Post

Introduction "Ethical Hacking" is a security practice where an expert hacker is hired in an organization to perform certain tasks like hacking into systems, cracking passwords, performing penetration testing, etc. Just to analyse the weaknesses of the system, search for any possible vulnerabilities, and try to eradicate them. We can also say that Ethical Hacking is a legal variation of hacking. If we talk about hackers then they can be categorized into 3 groups. White hat - They are the "Ethical Hackers" and they perform hacking for the good of the organization they are working in. Black hat - They willingly perform hacking just for the sake of doing criminal activities like stealing money, identity theft, etc. Grey hat - They lie between both white and black hat hackers. They have the skills of hacking but neither they use them to do criminal activities nor they improve the security of systems. They find hacking challenging and fun for them and there is no other motivation. Web application security Before discussing web application security first let's talk about what is a web application? Well, basically a web application is a program that is stored somewhere on a server and we can access it using a browser. Web applications consist of two sides front-end which is developed by using languages like HTML, CSS, JavaScript, etc. and back-end which is developed by using languages like PHP, .NET, etc. Now web application security is simply a process of securing web applications against different kinds of cyber-attacks by detecting and fixing the possible vulnerabilities. and according to OWASP(Open Web Application Security Project) which is an organization dedicated to web application security, some of the web application attacks are - SQL injection. Cross-Site Scripting (XSS).  Broken Access Control. Distributed denial of service (DDoS). cross-site request forgery (CSRF). A developer who is developing a web application must be aware of these web attacks because websites become vulnerable only when there are some loopholes left unrecognized by the developer. and it would be best if the developer works in collaboration with an ethical hacker. As soon as the developer is done with a module, an ethical hacker can perform penetration testing and find possible vulnerabilities. web application security is of higher concern for the businesses which are totally dependent on a web application because even a single vulnerability can cost them a lot if exploited by a black hat. Now let's dive deeper into one of the web application attacks i.e, SQL injection, which when exploited can cause damage to the database of the website. SQL injection SQL injection as its name suggests is the process of injecting malicious SQL queries into vulnerable websites so that the database can be hacked. as we know database is the core of any website and it stores critical information like user credentials and even their bank account details. So, SQL injection can be seen as one of the most destructive cyber web attacks. If you are wondering what does the term "SQL" means then SQL is basically a programming language used to perform operations on databases like creation, updating, deletion, etc. How SQL injection works? To understand how does it works, let's consider a scenario in which a user is trying to login to a website by entering his/her username and password in the login form. He enters username as 'Alex' and password as '123'. Meanwhile in the backend of the website a SQL query will be executed which may look like - SELECT * FROM users WHERE username='Alex' AND password='123'; Now suppose this website is SQL vulnerable and the attacker injects the string ' OR 1=1 into the username and password fields. The SQL query now formed would look like - SELECT * FROM users WHERE username=' ' OR 1=1 ' AND password=' ' OR 1=1 '; As we know 1=1 is always TRUE, so the above WHERE clause will be executed as TRUE, and this query will return all rows from the users table. How to prevent SQL injection? In order to prevent websites from these attacks, the developer should never take the data from the input field and directly pass it into the SQL query. Instead, the approach should be to eliminate the delimiters if present in the string and then do the SQL work. Another approach can be to use encryption. Whatever will the input supplied by the user firstly, should be converted into a hash for ex - MD5 or SHA. Then, this hash value should be compared with the hash present in the database. Doing so will eliminate all the possibilities of SQL injection done by exploiting input fields. Scope and future of Ethical Hacking In India, after the Digital India campaign, almost everyone uses the internet for important transactions and companies are also transforming their traditional business model into a digital one, where all the critical business and customer information is stored on some server. From the perspective of a black hat, it's a great opportunity and it leads to an increase in the number of cyber-attacks.  Now here comes the need of an expert certified Ethical Hacker who can monitor the internet based applications of an organization and protect their valuable data against hacking attempts. This need will continue to grow in the future. Career opportunities and growth in this field will keep on increasing as more people will use the internet and almost every work will be done on some network that needs to be secure.   Article Written By: Sanchit Gupta Sudent - MCA 2nd Year Jagran Institute of Management, Kanpur