SQL Injection-how about your site ?

<br> Many web developers are unaware of how SQL queries can be tampered with, and assume that an SQL query is a trusted command. It means that SQL queries are able to circumvent access controls, thereby bypassing standard authentication and authorization checks, and sometimes SQL queries even may allow access to host operating system level commands.<br> <br> Direct SQL Command Injection is a technique where an attacker creates or alters existing SQL commands to expose hidden data, or to override valuable ones, or even to execute dangerous system level commands on the database host. This is accomplished by the application taking user input and combining it with static parameters to build an SQL query. The following logs examples are based on true stories, unfortunately.<br>

SQL Injection-how about your site ?

Many web developers are unaware of how SQL queries can be tampered with, and assume that an SQL query is a trusted command. It means that SQL queries are able to circumvent access controls, thereby b…

Read more »

New Standard Pushes for a More Secure Web

There is no silver bullet when it comes to encryption. Even the most complex, invulnerable encryption today could be child’s play in the future. The NIST (National Institute of Standards and Technology) is <a href="http://www.pcworld.com/businesscenter/article/260922/new_nist_encryption_guidelines_may_force_federal_agencies_to_replace_old_websites.html">publishing new encryption standards</a> for public review to try and keep up with the times and stay a step ahead of the bad guys. <br> <a href="http://images.pcworld.com/images/article/2012/04/secure_browser-11351369.jpg"><img alt="" height="227" src="http://images.pcworld.com/images/article/2012/04/secure_browser-11351369.jpg" width="320"></a>The NIST is a government agency, and its guidelines only really impact other government agencies. However, many security experts and organizations look to the NIST standards as a baseline. <br> All of security is more or less a game of cat and mouse. Security measures are put in place, and they work for a while until attackers find the weak spots, or figure out how to compromise or circumvent them. Then, security experts have to devise new methods, and the game starts over. Website encryption, and the certificates we use to prove a site is legitimate, are subject to this same cause and effect.<br>

New Standard Pushes for a More Secure Web

There is no silver bullet when it comes to encryption. Even the most complex, invulnerable encryption today could be child’s play in the future. The NIST (National Institute of Standards and Technolog…

Read more »

Defcon Wi-Fi Hack Called No Threat to Enterprise WLANs

<p>Enterprise Wi-Fi networks can keep using WPA2 security safely, despite a <a href="http://www.networkworld.com/news/2012/072912-tools-released-at-defcon-can-261242.html">recent Defcon exploit</a> that has been widely, but wrongly, interpreted as rendering it useless. <p>The exploit successfully compromised a legacy authentication protocol, MS-CHAPv2, which was created by Microsoft years ago. But the vulnerabilities of this protocol (and other similar ones) are well known, and Wi-Fi Protected Access 2 makes use of additional mechanisms to protect them. That protection is still in force, according to both the Wi-Fi Alliance and a wireless architect, who blogged in depth on this issue after the Defcon exploit was reported. <p>IN PICTURES:&#160;<a href="http://www.networkworld.com/slideshow/58324">Quirkiest moments at 2012 Black Hat security conference</a> <p>In the wake of the Defcon demonstration, enterprises were being urged by some to abandon MS-CHAP, the Protected Extensible Authentication Protocol (PEAP), WPA2 or all of the above. None of that is necessary. <p>The Wi-Fi Alliance has reviewed the chapcrack tool and cloudcracker service announced last week at Defcon 20 and these tools do not present an exploitable vulnerability in Wi-Fi CERTIFIED products, according to statement issued by the Wi-Fi Alliance, via Kelly Davis-Felner, the WFA marketing director. These tools exploit previously-documented weaknesses in the use of Microsoft CHAP (MS-CHAP).&#160;All uses of MS-CHAP in WPA2 are protected by the Transport Layer Security (TLS) protocol. TLS is the same strong cryptographic technology that protects all online e-commerce transactions. TLS prevents interception of the MS-CHAP messages used in WPA2 Enterprise and effectively protects against attacks using chapcrack or cloudcracker.</p> </p></p></p></p>

Defcon Wi-Fi Hack Called No Threat to Enterprise WLANs

Enterprise Wi-Fi networks can keep using WPA2 security safely, despite a recent Defcon exploit that has been widely, but wrongly, interpreted as rendering it useless. The exploit successfully compromi…

Read more »

DNSChanger Malware: What's Next?

