NZ IZEK

Types of Black Magic and their detail

2012-08-08T02:24:00.000-07:00

AS SALAMU ALLAIQUM

Following are the types of black magic

a   complete amil and magician can do almost anything with the help of his   black magic art, except for escaping death and bringing the dead back to   life.

Following are the types.

1. separation between husband and wife. with this he can break a home and destroy somebody's married happy life.

2.   Wife hating her husband upon seeing his face. in this type of magic,   when a wife looks at her husband she feels angry and thus they both live   a miserable life.

3. having a headache all the time. this too is a sign of magic and the victim feels pain in the head all the time.

4. having throat infection all the time. one feels pain and cant speak, the voice seems to have stopped in the throat.

5. difficulty in breathing. it is a type of sifly magic. one cant breath easily. he feels suffocation.

6. making someone deaf. he cant hear things. and he feels pain in his ears.

7. women get periods before the proper time and she cant get close to her husband. this too is done through magic.

8.   pain in the entire body. there is pain in the whole body and sometimes   its too much in both the legs or in the backbone. one feels its weakness   but its magic.

9. making someone blind. a magician can make one blind with magic and his sight is lost.

10. pain in the teeth and decay in the teeth and blood from the teeth. this too is done with magic.

11.   making the heart beat faster than it should be. the heart beat is made   faster with magic. one feels its some disease but its not.

12. one remains sick all the time. having fever. and remains weak.

13. head spinning. it too is done through magic. one is made dizzy.

14. one loses his memory. he cant remember anything for long.

15. the brain does not work properly. one wants to do one thing and something else is done. his brain does not work properly.

16. one does not feel like doing anything. his heart wants to run away from things. he does not take interest in his work.

17. making astray. someone is made astray and derailed.

18. making one habitual of smoking cigarette and hash.

19. making one habitual of drinking.

20. making one long for having sex. or making one enter into prostitution.

21. making one hate religion, and the holy book and the creator.

22. making one dreamless.

23. making a woman a prostitute.

24. giving stomach aches.

25. giving acidity and pain in the chest.

26.   creating problem in the liver. Liver is an important organ in the human   body, so some people when they want to destroy someone will cast spells   on that victim to harm his liver.

27. The wife sees the husband’s   face as swine or a dog, he appears to her as a swine or a dog. This too   is done with the help of magic to create problems in someone’s life.

28.   Making a man gay. A man cannot get physically involved with anyone when   this spell is cast upon him because he becomes useless.

29. Magic   using voodoo dolls. This too is a very harmful form of magic. And the   victims doll is made and pins are stick into it and the spell is cast   upon it.

30. Children weaken and die. In this type of magic, the   child becomes severly weak and then his condition deteriorates day by   day and then eventually dies.

31. A woman loses her child during   pregnancy. The child is killed inside the womb befor he is born. This   too can be done using black magic.

32. Making the cattle sick using magic. Magic on animals.

33. The animals don’t give milk and remain sick. This too is done using black magic.

34. Men start hating women. A husband is made to hate his wife.

35.   Girls don’t get proposals anymore. In this type of magic, the girl that   this magic is cast upon, does not get any proposals for marriage.

36. Pain in the bones and joints. Arthritis.

37.   a woman is made to hate men and she does not feel like getting close to   them, as in sex with her husband, she does not like it.

38. Making the face look ugly. A woman is made to look ugly and people think she looks like a whitch.

39. Making a woman infertile. In this magic a woman is made infertile and she cant have any children.

40. Making the rizq/earnings less. A person is financially made weak.

41. Destroying someone’s home. Disturbing the peace of somebody’s home and leaving it all destroyed and messed up.

42. making someone suffer from an incurable disease.

43. disgracing a woman in her husband’s eyes.

44. Making a husband suspect his wife. This creates problems in their life.

45. Snatching someone’s job or disgracing him and lowering his position.

46. Getting a woman divorced.

47. Making the rich into poor. A rich person’s riches are taken away with black magic.

48. making someone live in exile.

49. Making someone full of anger. With this magic a person remains angry all the time.

50. women feel pain in ribs and chest.

51.   OKDAM zikar, it is that type of magic which when going to someone’s   home for a proposal, it is cast upon them and the girl’s family then   keep talking about the boy’s family for months.

52. making someone fall in love.

53. putting fear of the unknown in someone’s heart.

54.Khamol magic. Making someone weak and lazy. That he doesn’t feel like doing anything.

55. MIRGI fits. Epilepsy. A person is made to suffer Epilepsy.

56. magic with which a person is made to suffer LAQWA. Bell’s palsy.

57. Seher AL MAFLOJ, paralysis. A person is made paralyzed, either in some parts of the body or all over.

58. Seher Kabos. One feels sleepy all the time.

59. head spinning and feeling dizzy and blackout in front of the eyes.

60. Stopping nikkah for someone. Bandish of nikkah. It is cast right at the time of nikkah.

61. Surat anzal. A man is faced with this problem and he does not get cured.

62. Periods are stopped, menopause even before its time.

63. Magic of insanity. A person is made completely insane. He does not remain in his senses.

64.   masan is that type of magic which is cast upon kids. In this type of   magic, the ash left from the burnt hindu dead bodies is put in some food   for kids to eat.

symptoms of black magic

2012-08-08T02:11:00.001-07:00

i am going to tell you the symptoms of black magic.

if you have any of these symptoms then you are also suffering from black magic.

1) if some one sees motion or urine in his dream or see himself in bathroom or with the motion attached to his body, see himself/herself in unhygienic condition.

2) headache.

3) the whole body is in pain.

4) the one wishes or wants to have sex.

5) back-ache or has pain in kidneys

6) smelly farts.

7) feels like the body is on fire.

8) the whole body remains hot and so does the mouth.

9) eyes remain red and feels irritation in eyes.

10) you feel to go to the bathroom after a little while for urine and motion.

11) fast heat beats.

12) difficulty in breathing and have chest pain.

13) become irritant.

14) face complexion changes and becomes darker day by day. the more worse the magic is the more your complexion will become darker.

15) feel pain in stomach and you will be having diarrhea like situation.

16) pimples appear on the face.

17) face becomes terrible no attraction left in the face.

18) feeling anxiety.

19) becomes impatient.

20) you have all the happiness in life but still you don't feel happy.

21) what ever you eat you feel hungry again in about an hour and a half.

22) you don't wish to offer prayer and day by day you go away from religion.

23) always you have throat problem and the voice quality is also affected.

24) get scared in dreams. sometimes sees snakes, spiders, lizards, and cockroaches in dream.

25) you have fear in your heart.

26) feels like some one injecting pins in body.

27) get pain in stomach and feel nausea.

28) become lazy. and sleep for longer durations.

29) you forget where you put things and spend rest of the day in finding. in money transactions give more money.

30) starts hating your self.

31 - seeing blue or pink dots or seeing funny lines

32 - feeling tired without any reason

33 - by reading or hearing the quran do you get pain in your body

34 - feeling sick and hot

35 - always having a erection

36- Twitching of body parts and soreness of muscles

37 - hands and feet turn swollen

38 - spots on the head

39 - strong smell in your urine

40 - when you cook a lot does a bad smell come

41 - body feels cold

42 - pain in the feet

43 - seeing dogs and dead people as well as ants in your dream

44 - going skinny day by day

45 - taking medicine which works at the beginning then starts giving you more problems

46 - seeing a women and man having sex meaning a wet dream

47 - body head and shoulders feeling heavy

48 - getting marks on your body

49 - body feels weak for no reason

50 - feeling dizzy and blacked out

51 - getting red spots on the body

52 - on hearing the azan you run away and you hate the azan

53 Your sleep is disturbed

54 Disinterest in life

Mairy wehmo guman sy bhi ziada tot jata hy

2011-07-02T10:56:00.000-07:00

Main Sochta Hoon Kahaan Reh Gaya Mera Chehra...

2011-07-02T10:54:00.001-07:00

Kahan Tha Itna Azaab Ashna Mera Chehra
Jale Chirag To Bujhne Laga, Mera Chehra

Woh Tere Hijar Ke Din Woh Safeer Sadiyon Ke
Tu Un Dinoon Mein Kabhi Dekhta Mera Chehra

Judaiyon Ke Safar Mein Rahe Hain Saath Sada
Teri Talash, Zamane, Hawa, Mera Chehra

Mere Siwa Koi Itna Udaas Bhi To Na Tha
Khizaan Ke Chand Ko Achaa Laga Mera Chehra

Kitaab Khol Raha Tha Woh Apne Maazi Ke
Warq Warq Pe Bikharta Gaya Mera Chehra

Sehar Ke Noor Se Dhulti Hui Teri Aankhein
Safar Ke Gard Mein Lipta Hua Mera Chehra

Hawa Ka Akhri Boosa Tha Ya Qayamat Thi?
Badan Ke Shaakh Se Phir Gir Pada Mera Chehra

Jise Bujha Ke Hawa Sogwar Phirti Hai
Woh Shama-E-Shaam-E-Safar Thi Ke Mera Chehra

Yeh Log Kyon Mujhe Pehchante Nahi Mohsin
Main Sochta Hoon Kahaan Reh Gaya Mera Chehra...

mein apne dil ko dard se bharta chala gaya

2011-07-02T10:53:00.001-07:00

mein kis se miloon koi bhi dil ko bhata nahi
yeh zindage abb apni,dora hai per khari hai

khuloos dil se nibhaen jo koi ehad karein
yeh log kaise zamane talash kerte hain

muddaton un ko fakat un ko satane ke liye
geet gaye dil aashufta nawa ne aae dost

dil gawara nahi kerta hai shikast umeed
har tagafal pe nawazish ka guman hota hai

ilahi bhej de aise mein jaan tamanna ko
sakoot shab ka satana hai aur dil ki kahani hai

woh yun dil se guzarte hain ke aahat nahi hoti
woh yun awaaz dete hain ke pehchani nahi jaati

dil apni khirkanon ko chupa jaye kis tarah
pehle pehal ka khat likhna jae kis tarah

bharne ko teri mang mein zar-taab keh-kashan
mein apne dil ko dard se bharta chala gaya

Meri Ankhoon Kay Samandar Main Jalan Kaisi Hai

2011-07-02T10:50:00.001-07:00

Meri Ankhoon Kay Samandar Main Jalan Kaisi Hai
Ajj Phir Dil Ko Tarapnay Ki LaGan Kaisi Hai

Ab Kisi Chaat Pay Chiragon Ki Qatarin Bhi Nahi
Ab Teray Shehar Ki Galioyon Main Guthan Kaisi Hai

Baraf Kay Roop Main dhaal Jain Ge Saray Rishtay
Mujh say Pocho Kay Muhabbat Main Agan kaisi Hai

Main Teray Wisal Ki Khuwahish Ko na Marnay Doon Ga
Mausam-e-Hijar Kay lehjay Main Takan Kaisi Hai

Raigzaron Main Jo Banti Rahi Kantoon Ki Rida
Uss Ki Majboor Sii Ankhoon Main Kiran Kaisi Hai

Mujhe Masoom Si Pagal Larki Pay Taras Aata Hai
Usay Dekho Tu Muhabbat Main Magan Kaisi Hai...

Aacha huwa usne bhi roka nahi mujhe

2011-07-02T10:46:00.001-07:00

Ek shaks paas rehkar bhi samjha nahi mujhe
Is baat ka malal hai, shikwa nahi mujhe

Mein usko bewafa ka ilzam kaise du
Usne to abteda say hi chaha nahi mujhe

Kya kya umeed band kar aaya tha samne
Usne to aank bhar ke bhi dekha nahi mujhe

Pathar samaj kar paoon ki thokar pa rakh liya
Afsoos uski aankho ne parkha nahi mujhe

Kab taherna tha dost uske paas hamain
Aacha huwa usne bhi roka nahi mujhe

What do we prepare ourselves for: Marriage or a Wedding??

2011-06-21T19:31:00.000-07:00

Pretty dresses, mehandi, jewelry, invitation cards, houses lit in and out and decorated with different kinds of followers. Yes! You guessed it right. The wedding season is on. We see many people getting happily married around us these days. The above mentioned things and more are apparently the most important components of a wedding.

It all starts with the selection of the perfect spouse. The society we live in, it’s mostly that the parents select the ‘better half’ for their kids. Even if a girl or a boy chooses himself/herself the perfect spouse, they still mostly have to go for their parents’ consent. The selection process is totally different for both genders. While selecting the perfect partner, parents and the kids themselves generally do not look at the personality or the character, but go for the evident material things.

