What is HTTPS And Why is it Important to Have?

The term HTTPS stands for Hyper-Text Transfer Protocol Secure, it’s a secure channel through which data is transferred between your computer browser tool and the site which you are visiting. The 'S’ at the end stands for Secure, meaning all connections between your search tool and the webpage are encrypted.

Most popular browsers such as Chrome, Mozilla and Internet explorer display a padlock image next to the address bar, showing that a safe HTTPS link has been made.

How does HTTPS work?

Typically, HTTPS websites use either Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to encrypt online exchanges. Both of these protocols make use of an 'asymmetric’ PKI or Public Key Infrastructure network. The system uses dual keys, a public and private one, to encrypt all communications over the internet. Consequently, anything that’s secured with a private-key is only accessible via a public key and vice versa.

The private key of a HTTPS site should always be protected and be known by the owner alone. In most websites, it remains securely kept within the web server. Contrarily, the public-key is meant to be used by anyone who wants to decrypt data that was encoded using the private key.

SSL Certificate Requirement

When you make a HTTPS request on a website, the page will first relay its SSL Certificate to your search tool. This software carries the public-key required to start the safe browsing session.

From this initial communication, your web browser and the site will then commence with the 'SSL handshake’, which involves the creation of mutual secret codes used to establish a safe link between your search tool and the website. When a trustworthy SSL Digital-Cert is applied for a HTTPS connection, visitors will view a padlock image in the browser’s address bar and once an Extended Validity Certificate is installed the address bar shall turn green.

How to get a SSL Certificate cheaply?

There are various ways you can get affordable SSL certificates. First, you can refer online to reputable websites that list cheap SSL certificates which you can try. Such platforms allow you to compare the features of different cost-effective SSL certificates so as to get the best value for your money.

Additionally, oftentimes it’s much cheaper to buy a new certificate rather than renewing an old one, this is because special offer coupons don’t usually apply to SSL renewals. While most cheap certificates will work well and are approved across popular web browsers, you should still refer with your SSL/hosting provider just to make sure.

Reasons why you should have HTTPS

I) Improved search engine rankings. Google has already confirmed that they favor HTTPS websites over others. In fact, more than 30pct of the sites listed on their top page are 'Secure’ or encrypted.

II) Greater online security. It protects web users’ information and your own personal data from cyber criminals.

III) It makes your website mobile-friendly. Recently, Google developed the Accelerated Mobile Pages (AMP) app to ensure web content loads quicker on mobile phones. However, the app requires users to have https before their website can be optimized for mobile use.

IV) Improved conversion rates. Statistics show that most internet users will only share personal information over the internet if the site is HTTPS. If it’s not secured they may express concern sharing their name, phone number or email address.

How Google Chrome views HTTPS

As of July 2018, Chrome intends to label all HTTP sites as 'non-secure’. While the browser currently displays a neutral virtual icon, once the version 68 is launched it will caution visitors with a new indicator in the web-address bar.

Over the recent years, Google has been urging users to keep off unencrypted sites but this so far has been their most impactful move. The Chrome team mentioned that this decision was based on increased https adoption. Approximately 81 of the 100 sites on the internet default to HTTPS, plus most of the traffic on Chrome is already encrypted.

HTTPS impact on SEO

HTTPS can boost your search engine rankings, particularly in cases where the quality signals emanating from two different web results are equal in most aspects. Generally, if your site is equal to your competitor’s in terms of content freshness, speed and title tags among other factors, Google will place it on top of the competitor’s page if it has https and the other one does not.

In conclusion, https is a secure web communication protocol that can safeguard your private information from hackers. It can also help improve your rankings on search engines such as Google.

Detecting And Removing Malicious Scripts

We all have or will face getting our site hacked, it may come of non sanitized input, cms or even hosting bugs.

The biggest problem is that we have to check if the attacker has injected something into our site.

Most common are iframe attacks, they show an iframe injection who has no width and height and allows malicious files to be included, ex <iframe src="site/a.jar"></iframe>

In the example above a jar file is included, it can be a java drive or even a java 0day.

