How To Hack Codeigniter Website

This one is intended to be an educational/tutorial post on how I hacked an MMORPG web browser Persian game known as Removed From Text and along with it, the well known PHP framework CodeIgniter used for developing it. Reading this might help you learn a thing or two about information security.

More people have access to the internet than ever before. This has prompted many organizations to develop web-based applications that users can use online to interact with the organization. Poorly written code for web applications can be exploited to gain unauthorized access to sensitive data and web servers. In this article, we will introduce you to web applications hacking techniques and the counter measures you can put in place to protect against such attacks.

Topics covered in this tutorial • • • What is a web application? What are Web Threats? A web application (aka website) is an application based on the client-server model. The server provides the database access and the business logic.

It is hosted on a web server. The client application runs on the client web browser.

Web applications are usually written in languages such as Java, C#, and VB.Net, PHP, ColdFusion Markup Language, etc. The database engines used in web applications include MySQL, MSServer, PostgreSQL, SQLite, etc.

Most web applications are hosted on public servers accessible via the Internet. This makes them vulnerable to attacks due to easy accessibility. The following are common web application threats. • SQL Injection – the goal of this threat could be to bypass login algorithms, sabotage the data, etc. Tumhe dillagi bhool jani padegi.

• Denial of Service Attacks– the goal of this threat could be to deny legitimate users access to the resource • Cross Site Scripting XSS– the goal of this threat could be to inject code that can be executed on the client side browser. • Cookie/Session Poisoning– the goal of this threat is to modify cookies/session data by an attacker to gain unauthorized access. • Form Tampering – the goal of this threat is to modify form data such as prices in e-commerce applications so that the attacker can get items at reduced prices. • Code Injection – the goal of this threat is to inject code such as PHP, Python, etc. That can be executed on the server. The code can install backdoors, reveal sensitive information, etc.

• Defacement– the goal of this threat is to modify the page been displayed on a website and redirecting all page requests to a single page that contains the attacker’s message. How to protect your Website against hacks?

An organization can adopt the following policy to protect itself against web server attacks. • SQL Injection– sanitizing and validating user parameters before submitting them to the database for processing can help reduce the chances of been attacked via SQL Injection. Database engines such as MS SQL Server, MySQL, etc. Support parameters, and prepared statements.

They are much safer than traditional SQL statements • Denial of Service Attacks – firewalls can be used to drop traffic from suspicious IP address if the attack is a simple DoS. Proper configuration of networks and Intrusion Detection System can also help reduce the chances of a DoS attack been successful. • Cross Site Scripting – validating and sanitizing headers, parameters passed via the URL, form parameters and hidden values can help reduce XSS attacks. • Cookie/Session Poisoning– this can be prevented by encrypting the contents of the cookies, timing out the cookies after some time, associating the cookies with the client IP address that was used to create them. • Form tempering – this can be prevented by validating and verifying the user input before processing it. • Code Injection - this can be prevented by treating all parameters as data rather than executable code. Sanitization and Validation can be used to implement this.

This one is intended to be an educational/tutorial post on how I hacked an MMORPG web browser Persian game known as Removed From Text and along with it, the well known PHP framework CodeIgniter used for developing it. Reading this might help you learn a thing or two about information security.

More people have access to the internet than ever before. This has prompted many organizations to develop web-based applications that users can use online to interact with the organization. Poorly written code for web applications can be exploited to gain unauthorized access to sensitive data and web servers. In this article, we will introduce you to web applications hacking techniques and the counter measures you can put in place to protect against such attacks.

Topics covered in this tutorial • • • What is a web application? What are Web Threats? A web application (aka website) is an application based on the client-server model. The server provides the database access and the business logic.

It is hosted on a web server. The client application runs on the client web browser.

Web applications are usually written in languages such as Java, C#, and VB.Net, PHP, ColdFusion Markup Language, etc. The database engines used in web applications include MySQL, MSServer, PostgreSQL, SQLite, etc.

Most web applications are hosted on public servers accessible via the Internet. This makes them vulnerable to attacks due to easy accessibility. The following are common web application threats. • SQL Injection – the goal of this threat could be to bypass login algorithms, sabotage the data, etc. Tumhe dillagi bhool jani padegi.

• Denial of Service Attacks– the goal of this threat could be to deny legitimate users access to the resource • Cross Site Scripting XSS– the goal of this threat could be to inject code that can be executed on the client side browser. • Cookie/Session Poisoning– the goal of this threat is to modify cookies/session data by an attacker to gain unauthorized access. • Form Tampering – the goal of this threat is to modify form data such as prices in e-commerce applications so that the attacker can get items at reduced prices. • Code Injection – the goal of this threat is to inject code such as PHP, Python, etc. That can be executed on the server. The code can install backdoors, reveal sensitive information, etc.

• Defacement– the goal of this threat is to modify the page been displayed on a website and redirecting all page requests to a single page that contains the attacker’s message. How to protect your Website against hacks?

An organization can adopt the following policy to protect itself against web server attacks. • SQL Injection– sanitizing and validating user parameters before submitting them to the database for processing can help reduce the chances of been attacked via SQL Injection. Database engines such as MS SQL Server, MySQL, etc. Support parameters, and prepared statements.

They are much safer than traditional SQL statements • Denial of Service Attacks – firewalls can be used to drop traffic from suspicious IP address if the attack is a simple DoS. Proper configuration of networks and Intrusion Detection System can also help reduce the chances of a DoS attack been successful. • Cross Site Scripting – validating and sanitizing headers, parameters passed via the URL, form parameters and hidden values can help reduce XSS attacks. • Cookie/Session Poisoning– this can be prevented by encrypting the contents of the cookies, timing out the cookies after some time, associating the cookies with the client IP address that was used to create them. • Form tempering – this can be prevented by validating and verifying the user input before processing it. • Code Injection - this can be prevented by treating all parameters as data rather than executable code. Sanitization and Validation can be used to implement this.