Media or the occasional real life stories have made both the genders so bitter against each other and the in laws that they can hardly expect any good from each other. Guys always think, before or after the marriage that his in laws are against his family and him. He always has it in his mind that the bride and her family are conspiring against him in some way or the other. Most of the guys think women marry for money and will remain married till the guy has it. But the fact is most of the women in our society marry men with nothing, help them gain something and remain with them till they have everything.

It’s not just the guys that have this misconception about the girls or their families; it’s the girls too. The daily soaps are very much penetrating in our daily lives and are poisoning them in many ways. The girls before marriage at times have this in mind built in that her in laws are or will be against her. They don’t like her and will make every effort to separate her from her husband. If we think of it logically, why will they when they themselves selected her (in most cases) and made her their daughter in law? It’s quite understandable that it’s tougher for a girl to adjust in when compared to the guy, but thinking like that makes it tougher for her. If she takes her mother/father in law as her mother/father and sisters/ brothers in law as her own siblings, it’s her who will be the most comfortable in the situation. Helping in daily chores or doing all of it themselves is not that difficult. We see it many times that the girls do a lot more in their own houses but complain about doing it when living with their in-laws.

We all mostly expect it from the girl that she should be the one compromising in all situations. If she has to take her in laws as her own family, she should be given the love and respect she deserves living in her own family. It is rationally impossible for anybody to accept strangers like that without them being kind to her. The guy’s family should accept the girl as their own family member. We mostly see a war like situation between the wife and the mother of men. I again call it a star plus effect. The mother should realize that she brought her son somebody who left everything for him should be given proper space. Same has to be understood by the girl, mother is the one who brought the guy up and they both can’t be should not be split apart. Many times its men to be blamed for it. They are the ones who lose the balance which causes a conflict.

The girl does not have to go and tell everything to her family. She should own the family she gets married in to. Their disrespect should be a disgrace for her too. It happens that the girls take every matter to her parents; unnecessary interference of the girls’ family in the issues causes many problems. Woman should be able to handle little issues themselves without asking their mothers for a suitable situation. But of course, if it really is unbearable for the girl to stay there, if she is treated badly or abused etc., she should never stay quiet about it.

Marriage is the most significant institution in a person’s life. It’s on the marriage’s base that the new relationships are built. Respect for everybody involved is the key point to its success. Accept everybody whole heartedly. Look beyond material things. Don’t just prepare yourself for the wedding, do it for the marriage. Wedding lasts for a day or two, marriage goes on for forever (in most cases). Why not make it a happy and content one?

Fate or injustice?

2011-06-21T19:24:00.001-07:00

This is a true story of a woman suffering from continuous abuse at the hands of her husband...

This is the story of a young woman - a sister, a daughter, a mother, but most of all a divorcee, dependent on her parents. Naeema (not her real name) underwent an arranged marriage two years ago. Feeling that everybody in the family blamed her for the break-up of an earlier engagement (her fiancé had called it off because she refused to have a sexual relationship with him before marriage), she agreed to the proposal despite her misgivings.

The wedding was a traditional one and everyone in her family was happy. And then the wedding ended and the marriage started. The first thing her new husband said to her was, “I need the money you received in salami (money given by relatives); I have to pay all the bills.” She quietly gave it all. The next day Raheel demanded her jewellery, but she gave it without any argument, wanting to make him happy.

Then came another shock. Naeema had looked forward to getting married and leaving her job at the bank but her husband refused to let her quit the job. She then learnt that he didn’t earn and she would be the one feeding him. Her family were unaware of this as they had been told that he had a job and earned well.

She continued working, and giving him all her earnings, fulfilling his desires, thinking life would get better one day. Instead, things got worse. She discovered that Raheel was a drug addict and he would come home late at night and brutally rape her. She bore the pain without complaint. He soon started demanding things like a car, motorbike and property from her parents, and beat her when she refused to convey his demands to them.

After one particularly painful bout of physical and sexual torture, she returned to her parent’s house only to discover after some days that she was pregnant. She immediately assumed that having a baby would save her from further torture. Her parents were happy, thinking she would go back and live happily with her husband. Her father gifted the husband with a motorbike and he took her back.

Despite her pregnancy, Raheel continued to come home late, rape her and demand things. Her health deteriorated and soon she learnt that she had lost her baby. Continuous painful rapes had resulted in a miscarriage. She decided again to leave her husband, the man responsible for killing her baby, but going back to her parents was not easy. She found it impossible to withstand the misery in their eyes. When her mother-in-law came to bring her back, promising that her son would change, her parents agreed to send her back. Naeema went along with their decision.

Unexpectedly after her return, Raheel seemed like a changed man. But it didn’t last long. Everything started becoming what it was. The late night sexual harassment, demands for money, the beatings. After a month or two, she was pregnant again.

In her fifth month Naeema quit the job and her mother took her home and looked after her. She gave birth to a beautiful girl. However, Raheel wasn’t a part of the happiness since he was in jail for being involved in a gang rape case. Soon he was released and happy with the baby, Naeema was ready to forgive and forget. Raheel was good to the baby but his behaviour towards Naeema continued to be abusive. Unwilling to see her baby growing up in that environment, Naeema finally decided to leave Raheel. She filed a case and got a divorce, but he wasn’t ready to divorce her. He filed a case for the custody of the baby but fortunately, the court assigned custody of the baby to Naeema. Even though she had legally won the rights to keep her baby, her ex-husband began terrorising her and her family day and night saying it was his right to see the child whenever he wanted. Sick and tired of continuous harassment, Naeema’s family decided to return the daughter to the father.

Now, Raheel is again in jail for a rape case and for his abusive and threatening behaviour to Naeema and her family. His intimidating behaviour has reached to a point where he is now threatening to throw acid on Naeema’s face once he gets out of jail. But that’s the furthest of Naeema’s worries as all she can think about is her baby living with her sister-in-law. She wants to fight for her daughter’s custody but has no support from her family. They say they want to get her re-married - which will be easier without the baby. Secondly, they don’t want any kind of contact with the ex-husband. If Naeema gets custody of the baby, she will have to allow Raheel to meet her once in a while - a thought that fills everyone with dread. Everyone - except for Naeema - is ready to give away the baby to get rid of him completely. People try to make her feel better by saying it is fate. Naeema doesn’t call it fate: she calls it injustice. She knows it’s her right to get her daughter back and live a civil life without interference from her ex-husband. She knows it’s her right to be happy. But, the rights of women are something that has been long ignored in our country and there still seems to be no light at the end of the tunnel.

*Names have been changed

The story was originally published in the 'You Magazine' dated 6/14/2011.

Idea of "Killer Exchanged with An Innocent" Rejected by Dr. Fauzia Siddiqui

2011-02-04T13:09:00.001-08:00

While there is a growing demand in Pakistan after the Lahore incident that the American killer should be exchanged for Dr Aafia Siddiqui as a few parliamentarians have also raised this demand, the sister of Dr Aafia says that Raymond Davis has killed three Pakistanis and blood of Pakistani nationals cannot be forgiven in return for an innocent Aafia.

Dr Fauzia Siddiqui, in an exclusive chat with The News from Karachi, said that Davis was a killer and after meeting the heirs of the deceased youth, Aafia’s family can never imagine to forgive the blood of Pakistanis against repatriation of Aafia.

She mentioned that first Aafia should be brought home with respect then the government should think of dealing the case of Davis with the Americans. “Aafia has not killed anyone; therefore, we can not demand exchange of an innocent lady with a double murderer,” said Dr Fauzia, adding that it was the time for government to negotiate with Americans regarding respectful repatriation of Dr Aafia.

She said that Aafia has been jailed for a falsely carved crime in Afghanistan whereas Davis was a daylight killer, so we should not compare the crimes of both of them. “Government should bring Americans on negotiating terms regarding Aafia; otherwise, these rulers will be kicked off from their palaces by the people of Pakistan if they handed over Davis to America.”

Dr Fauzia said that she has met the families of the three deceased youths of Lahore and after looking at the condition of mothers of those three boys, she could not demand for forgiving the blood of Pak nationals rather David should be punished under the penal law of the country for the crime which the has committed. On the other hand, a few parliamentarians have raised their voice for exchange of Davis for Dr Aafia and Pakistan Tehrik-e-Insaf vows to establish a fund for the legal heirs of the three youths who were killed by American so that those families should not compromise on money with US. Fakhar Chathha, President PTI Traders-Wing, while talking to this correspondent said that Pakistan should make a simple deal with US: “Give us our innocent Aafia and take your double murderer Davis.” He mentioned that time has come for Pakistan to take a stand before the Americans, otherwise, world will curse on us.

He said that his party is ready to establish a fund for the heirs of three deceased youths of Lahore so that they should not accept American offer of money against blood rather ask for the extradition of Dr Aafia from America in return of Davis. It is worth mentioning here that the PTI is the only political party in the country, which has stage protests regarding American killing in Lahore. Even the protesters were baton charged in Islamabad when they tried to enter the red zone to get their protest registered in front of US embassy.

The Human Rights Commission of Pakistan’s ex-Chairman Iqbal Haider on Geo TV said that Dr Aafia has not killed any person, and the way she was produced before the American court was also condemnable. “On the other hand Davis has killed three people in broad daylight, yet immunity is being sought for the killer,” the lawyer said. He mentioned that Aafia has been sentenced for 86 years, which was again cruel whereas America wants a killer to be free. On the other hand, an SMS campaign to exchange Aafia for Davis has already started, and cyber groups, like OSAPK, have launched campaigns for Davis for Aafia.

‘I am revolution’, I have lost my mind .

2011-02-04T13:03:00.000-08:00

I am born in the blood of the oppressed,

In the veins of the poor, I start to flow;

The hearts of the depressed have my throbs,

The wounded egos give me a beaming glow.

The injustice always thinks , I have died,

The repression considers , I have no choice;

The savagery never fathoms my depth,

The brutal regimes try to silence my voice.

I wait for my foes to mend their ways,

I exhort them to behave with a human grace;

But their arrogance stands as a stumbling- block,

Then with every silent sigh, I increase my pace.

Slowly, I leave my abode in hearts and minds,

And come on the streets to show my might;

Like the seething sea under the scorching Sun,

My simmering discontent gains its height.

Fuming with rage, I become a tempest,

My frenzy makes me totally blind ,

What I will do, I am unable to foresee;

None can anticipate my colour and kind.

Wait for the time when my fury ends,

Horrific trails of ravages, you will find;

Luxurious palaces will be lying in debris,

‘I am revolution’, I have lost my mind .

O level student scores record 23 As

2011-01-28T00:54:00.000-08:00

ISLAMABAD: A student in Islamabad, Ibrahim Shahid, set a new world record by scoring 23 As in Cambridge O level exams.
Shahid, a student of a private school in Islamabad, sat for 24 subjects and scored 23 As.
Attributing his success to his parents, Shahid recalled an incident where his teacher in Australia had written him off, stating that he would “never excel”. He added that every child is special and everyone has their own capabilities.
Earlier, Ali Moeen Nawazish, also a Pakistani student, had set a world record by securing 23 As in A level Cambridge exams.

http://tribune.com.pk/multimedia/videos/108614/

Facebook Markup Language (FBML)

2011-01-27T21:01:00.000-08:00

FBML enables you to build Facebook applications that deeply integrate into a user's Facebook experience. To use JavaScript within FBML, use FBJS.

Tools
User/Groups
Notifications and Requests
Platform Internationalization
Deprecated
Status Messages
Page Navigation
Wall
Visibility on Profile
Profile-specific
Misc
Editor Display
Embedded Media
Dialog
Additional Permissions
Social Plugins
Message Attachments
Forms

Tools

fb:board

Displays a discussion board with a unique identifier.

fb:bookmark

Renders a button that lets a user bookmark your application so a link to your application appears on the user's profile.

fb:chat-invite

Enables your users to initiate Facebook Chat with their friends from within your applications.

fb:comments

Displays a set of comments for a unique identifier.

fb:default

For a group of fb: tags contained within an fb:switch tag, the fb:default tag renders any content inside itself if no other fb: tag inside the fb:switch tag renders code before it.

fb:else

Handles the else case inside any fb:if, fb:if-* or fb:is-in-network tag, and with age and location restricting tags.

fb:feed

Renders an application-specific News Feed, which displays recent application stories about the logged in user's friends.

fb:friend-selector

Renders a predictive friend selector input for a given person.

fb:google-analytics

Inserts appropriate Google Analytics code into a canvas page.

fb:if

Only renders the content inside the tag if value tag is set to true.

fb:if-multiple-actors

Displays the enclosed content when more than one actor is involved in a Feed story.

fb:mobile

Renders the contained content only when viewed on the mobile website (http://m.facebook.com).

fb:multi-friend-input

Renders a multi-friend form entry field like the one used in the message composer.

fb:quantcast

Inserts appropriate Quantcast code into a canvas page.

fb:random

Randomly chooses an item inside the tags based on the weights provided.

fb:random-option

Contains code to be output when selected by the fb:random tag.

fb:switch

Evaluates every fb: tag inside and returns the first one that evaluates to anything other than an empty string.

fb:typeahead-input

Creates a type-ahead tool (as suggested) that will give you the results that you specify.

fb:typeahead-option

This tag specifies the values for a typeahead form input.

fb:user-agent

Displays the contents wrapped inside the tag to the specified user-agents.