How to detect them

We can use a simple grep command if running on linux

Searching in a single file

grep ".jar" filename

Searching in multiple files

grep "string" FILE_PATTERN

Case insensitive search

grep -i "string" FILE

For more on http://www.thegeekstuff.com/2009/03/15-practical-unix-grep-command-examples/

What else to check for:

system, eval, passthru, popen, base64_decode, mail(used for sending data)

It is recommended checking php.ini, it keeps a log of all the actions made on the server(note! they can be modified)

There are also other type of injection using Get/Post handling but a simple grep search for dangerous functions can do

some useful resources on the web

http://perishablepress.com/malicious-server-scans/

http://www.mikestowe.com/2010/10/php-malicious-code-scanner.php

http://pwnsrc.blogspot.com/2012/12/php-htaccess-backdoors.html

Top 3 WordPress Security Plugins

From http://konnectingu.com/best-wordpress-security-plugins/

There are more than 700 million sites on the web and recent statistics revealed that 18.9% of them are powered by WordPress. The CMS platform receives much love from the interwebs but it is also one of the biggest targets for cyber attacks. Fortunately, it is also one of the most versatile and customizable platforms with thousands of plugins with quite a few dedicated to security. Here are the top 3 best security plugins for WordPress that all webmasters should install.

#1. Better WP Security

Better WP Security is the best solution to fix one of the most common security risks. The admin login path and username are rarely changed by the webmaster. This means that everyone knows the link and the username which opens the path for brute force attacks. Better WP Security can change the wp-content and wp-admin path changing the links. It can also remove the meta “generator” tag, login error messages and RSD header info.

Better WP Security offers some basic yet essential security controls and it should be the first thing on the list of plugins that needs to be installed the moment WordPress is configured.

#2. Wordfence

Wordfence is one of the most popular plugins for added security for WordPress. The Premium version includes a Cellphone Sign-in via SMS and also enables the admin to block certain countries. This feature makes it easy to stop brute force attacks. It also enables the creation of stronger password policies for users and admins and publishers. In addition, it can control the access of entire networks to the website by using IP and Domain WHOIS reports and public lists of malicious IPs. Additionally, it can send security reports to the network owner.

The plugin has plenty more features such as a DNS security monitor and file malware scanner that is updated constantly in order to recognize the latest suspicious codes.

Wordefnce is 100% free with the exception of the SMS sign-in feature.

#3. BulletProof Security

BulletProof Security has been praised for its ability to prevent code and SQL injection attacks. It provides the means to protect the website against XSS, RFI, CSRF and Base64 attacks.

Another popular feature of the plugin is the maintenance mode. It enables the admin to filter who gets to see his website and who will be greeted by a 503 Website Under Maintenance page. Using IP filtering, the access can be controlled directly from the plugin.

Last but not least, BulletProof Security offers a more convenient way of protecting and updating distributed configuration files without using an FTP client. It locks down critical htaccess files, wp-config.php, bb-config.php, php.ini and php5.ini.

The plugin is completely free with no additional features for users that donated. With a close to 5 star rating, BulletProof Security, the plugin is a must for all WordPress websites.

In Conclusion

These 3 plugins should cover all the security gaps in the code and setup of the default WordPress installation. They complement each other and consume very little resources. The only thing that could be added to complete the security packages is an SSL certificate for the domain.

Please note: If you are looking for an easier drag and drop solution that has built in security and is less targeted by hackers and crackers I advise you to use either Weebly  , Wix or Yola.

Prevent Cross Site Scripting aka XSS attacks

Cross Site Scripting also called as xss attack it is one of the most common web vulnerabilities today, after making a tutorial on sql injection i thought that making a tutorial on preventing cross site scripting would be useful to readers.

First of all what is XSS (not CSS)

It is a web application bug on non filtered user input like search or comment box.
When an attacker has the possibility to inject some code into the page and on site reload that code does not show, it is called Non Persistent xss attack and when the code is saved on a database and loaded into the page that that is a high security risk.
He could insert an malicious script to steal user cookies or even further so how can we prevent xss at all.

