similar problem happened to Microsoft before the launch of live.com email - a “javascript:” pseudo-url was passed around the internet which added an option to the drop down box and allowed people to sign up for @live.com names before it was officially allowed.

]]> By: Paul http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-103 Paul Mon, 22 Jan 2007 13:03:14 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-103 Anything that comes from the browser should be treated as if it could be faked. Even if common browsers don't have the ability to fake it, someone using CURL or some other software could find a way around it. In the case of cookies, they are defiantly editable. FireFox's developer toolbar has a feature that lets you add your own cookies and delete existing ones, so effectively you could use that to modify existing cookies. Anything that comes from the browser should be treated as if it could be faked. Even if common browsers don’t have the ability to fake it, someone using CURL or some other software could find a way around it.

In the case of cookies, they are defiantly editable. FireFox’s developer toolbar has a feature that lets you add your own cookies and delete existing ones, so effectively you could use that to modify existing cookies.

]]> By: Jeff Kee http://www.jeffkee.com/web-development-design/how-i-hacked-a-site-and-how-to-defend-properly/#comment-101 Jeff Kee Mon, 22 Jan 2007 10:15:06 +0000 http://blog.jeffkee.com/2007/01/22/how-i-hacked-a-site-and-how-to-defend-properly/#comment-101 Yes, always guard the goods, not JUST the keys to the goods! Yes, always guard the goods, not JUST the keys to the goods!

]]>