User/Groups

fb:eventlink

Prints the specified event name and formats it as a link to the event's page.

fb:grouplink

Prints the specified group name and formats it as a link to the group's page.

fb:if-can-see

Displays the enclosed content if the logged in user can see the specified what attribute of the specified user.

fb:if-can-see-photo

Displays the enclosed content only if the logged in user can see the photo specified.

fb:if-is-app-user

Displays the enclosed content only if the specified user has accepted the terms of service of the application (that is, authorized your application).

fb:if-is-friends-with-viewer

Displays the enclosed content only if the specified user is friends with the logged in user.

fb:if-is-group-member

Displays the enclosed content only if the specified user is a member of the specified group.

fb:if-is-user

Only renders the content inside the tag if the viewer is one of the specified user(s).

fb:if-is-verified

Displays the enclosed content only if Facebook has verified the current user.

fb:name

Renders the name of the user specified, optionally linked to his or her profile.

fb:profile-pic

Turns into an img tag for the specified user's or Facebook Page's profile picture.

fb:pronoun

Renders a pronoun for a specific user.

fb:user

Hides the content enclosed in this tag from any user who is blocked by the user whose uid is referenced in fb:user.

fb:user-status

Returns the status of the user specified by uid.

Notifications and Requests

fb:application-name

Renders the application name.

fb:multi-friend-selector

There are actually two versions of this button - the full version and the condensed version.

fb:multi-friend-selector_(condensed)

There are actually two versions of this button - the full version and the condensed version.

fb:req-choice

Specifies a button to be shown at the bottom of a request on the user's requests page.

fb:request-form

Creates a form that sends requests to the selected users.

fb:request-form-submit

Creates a button that submits an fb:request-form.

Platform Internationalization

fb:date

Renders a date.

fb:fbml-attribute

Contains the value of an attribute of an FBML tag.

fb:intl

Marks a string of English text as translatable into other languages.

fb:intl-token

Contains an attribute that replaces a token (variable) in the text of an fb:intl tag.

fb:tag

Renders an HTML tag.

fb:tag-attribute

Contains the value of an attribute of an HTML tag specified by fb:tag.

fb:tag-body

Contains the body (contents) of an HTML tag specified by fb:tag.

fb:window-title

Sets the title of the browser window to the content within the tag.

Deprecated

fb:if-is-own-profile

This tag is deprecated, since if- tags are no longer allowed on profile pages.

fb:if-user-has-added-app

Displays the enclosed content only if the specified user has added the application to their account.

fb:networklink

Prints the specified network name.

fb:notif-email

Specifies content of the email body for a notification sent with the notifications.send call.

fb:notif-page

Specifies content of a notification that appears on a user's Notifications page.

fb:notif-subject

Specifies the content of the email subject line for a notification sent with the notifications.send call.

fb:profile-action

Renders a link on the user's profile under their photo (such as "View More photos of..").

fb:rock-the-vote

Displays a Rock the Vote & CREDO Mobile registration widget inline in your application.

fb:userlink

Prints the specified user's full name linked to their profile along with their network, optionally (as is normally displayed on the Wall, for example).

fb:visible-to-added-app-users

Displays the enclosed content only if the viewer has added the application to their account.

fb:visible-to-user

Only displays the content inside the tag if the viewer is the specified user.

Status Messages

fb:error

Renders a standard Facebook error message.

fb:explanation

Renders a standard Facebook explanation message.

fb:message

Renders the heading text for an error, explanation or success message.

fb:success

Renders a standard Facebook success message.

fb:create-button

Renders a Create button for adding user-generated content.

fb:dashboard

Renders a standard Facebook dashboard header.

fb:header

Renders a standard Facebook title header.

fb:header-title

Specifies the header title for a fb:mediaheader.

fb:help

Renders a help link.

fb:mediaheader

Renders a standard media header, intended mainly for displaying content contributed by a particular user.

fb:owner-action

Specifies an action link to be displayed inside a fb:mediaheader when the viewer is the owner of the content

fb:tab-item

Renders a standard Facebook tab.

fb:tabs

Renders a group of standard Facebook navigation tabs.

Wall

fb:wall

Emulates the look of a wall environment.

fb:wallpost

Renders a Wall-style post.

fb:wallpost-action

Displays a link at the bottom of a wallpost (even if it appears before other text within the fb:wallpost tag).

Visibility on Profile

fb:18-plus

Restricts content to users who are age 18 or older.

fb:21-plus

Restricts content to users who are age 21 or older.

fb:restricted-to

Lets you tailor the enclosed content to display to specific ages, locations, or content types.

fb:visible-to-app-users

Displays the enclosed content only if the viewer has granted full permissions to the application.

fb:visible-to-connection

Use this tag to display the content inside the tag on a user's or a Facebook Page's profile only if the viewer is a friend of that user or is a fan of that Facebook Page.

fb:visible-to-friends

Use this tag to display the content inside the tag on a user's profile only if the viewer is a friend of that user.

fb:visible-to-owner

Displays content inside only if the viewer of the profile matches the profile owner.

Profile-specific

fb:action

Renders a link, usually for navigational purposes.

fb:add-section-button

Renders an Add to Profile or Add to Info button (depending upon which section attribute you specify) on an application's canvas page.

fb:if-section-not-added

Renders the content wrapped within this tag on an application canvas page if the user hasn't added a condensed profile box or info section to her profile.

fb:narrow

Renders the content contained by the tag only if the profile box is in the narrow column of the profile.

fb:publisher-link

Renders an anchor tag around the internal content pointing to a profile with the application's Publisher preselected.

fb:subtitle

Defines the subtitle for the profile box.

fb:user-item

Renders a single cell of a table, which contains a thumbnail and name for a particular user, similar to the Mutual Friends table on profile pages.

fb:user-table

Renders a table, each cell of which contains a thumbnail and name for a particular user, similar to the Mutual Friends table on profile pages.

fb:wide

The enclosed content appears only when profile box is in the wide column of the profile.

Misc

fb:add-profile-tab

Renders a button that lets a user add your application or site's application tab to his or her profile

fb:fbml

This tag serves two purposes.

fb:fbmlversion

Prints the version of FBML currently in scope.

fb:js-string

This tag renders a block of FBML into an FBML block variable instead of rendering it on the page.

fb:page-admin-edit-header

For apps that can be added to Facebook Pages, this adds a standardized edit header for canvas pages so that the Page owner can easily jump to their Page's app configuration.

fb:redirect

Redirects a user's browser to a new URL within the Facebook canvas.

fb:ref

Fetches and renders content (like FBML or JavaScript) from a given ref source onto your canvas pages.

fb:serverFbml

Renders the FBML on a Facebook server inside an IFrame.

fb:time

Renders the date and time in the user's time zone.

fb:title

Sets the page's tag to its contents.

Editor Display

fb:editor

Creates a form with two columns, just like the form on the edit-profile page.

fb:editor-button

Renders a button of type submit inside an fb:editor tag.

fb:editor-buttonset

A container for one or more fb:editor-button tags, which are rendered next to each other with some space between each button.

fb:editor-cancel

Renders a Cancel button inside an fb:editor tag.

fb:editor-custom

Allows you to put any content into an fb:editor block, as long as it is valid FBML.

fb:editor-date

Creates two drop down list boxes that let a user select a date.

fb:editor-divider

Renders a horizontal line separator in the column containing the form elements.

fb:editor-month

Creates a form selector element displaying the month.

fb:editor-text

Creates an of type text.

fb:editor-textarea

Creates a

</code> element.</p> </div></div><div class="page"><div class="title"><b>fb:editor-time</b></div><div class="snippet"><p>Creates a series of form selector elements showing the time in hours and minutes, and an AM/PM indicator.</p> </div></div></div><hr><h2 id="embedded-media">Embedded Media</h2><div class="refindex"><div class="page"><div class="title"><b>fb:flv</b></div><div class="snippet"><p>Renders a Flash-based FLV player that can stream arbitrary FLV (video/audio) files on the page.</p> </div></div><div class="page"><div class="title"><b>fb:iframe</b></div><div class="snippet"><p>Inserts an <code><iframe></code> tag into an application canvas page; you cannot use the  tag on the profile page (that is, application tabs and profile boxes).</p> </div></div><div class="page"><div class="title"><b>fb:mp3</b></div><div class="snippet"><p>Renders a Flash-based audio player.</p> </div></div><div class="page"><div class="title"><b>fb:photo</b></div><div class="snippet"><p>Renders a Facebook photo.</p> </div></div><div class="page"><div class="title"><b>fb:silverlight</b></div><div class="snippet"><p>Renders a Microsoft Silverlight control.</p> </div></div><div class="page"><div class="title"><b>fb:swf</b></div><div class="snippet"><p>Renders a Shockwave Flash (SWF) object.</p> </div></div></div><hr><h2 id="dialog">Dialog</h2><div class="refindex"><div class="page"><div class="title"><b>fb:dialog</b></div><div class="snippet"><p>The <strong>fb:dialog</strong> tag displays a lightbox-type dialog box when a user clicks on some element.</p> </div></div><div class="page"><div class="title"><b>fb:dialog-button</b></div><div class="snippet"><p>Renders a button for the fb:dialog popup.</p> </div></div><div class="page"><div class="title"><b>fb:dialog-content</b></div><div class="snippet"><p>The  fb:dialog-content tag is a child of fb:dialog and represents the  content that gets displayed inside the popup dialog when it appears.</p> </div></div><div class="page"><div class="title"><b>fb:dialog-title</b></div><div class="snippet"><p>fb:dialog-title is a child of fb:dialog and renders a title for what is displayed inside the popup dialog.</p> </div></div></div><hr><h2 id="additional-permissions">Additional Permissions</h2><div class="refindex"><div class="page"><div class="title"><b>fb:prompt-permission</b></div><div class="snippet"><p>Renders  the content of the tag as a link that, when clicked, initiates a dialog  requesting the specified extended permissions from the user.</p> </div></div></div><hr><h2 id="social-widgets">Social Plugins</h2><div class="refindex"><div class="page"><div class="title"><b>fb:comments</b></div><div class="snippet"><p>Displays a Comments Box on a Facebook Connect site or in an IFrame application.</p> </div></div><div class="page"><div class="title"><b>fb:live-stream</b></div><div class="snippet"><p>Use this tag to render a Live Stream Box social widget on your FBML canvas pages or Facebook Connect sites.</p> </div></div></div><hr><h2 id="message-attachments">Message Attachments</h2><div class="refindex"><div class="page"><div class="title"><b>fb:attachment-preview</b></div><div class="snippet"><p>Renders a link in a message attachment that, when clicked, replaces that attachment with newly fetched content.</p> </div></div></div><hr><h2 id="forms">Forms</h2><div class="refindex"><div class="page"><div class="title"><b>fb:captcha</b></div><div class="snippet"><p>Renders a CAPTCHA on your canvas page inside of a form.</p> </div></div><div class="page"><div class="title"><b>fb:submit</b></div><div class="snippet"><p>Creates a JavaScript submission mechanism for a form, which makes image or text links act as Submit buttons.</p> </div></div></div><p> </p><p></p><p></p><hr><p></p></DIV>

7 FBML examples to rock your Facebook fan page.

2011-01-27T20:36:00.000-08:00

Facebook markup language or FBML for short is used in a variety of places within the social network. Anyone who has written any Facebook applications will already be pretty familiar with its tags, and will probably have used it to write data to walls, or share postings with others programmatically. If however you haven’t yet dipped your toe in the water of the Facebook API, or indeed haven’t actually needed to – there are some snippets of FBML which prove to be mighty useful when creating custom Facebook Fan Pages, and can easily and quickly out of the box be used with the FBML widget, which adds an extra much needed layer of customisation to an existing Facebook fan page. The static FBML widget can be added multiple times, and in multiple places (sidebar and tabs) to facilitate this. Once you’ve added it to your page, simply go to “edit page”, then under Applications click “edit” under Static FBML. This will give you the options you need to paste in your code.

