Teknik Web Deface dan Cara Pencegahannya

Published on http://batampos.co.id/content/view/31768/98/
Beberapa minggu lalu, ketika masalah pemukulan warga negara Indonesia oleh polisi Malaysia, dunia internet Indonesia ramai oleh kelakuan para hacker merusak tampilan situs-situs yang berdomain Malaysia.

Juga beberapa bulan lalu ketika krisis Ambalat berlangsung, kedua kubu saling serang web deface.
Deface adalah teknik mengganti atau menyisipkan file pada server, teknik ini dapat dilakukan karena terdapat lubang pada sistem security yang ada di dalam sebuah aplikasi.

Defacer website dapat merubah tampilan sebagian atau seluruhnya tergantung kemauan defacer dan lubang yang bisa dimasuki, namun jika dia sudah putus asa, defacer akan melakukan denial of servis (DoS) attack yaitu mengirimkan request palsu pada server yang berlebihan sehingga kerja server lambat dan lama-kelamaan server akan crash dan down. Untuk dapat melakukan web deface, defacer melakukan beberapa tahap sebagai berikut :

a. Mencari kelemahan pada sistem security, menemukan celah yang dapat dimasuki untuk melakukan eksplorasi di server target. Dia akan melakukan scanning tentang sistem operasi, service pack, service yang enable, port yang terbuka, dan lain sebagainya. Kemudian dianalisa celah mana yang bisa dimasuki.
b. Melakukan penyusupan ke server korban. Teknik ini dia akan menggunakan beberapa tools, file yang akan disisipkan, file exploit yang dibuat sengaja untuk di-copy-kan. Setelah berhasil masuk , tangan-tangan defacer bisa mengobok-obok isi server.
Tapi tidak adil kiranya jika hanya sharing tentang teknik deface web. Maka untuk pengelola situs harus waspada, karena deface bisa jadi bencana yang sangat merepotkan. Pekerjaan menata ulang dan memperbaiki bagian yang rusak, bukan pekerjaan yang mudah. Karena itu sebelum situs anda digerayangi seyogyanya melakukan langkah-langkah preventif sebagai berikut :
1. Rutin melakukan update, upgrade dan patch pada sistem operasi dan aplikasi-aplikasi yang dipakai.
2. Memeriksa ulang dan memperbaiki konfigurasi pada sistem operasi, web server dan aplikasi lainnya.
3. Menganalisa kembali service-service yang aktif, matikan jika tidak perlu.
4. Mengatur jadwal untuk melakukan backup data penting, file konfigurasi sistem, database, sehingga jika sewaktu-waktu terjadi deface, anda tinggal menggunakan data backup.
5. Melindungi server dengan firewall dan IDS. Kedua tools ini ampuh untuk mengatasi serangan denial of service(DoS) attack.
6. Selalu memperhatikan hal-hal yang mencurigakan pada server, baca log system operasi, log web server ataupun log aplikasi.
7. Melakukan vulnerability scanning secara rutin, juga melakukan private security test.
Demikian beberapa trik, baik melakukan deface (meskipun tak secara detail/teknis) maupun menangkal deface. Semoga website anda aman dari serangan para hacker

Apex, Oracle Free edition

What is Application Express?

Oracle Application Express (Oracle APEX), formerly called HTML DB, is a rapid web application development tool for the Oracle database. Using only a web browser and limited programming experience, you can develop and deploy professional applications that are both fast and secure. Oracle application express combines the qualities of a personal database, productivity, ease of use, and flexibility with the qualities of an enterprise database, security, integrity, scalability, availability and built for the web. Application Express is a tool to build web-based applications and the application development environment is also conveniently web-based. You can try Application Express simply by signing up for an account at apex.oracle.com.

Application Express Home Page

No client software is required to develop, deploy, or run Application Express applications. Application Express provides three primary tools: Application Builder - to create dynamic database driven web applications SQL Workshop - to browse your database objects, run ad-hoc SQL queries, as well as a graphical query builder Utilities - allows for data to be loaded and unloaded from both flat files and spreadsheets

What types of applications can you build with Application Express?

Application Express is a productive tool to build applications that report on database data. Reports are typically hyper text linked with other reports allowing users to navigate through database data in the same way they navigate web sites. Columns in reports can be easily linked to other reports, charts, and data entry forms and it is all done declaratively. An extensive charting engine allows SQL queries to be represented graphically and that allows data to be more effectively communicated. Application Express is also very adept at editing database data and supports a large number of declarative form controls including radio groups, checkboxes, select lists, shuttles, text editors, and date pickers.

