The document discusses web application security, focusing primarily on SQL injection (SQLi) as a common vulnerability that can lead to unauthorized access and data manipulation. It emphasizes the importance of input validation, least privilege database access, and various tools available for enhancing site security. Additionally, it includes case studies related to self-security and preventative measures against hacking.

1. Cyber Security
Md. Samiul Alim Sakib
me@sakibsami.com
http:/fb.me/s4kibs4mi
http://www.sakibsami.com

2. Web Application Security
Most Common Vulnerability
SQL Injection ( SQLi ) : App Killer

3. SQL Injection
SQL injection is a technique where a user can
inject malicious SQL commands into an SQL
statement, via web page input.
A successful SQL injection exploit can read
sensitive data from the database, modify
database data (insert/update/delete) and
compromise the security of a web application.

4. Example
Lets assume this is our code of login page

5. Browser Interface & Injection
Login Page
Login Page with malicious code

6. SQLi on real site

7. SQLi on real site

8. SQLi on real site

9. Preventing SQL Injection

You can prevent SQL injection if you adopt an
input validation technique in which user input is
authenticated against a set of defined rules for
length, type and syntax and also against
business rules.

You should ensure that users with the
permission to access the database have the
least privileges. Additionally, do not use system
administrator accounts. Also, you should
always make sure that a database user is
created only for a specific application and this
user is not able to access other applications.

10. Other common web application
bugs

Cross site scripting ( XSS )

Cross Site Request Forgery ( CSRF )

Remote Code Execution ( RCE )

Remote File Inclusion ( RFI )

Local File Inclusion ( LFI )

Broken authentication etc

11. Tools to Secure your Site

MetaSploit
( http://www.metasploit.com )

Zap
( http://sourceforge.net/projects/zaproxy/ )

Brup Suite
( http://portswigger.net/burp/download.html )
etc

12. SELF Security
Case Study
Securing yourself

13. Case Study
SMS
Spoofi
ng :

14. Case Study
You got trapped. You just installed attacker's hacking tool ( RAT )

15. Case Study
You are connected to hackers bot

16. Case Study

17. Case Study
Have a look, now what can hacker do with your device :D

18. Case Study
Now Hacker can do call,send sms from your device.

19. Case Study
Can Monitor calls and smsS

20. Stay Secure

Use Linux based operating systems B|

Never believe anyone

Use a better anti-virus

Always keep PC firewall ON

Check URL before visiting any website

Always download app from play-store/app-store

Check app permissions while installing app

Use 2nd
step verification on email or social
networks

21. And who wants to be a Hacker !!
Programming
Programming
Programming
Programming
Programming
Programming
Programming
Programming
Programming

22. Hacking or Defacing
Hacking in Bangladesh perspective.

23. Any Question ???

24. Thank You :)