Adding your newsletter

If your blog or website offers subscription via email, an additional place to find subscribers is within the Facebook network. Fans that stumble upon your page, or are invited by others may want to add themselves to your subscriber list directly from you page, without visiting your site. Using the code that your newsletter provider gave you, you can easily create a newsletter tab with a subscribe box. Whilst this isn’t strictly FBML (its just HTML) – its an easy way to increase your reach and exposure on the cheap. FBML needed. Something similar to below. This is what I’m using folks.

Include Sharing With Friends

One of the main benefits of being on the Facebook platform is the ability for viral sharing to take place amongst participants in the network. To encourage your business page to be shared with others you can implement a Facebook “multi-select” box, all within the static FBML box. This will loop through the current users friend list, allowing them to select who they want to share the fan-page with when they click send. You might want to put this under a “Spread the word” type tab to increase your reach.
Update. Some people have reported problems with this code. From what I can remember, it worked previously – so unless FB have changed things. Anyway – I’m using the below successfully now. Don’t for god’s sake copy and paste, examine the code, and type it exactly. WordPress makes a mess of single quotes which won’t work inside Facebook. I will get around at some stage to ammending this, but for now take care and try and understand what you are using. If all else fails, consult the Facebook documentation, or leave a comment here, which I’m more likely to respond to. I’ll not be replying to personal emails asking for help.

Include Multimedia

Multimedia objects such as flash, video and images can also be easily added to Fan Pages. If for example you wanted some flash video, or embedding of a flash game, the FB:swf, and FB:flv are perfect candidates. More details on the format of the API request available here for FLV and here for SWF. FBML needed

Monitor your pages with Google Analytics

A great social media campaign should focus on measurement over reach. One of the easiest ways to take a look at the data provided via a Facebook page is via Google Analytics. Thankfully, inclusion on an existing static FBML page is particularly easy. Here’s the code you need. Obviously, just replace the uacct with your own account ID to start collecting data about your page. FBML needed

Add profile image

Your profile image is the thumbnail found at the top left of your page. To include it again anywhere on your Facebook Static FBML page, try using this example. A number of size parameters can be set with the tag, so if this size isn’t your thing, you can easily adjust it. Replace the UID parameter with your own userId.

Overview

Hopefully some of these FBML examples should help get your Facebook page off the ground, with some additional functionality for minimal effort. Combining some of the tags that Facebook provide out of the box, with a little creativity can really boost your social media marketing efforts without the need for calling on a programmer.

Static FBM

2011-01-27T20:32:00.000-08:00

FBML stands for Facebook Markup Language, which is a subset of HTML.

Static FBML is a Facebook application that allows Facebook page administrators to create custom tabs on their Facebook pages. This application is only available for Facebook pages, not for personal profiles or Facebook groups.

Adding Static FBML to Your Facebook Page

You can add Static FBML in four easy steps.
#1: Make sure you are an administrator of the Facebook page so you have the ability to edit.
#2: Go to the Static FBML application.
#3: Click “Add to my Page.”
#4: A window will appear that contains a list of the Facebook pages for which you are an administrator. Click “Add to Page” to add the application.
Static FBML is now added to your page.
Before you add content to your FBML tab, you should have an idea the image or video size you need so these components fit in the space provided.

Setting Up Static FBML as a Tab

To set up your FBML tab, click on “Edit Page” under your Facebook page logo/avatar located on your wall.

Scroll down to the “Applications” section and locate the FBML app and click “Application Settings” (see below). Make sure that the “Tab” setting is “added”. You now have an FBML tab.

To the left of application settings you will see an “Edit” option on your FBML. This is where you will ultimately paste your HTML code. You can also add a “box title.” The box title becomes the name of your tab.
Please note that your FBML box must be coded for a maximum width suitable for a tab. The maximum width for an FBML tab is 520 pixels.

Adding Content to Your Static FBML Tab

Now it’s time to edit and add content. To begin, click on “Edit Page” located under your Facebook page logo. Scroll down to the “Applications” section and locate the FBML app, but this time click “Edit.” The FBML tab will be empty.
This is the area where you can name the FBML tab and add HTML code. Please note that FBML does not work with all HTML code. For example, JavaScript does not work. You’ll need to experiment.
If you scroll down to the bottom, you can add additional FBML tabs.

The maximum number of FBML tabs you can have is 10.
Now let’s spice up your Facebook page. I’ll go over the two most popular enhancements using Static FBML – adding a clickable image and embedding a YouTube video.

How to Add a Clickable Image in Static FBML

When adding an image in the FBML box, I’ve found that the best place to host images is Photobucket. Using Flickr or Facebook photos caused issues for me. If it works for you, stick with it. The maximum width for an image in the FBML tab is 520px.
There is no maximum height, but think of it as a landing page by keeping the scrolling to a minimum. Ask yourself: do you want users to scroll down to get the message or do you want to get the main point across once they’ve landed on your page?
Upload your image to your Photobucket account. Copy the direct URL to the image you intend to use in your FBML box. Next, you want to use this code:
http://xxxxx” mce_href=”http://xxxxx” target=”_blank”>http://yyyyy” mce_src=”http://yyyyy” width=”##px” height=”##px” border=”0″ alt=” “>
Replace the xxxxx with the target URL. Replace the yyyyy with the direct link to your uploaded Photobucket image. Replace the ## with your width and height in pixels.

How to Embed a YouTube Video in Static FBML

As with images, I would recommend a maximum width of 520px for a tab. After uploading your video, you want to use this code:
000000” imgstyle=”border-width:##px; border-color:white;” swfsrc=”http://www.youtube.com/v/xxxxx” imgsrc=”http://img.youtube.com/vi/xxxxx/2.jpg” width=”520″ height=”400″ />
Replace the xxxxx with your YouTube’s video ID. In both examples below, “MqqKPWhY4es” is my YouTube ID.
Example 1: In this YouTube link: http://www.youtube.com/watch?v=MqqKPWhY4es, all the characters after the “=” are the YouTube ID.
Example 2: If your YouTube link looks like this: http://www.youtube.com/watch?v=MqqKPWhY4es&feature=player_embedded, all the characters after the “=” and before the “&feature” will be the YouTube ID.
You can change the values of “swfbgcolor” and “imgstyle” to your preferences. The “imgsrc” is a bit trickier because it is a preview image. When a user clicks on the preview image, it turns into the video. To see a real-life example, you can go to the Marketwire page (see below screen shot). In order to change the preview image, you can replace the URL to a direct link to one of your Photobucket images (or any other source).
Make sure you open and close all tags and quotes.

Example of a clickable image with an embedded video

How to Set the FBML Box as the Default Landing Tab

The option of setting your FBML tab as the default landing tab, rather than the wall, is one of the most relevant enhancements you can make to your Facebook page. This is where adding Google Analytics to your Facebook page helps tremendously with tracking.
In order to set your FBML tab as your default landing page, go to “Edit Page” under your Facebook page logo and scroll down to “Wall Settings.” You’ll notice a section called “Default Landing Page for Everyone Else.” Visitors who are not fans of your page will see your newly created FBML tab. Visitors who are fans will land on your wall.

That’s it!

Static FBML a Must-Have for Facebook Pages

The ability to enhance your page as a marketing vehicle by driving traffic to your website and engaging even more with your audience should warrant consideration. Many administrators shy away from Static FBML because they’re intimidated with coding.
My suggestion: review this post, research a bit more on Google and try it out. In the words of Ben Stiller from the movie Starsky & Hutch, Do it! Do it! Do it!.
I hope this tutorial has given you some insight on how to implement Static FBML to your Facebook page.

Tips to Avoid Having Your Google AdSense Account Banned

2011-01-20T00:19:00.001-08:00

Google’s AdSense program is a fantastic way to earn extra money on your website or blog, but unless you’re extra careful, you may risk being banned from participating. In this article we will outline several tips which can help you avoid being banned from Google AdSense, including some which may surprise you.

Tips to Avoid Being Banned from Google AdSense

In terms of the rules set forth by Google for their AdSense program, the company is very fair and makes it extremely easy to participate. There are, however, a few surefire ways to have your account banned—ways that you may want to avoid at all costs. Here are just a few of those ways:

· Clicking on Your Own Ads. This may seem like a no-brainer, but according to the good folks at Google, it is the number one reason people have their AdSense account banned. Now this doesn’t mean that if you occasionally and accidentally click on your own ad your account will be banned, but it does mean that if you try to trick Google by persistently clicking on your ads, you will quickly find yourself on the outside looking in.

· Signing up for more than one account. Some of the veterans of Google’s AdSense will tell you there’s a few ways around this rule, but if you want to be safe from the threat of being banned, you’ll probably want to stick to just the one account.

· AdSense clicking rings. Getting together with friends or colleagues and conspiring to click on each other’s ads may sound like a profitable idea, but if you think you’re going to fool Google you have another thing coming. This is a “deal breaker” and can quickly result in having your account banned permanently.

· Questionable or Illegal Content. Sites which feature illegal or questionable content—sites such as gambling sites, porn sites and even hacker sites—are not eligible for Google AdSense. Attempting to include Google AdSense on these types of sites is a no-no and will get you banned.

· Images or Pictures Adjacent to your AdSense blocks. Google will afford you a lot of freedom with regard to the placement of your ads, but if you feature pictures or images which are relative to your AdSense blocks they cannot appear next to your ads or you will eventually be banned. Why? Because Google feels this practice is akin to tricking your visitors into clicking on your ads.

· Avoid putting AdSense on Pop-Up Ads. Placing Google AdSense material on pop-ups, especially those pop-ups which generate other pop-ups when users try to close them, is not acceptable in the eyes of Google and can have your account banned until you correct the violation.

· Disclosing your potential earnings. According to Google’s terms of service, any information concerning your click-through rates or earnings per impressions or clicks is not allowed on the same site where you will feature any AdSense blocks.

· Having Blank or AdSense-Only Pages. Sites which have no content or those sites featuring nothing but Google AdSense ads are not allowed and can get you banned from the program.

Of course these are just a few of the ways to get your account banned, and while you may not completely agree with all of them, failing to comply can be a one-way ticket to having your account banned, either temporarily or permanently. To ensure that your ads remain up and running, simply follow the rules outlined in Google’s terms of service for the AdSense program and avoid questionable conduct altogether.

Prevent Denial of Service (DoS) Attacks

2011-01-20T00:11:00.001-08:00

Denial of Service (DoS) attacks against web sites occur when an attacker attempts to make the web server, or servers, unavailable to serve up the web sites they host to legitimate visitors. For some time, it was thought that these types of attacks were generally used against large corporations, government sites, and activist sites as a form of protest to disrupt their web presence.

However, more small and medium businesses are beginning to see their online presence disrupted by this type of attack.

Application Denial of Service attacks have rapidly become a commonplace threat for doing business on the Internet - more proof that Web application security is more critical now than ever. Denial of Service attacks can result in significant loss of service, money and reputation for organizations. Typically, the loss of service is the inability of a particular network service, such as e-mail, to be available or the temporary loss of all network connectivity and services. An HTTP Denial of Service attack can also destroy programming and files in affected computer systems. In some cases, HTTP DoS attacks have forced Web sites accessed by millions of people to temporarily cease operation.

Examples of Denial of Service attacks launched against web applications include:

* Attempts to "flood" web applications, thereby preventing legitimate user traffic
* Attempts to disrupt service to a specific system or person, e.g., blocking user access by repeated invalid login attempts resulting in the account's suspension
* Jamming the application-database connection by crafting CPU-intensive SQL queries

Risks Associated with Denial of Service Attacks

Denial of Service attacks are centered around the concept that by overloading a target’s resources, the system will ultimately crash. In the case of a DoS attack against a web application, the software is overloaded by the attack and the application fails to serve web pages properly. To crash a web server running an application, a DoS threat attacks the following services:

* Network bandwidth
* Server memory
* Application exception handling mechanism
* CPU usage
* Hard disk space
* Database space
* Database connection pool

In the past, Denial of Service attacks were thought to be a tool used by hacktivists as a form of protest. However recent attacks have shown that Denial of Service attacks can also be way for cyber criminals to profit.