Hyper Text Linked Report Hyper Text Linked Chart Data Entry Form

When to use Application Express?

Due to its ease of use, Application Express is designed to build opportunistic and departmental applications quickly. These application are deployed on the web with superior performance. Historically, departments, prototypes, and small projects have relied on desktop databases to provide an agile development tool for these smaller scale SMB or departmental application development needs. Desktop databases can become very fragmented because they keep data in too many places, they can be vulnerable or inappropriate for use with sensitive information, and they are typically not web friendly. The browser based design time interface, the declarative programming framework, and simple wizards make Application Express a natural replacement for multi-user desktop databases applications such as Microsoft Access.SQL Savvy application developers also appreciate the ease with which you can create database applications with little or no web experience. You don’t need to learn scripting languages or complex deployment frameworks, you simply write a few queries and choose from ready built user interface themes and form controls to create highly professional, secure, and scalable applications.

Declarative Programming

With Application Express, coding is declarative. That means that no code is generated, no code is compiled, and you interact with wizards and property sheets. The SQL language is used to define reports and charts, so some knowledge of SQL is very helpful. You can optionally write snippets of code using PL/SQL, if procedural logic is needed. Declarative code yields fewer differences between developers and this consistency makes Application Express applications easy to maintain and manage.

Architecture

The Application Express engine renders applications in real time from data stored in database tables. When you create or extend an application, Oracle Application Express creates or modifies metadata stored in database tables. When the application is run, the Application Express engine then reads the metadata and displays the application. Application Express lives completely within your Oracle database. It is comprised of nothing more than data in tables and large amounts of PL/SQL code. The essence of Oracle Application Express is approximately 215 tables and 200 PL/SQL objects containing 300,000+ lines of code.To provide stateful behavior within an application, Oracle Application Express transparently manages session state in the database. Application developers can get and set session state using simple substitutions as well as standard SQL bind variable syntax.

Application Express Architecture Diagram

Key Features

The sections that follow describe key features of Oracle Application Express.Reporting With Oracle Application Express, you can quickly generate HTML reports that display the results of SQL queries. You can also download and print reports in HTML, PDF, RTF (compatible with Microsoft Word), and XLS (compatible with Microsoft Excel) formats. You can declaratively link reports together to provide drill-down reporting and use bind variables to pass information from session state to a report. Reports support declarative column heading sorting, control breaks, sums, and pagination. Report sorting and pagination can use Partial Page Refresh (PPR) technology to avoid refreshing the entire page. You can also add declarative links to a report to download the report data to CSV or XML formats. Plus, you can customize the report appearance using templates. Forms Using wizards, you can easily create forms on tables or on a stored procedure. When creating a form on a table, these wizards provide automatic management of insert, update, and delete as well as lost update detection. Once you create a form, you can rearrange form fields (called form items) using a visual representation, enabling you to quickly achieve the layout you want. Form items offer a variety of display options including text fields, text areas, radio groups, select lists, check boxes, date pickers, and popup list of values. Run Download Charting You can also use wizards to create HTML, SVG, or Flash charts. You can create charts that enable users to drill down from one chart to another chart or report. Charts can also be refreshed using Partial Page Refresh (PPR) technology, avoiding the need to refresh an entire page. You can also configure a chart to refresh at defined intervals. Additionally, you can take advantage of report column templates to add simple HTML bar charts to any report. Run Download PDF Printing As of Application Express 3.0, you can include the ability to export a report region to PDF - essentially, printing a report. A custom link or button can be added to any report region. You can also define Report Queries and Report Layouts under Shared Components. These are custom reports that can be linked anywhere within an application. Run Download

