Tag Info

New answers tagged

-1

It's a problem of web page design/implementation. If it's bad designed (composing SQL statements on the fly mixing them with written literals) SQL injection issue exists. If it's well designed there is no way to do that attack.


2

You could start by reading about some (Ubuntu specific) best practices. Like: Closing unnecessary ports. Removing unnecessary packages. Setting up some basic iptables rules. Setting up a Web Application Firewall like mod_security. Look into DNS solutions like CloudFlare to prevent heavy load on your VPS processes in case of DDoS-attacks. Working with SSH ...


2

There are currently three accepted password hashing algorithms (note the difference between encryption and hashing!): pbkdf2 bcrypt scrypt So you can use either of these three. PBKDF2 is the most supported. Storing passwords in a reversible way is considered bad practice.


1

Backups don't really have anything to do with preventing or mitigating DDOS attacks. A DDOS attack will prevent people from accessing your site, it doesn't have anything to do with the destruction of data. So to answer your question, no - I don't think setting up backups will help you in the event of a DDOS attack. That said, regularly backing up data ...


1

It looks like the server has php configured with magic quotes on. Since the example query provided doesn't contain any quotes you won't need to inject any quotes. Something like 1 union select @@version from shop -- - should give you an error about unions needing the same number of columns, proving the injection.



Top 50 recent answers are included