Scribd Logo
Upload

Welcome to Scribd!

  • 38 views

    JNTUK - University College of Engineering Vizianagaram

    Uploaded by

    priyanka
    This document discusses various web security threats such as phishing, pharming, URL obfuscation, HTTP response splitting, cross-site scripting, cross-site request forgery, SQL injection, and provides recommendations for protection. It explains techniques like obfuscated URLs, URL redirection, and HTTP response splitting that can be used in phishing and other attacks. It also discusses how to protect against these threats through practices like input validation, access restrictions, auditing and others.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    JNTUK - University College of Engineering Vizianagaram

    Uploaded by

    priyanka
    38 views34 pages
    This document discusses various web security threats such as phishing, pharming, URL obfuscation, HTTP response splitting, cross-site scripting, cross-site request forgery, SQL injection, and provides recommendations for protection. It explains techniques like obfuscated URLs, URL redirection, and HTTP response splitting that can be used in phishing and other attacks. It also discusses how to protect against these threats through practices like input validation, access restrictions, auditing and others.

    Original Title

    3-CyberThreats.pdf

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses various web security threats such as phishing, pharming, URL obfuscation, HTTP response splitting, cross-site scripting, cross-site request forgery, SQL injection, and provides recommendations for protection. It explains techniques like obfuscated URLs, URL redirection, and HTTP response splitting that can be used in phishing and other attacks. It also discusses how to protect against these threats through practices like input validation, access restrictions, auditing and others.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    38 views34 pages

    JNTUK - University College of Engineering Vizianagaram

    Uploaded by

    priyanka
    This document discusses various web security threats such as phishing, pharming, URL obfuscation, HTTP response splitting, cross-site scripting, cross-site request forgery, SQL injection, and provides recommendations for protection. It explains techniques like obfuscated URLs, URL redirection, and HTTP response splitting that can be used in phishing and other attacks. It also discusses how to protect against these threats through practices like input validation, access restrictions, auditing and others.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 34

    by

    Siva Rama Krishna T.

    Department of Computer Science and Engineering


    JNTUK University College of Engineering Vizianagaram
    www.jntukucev.ac.in
    Obfuscated URL
    Redirection Technique

    http://www.paypal.com/url.php?url = http://phishing.com
    Pharming
    Protection
    Guard against spam.
    Communicate personal information only via phone or secure
    web sites
    Do not click on links, download files or open attachments in
    emails from unknown senders.
    Never email personal or financial information, even if you are
    close with the recipient
    Never enter personal information in a pop-up screen.
    Protect your computer with a firewall, spam filters, anti-virus
    and anti-spyware software.
    Check your online accounts and bank statements regularly
    Safe Browsing Tool
    Safe guards web browser
    communications

    Acts based on website ratings

    Eg. Web of Trust (WOT) Plug-in


    URL Filtering
    HTTP Response Splitting

    3 1

    4
    Server: WebLogic XMLX Module 8.1 SP1 Fri, 15 Apr 17:22:21
    GMT
    2011 271009 with
    Content-Type: text/html
    Set-Cookie:
    JSESSIONID =....; path =/
    Connection: Close
    <html><head><title>302 Moved Temporarily</title></head>
    <body bgcolor = #FFFFFF>
    <p>This document you requested has moved temporarily.</p>
    <p>Its now at <a
    href = http://a.com/language/by_lang.jsp?lang =
    English>http://a.
    com/language/by_lang.jsp?lang = English</a>.</p>
    </body></html>
    HTTP/1.1 302 Moved Temporarily
    Date: Fri, 15 Apr 2011 17:22:21 GMT
    Location:
    http://a.com/language/by_lang.jsp?lan
    g = bogus
    Content-Length: 0
    HTTP/1.1 200 OK
    Content-Type: text/html
    Content-Length: 26
    <html>Bogus_Message</html>
    2

    6
    Cross Site Request Forgery
    Cross Site Scripting
    SELECT * FROM users WHERE name =" + userName +

    "SELECT * FROM users WHERE name =admin@jntu-1234

    "SELECT * FROM users WHERE name =hello@123.com


    SELECT * FROM users WHERE name = OR 1=1
    SELECT * FROM users WHERE name =a; DROP TABLE users;
    <form action=index.php method="post">

    <input type="email" name="email" required="required"/>

    <input type="password" name="password"/>

    <input type="checkbox" name="remember_me" value="Remember me"/>

    <input type="submit" value="Submit"/>

    </form>

    SELECT * FROM users WHERE email = $_POST['email']


    AND password = md5($_POST['password']);
    Protection
    Never concatenate user input with application SQL to
    form the SQL sent to the database.
    Properly device access restrictions in database
    Input Validation
    Audit for vulnerabilities

    You might also like