<br> <div style="border: 0px; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 24px; margin-bottom: 0.5em; margin-top: 0.5em; padding: 0px;"> <span style="background-color: white;">The Federal Bureau of Investigation estimates around 64,000 computers in the U.S. infected with the DNSChanger Trojan may have Internet connectivity problems Monday. This particularly nasty piece of malware first surfaced in 2007 and is able to reroute a PC's Web traffic without knowledge of the user. DNSChanger achieved this by manipulating the Domain Name System (DNS) routing service for infected computers.</span></div>

DNSChanger Malware: What's Next?

The Federal Bureau of Investigation estimates around 64,000 computers in the U.S. infected with the DNSChanger Trojan may have Internet connectivity problems Monday. This particularly nasty piece of …

Read more »

Changing user agent with your browser

<p>Before this someone ask me to edit registry to change default user agent. If we want to change only one user agent it maybe easy. but how about when we want to change hundred of user agent out there ? It maybe difficult to edit registry every time.</p> <p>In this post i will show you how to edit user agent only from your extension(google chrome) and add on(firefox). You can change to hundred user agent out there including googlebot, msn bot and baidu spider.</p> <ol> <li>For firefox you can install add on at <a title="https://dl.dropboxusercontent.com/u/101028009/d/1/user%20agent.xpi" href="https://dl.dropboxusercontent.com/u/101028009/d/1/user%20agent.xpi" target="_blank">https://dl.dropboxusercontent.com/u/101028009/d/1/user%20agent.xpi</a>. After installing and update user agent you will see this on your firefox browser. </li></ol>

Changing user agent with your browser

Before this someone ask me to edit registry to change default user agent. If we want to change only one user agent it maybe easy. but how about when we want to change hundred of user agent out there ?…

Read more »

Subhanallah! Gambar Cicit Rasulullah Yang Comel

<a href="http://1.bp.blogspot.com/-6FQjDblvncs/UYSqV5PUJSI/AAAAAAAAjWU/wf1ISH2LoBg/s1600/cicit.jpg"><img height="400" src="http://1.bp.blogspot.com/-6FQjDblvncs/UYSqV5PUJSI/AAAAAAAAjWU/wf1ISH2LoBg/s400/cicit.jpg" width="300"></a><br> Masih ingatkah anda apakah gelaran Rasulullah s.a.w untuk zaujahnya (isterinya), iaitu Saidatina Aisyah r.a? Rasulullah s.a.w menggelar Saidatina Aisyah r.a dengan gelaran Al-Humaira yang bermaksud putih kemerah-merahan.<br>

Subhanallah! Gambar Cicit Rasulullah Yang Comel

Masih ingatkah anda apakah gelaran Rasulullah s.a.w untuk zaujahnya (isterinya), iaitu Saidatina Aisyah r.a? Rasulullah s.a.w menggelar Saidatina Aisyah r.a dengan gelaran Al-Humaira yang bermaksud p…

Read more »

Is your website safe enough ?

When i wake up this morning and see statistic of <a href="http://www.ezadnet.my/" target="_blank">my site</a> and <a href="http://www.ezadblog.my/">my blog</a> i get many bad bot and spam that want try to access to my domain. it is nothing strange for me. as I tried to fight bad bots, suspicious user agent, spam and everything every day.<br> <br> Do you think your blog is safe enough ? think again, even for blogger. This is spam statistic for this blog when i wake up this day.<br>

Is your website safe enough ?