By not proactively working to prevent Dos attacks, you leave your site vulnerable to:

* Extortion: Attackers threaten to continue disrupting service until payment is received.
* Sabotage: Competing businesses attack web sites to build a stronger market share.
* Brand damage: Sites that are attacked find that their reputation is hurt by lack of uptime or the perception that the site is not secure.
* Financial losses: Sites that are attacked are prevented from doing business online. The result is often a loss in sales revenue or advertising revenue.
* Other attacks: Information gathered from a successful Denial of Service attack can be used later to further attack a web site. Additionally, other vulnerabilities may be used to launch a DoS attack providing the attacker with access to more than they had originally intended.

Preventing Denial of Service Attacks

With dotDefender web application firewall you can avoid DoS attacks because dotDefender inspects your HTTP traffic and checks their packets against rules such as to allow or deny protocols, ports, or IP addresses to stop web applications from being exploited.

Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against DoS threats, cross-site scripting, SQL Injection attacks, path traversal and many other web attack techniques.

The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

* Easy installation on Apache and IIS servers
* Strong security against known and emerging hacking attacks
* Best-of-breed predefined security rules for instant protection
* Interface and API for managing multiple servers with ease
* Requires no additional hardware, and easily scales with your business

How does an attacker launch a Denial of Service attack?

There are many different ways that an attacker can launch a Denial of Service attack. They range from simply unplugging a server from the network (if they have physical access) to coordinating large armies of zombie computers to launch a large scale distributed attack against their target using:

* Buffer overflows in the application functions
* Malformed data to raise unexpected exceptions
* Exploited race conditions in multi-threaded systems
* Heavy-duty SQL queries via web forms and "spamming" them with requests, e.g., inserting % characters within search query fields
* SQL Injection attacks executing recursive CPU-intensive queries
* The end users' web browsers to overload the application with parallel requests via persistent / reflected Cross-Site Scripting attacks
* Overly-complex regular expressions within search queries
* Excessively large files uploaded to the server

Most commonly, the following tactics are used in a DoS attack:
Ping Flooding

(Also known as ICMP flood, Smurf attack, Ping of death, or SYN flood)

Ping flood works by sending the target an overwhelming number of ping packets, usually using the "ping" command. It is very simple to launch and by creating traffic that exceeds the web site’s bandwidth availability, the attack is a success.

A SYN flood sends a flood of TCP/SYN packets using a forged sender address. Since the sender address is not correct, the response in the form of a TCP/SYN-ACK packet never comes leaving a half-open connection. As these connections begin to accumulate, the number of available connections becomes saturated keeping legitimate requests from successfully connecting.
Peer-to-peer attacks

Peer-to-Peer attacks are launched when the attacker causes users to disconnect from their peer-to-peer network and to connect to the victim’s website instead. Like a zombie or botnet attack, several thousand computers may be trying to connect to the victim’s site at once. If enough machines are controlled by the attacker, the overflow of connection requests can easily bring down a web application.

Unlike zombie attacks, there is no botnet so the attacker does not have to communicate with the computers he uses to launch his attack.
Application level floods

While most Denial of Service attacks exploit bandwidth, some rely on software related exploits such as buffer overflows. These attacks cause confusion in the application causing it to fill the disk space or consume all available memory or CPU cycles.
The Need to Avoid Denial of Service Attacks

Denial of Service attacks are often random when they are launched against small and medium sized web sites. When a web site is attacked that does not fall into the category of a high profile target (large corporation, government site, or activist site), the reason usually falls within one or more of the following categories:

* Grudge: An unscrupulous competitor or disgruntled former business partner or employee may wish to cripple a business's Web site for the purpose of financial gain or revenge.
* Name Confusion: The Web site's name may closely resemble one used by a well-known enterprise or personality.
* Easy Target: Most mega-corporations have already installed anti-DoS safeguards — such as security technologies and extra server and connectivity power — on their sites. Smaller businesses, with fewer resources at their disposal, are tempting targets for DoS attackers, especially those looking to hone their skills.
* Bad Luck: Sometimes there's no apparent reason for a DoS attack. An attacker may simply pick a business's domain at random, or because they like the sound of its name or the way it looks. Attackers, by nature, can be highly irrational.

Unfortunately for the victim, attacks that are unintentional yield many of the same results as those that are launched against a specific target.
Protect Yourself from Denial of Service Attacks

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing the request and the impact it has on the application. Effective web application security is based on three powerful web application security engines:

Pattern Recognition, Session Protection and Signature Knowledgebase.

The Pattern Recognition web application security engine employed by dotDefender effectively protects against malicious behavior such as Denial of Service attacks. The patterns are regular expression-based and designed to efficiently and accurately identify a wide array of application-level attack methods. As a result, dotDefender is characterized by an extremely low false positive rate which is important when dealing with DoS attacks as a false positive will generate the same end-result as a well coordinated DoS threat.

What sets dotDefender apart is that it offers comprehensive protection against Denial of Service and other attacks while being one of the easiest solutions to use.

In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.

Prevent Cross Site Scripting (XSS) Attacks

2011-01-20T00:09:00.000-08:00

Cross-site scripting has been at the top of both the OWASP Top Ten list and the CWE/SANS Top 25 repeatedly. Some reports show cross-site scripting, or XSS, vulnerabilities to be present in 7 out of 10 web sites while others report that up to 90 percent of all web sites are vulnerable to this type of attack. Why are so many sites at risk? Because cross-site scripting attacks are so easy to perform.

Basically, an attacker inputs a malicious script into a web site. This can be in a forum, comment section, or any other input area. When victims visit that web site, they only need to click on that script to start the exploit.

A few facts about cross-site scripting attacks that you should be aware of are:

* Every month roughly 10-25 XSS holes are found in commercial products and advisories are published explaining the threat.
* Websites that use SSL (https) are in no way more protected than websites that are not encrypted. The web applications work the same way as before, except the attack is taking place in an encrypted connection.
* XSS attacks are generally invisible to the victim.
* All Web servers, application servers, and Web application environments are susceptible to cross-site scripting.

Risks Associated with Cross-Site Scripting

Attackers are lured to XSS exploits because how easy they are to perform, but they also know to follow the money. Attacking a web site through a cross-site scripting vulnerability can be quite profitable for the attacker who knows how to harness this type of exploit.

Without proactive Web application security in place to stop XSS attacks, you leave your site vulnerable to:

* User accounts being stolen through session hijacking (stealing cookies) or through the theft of username and password combinations
* The ability for attackers to track your visitors web browsing behavior infringing on their privacy
* Abuse of credentials and trust
* Keystroke logging of your site’s visitors
* Misuse of server and bandwidth resources
* The ability for attackers to exploit your visitor’s browser
* Data theft
* Web site defacement and vandalism
* Link injections
* Content theft

Web sites that have been exploited using XSS attacks have also been used to:

* Probe the rest of the intranet for other vulnerabilities
* Launch Denial of Service attacks
* Launch Brute Force attacks

Preventing Cross-Site Scripting Attacks

With dotDefender web application firewall you can avoid XSS attacks because dotDefender inspects your HTTP traffic and determines if your web site suffers from cross-site scripting vulnerabilities or other attacks to stop web applications from being exploited.

Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against cross-site scripting, SQL Injection attacks, path traversal and many other web attack techniques.

The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

* Easy installation on Apache and IIS servers
* Strong security against known and emerging hacking attacks
* Best-of-breed predefined security rules for instant protection
* Interface and API for managing multiple servers with ease
* Requires no additional hardware, and easily scales with your business

How does an attacker exploit a cross-site scripting vulnerability?

Before a web site can be compromised, an attacker needs to find applications that are vulnerable to XSS vulnerabilities. Unfortunately, most web applications, both Free/Open Source Software and commercial software, are susceptible. Attackers simply perform a Google search for terms that are often found in the software. Using search bots to automate this process means an attacker can find thousands of vulnerable web sites in minutes.

Once a vulnerable web site is discovered, the attacker then examines the HTML to find where the exploit code can be injected.
Coding the exploit

After this has been determined, the attacker then begins to code the exploit. There are three types of attacks that can be used:

1. Stored (persistent) attacks: Injected malicious code is stored on a target server such as a bulletin board, a visitor log, or a comment field. When interacting with the target server, an end-user inadvertently retrieves and executes the malicious code from the server.
2. Reflected attacks: The end-user is tricked into clicking a malicious link or submitting a manipulated form. The injected code is sent to a vulnerable web server that directs the cross-site attack back to the user’s browser. The browser then executes the malicious code, assuming it comes from a trusted server.
3. DOM-based attacks: The attack script is based on the same page's DOM (document object model), enabling it to manipulate and interrogate it. In this type of exploit, remote execution is enabled allowing the attacker to execute malicious code on the victim's computer.

After the code has been written, it is then injected into the target site.
Reap the rewards

Now that the script has been injected into the vulnerable site, the attacker can now begin to reap the rewards. If the intent of the XSS attack was to steal user authentication credentials, usernames and passwords are now collected. For attacks that center around keystroke logging, the attacker will begin to receive the logged results from the victims. If the intent was to inject spam links into a well trusted site, then the attacker will begin to see increased activity on their sites due to higher traffic and higher search engine results.

If the attack was successful, the attacker will often replicate it on other sites to increase the potential reward.
The Need to Avoid Cross-Site Scripting Attacks

Cross-site scripting not only costs businesses in stolen data, but also by harming their reputation. Owners who work hard to build themselves as trusted site to deliver content, services, or products often find themselves hurt when loyal visitors lose trust in them after an attack. Visitors whose data is stolen or find their computers infected as the result of an innocent visit to your web site are hesitant to return even if assurances are made that the site is now clean.

Even if a vulnerable site is fixed, sites that contained malicious code from an XSS exploit are usually flagged by Google and other search engines as a result. Resources spent in time and effort to restore a solid reputation with the search engines is an added cost that most web site owners never figure on.

The threat posed by cross-site scripting attacks is not solitary. Combined with other vulnerabilities like SQL injections, path traversal, denial of service attacks, and buffer overflows the need for web site owners and administrators to be vigilant is not only important but overwhelming.
Protect Yourself from Cross-Site Scripting Attacks

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing the request and the impact it has on the application. Effective web application security is based on three powerful web application security engines: Pattern Recognition, Session Protection and Signature Knowledgebase.

The Pattern Recognition web application security engine employed by dotDefender effectively protects against malicious behavior such as SQL Injection and Cross Site Scripting. The patterns are regular expression-based and designed to efficiently and accurately identify a wide array of application-level attack methods. As a result, dotDefender is characterized by an extremely low false positive rate.

What sets dotDefender apart is that it offers comprehensive protection against cross-site scripting and other attacks while being one of the easiest solutions to use.

In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.

Security Tools for Apache Servers

2011-01-20T00:07:00.000-08:00

It is assumed that Apache is a more secure web server than its Microsoft counterpart, Internet Information Services (IIS) (read more about IIS security here). Whether this statement is true or not depends on who’s facts you believe, however for the web administrator who is under the impression that Apache on its own is completely secure is in for an unfortunate shock.

Apache, like any software, is susceptible to vulnerabilities. Having the largest share of the web server market makes Apache, and those who use it to power their web sites, vulnerable to the different threats that exist. As cyber criminals have shifted the focus of their attacks from defacement and delinquency to the actual theft of dollars and data, web administrators have to be more vigilant that ever when it comes to securing their web applications, regardless of what server software they are running.
Risks Associated with Apache

Despite the belief that Apache is more secure than its competitors, the latest version of the software, Apache 2.2, has had 30 known vulnerabilities patched since May of 2002. These vulnerabilities range from giving attackers the ability to coordinate Denial of Service attacks against the server to bring down a web site to opening the door to Cross-Site Scripting (XSS) attacks.
Configuration

Like any web server, if Apache is not configured properly there is a good chance that it will be open to attackers who use exploits like SQL Injections and PHP File Includes. Since Microsoft’s IIS was marketed to be easier to install, configure, and manage Apache’s developers have made great strides in making their web server a more user friendly product to those who may have shied away from the GNU/Linux shell in the past. However, as the default installation has become easier, it has also become less secure due to unnecessary services being installed. The more services that are running equates to a higher risk of a vulnerability being exploited. If the administrator is unaware of a specific service, then they may not know what to watch for in order to prevent an attack.
Zero-Day Vulnerabilities

Even a web server that is updated with all the latest patches, monitored closely, and configured properly can be compromised by a zero-day attack. When this happens, it can be days before a fix is found and the attacked site could suffer from any number of issues during that time. Unless the web administrator knows what patterns to look for in illicit web traffic and does nothing else but watch this traffic, he or she will not be able to spot this type of attack before it is too late.
Web Applications

While efforts to secure Apache may be high on a web administrator’s priority list, if the applications installed on the server are not treated with the same consideration the site is vulnerable to a number of threats. Some of the more common methods of attack against the most popular web applications are:

* Cross-Site Scripting
* Path Traversal
* SQL Injection
* Session Hijacking
* Link Injection
* Cross Site Request Forgeries
* Malware
* Denial of Service

Protecting Apache

Like any server, certain steps need to be taken to harden the operating system against attacks. While malware prevention, Intrusion Detection/Prevention Systems, network firewalls, and all of the other tools and techniques help prevent some attacks, they don’t adequately prevent attacks launched against any third-party applications that have been installed on the server.