Let's take an simple example of an vulnerable php script:
<?php
if(isset($_GET['search'])){
echo 'You searched for'.$_GET['search'];
}
else{
?><form action="" method="get">
<input type="text" name="search" value="search.."><br>
<input type="submit"></form>
}
?>
Basically this script is vulnerable
We can use this php functions:

• htmlspecialchars
• htmlentities

There are a few other we could use like is_int, is_numeric, (int)$data used when we are expecting the user to enter only numbers, also we can use preg_match, eregi which we can use for example to check if email is valid etc..

So here it is the implementation of htmlspecialchars

<?php
if(isset($_GET['search'])){
echo 'You searched for'.htmlspecialchars($_GET['search']);
}
else{
?><form action="" method="get">
<input type="text" name="search" value="search.."><br>
<input type="submit"></form>
}
?>

htmlspecialchars does not filter all characters like htmlentities does but that does not mean that it contain bugs.
Also i would like to mention that never using javascript for filtering user input, consider it only as a gui part handled by php, maybe most of you know this either.
I also recommend reading this other web security articles

Protect server config or important files for security

Securing a server is at hard task especially for beginners.
On todays topic we gonna protect server config files using htaccess.
Why we should do that ?
well if another site on same server with you gets hacked, then he can read your configuration files like config.php wp-config.php etc..
Ok lets get into point
<Files config.php>
Order allow,deny
Deny from all
</Files>
When the attacker tryes to read the config.php (as example) file it gets a 403 permission denyied.

Protecting same type files

Lets for example we wanna protect all .ini files
We can do
<Files *.ini>
Order allow,deny
Deny from all
</Files>

I just explainded what can we do to protect our config files if we dont have enough access to php.ini
If you are a server administrator you can automate this (future tutorial).

Few notes to remember

a. If you deny all .txt robots.txt will get blocked, or .xml when sitemap.xml gets blocked, but if you dont have this 2 files do whatever you want.
b. Make an separated config file, you cant protect article.php which has seme configurations(database password) since it will disallow all users to access normal files.
c. Make shure you have the right chmod (permossion) for files.
d. Dont forget to share :D :D

Php firewall script example with download

This is a simple firewall php script which filter form data against XSS SQLI FRI LFi attacks
I would like to say that i was playing around with it.
Note that some methods are not totally filtered (preg_match like ../) etc..
Either i dont have time to go back and edit it.
Do not use this code on your site until you know what you are doing, its just an sample!

Download

<?php
error_reporting(0);

// ###########################################
// simple firewall
// coded by Mikel Doka
// http://www.thecodertips.com
// its not something big, i was just playing around
// then moved to trash o.0 :P
// you can easily implement it to your site but dont take this as
// a functional firewall
// it has or may contain bugs
// i mean learn from code :D
// ###########################################

// get ip

$ip_logged = htmlentities($_SERVER['REMOTE_ADDR']);

// html

$html = "<html><head><title>Hack Attemp Logged</title></head><body style='background-color:red'><center><h1>$ip_logged<br />Hack Attemp Detected!<br />Your IP has been logged and will be reported to your ISP.</h1></center></body></html>";

// too long

$too_long = "<html><head><title>Data too long</title></head><body style='background-color:red'><center><h1>Try something more short.</h1></center></body></html>";

// ###########################################
// get post title
// ###########################################

if(isset($_GET['title'])){

$url = $_GET['title'];

if(strlen($url) > 300){
die($too_long);
}

// switch to lowercase, good sqli prevention

$url = strtolower($_GET['title']);

