Building an entire membership system using PHP and XML

This is a great video tutorial that will teach you how to create a login system using PHP and XML. They will show you how to create a registration page, login page, logout page and change password (forget password) page. In addition you will learn how to use sessions, .htaccess to protect your XML files, MD5 Encryption, and may more. Are you ready to learn how to created complete login system using PHP and XML? Visit net.tutsplus.com and source code is available.

Default Username and Default Password

Most of the hardware (eg: routers, modems) and software that requires a login comes up with a default user name and a password for you to login to the system for the first time. Setting up and giving out different user name and password for each hardware component is costly. So default user name and password is a commonly used method. 

Couple of common default user name or passwords used as follows. 

admin, system, administrator, user, password, change it, manager, root, secret, secure, backdoor. Sometimes they have used the brand name as the default user name or the password. 

Normally if you have purchased a new hardware you can easily find the default user name and the password with the user manual. First thin you must do is to change the default user name and the password to something else. Because someone else will be able to login to your hardware by using the default user name and password. 

However, in a situation where you do not have the manuals or do not remember the user name and the password but still if you want to login to the control panel to change the configurations you will have to do a reset ( Hardware reset button will be there ) and then use the default user name and password to login and reconfigure it. When you do a hardware reset you will loose all the previous configuration and settings. 

I find this default password list quite useful when it comes to login to routers and modems or any type of hardware that requires a login. Remembering the common default user name and password can save your day specially if you do not have Internet connection. Imagine a time you try to configure your router or modem to get the new Internet connection.

SQL Injection: Crazzy Way to bypass Login

SQL injection is quite simple method of hacking a website login. You do not need much knowledge and it is not a secret any more. Even small kinds can try it. You can find thousands of good articles, e-books and tutorials about SQL injection on net. Because of this many websites blogs been attacked by using SQL injection.

Couple of interesting News you can find on Google News for SQL- Injection

Business Bloggers Leave Blogs Open To HackersZDNet UK, UK - 18 hours agoThe two main threats bloggers face are comment spam and SQL injection attacks. Both Blogger and Wordpress have been vulnerable to SQL injection attacks, ...

Massive SQL Injection Attacks: The Chinese WayCircleID, Canada - 22 Oct 2008... with tools and setting new benchmarks for massive SQL injection attacks, like the case with this one: ”A professional web site vulnerability scanning, ...

Adobe website suffers SQL injection attackIT PRO, UK - 20 Oct 2008Sophos said that Mac/Badsrc-C was a dangerous piece of malware which spread by infecting PCs with SQL injection. This downloaded malicious scripts from the ...

If you interested in reading more news related to SQL Injection Go to Google News.

Yes. it is pretty scary if you manage and website or a blog. It would be quite fun to try SQL injection on websites and see if they haven't handle it well.

If so missed a simple validation at some point your database might be open for a SQL Injection and results would be
unauthorised login in to your members area
SQL injector get hold of all your data and your SQL table structure
Changing your valuable data
Delete a Database table or tables or
if attacker gets lucky may be whole database would be deleted.

How SQL injection Works?

It is pretty simple. I will satart with a simplest example. Imagin Website Database has a Table called 'USER_LOGIN' and there are two columns for 'USERNAME' and 'PASSWORD'. In your webpage loging.aspx or login.php you will have TXTUSERNAME.TEXT and TXTPASSWORD.TEXT. Two text boxes with simple server side validation or no server validation at all. So you will have a simple SQL query in your loging page something similar to

SELECT * FROM USER_LOGIN where USERNAME = '+ TXTUSERNAME.TEXT+' AND PASSWORD = '+TXTPASSWORD.TEXT+';

then you will be checking if the result is greater than or equel to one then you take the user to next step that is login. If your website loging is doing something similar your website might be open for a SQL injection.

Lets see what happend if someone type ' or 1=1 --- in the TXTUSERNAME text box. Above SQL query will be rewritten as follows.

SELECT * FROM USER_LOGIN where USERNAME = '' or 1=1 --- ' AND PASSWORD = 'anything';

In English above SQL query means Select each record which satisfy the condition that USERNAME is equal to '' or 1=1. --- will comment out the rest of the query so it really does not matter what you type on the password. Which will return all the record as 1=1 is always True with the OR condition. Logic is so simple and it is Crazzy.

I will post more about SQL Injection and would like to know what you like to know. I can share some e-books related to SQL Injection and How to protect your website from that.

Further Reading

SQL Injection Attacks By Example

Please do not miss use this.