Web Services The Application Express Web services engine supports loosely defined types and document style Web services. This makes it possible to support JDeveloper created Web services and Oracle BPEL synchronous Web services. It is also possible to interact with Web services over SSL (HTTPS) and Web services that require basic authentication. Finally, there is also support for manually creating a Web service reference if the Application Express engine cannot correctly parse the WSDL document for a particular service. You supply the SOAP request envelope and the URL endpoint among other information about the Web service.Spreadsheet Upload Use the Create Application from Spreadsheet Wizard to quickly upload spreadsheet data directly into the database. You can choose to store the data in a new database table or add it to an existing database table. Once the data is uploaded, you can quickly create an application. This handy wizard enables you to go from spreadsheet to a shared application in just a few clicks. Session State Management Oracle Application Express transparently manages session state (or application context) in the database. Forms automatically save session state, remembering your application context over your session. Referencing session state within SQL and PL/SQL is as simple as using bind variables. For example, consider the following SELECT statement: SELECT * FROM EMP WHERE EMPNO = :P1_ID In this example, the value in the item P1_ID is automatically bound when the query is run. You can also reference session state within a static context by prefixing the item name with an ampersand (&amp and suffixing it with a period(.), for example: &P1_NAME. For management of two dimensional data sets, Oracle Application Express provides a robust collections infrastructure. Best of all, session management is stateless and does not consume any memory. User Interface Themes Oracle Application Express separates presentation (or user interface themes) from the application logic. You can design your application in one theme, change to another supplied theme, or create and use your own custom theme. By separating the application logic (such as queries, processes, and branches) from the HTML rendering, your application can take advantage of new designs and other technological advances without an application rewrite. Flow Control and Navigation Every Web application needs navigation and dynamic applications need flow control. Oracle Application Express provides built-in components to simplify the development and maintenance of navigational controls. Navigation is controlled using declarative tabs (one or two levels), breadcrumbs, tree controls, and lists of links. Flow control is performed using declarative branches that can take effect at specific events and under certain conditions. The appearance of navigation controls are managed through templates, making it easy to change from one look to another. Conditionality on All Components When creating dynamic Web applications, many application components and processing are conditional. In other words, you only show or process certain pieces of information based on the application context, the data, an event, or a privilege. Oracle Application Express enables you to declaratively specify conditionality of all components. This gives you exact control over what users see or do not see on a tab, button, item, list entry, and so on. External Interfaces and Extensibility Even though Oracle Application Express provides a robust declarative environment for building applications, you also have the option of developing custom interfaces or controls. For example, if a component does not meet the needs of your environment, you can generate your own custom HTML using PL/SQL. You can also call external services using Web services. Oracle Application Express also includes APIs to easily integrate email alerts into an application. Plus, because Oracle Application Express resides in the Oracle database, you can take advantage of inherent database capabilities, including external tables, PL/SQL, database links, gateways, and database Java to extend the functionality of your application. Security With Oracle Application Express, you can create public applications that do not require a user log in, or you can create secure applications that require authentication. Oracle Application Express provides a number of built-in authentication schemes including Single Sign On, Database Account Credentials, and an easy-to-use user management system. You can also use custom schemes that interface with just about any authentication service including Microsoft Active Directory and Oracle Applications. Additionally, you can customize authorization to meet the needs of your environment and apply authorization selectively to an entire application, a page, or a page component. Finally, you can also take advantage of an innovative session state protection feature to prevent URL tampering and built-in features to protect an application form SQL Injection and cross-site scripting (XSS) attacks. SQL Workshop Tools SQL Workshop provides tools to enable you to view and manage database objects from a Web browser. Use SQL Commands to run SQL and PL/SQL statements. Query Builder enables you to define queries by dragging and dropping tables and easily create relationships between objects. Object Browser provides an easy-to-use graphical user interface for viewing, creating, modifying, browsing, and dropping database objects. Finally, you can use SQL Scripts to create, edit, view, run, and delete script files. Supporting Objects Utility You can simplify the steps needed to export and install an application in another Oracle Application Express by creating a packaged application. Using the Supporting Objects utility, you can bundle the application definition with scripts for creating the database objects, seed data, images, cascading style sheets, and JavaScript. Creating a packaged application provides application users with an installer-like experience and automates the process of importing and installing an application in another development, test, or even production instance. Performance Oracle Application Express provides application developers and application users with an extremely high level of performance. Because Oracle Application Express resides in the Oracle database, it has minimal impact on network traffic. Plus, Application Builder includes a large number of monitoring reports to enable you to identify and tune application performance. Packaged Applications Packaged Applications are fully functional applications that you can use and customize. Packaged applications not only illustrate interesting examples of Oracle Application Express applications, but they provide immediately useful tactical business applications. Packaged applications are ready-to-run - they come complete with database schema, seed data, images, application definitions, everything you need and installation is via a simple to use wizard.

Packaged Applications

Hosted Development Oracle Application Express enables a single database to host large numbers of users. Users work in a dedicated work area called a workspace. This flexible architecture enables a single database instance to manage thousands of applications.You determine how the process of provisioning (or creating) a workspace works. In request provision mode, users request a workspace using a link on the login page. After the workspace request has been granted, users receive an email containing a link that they must click to verify the validity of their email address. Then they receive an email with their login credentials.