// anti sqli

if(preg_match("/--/", $url)){
die($html);
}
else
if(preg_match("/;/", $url)){
die($html);
}
else
if(preg_match("/0x/", $url)){
die($html);
}
else
if(preg_match("/@@/", $url)){
die($html);
}
else
if(preg_match("/alter/", $url)){
die($html);
}
else
if(preg_match("/char/", $url)){
die($html);
}
else
if(preg_match("/begin/", $url)){
die($html);
}
else
if(preg_match("/cast/", $url)){
die($html);
}
else
if(preg_match("/create/", $url)){
die($html);
}
else
if(preg_match("/cursor/", $url)){
die($html);
}
else
if(preg_match("/declare/", $url)){
die($html);
}
else
if(preg_match("/delete/", $url)){
die($html);
}
else
if(preg_match("/drop/", $url)){
die($html);
}
else
if(preg_match("/end/", $url)){
die($html);
}
else
if(preg_match("/fetch/", $url)){
die($html);
}
else
if(preg_match("/insert/", $url)){
die($html);
}
else
if(preg_match("/kill/", $url)){
die($html);
}
else
if(preg_match("/open/", $url)){
die($html);
}
else
if(preg_match("/select/", $url)){
die($html);
}
else
if(preg_match("/sys/", $url)){
die($html);
}
else
if(preg_match("/update/", $url)){
die($html);
}
else
if(preg_match("/union/", $url)){
die($html);
}
else
if(preg_match("/or/", $url)){
die($html);
}
else
if(preg_match("/from/", $url)){
die($html);
}
else
if(preg_match("/like/", $url)){
die($html);
}
else
if(preg_match("/and/", $url)){
die($html);
}
else
if(preg_match("/all/", $url)){
die($html);
}
else
if(preg_match("/group_concat/", $url)){
die($html);
}
else
if(preg_match("/order/", $url)){
die($html);
}
else
if(preg_match("/by/", $url)){
die($html);
}
else
if(preg_match("/version/", $url)){
die($html);
}
else
if(preg_match("/table/", $url)){
die($html);
}
else
if(preg_match("/database/", $url)){
die($html);
}

// anti xss

else
if(preg_match("/script/", $url)){
die($html);
}
else
if(preg_match("/alert/", $url)){
die($html);
}
else
if(preg_match("/img/", $url)){
die($html);
}
else
if(preg_match("/cookie/", $url)){
die($html);
}
else
if(preg_match("/href/", $url)){
die($html);
}
else
if(preg_match("/input/", $url)){
die($html);
}
else
if(preg_match("/form/", $url)){
die($html);
}

// anti rfi and outgoing scripts like .php .js etc..

else
if(preg_match("/http/", $url)){
die($html);
}
else
if(preg_match("/.php/", $url)){
die($html);
}
else
if(preg_match("/.js/", $url)){
die($html);
}
else
if(preg_match("/.asp/", $url)){
die($html);
}
else
if(preg_match("/phtm/", $url)){
die($html);
}

// anti lfi

else
if(preg_match("/etc/", $url)){
die($html);
}
else
if(preg_match("/passwd/", $url)){
die($html);
}
else
if(preg_match("/proc/", $url)){
die($html);
}
else
if(preg_match("/self/", $url)){
die($html);
}
else
if(preg_match("/environ/", $url)){
die($html);
}

// shell functions

else
if(preg_match("/passthru/", $url)){
die($html);
}
else
if(preg_match("/exec/", $url)){
die($html);
}
else
if(preg_match("/open/", $url)){
die($html);
}
else
if(preg_match("/load_file/", $url)){
die($html);
}
else
if(preg_match("/system/", $url)){
die($html);
}
else
if(preg_match("/show_source/", $url)){
die($html);
}

}

Session security tutorial, protection against session hijacking and hackers

When it comes to session security lot of webmasters like to skip it.
By myself i use sessions and not cookies, not for any big prupose but sessions are cool, easy to implement.

Steps to session security

1- Not filtered GET, POST, REQUEST data
2- Using session_regenerate_id()
3- Acsepting http only cookies
4- Manually expiring sessions
5- Php.ini modifications

Lets move on

To start a session we start by:
<?php
session_start(); // it starts sessions
?>
A live example is echoing "Hello World"
<?php
session_start();
// string to print
$string = "Hello World";
$_SESSION['string'] = $string;
// printing it out
echo $_SESSION['string'];
?>
Simple and cool :D

Not filtered GET, POST, REQUEST data

If you are giving to a session a value from forms make sure to filter all bad charachters.