Apache’s developers realize the need to protect their product with a web application firewall. In response to security threats that exist users can install a module called mod_security. mod_security is a plug-in that installs a web application firewall on Apache to help protect against certain threats. While in the hands of a security expert mod_security can be a useful tool in the fight to protect a web server, it does require the user to understand how to write complex rules, accept the basic supplied rule set, or purchase rules for a small fee.
Protect Apache With dotDefender

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing the request and the impact it has on the application. Effective web application security is based on three powerful web application security engines: Pattern Recognition, Session Protection and Signature Knowledgebase.

The Pattern Recognition web application security engine employed by dotDefender effectively protects against malicious behavior such as the attacks mentioned above, and many others. The patterns are regular expression-based and designed to efficiently and accurately identify a wide array of application-level attack methods. As a result, dotDefender is characterized by an extremely low false positive rate.

What sets dotDefender apart is that it offers comprehensive protection against threats to web applications while being one of the easiest solutions to use.

In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.
Advantages of Running dotDefender on Apache

Unlike mod_security, dotDefender runs as a Security-as-a-Service solution and is able to provide protection to web servers directly out of the box- whether the admin has an extensive background in security or just a minimal amount of knowledge on the subject.

With the dotDefender web application firewall you can avoid many different threats to web applications because it performs a deep inspection of your HTTP traffic and checks their packets against rules such as to allow or deny protocols, ports, or IP addresses to stop web applications from being exploited. This deep level packet inspection helps to prevent against zero-day attacks as traffic that appears to be illicit can be stopped using the pattern recognition features.

Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against DoS threats, Cross-Site Scripting, SQL Injection attacks, path traversal and many other web attack techniques without the need to perform expert level configurations.

The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

* Strong security against known and emerging hacking attacks
* Best-of-breed predefined security rules for instant protection
* Interface and API for managing multiple servers with ease
* Requires no additional hardware, and easily scales with your business

E-Commerce Security

2011-01-20T00:05:00.000-08:00

By the year 2014 it is estimated that close to $250 million a year will be spent by consumers at online retailers. With web applications like Zen Cart, Open Cart and Magento making it easy for brick and mortar shops to quickly set up an ecommerce site, more businesses are moving to get their products in front of a larger market using the web.

For some business owners, the ease in which an e commerce site can be set up may actually come at an unexpected cost. Using one of the web applications mentioned above, or any number of proprietary solutions as well, someone with very little knowledge can set up shop and begin collecting credit card information from their customers. While an online shop may be too attractive to pass up, web applications that run ecommerce sites have become a "soft spot" for cybercriminals interested in stealing credit card information and other customer data. For this reason, Web application security is a vital consideration for e-commerce site owners.
Risks Associated with E-Commerce

Over the years, the methods used by ecommerce sites to process and store credit card information has become much more sophisticated than the early days of online shopping. This progress has helped online shopping overcome one of its greatest obstacles, consumer trust. As evidenced by the amount of money spent online each year, people feel much more secure in shopping online than they ever have. Unfortunately for businesses, the methods used by cyber criminals trying to steal their customer’s information have made it easier than ever for them to compromise a web application.
Credit Card Theft/Fraud

Sophisticated cyber criminals use bot nets to launch coordinated attacks against unsuspecting web sites that are vulnerable to attack in order to steal credit card information - credit card security is one of the most important components of e-commerce security. The infamous TJX security breach disclosed in 2007 is a good example of what can happen to companies that do not have the proper security measures in place. This breach resulted in 94 million accounts being compromised with losses exceeding $70 million due to fraud the result was a lawsuit filed against TJX by over 300 banks. When the attacker, Alberto Gonzalez, was finally caught it was found that he exploited SQL Injection vulnerabilities in various web sites to net over 130 million credit cards.

Some of the most common exploits used in financial data theft include:

* SQL Injection
* Cross-Site Scripting
* Path Traversal
* Session Hijacking
* Malware (Drive-by downloads)

Unfortunately, most sites that are vulnerable to these types of attacks don’t know it until it is too late.
Interruption of Business

It could be that a competitor is trying to hurt your business, or maybe just an attacker learning how to exploit known vulnerabilities. Quite possibly, it could be that someone has compromised your web server so that they can use its resources: hard drive space, processing power, and bandwidth. Whatever the reason, a Denial of Service attack can hurt any business because customers cannot get to your site while you are under attack. Not only is revenue lost because your customers cannot get to your online store, but they may think twice before ever shopping their again if they know that your site is vulnerable to attack.
Damaged Brand

When credit cards are stolen from ecommerce sites, it usually makes the news. When a theft reaches the headlines, both existing and potential customers tend to avoid using that merchant. Even the most loyal customers think twice and may turn to a competitor if they are concerned about the security of their financial data.

Theft is not the only way an attack can hurt an established brand name either. With many Internet users relying on browser add-ons that seek out and report on potentially harmful sites, if your web site is thought to be spreading malware or loaded with spam as a result of a link injection you could quite rapidly see a loss of traffic.
Search Engine Results

Companies fight hard to achieve the premier listings in the search engine results page, often spending a great deal of money on Search Engine Optimization specialists to help them rank high. All it takes is a Cross-Site Scripting attack that feeds your visitors with malware, or a link injection attack that flags your site as a spam delivery site and those rankings you worked so hard for will plummet. Larger search engines will remove potentially harmful sites from their search results altogether.

Once a web site has been cleaned, a request can be made to have it re-evaluated and returned to the search engine results, however it can be a rather time consuming process and it is a process that is sure to hurt traffic and revenue.
Protecting Ecommerce Sites

In 2004 five different credit card security programs merged to form the Payment Card Industry Security Standards Council (PCI DSS) with the purpose of creating an extra level of protection for card issuers making sure that merchants (both online and brick and mortar) meet basic levels of security when storing, processing, and transmitting cardholder data.

To set a minimum level of security, the Payment Card Industry set 12 requirements for compliance that fall into one of six groups called control objectives. The control objectives consist of:

* Build and maintain a secure network
* Protect cardholder data
* Maintain a vulnerability management program
* Implement strong access control measures
* Regularly monitor and test networks
* Maintain an information security policy

Companies that fail to comply with the PCI DSS standards risk losing the ability to process credit card payments and may be subjected to audits and fines.
Web Application Compliance

As many web sites are powered by web applications, and the application layer being a soft spot for attackers, the PCI Data Security Standards specifically address how to protect web applications.

In what is known as requirement 6.6, web site owners who process credit cards are given two options for compliance. Option one requires a code review to be done by an internal employee or a trusted third-party source and must consist of one of the four methods:

1. Manual review of application source code
2. Proper use of automated application source code analyzer (scanning) tools
3. Manual web application security vulnerability assessment
4. Proper use of automated web application security vulnerability assessment (scanning) tools

The problem with code reviews is that they can be time consuming, they can be expensive, and they don’t protect against zero-day vulnerabilities. For instance, if a highly qualified reviewer is hired to check the source code for compliance, he may be able to locate vulnerabilities that are known to him today, however the vulnerabilities that have yet to be discovered most likely will not be caught in a standard code review.
Web Application Firewalls

Option two of requirement 6.6 allows for a company to implement a web application firewall solution in place of regular code reviews. A web application firewall, either a hardware appliance or software solution, is placed in between the client end point and the web application. Web application firewalls, or WAFs, protect cardholder data because all web layer traffic is inspected looking for traffic that is meant to exploit known vulnerabilities as well as patterns that may suggest a zero-day exploit being launched against the application.

Without having to dedicate programmers to inspect every line of code, web application firewalls are known to protect against:

* Path Traversal Vulnerabilities
* Known worms
* Remote Command Execution
* Probes
* Denial of Service attacks
* Compromised servers
* Cross-Site Scripting
* SQL Injections

and many more.
The Need to Avoid Attacks

When it comes to protecting your ecommerce site from attackers having access to the credit card data, security needs to be a top priority. To ensure that all online merchants who process credit cards are taking the same precautions, the Payment Card Industry mandates compliance with their Data Security Standards.

A successful attack against an ecommerce site that puts credit card data at risk will most certainly draw the attention of the PCI. Odds are that a vulnerable web site who has allowed card holder data to be accessed illegally will be found out of compliance with these standards. In addition to the possibility that such a breach could result in lost revenues, the victim may also find themselves subject to fines imposed by the PCI.
Protect Your Web Applications With dotDefender

By acting as a Security-as-a-Service solution, dotDefender is able to provide protection to web servers whether the admin has an extensive background in security or just a minimal amount of knowledge on the subject.

Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against the common threats that the PCI Data Security Standards were put in place to protect against.

The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

* Strong security against known and emerging hacking attacks
* Best-of-breed predefined security rules for instant protection
* Interface and API for managing multiple servers with ease
* Requires no additional hardware, and easily scales with your business

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing each request to the web server and the impact it has on the application.

In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.

Cloud Security

2011-01-20T00:04:00.000-08:00

The concept of cloud computing can trace its inception back to the 1906's when the Turing Award winning computer scientist John McCarthy stated that "computation may someday be organized as a public utility". However, it wasn't until recently that the cloud began to take hold in IT as a result of Amazon providing access to their systems to maximize the use of their data centers through their Amazon Web Services project.

As more companies begin to explore the benefits of cloud computing, it was found that this solution had the potential to:

* Reduce costs
* Provide more flexibility
* Reduce IT management of hardware and data
* Reduce management of web applications through automated updates
* Provide greater storage capacity

While the advantages of a cloud solution are evident, there are many who also have been quick to point out the fact that there are plenty of security concerns one faces when considering moving to the cloud.
Risks Associated with Cloud Computing

The debate as to how secure moving applications and data to the cloud is such an area of concern that the topic consumed much of the discussion at the 2009 RSA conference. These ongoing debates have sparked a number of security experts to identify a number of threats to cloud computing to include;
The fact that someone else is in control of your data

Moving data to the cloud requires a great deal of trust in the host since they are essentially housing all of your data. If they fail to put adequate security controls in place between the client and data, a number of attacks can be used to compromise sensitive information. SQL Injection attacks, compromised servers, and session hijacking can all lead to cyber criminals harvesting your data on someone else's watch.
Someone else is managing your applications

While this is also noted as one of the benefits to cloud computing, it can also cause problems. As web applications grow in popularity, more companies rely on them as an integral part of how they do business. Moving these applications to the cloud should mean that the management of these apps is taken care of, but this usually means automated updates, not complete security. In fact, George Reese stated in his article, Twenty Rules for Amazon Cloud Security - "Above all else, write secure web applications."

The fact is, while your cloud provider may handle necessary updates of your software, they are not going to review your code for potential vulnerabilities; make sure your input and output is validated, escaped, and filtered; and that your application is protected against other methods of exploiting common threats like Cross-Site Scripting.
The perimeter of the cloud is different

The very nature of the cloud means that resources are shared as they are needed. Traditional perimeter security in the cloud doesn't work in the same way. For instance, using Amazon's Web Services you may find yourself restricted when it comes to checking logs and deploying tools like traffic sniffers and intrusion detection systems. Essentially, its not your perimeter so the way you used to protect it has changed. Some terms of service even prevent you from running vulnerability scans making it virtually impossible to perform a code review. For PCI compliance, this can present a major problem.
Protecting the Cloud

Even though data and applications running in the cloud are exposed to a number of security threats, a strong push form industries such as healthcare and ecommerce, as well as support from Google, IBM, Amazon, and other IT powerhouses, means that solutions to these security related problems need to be identified.

One way to protect against threats to your web applications and data is to deploy a Web application Firewall as a software solution. No additional hardware is required on the part of the cloud provider and in can be installed directly in front of your web facing applications.

When deployed correctly, a Web Application Firewall protects your web applications from known threats including:

* Path Traversal
* Known worms
* Remote Command Execution
* Probes
* Denial of Service attacks
* Compromised servers

Web application Firewalls also take traditional security much further. By performing a deep inspection of traffic on the web service layers they are able to stop threats that intrusion detection and prevention systems often miss.
The Need to Avoid Attacks

Cyber criminals attack the most vulnerable web sites, and they attack the biggest possible pool of victims they can. As more IT departments are forced to scale back, cost saving initiatives like cloud computing become even more attractive.