When i wake up this morning and see statistic of my site and my blog i get many bad bot and spam that want try to access to my domain. it is nothing strange for me. as I tried to fight bad bots, suspi…

Read more »

Senarai Calon PRU 13 – PAS, BN, PKR, DAP dan bebas

Senarai Calon PRU 13 (PAS, PKR, DAP, BN, Bebas & Lain-Lain) untuk setiap negeri di Malaysia pada 5 Mei 2013 dalam Pilihan Raya Umum ke-13.<br> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmP3hBz0DZ97XRqWW-L9wzoMPHgVTif2_8OaZs8lSCK0P0F-B4LDjCk3SZE_8Zj890sg6ZBQEfKLDgutD2VC1Q5FJxh0dIjHt86gsh4cCuYdGC69vUFGIaDaUhL9Xr97jl0txOULNwBJM/s1600/pru13.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="156" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmP3hBz0DZ97XRqWW-L9wzoMPHgVTif2_8OaZs8lSCK0P0F-B4LDjCk3SZE_8Zj890sg6ZBQEfKLDgutD2VC1Q5FJxh0dIjHt86gsh4cCuYdGC69vUFGIaDaUhL9Xr97jl0txOULNwBJM/s320/pru13.png" width="320"></a></div> <h2> Senarai Calon PRU 13</h2>

Senarai Calon PRU 13 – PAS, BN, PKR, DAP dan bebas

Senarai Calon PRU 13 (PAS, PKR, DAP, BN, Bebas & Lain-Lain) untuk setiap negeri di Malaysia pada 5 Mei 2013 dalam Pilihan Raya Umum ke-13. Senarai Calon PRU 13…

Read more »

Hotlink Protection

<p>Hotlink protection prevents other websites from directly linking to files on your website. Other sites will still be able to link to any file type that you don't specify (i.e., HTML files). An example of hotlinking would be using an <img> tag to display an image from your site somewhere else on the Web. The end result is that the other site is stealing your bandwidth.</p> <div id="codeSnippetWrapper" class="csharpcode-wrapper"> <div id="codeSnippet" class="csharpcode"><pre class="alt"><span id="lnum1" class="lnum"></span></pre></div><br><div id="codeSnippet" class="csharpcode"><pre style="overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; border-bottom: #cecece 1px solid; padding-bottom: 5px; padding-top: 5px; padding-left: 5px; min-height: 40px; border-left: #cecece 1px solid; padding-right: 5px; width: 650px; background-color: #fbfbfb"><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #d6d6d6"> 1: RewriteCond %{HTTP_REFERER} !^$<br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #ffffff"> 2: RewriteCond %{HTTP_REFERER} !^http:<span style="color: #008000">//yoursite.com/.*$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #d6d6d6"> 3: RewriteCond %{HTTP_REFERER} !^http:<span style="color: #008000">//yoursite.com$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #ffffff"> 4: RewriteCond %{HTTP_REFERER} !^http:<span style="color: #008000">//www.yoursite.com/.*$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #d6d6d6"> 5: RewriteCond %{HTTP_REFERER} !^http:<span style="color: #008000">//www.yoursite.com$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #ffffff"> 6: RewriteCond %{HTTP_REFERER} !^https:<span style="color: #008000">//yoursite.com/.*$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #d6d6d6"> 7: RewriteCond %{HTTP_REFERER} !^https:<span style="color: #008000">//yoursite.com$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #ffffff"> 8: RewriteCond %{HTTP_REFERER} !^https:<span style="color: #008000">//www.yoursite.com/.*$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #d6d6d6"> 9: RewriteCond %{HTTP_REFERER} !^https:<span style="color: #008000">//www.yoursite.com$ [NC]</span><br></pre><pre style="font-size: 12px; font-family: consolas,'Courier New',courier,monospace; margin: 0em; width: 100%; background-color: #ffffff"> 10: RewriteRule .*\.(jpg|jpeg|gif|png|ico|bmp|swf|wav|mp3|pdf|xls|xlsx|xps|psd|dxf|eps|ps|ai|tiff|svg|ttf|doc|docx|css|js|jsp|cfm|htm|shtml|shtm|xhtml|xhtm|jsp|phtml|phtm|php3|php4|php5|pl|pm|plx|xsml|log|json|otf|woff)$ http:<span style="color: #008000">//www.yoursite.com/ [R,NC]</span></pre></pre></div></div><br><div> </div><br>

Hotlink Protection

Hotlink protection prevents other websites from directly linking to files on your website. Other sites will still be able to link to any file type that you don't specify (i.e., HTML files). An example…

Read more »