Here is a live example of a vulnerability:
<?php
session_start();
/* attacker using an evil javascript like:
<script>alert(0)</script>
which will popup a "0"
*/
$string = $_GET['string'];
$_SESSION['string'] = $string;
// printing it out
echo $_SESSION['string'];
?>
What happened here is that GET data are not filterd against Cross Site Scripting(XSS Attacks), think when the data get posted in mysql database and attacker executes sql injection scripts.
Make sure this kind of data is always filtered.

Using session_regenerate_id()

Whats all about this function ??
Well this function is very inportant!

a- When you refresh the page you get a new session id
b- When you close the browser the session gets destroyed
c- It will prevent session stealing

To implement it just simply do:
<?php
session_start();
session_regenerate_id();
?>

Acsepting http only cookies

This is an php.ini function, php.ini explains it as: Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. for more about it you can read on php.net

To implement it just simply do:
<?php
session_start();
session_regenerate_id();
// setting ini rule
ini_set('session.cookie_httponly', true);
?>

Manually expiring sessions

We can use time() to create a session when we last logged in and destroy it after X time.
<?php
session_start();
session_regenerate_id();
// setting ini rule
ini_set('session.cookie_httponly', true);
// record last login
$_SESSION['lastlogin'] = time();
?>
When we nextly access it we do a check for expiration:
<?php
session_start();
session_regenerate_id();
// setting ini rule
ini_set('session.cookie_httponly', true);
// check if session is more old than 20 seconds
if($_SESSION['lastlogin'] > time() - 20){
die("Session expired, please relogin.");
}
?>

Php.ini modifications

We gonna make some modifications on php.ini file.
You can use ctrl+f to search for strings.
session.save_path = "c:/wamp/tmp" (where the sessions will be saved)
session.gc_maxlifetime = 1440 (maximum time session will be alive)
it is good to change this 2 options or more (depending on your needs)

Dont's

It is not a good recomandation to save sessions on a mysql database, it will slow page speed and if data is not filtered things may go bad.

Thanks for reading, I worked alot on writing this tutorial, a bit of share of this post would be nice :D

Sql Injection security tutorial | Web Security part 1

In this tutorial about preventing sql injection we will explain various methods to keep a blog safe against attackers.

We will focus on three php functions:
1. mysql_real_escape_string() 2.
int/is_numeric etc..
3. string length (tip)
Lets start with mysql_real_escape_string.
It's a php function made for the prupose of escaping dangerous charachters.

Before starting i suggest you read Php Mysql post to database and Building a blog with Php and Mysql


Now lets explain what mysql_real_escape_string does

1. Filters dangerous charachters against sql injection.
2. Keep us safe

Note! this function does not work when a nysql connection is not set, for filtering stuff when no mysql database is added we can use htmlspecialchars() or htmlentities()

Im gonna show a simple script which is vulerable to sql injection, i suppose you know to build one.
<?php
$user = $_POST['user'];
$pass = $_POST['pass'];
mysql_query("UPDATE users SET pass=$pass WHERE user=$user");
?>

That script suffers from Sql Injection and is not safe for use but we can make it to.

<?php
$user = mysql_real_escape_string($_POST['user']);
$pass = mysql_real_escape_string($_POST['pass']);
mysql_query("UPDATE users SET pass=$pass WHERE user=$user");
?>


We can also use htmlspecialchars or htmlentities with mysql_real_escape_string


Other things to try

1. trim (filters spaces and new lines)
2. htmlentities (cross site scripting security)
3. htmlspecialchars (cross site scripting security)
4. is_int (if is numeric)
5. strlen (string length)

And finally

1. php chaptcha (anti spam)
2. protecting folder using php
3. limiting string length tutorial

Conclusion, always use mysql_real_escape_string to prevent sql injection.