While cloud computing provides managed services, you are still responsible for compliance. No provider will assume this responsibility for you simply because they are managing your applications and data. In order to comply with regulations like PCI DSS, HIPPA, SOX, and the many others it is essential that security be one of the most important factors when making the decision to move to the cloud.
Protect Your Web Applications on the Cloud With dotDefender

What sets dotDefender apart is that it offers comprehensive protection against threats to web applications while being one of the easiest solutions to use.

By acting as a Security-as-a-Service solution, dotDefender is able to provide protection to web servers whether the admin has an extensive background in security or just a minimal amount of knowledge on the subject. In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your web site’s performance.

Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against DoS threats, Cross-Site Scripting, SQL Injection attacks, path traversal and many other web attack techniques.

The reasons dotDefender offers such a comprehensive security solution to your web application security hosted in the cloud are:

* Strong security against known and emerging hacking attacks – even zero-day vulnerabilities can be stopped before they exploit your web site.
* Best-of-breed predefined security rules for instant protection.
* Interface and API for managing multiple servers with ease. This works especially well with multiple virtual servers in the cloud.
* Requires no additional hardware, and easily scales with your business. Your cloud provider is not required to do anything. The software can be easily installed by your staff without the need for additional support from your cloud provider.

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing the request and the impact it has on the application. Effective web application security is based on three powerful web application security engines: Pattern Recognition, Session Protection and Signature Knowledgebase.

Web Application Firewall

2011-01-20T00:02:00.001-08:00

With reports stating that over 80% of all web sites are contain vulnerabilities that make them susceptible to Cross-Site Scripting, SQL Injection, Path Traversal, and many other exploits, many organizations have shown their concern.

Most notable is that of the Payment Card Industry (PCI) Security Standards Council who has required that in order to be in compliance, a company who processes credit cards over the Internet needs to either complete, Option 1, a web application vulnerability assessment or, Option 2, implement a web application firewall.

PCI defines a web application firewall as:

“A security policy enforcement point positioned between a web application and the client end point. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components.”

Basically, a web application firewall, or WAF, protects web applications much in the same way a traditional firewall protects a network. It controls the input and output, as well as the access to and from the asset it is protecting. However, traditional network firewalls, and even Intrusion Prevention Systems (IPS), evaluate IP packets or protocols without an awareness of the application payload so they cannot provide protection to the application layer. Without an awareness of the HTML data payload these layer 3 devices cannot recognize and overcome the types of application layer threats that make web applications vulnerable to attack.

Unlike traditional firewalls that usually block access to certain ports or filter by IP address, web application firewalls look at every request and response within the different web service layers such as HTTP, HTTPS, SOAP, and XML-RPC. The meticulous inspection of web traffic that web application firewalls perform has also earned them the nickname “Deep Packet Inspection Firewalls”.
Risks Associated with Web Applications

Falling out of PCI compliance may not be a concern for many web site owners. Many web sites simply don’t collect credit card data over the Internet and others rely on payment gateways like PayPal to handle all of their online transactions.

Unfortunately for any business or person who runs a web site, deploying any type of web application - even commercial applications or ones supported by a hosting provider - puts the web site at risk for the following:

* Web defacement and vandalism: using Path Traversal exploits, attackers can gain access to parts of your web site that the visitor never sees - the files and folders that exist outside of the web document root directory.
* Denial of Service attacks: by manipulating incoming web traffic, attackers can overload your web server or web applications causing them to crash or slow to a crawl. Visitors who have come to your site to purchase products, read your content, or participate in the community will become discouraged when the site is unavailable causing damage to your brand reputation and a potential loss in sales.
* Stolen user information: using SQL Injection exploits attackers can access any data stored in the data bases that your web site relies on. Information like user accounts, user identities, and user credit cards can be stolen or manipulated. Cross-site scripting can also be used to trick users into giving up this information as well. By uploading malicious scripts to a vulnerable web site, attackers can create a mock login area where visitors unknowingly send their information to the attacker.
* Stolen user sessions: using Cross-Site Scripting, attackers can steal a legitimate user’s session ID and manipulate it to gain access to their information.
* Being flagged as malicious by search engines: various vulnerabilities found in many web sites allow attackers to upload spam links to a site. Sites vulnerable to Cross-Site Scripting can also be exploited so that attackers can upload malicious scripts like Trojan horses, keystroke loggers, adware, spyware, and other malware. Once the search engines become aware of sites serving spam or malware, they are flagged as malicious and their page ranking drops.

The truth is, any web application is at risk. Whether it be a commercial application or a Free/Open Source application the potential for it to have vulnerabilities exists. Once these threats are known, attackers use well coordinated methods to seek out sites that are vulnerable and begin to launch their attack.
Preventing Web Application Attacks

Code reviews and vulnerability assessments are excellent ways to help seek out and patch known vulnerabilities in a web application. However, as solid as these two solutions are, they do raise two concerns.
Cost

Both code reviews and vulnerability assessments can be rather costly. One way a company can defray some of these costs is to perform these duties in house but this too may be expensive as personnel usually have to be trained in this practice. Additionally, having people dedicated to these tasks pulls them away from other duties. In smaller organizations, this may not be possible.
Zero-Day Exploits

Code reviews and vulnerability assessments work, but only against known vulnerabilities. Zero-day exploits are ones that have no patch because they have not yet been seen. Even the best reviewers and auditors cannot see into the future to recommend fixes for problems that don’t exist yet.
Web Application Firewalls

Web application firewalls are a perfect solution to the problems with code reviews and vulnerability assessments because they actively and constantly protect web applications against threats using Pattern Recognition to detect and thwart zero-day exploits and other evolving threats, Session Protection to help prevent impersonation, and a Signature Knowledgebase to block known vulnerabilities and known attackers.

With dotDefender web application firewall you can avoid many different threats to web applications because dotDefender inspects your HTTP traffic and checks their packets against rules such as to allow or deny protocols, ports, or IP addresses to stop web applications from being exploited.

Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against DoS threats, Cross-Site Scripting, SQL Injection attacks, path traversal and many other web attack techniques.

The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

* Easy installation on Apache and IIS servers
* Strong security against known and emerging hacking attacks
* Best-of-breed predefined security rules for instant protection
* Interface and API for managing multiple servers with ease
* Requires no additional hardware, and easily scales with your business

The Need to Avoid Attacks

Gartner research states that 75% of all attacks happen at the application layer. As more applications are designed to run in the browser, like Google Apps and the upcoming release of Microsoft Office, and more apps are designed to run in the cloud the odds that a company’s data is vulnerable to a number of threats multiplies with each passing day.

Leaving data exposed like this is expensive. The 2003 attack against TJ Maxx cost between $500 million to $1 billion in lost income and fines. Add to this the fact that their stock fell roughly 66% and it is easy to see just how lost income is not the only way a compromised site can hurt a business’ bottom line. Small web sites are not immune to this threat. While they may not stand to have millions of dollars stolen, they are prime targets for cyber criminals who use these sites as a launching pad for malware distribution and other scams. The sites that serve as unknowing hosts to these criminals soon find their reputation ruined as they are flagged as malicious, and once their visitors are infected they rarely return.

Web application firewalls directly address these threats by examining incoming requests when they are opened by the web server. From here, the web application firewall is able to see the request exactly as the web server sees it allowing it to stop any malicious attempt in an efficient and timely manner.

When looking for a web application firewall solution, it is important to keep certain criteria in mind:

* Does the WAF provide protection to applications running on both public facing web sites and internal web sites?
* Does it support multiple web server software and operating systems?
* Does it provide out-of-the box protection?
* Does it update automatically?
* Does it integrate with other security systems?
* Is it easy to maintain?
* Is it easy to manage?

Protect Your Web Applications With dotDefender

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing the request and the impact it has on the application. Effective web application security is based on three powerful web application security engines: Pattern Recognition, Session Protection and Signature Knowledgebase.

The Pattern Recognition web application security engine employed by dotDefender effectively protects against malicious behavior such as the attacks mentioned above, and many others. The patterns are regular expression-based and designed to efficiently and accurately identify a wide array of application-level attack methods. As a result, dotDefender is characterized by an extremely low false positive rate.

What sets dotDefender apart is that it offers comprehensive protection against threats to web applications while being one of the easiest solutions to use.

In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.

Prevent SQL Injection Attacks

2011-01-20T00:01:00.000-08:00

Coming in at number one in the OWASP Top Ten Most Critical Web Application Vulnerabilities are injection attacks, and SQL Injection vulnerabilities are the most common and most dangerous in this category. SQL injection is a technique that exploits vulnerable web sites by inserting malicious code into the database that runs it.

What makes the threat of SQL injection attacks so dangerous is the ease in which they can be launched and how many web sites are vulnerable to them.
Attackers often use large botnets to systematically seek out vulnerable web sites to attack with little work being done on their part. Pair this with the fact that the number of sites vulnerable to this type of attack grows each year and it is clear to see why it remains at the top of the most critical vulnerabilities.

Risks Associated with SQL Injection

Even with the ease that an automated SQL injection attack can be carried out, if the attackers stood to gain nothing this threat would soon disappear. Unfortunately, those who successfully compromise vulnerable web sites can find that this vulnerability can be quite profitable as they give the attacker access to the database so information can be sold or data can be deleted. More advanced techniques can also be used to give the attacker unrestricted access to the system through a backdoor. SQL injection can also be used in tandem with other exploits, such as cross-site scripting, to manipulate how data is displayed to a web site’s visitors.
Not preventing SQL Injection attacks leaves your business at great risk of:

Changes to or deletion of highly sensitive business information.
Steal customer information such as social security numbers, addresses, and credit card numbers.
Financial losses
Brand damage
Theft of intellectual property
Legal liability and fines

Preventing SQL Injection Attacks

With dotDefender web application firewall you can avoid SQL injection attacks because dotDefender inspects your HTTP traffic and determines if your web site suffers from SQL Injection or other attacks stopping identity theft and preventing data leaks from web applications.
Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against SQL Injection attacks, cross-site scripting, website defacement and many other web attack techniques.
The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

Enterprise-class security against known and emerging hacking attacks
Central Management console for easy control over multiple dotDefender installations
Supports multiple platforms and technologies - IIS, Apache, Cloud ...
Open API for integration with management platforms and other applications
Solutions for Hosting, Enterprise and SMB/SME

How does an attacker compromise your SQL server?

Before a web site can be compromised, an attacker needs to find applications that are vulnerable to SQL injection using queries to learn the SQL application methods and its response mechanisms.
The attacker has two ways to identify SQL injection vulnerabilities:

Error messages: the attacker constructs the correct SQL syntax based on errors messages propagated from the SQL server via the front-end web application. Using the errors received, the hacker learns the internal SQL database structure and how to attack by injecting SQL queries via the Web application parameters.
Blindfolded Injection: this technique is utilized by hackers in situations where no error messages or response content is returned from the database. In these cases, the attacker lacks the ability to learn the backend SQL queries in order to balance the SQL injection query. In the lack of database content output within the Web application, the attacker is also challenged with finding a new way of retrieving the data.

Identifying the database

When the attacker knows how each database is reacting he or she can identify the database type and the server that is running it.
There are several techniques the attacker uses to identify database objects in a SQL statement.

Using a concatenation string:
select f1+f2
from t1
Using a semicolon or cash sign ($)

Compromising the SQL server

Once the attacker has all information he can build the exploit code.
Some techniques used to execute SQL Injection attacks are:

Terminating queries using quotes, double-quotes, SQL comments
Using stored procedures
Database manipulation commands such as TRUNCATE, DROP
Using CASE WHEN, EXEC to run nested queries
Utilizing SQL injection to create Buffer Overflow attacks within the database server
Delivering SQL queries via XML and Web Services
Blindfolded SQL Injection techniques:
- Blindfolded injection techniques using Boolean queries and WAITFOR DELAY
- Comparison queries using commands such as BETWEEN, LIKE, ISNULL
IDS signature evasive SQL Injection techniques:
- Using CONVERT & CAST commands to mask the attack payload Using Null bytes to break the signature pattern
- Using HEX encoding mixtures
- Using SQL CHAR() to represent ASCII values as numbers

For example, the attacker decides to go with a basic attack using:
1 = 1--
What happens when this is entered into an input box is that the server recognizes 1 = 1 as a true statement. Since -- is used for commenting, everything after that is ignored making it possible for the attacker to gain access to the database. You can see precisely how this attack works on our SQL injection example page.

