Here at Wubbleyou, we like to keep our customers up to date with the latest news from Wubbleyou HQ, new technologies available and also articles on current IT related stories. If it’s happening on the world wide web, we’re probably blogging about it!
Now the chances are if your website is a run of the mill 5 page portfolio site, you should not be too concerned about security. I say this as unless you have crossed someone with knowledge in such fields and they are looking for a bit of payback, most people with the skill and patience to complete such a task are looking to steal valuable data. This can consist of user information or credit card numbers, your website is unlikely to possess such information.
Not so long back Wubbleyou was commissioned to test a relatively modest site, with a medium sized user base. After about 2 hours we had full control over the website, in fact I could argue we had more control than those who owned the site. This is only because we had the knowledge to circumvent certain restrictions imposed by the web developers, specifically designed to prevent them accidently destroying their own website.
I will iterate this now, most web designers will painstakingly scrutinise their own work testing for potential vulnerabilities, but if you have your doubts this article should provide you with a few ‘security DIYs’ to test this yourself. If you prefer you could also contact us at Wubbleyou for a free consultation, I realise not everyone out there is technically geared to do this!
Now we can start with the relatively tedious task of testing for vulnerabilities with one of the more basic but effective penetration methods, in security terms we call this SQL Injection. This is as simple as going through your website and entering only a ‘ (single quote) into any and all input boxes and hitting send. If you get back an expected message such as “Email address not recognised” or “password is not recognised” (assuming you’re testing your login page), then chances are all is good and your attempt was dealt with correctly. On the other hand if you’re thrown something unexpected like a “server 500 error”, a blank page or a snippet of code, you are likely to be vulnerable and it could only be a matter of time before it is manipulated.
Another method of penetration could be the links used to navigate your website. Now if your website is dynamic where you have the ability to add/remove pages and products etc. You should also test these. Say the link to one of your products is http://somesite.co.uk/products.php?id=2; this link is passing information to your server through the bolded. You can test this with the same method by adding a ‘ (single quote) to the end of this link as so: http://somesite.co.uk/products.php?id=2’. A normal response would be to either take you to a product or throw you a “Product not found”, this should look like an error which conforms to the rest of your website. If on the other hand you are thrown the server 500 errors stated earlier, that link is likely to be vulnerable.
How this works you ask? Just like the English language has structure and syntax, computer systems rely on a similar system to operate efficiently. If you read this article and there was question marks where there was meant to be commas or I swapped the word ‘and’ for ‘flaps’, this would most likely confuse you but you would probably still understand what the general gist was. Computers systems require a very logical course of action to operate. Apply the same analogy to this where errors are poorly handled, the system is likely to collapse and reveal vulnerable information. We can manipulate this weakness further by injecting our own data to make your website operate in a way to suit us.
I’m not going to delve any further into this as I am likely to make a complex subject to those who are not versed in its methods very confusing. If you are feeling particularly ambitious I would recommend visiting links I’ve listed below, or alternatively searching “Penetration Testing” or “SQL Injection” in Google. As I say, this is a DIY guide for those with little knowledge in the subject, if you believe there is a vulnerability or just want peace of mind I suggest you contact Wubbleyou for a free consultation.
Further SQL Injection Methods (If you’re feeling ambitious!):
http://www.securiteam.com/securityreviews/5DP0N1P76E.html (a relatively old article but the methods still apply)
Notable Examples of SQL Injection: