Common techniques and methods used by hackers to attack websites

Common techniques and methods used by hackers to attack websites

With the increasing popularity of computer networks, a large amount of information that is closely related to us is stored and transmitted through the website carrier, such as e-commerce websites, travel and living websites, educational course selection websites, and online game websites. If a netizen or website security administrator is not familiar with basic knowledge such as website intrusion, website attack and defense, and computer network, the Administrator lacks awareness of network information security and can handle important personal information at will. As a result, website security issues become complex and diverse, and hackers are also given the opportunity to attack websites to obtain personal information. Therefore, understanding the basic methods for hackers to attack websites, understanding the basic knowledge of hackers, and understanding website security protection are crucial to protecting network information security.

Currently, the main website intrusion methods are: Upload Vulnerability Trojans, typical website upload vulnerabilities. We directly access the upload page and directly upload Trojans at the website background. We also add website upload types, some website systems restrict the upload of ASP files. Hackers can add files that are allowed to upload files such as ASACER. Then, they only need to change the trojan file name to ASACER. webshell can also be uploaded. With the background backup and recovery file function, hackers can modify the trojan file suffix to JPG or GIF. After uploading the file, they can use the background backup database function to restore it to an ASP suffix.

Password. For servers with poor website permissions, you can obtain the highest permissions through WEBSHELL to intrude into and modify the website and obtain information. Generally, there are several methods to upload website vulnerabilities:

The first is the vulnerability of uploading ASP files directly. Many shared websites have upload pages. Therefore, these websites must be vigilant against the vulnerability of uploading ASP files directly. Hackers only need to open the upload page and directly upload the asp Trojan to obtain the WEBSHELL file of the website, thus obtaining the website administrator privilege. WEBSHELL is usually called a WEBSHELL. It is used as a WEB script to perform website operations anonymously on the WEB server through the WEB Service port. WEBSHELL can traverse the firewall, and generally does not appear in system logs using WEBSHELL, which is hard to detect by experienced administrators.

To prevent such vulnerabilities, we recommend that you use the latest programs for website development. The latest programs do not have the direct upload vulnerability. If the website does not share information for other purposes, we recommend that you do not set the upload page, in this way, no file upload vulnerability can be exploited by hackers. If you cannot delete the website's upload page, you can add a restricted file type code in the upload program to prohibit the upload of files such as ASP/EXE.

The second type is the brute-force database. It is used to download the website database files directly. At present, with the increasing popularity of websites and the increasing awareness of computer website security, this method is rare and many websites have fixed this vulnerability. Then, there are still a lot of websites that have not been taken seriously, thus leaving hackers with an opportunity. If the database files of the website are obtained by hackers, the hackers directly have the permissions of the front and back ends of the website. The impact on the website can be imagined. In general, the hacker's brute-force library method is: for example, a website address is http://www.xxx.com/dispbbs.asp? BoardID = 7 & ID = 161 hackers modified the website address to http://www.xxx.com % 5cdispbbs. asp? BoardID = 7 & ID = 161 you can directly get the absolute path of the website database, and then directly download through the download tool; or, by entering the database default path http://www.xxx.com/conn. asp (for example

 

I. Common website intrusion methods

At present, there are usually three types of Web Pages browsed by netizens. The first is to browse well-known websites, which usually have high security protection measures. Generally, hackers do not select such websites for intrusion. Secondly, websites obtained by searching for keywords through search engines, which are often the main targets of hacker intrusion. Finally, they are websites obtained through links of websites, if such websites use links of the second type of websites, netizens should pay special attention to browsing websites, which are often websites with Trojans.

How did hackers intrude into the system? Next, we will give a brief introduction to the common methods used by hackers to intrude into websites.

(1) Exploiting website Vulnerabilities

Hackers can easily obtain website administrator accounts through website vulnerabilities.

78

2011.03

If the website does not modify the default database path during development, you can directly obtain the database file.

 

The third vulnerability is injection, which is currently the most harmful and the most widely used vulnerability. This vulnerability may also exist in well-known websites. The injection vulnerability is caused by poor character filtering. Hackers can obtain the account and password of the website administrator.

 

First introduce how hackers find the vulnerability, such as a website http://www.bkjia.com/bbs.asp? Boardid = 7 & id = 111. If the website name ends with a number, manually add "and 1 = 1" or "and 1 = 2". If an error message is returned, it indicates that the website has an injection vulnerability. If the "and 1 = 1" website is added and an error page is returned, it indicates that the website is not available to exploit the vulnerability. In this case, hackers use manual guesses or tools (such as DOMAIN) to guess the password of the website administrator account. In addition, for websites with good security protection measures, hackers usually find websites with the same server as the website for intrusion, use this site for sniffing and other methods to intrude into their target site.

The fourth type is COOKIE spoofing. COOKIE is the information stored on the computer of netizens on the website server so that the server can identify users' computers. It records some information of netizens, such as IP address, name, and browsing history. How hackers intrude into websites through COOKIE spoofing? If we already know the Administrator account of a website and the MD5 (MD5 is the 16-bit password after encryption) password, but due to the strict website encryption technology, hackers cannot crack the password. In this case, hackers use COOKIE fraud to obtain administrator privileges. First, they change their user ID to the administrator user ID, and the MD5 password is also changed to the administrator user ID. Then, they use tools to modify the COOKIE, in this case, the system considers the hacker as the administrator.

Is a security protection measure widely used on the Internet. It establishes a unique data portal between different network types to monitor inbound and outbound network information, to improve website attack and defense capabilities.

For information exchange between networks, all information from the Internet or from the internal network must be verified and monitored through the firewall, such as email, file transmission, remote control, and other special inter-system information exchanges.

(2) Digital Signature technology

Data transmission is performed between networks. The data sender attaches some specific information to the data information as a password change, which enables the recipient to confirm the real source and integrity of the information, the sender cannot deny the sent information after sending the message, and the receiver cannot tamper with the data information of the sender. Data transmission by using digital signatures can avoid illegal information contained in the file during transmission and upload. However, it should be noted that, for password exchange included in digital signatures, operations should be performed using probabilistic or randomized data algorithms to avoid hacking.

 

(3) data encryption technology

First, data transmission encryption technology is mainly used to encrypt data streams in transmission. Common encryption methods include line encryption and receiver encryption. Line encryption focuses on transmission lines, regardless of the source and sink. The sender end encrypts the data and encapsulates TCP/IP data packets, when the data arrives at the receiving end, it is automatically reorganized and decrypted to become readable data.

Second, data storage encryption technology is mainly used to prevent data loss during the storage process, including access control and ciphertext storage. Access control is used to review and restrict user permissions to prevent unauthorized data access. ciphertext storage is implemented through encryption algorithm conversion, additional passwords, and encryption modules.

Third, the data integrity authentication technology mainly involves the user's information access, transmission, modification, and so on to verify the user's identity and permissions, so as to achieve confidentiality.

Fourth, the key management technology refers to the reference document on keys used for data