The Need to Avoid SQL Injection Attacks

SQL injection techniques have been around for over 10 years now, but recent years have seen a dramatic increase in both number of attacks and the extent of damage caused by them. In fact, a sweep of attacks in the second quarter of 2008 alone resulted in over 500,000 exploited web pages that were compromised to deliver password-stealing malware to users' computers. In more recent studies, security firms report attempted attacks reaching totals of 450,000 per day.
The tragedy is that these threats can be mitigated, or even prevented, with the proper tools and knowledge.
The attacker identifies vulnerabilities and obtains database access SQL (Structured Query Language) provides an interface to facilitate access to and interaction with a database. A database usually stores data in tables and procedures.
SQL Injection is a security exploit method in which the attacker aims at penetrating a back-end database to manipulate, steal or modify information in the database. The SQL Injection attack method exploits the Web application by injecting malicious queries, causing the manipulation of data. Almost all SQL databases and programming languages are potentially vulnerable and over 60% of websites turn out to be vulnerable to SQL Injection.
The threat posed by SQL injection attacks are not solitary. Combined with other vulnerabilities like cross-site scripting, path traversal, denial of service attacks, and buffer overflows the need for web site owners and administrators to be vigilant is not only important but overwhelming.

Protect Yourself from SQL Injection Attacks

What types of SQL Injection attacks does dotDefender block?

dotDefender blocks against various SQL Injection techniques including, but not limited to:

Terminating queries using quotes, double-quotes, SQL comments
Stored procedure names
Comparison queries using commands such as BETWEEN, LIKE, ISNULL
Database manipulation commands such as TRUNCATE, DROP
Reserved words such as CASE WHEN, EXEC
Blindfolded injection techniques such as Boolean queries and WAITFOR DELAY
Database-unique attacks relating to Oracle, MySQL, MS-SQL
Signature evasion techniques such as using CONVERT & CAST
Buffer overflow attacks via SQL Injection
XML and Web-Services encapsulating SQL Injection techniques
Null byte signature evasion
HEX encoding mixtures for signature evasion
Using SQL CHAR() for signature evasion
Zero-day protection against MS-SQL stored procedure attacks such as MS08-040

What sets dotDefender apart is that it offers comprehensive protection against SQL injection and other attacks while being one of the easiest solutions to use.
In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.

IIS Website Security

2011-01-19T23:59:00.000-08:00

For years, Microsoft has had to contend with the impression that their products were not as secure as their counterparts. This was especially true when it came to Internet Information Services (IIS), the Microsoft web server. Much of the issues associated with ISS were related to the fact that many of the services were enabled by default.

Right out of the box, IIS could run as a fully functional web server without much need to configure various services. Unfortunately, attackers knew this and were able to compromise servers, and web sites, that relied on IIS because many of the administrators who installed the software were not aware of what steps they needed to take to secure this application.
Much has changed over the years. In response to an increase in web-based application attacks, Microsoft made attempts to increase security in all of their products, including IIS. In version 6, they rolled out what was referred to as a lockdown by default approach where many features and services were left out, or disabled, in the default installation. They were still available, however the administrator had to enable or install them giving them full knowledge that they were running. In version 7, this approach changed again to take on a minimum install approach where only the bare minimum components are installed giving attackers a much smaller surface to work from.

Risks Associated with IIS

Despite the strides taken to protect IIS 7 from attacks, there are still risks that a web administrator needs to be aware of if they are running this application as their web server - this is what makes using a WAF (Web application firewall) so appealing. Unfortunately, some of the things that make Microsoft’s IIS so appealing are also some of the issues that anyone using it needs to be aware of.

It is a Microsoft product

It is not insecure because it is a Microsoft product, but the fact that Microsoft still makes things easier for administrators still makes it a target. IIS can be installed and run on Server 2008 Core, which uses a command line interface rather than Windows. In this environment, the server is much more secure. However, when Windows is used the temptation to make use of Internet Explorer to connect to the web is far too great and happens far too often. When servers are allowed to access the web, they are put at risk. Windows makes it too easy for a lazy admin to simply fire up IE to find something from their server rather than a workstation.

It is too easy to install software

One of the biggest threats to security is a web application. Odds are that most servers using IIS are using Windows. In a Windows environment, it is far too easy to install web applications like WordPress, Joomla!, or ZenCart. Although this is a huge selling point, it also poses a risk because if the web administrator does not have background knowledge related to the vulnerabilities that are present in these, or any other web application, then they may unknowingly be installing insecure software onto their server.
Of course, this can be true of applications installed via a command line interface or GNU/Linux shell as well, however odds are that if a person is adept at using these tools, they are more aware of basic security risks as well.

Malware

Unfortunately for Microsoft, many web admins still remember what the Code Red and Nimda worms did to web servers using IIS. Defacing web sites, hitting them with Denial of Service attacks, and exploiting path traversal vulnerabilities.
Due to Microsoft’s market share, it will always be a preferred target for malware attacks. Even as engineers work to patch known vulnerabilities, the thousands of pieces of malware being released into the wild every day that pose significant threats to any server running Microsoft.

Protecting IIS

Like any server, certain steps need to be taken to harden the operating system against attacks. While malware prevention, Intrusion Detection/Prevention Systems, network firewalls, and all of the other tools and techniques help prevent some attacks, they don’t adequately prevent attacks launched against any third-party applications that have been installed on the server.
dotDefender protects IIS web servers against a variety of vulnerabilities to include:

Path Traversal
Known worms
Remote Command Execution
Probes
Denial of Service attacks
Compromised servers

By acting as a Security-as-a-Service solution, dotDefender is able to provide protection to web servers whether the admin has an extensive background in security or just a minimal amount of knowledge on the subject.
With dotDefender web application firewall you can avoid many different threats to web applications because dotDefender inspects your HTTP traffic and checks their packets against rules such as to allow or deny protocols, ports, or IP addresses to stop web applications from being exploited.
Architected as plug & play software, dotDefender provides optimal out-of-the-box protection against DoS threats, Cross-Site Scripting, SQL Injection attacks, path traversal and many other web attack techniques.
The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

Strong security against known and emerging hacking attacks
Best-of-breed predefined security rules for instant protection
Interface and API for managing multiple servers with ease
Requires no additional hardware, and easily scales with your business

The Need to Avoid Attacks

Whether your web server is running IIS or Apache makes little difference. With hundreds of millions of dollars being stolen each year by cyber criminals vulnerabilities will continue to be a problem as known ones are exploited and new ones emerge.
In addition to money and data stolen as a result of compromised servers and web sites, businesses have to contend with a damaged reputation after an attack. When a breach of security occurs, customers and visitors second guess visiting that site if they know that they are not safe. Once the search engines find malware or spam on a web site, it can be flagged as malicious and removed from the search engine results page causing a loss in legitimate traffic.

Protect Your Web Applications With dotDefender

dotDefender's unique security approach eliminates the need to learn the specific threats that exist on each web application. The software that runs dotDefender focuses on analyzing the request and the impact it has on the application. Effective web application security is based on three powerful web application security engines: Pattern Recognition, Session Protection and Signature Knowledgebase.
The Pattern Recognition web application security engine employed by dotDefender effectively protects against malicious behavior such as the attacks mentioned above, and many others. The patterns are regular expression-based and designed to efficiently and accurately identify a wide array of application-level attack methods. As a result, dotDefender is characterized by an extremely low false positive rate.
What sets dotDefender apart is that it offers comprehensive protection against threats to web applications while being one of the easiest solutions to use.
In just 10 clicks, a web administrator with no security training can have dotDefender up and running. Its predefined rule set offers out-of-the box protection that can be easily managed through a browser-based interface with virtually no impact on your server or web site’s performance.

How Hacking Attacks Work

2011-01-19T23:57:00.000-08:00

Given the amount of sensitive and financial information that is transmitted over the Internet every hour, it would be an obvious choice for cyber criminals to conduct their illegal activities. Yet in addition to the amount of traffic, the proliferation of insecure web applications makes web based hacking attacks even more attractive, and even more profitable.
Breaking into computer systems for malicious intent is nothing new. Since the early eighties skilled computer enthusiasts, or hackers, have used their knowledge to break into systems with no redeeming intent. However with the advent of web based applications, the sophistication of hacking attacks has dramatically increased while the amount of skill required to carry out these attacks has proportionately lessened.
Malicious hackers nowadays can make use of a number of tools that help them automate their attack. Using scanning tools the attacker is able to perform the first step of their attack, enumeration. In this phase information is gathered regarding the intended target. With specific tools, the attacker can scan multiple computers, routers, servers, and web sites at once looking for specific information that will help them easily attack the machine. Add to this the ability for the attacker to conduct the enumeration process with an army of zombie computers and the number of vulnerable systems that they can identify rises exponentially depending upon the size of the botnet they control.
Once the targets have been identified the attacker continues to analyze the targets looking for known vulnerabilities. Depending on what the overall goal of the attacker is, they could be searching for any number, or combination, of vulnerabilities in which to exploit. These can include, but are not limited to:

Cross-Site Scripting
SQL Injection
Remote File Execution
Denial of Service
Path Traversal
And many others

Once the vulnerabilities are identified, the attacker can move into the last stage of their attack, exploiting the computers.
Using the information found in the vulnerability analysis, the attacker then attempts to exploit the target computers. Again, this process can be automated like the others, and when launched from a large botnet army the attacker can exploit thousands of victims with minimal effort on their part.

Effects of Hacking Attacks

Hacking attacks can have detrimental effects on the victim. These effects vary according to the type of attack the hacker launched and what the target of their attack is. Unfortunately for many Web Sites, there are multiple ways to exploit them.

Malware that infects desktop computers can reveal administrator credentials or FTP credentials. These credentials can then be used to access the web site, web server, and even other resources on a companies network.
Vulnerabilities in the server operating system can provide a hacker access to the files that make up the web site. The web site can then serve spam or malicious files to innocent visitors. Sites that are found to do this, even if they are not aware, can be flagged as malicious by the search engines and even removed from the Search Engine Results Page.
Web applications that power dynamic web sites present multiple ways for an attacker to exploit a site and connect to the web site’s data base. Data bases that contain financial or personal information can then be farmed to later be used for credit card fraud or identity theft.
Denial of Service attacks can cause a disruption in web services. If any essential business processes are run over the Internet, these can cease to function as well.

The Need to Protect Against Hacking Attacks

When a web site or network is attacked, the blame falls on the owner. It is their responsibility to ensure that any service or application that they are running is protected against the vulnerabilities that can be used to exploit their property, and that includes their web site.
To protect customers and employees from having their financial or private information from being stolen, both industry and governments have implemented regulations with the intent of securing against common hacking attacks. To combat credit card fraud, the Payment Card Industry created the Data Security Standard that requires merchants who process credit cards to take specific measures that help protect against hacking attacks. The European Union, United Kingdom, United States, and Canada are among the governments that have also instituted privacy acts meant to regulate how businesses protect their customer and employee data from malicious hackers.
In addition to the fees and legal ramifications that can come as a result of failing to comply with the different regulations, hacking attacks can also damage a company’s reputation to the point that they lose customers and revenue. A company who is in the news because they have been hacked is sure to lose the trust of even their most loyal customers. The same happens with web sites that are identified as containing spam or malicious scripts. Once this is known, most visitors will stay away. And if losing traffic wasn’t bad enough, but once the search engines have identified as site as malicious their placement in the search engine falls dramatically rendering any Search Engine Optimization work essentially useless until the problem is corrected.

How Does dotDefender Helps to Protect Against Hacking Attacks?

IBM’s X-Force Trend report stated that, “Web applications remain the Achilles heel for the security industry”. With over 80% of all web sites having contained at least one vulnerability, web application security needs to be addressed by any company with a web presence as protecting web applications not only helps to protect your web site from attack, but also can protect your web servers and any other network resources that access them.
dotDefender enables companies to address challenges facing their web site in a straightforward and cost-effective manner by utilizing a Security as a Service solution. dotDefender offers comprehensive protection against the vulnerabilities that hacking attacks use against your web site every day.
The reasons dotDefender offers such a comprehensive solution to your web application security needs are:

Easy installation on Apache and IIS servers
Strong security against known and emerging hacking attacks
Best-of-breed predefined security rules for instant protection
Interface and API for managing multiple servers with ease
Requires no additional hardware, and easily scales with your business

Architected as plug & play software providing optimal out-of-the-box protection, dotDefender creates a security layer in front of the application to detect and protect against application-level attacks in incoming web traffic that could be used to compromise the web server, steal sensitive information, or disrupt web services.