September 2019

What is a WebRTC leak? What is the WebRTC technology?

<h1 style="font-family: "OpenSans Bold"; line-height: initial;">What is a WebRTC leak?</h1><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">A WebRTC leak, like a DNS-leak, is the capability to get your real address even while you are using some anonymization services.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">What is the WebRTC technology?</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">WebRTC (Web Real-Time Communication) is a technology that allows you to organize the flow of data between browsers. It is currently supported by Firefox and Chrome, as well as all browsers that are based on Chrome. The technology basically allows voice and video communication in browsers.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The leak of the IP address (local and external) occurs by calling the command using WebRTC. Typically, this command is called by javascript.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">There are two solutions for this problem - prohibiting the execution of all scripts in the browser and/or disabling the WebRTC technology in the browser.</div>

What is a WebRTC leak? What is the WebRTC technology?

What is a WebRTC leak? A WebRTC leak, like a DNS-leak, is the capability to get your real address even while you are using some anonymizatio...

6:24 PM

What is a Subnet Mask? How it works?

<h1 style="font-family: "OpenSans Bold"; line-height: initial;">What is a Subnet Mask?</h1><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">There are two elements every IP address consists of: one element represents the network address, and the other one represents the host address. There is a ‘tool’ (that is a number) called a subnet mask that specifies which part of an IP address to use in order to define the network ID.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">Subnetting</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">A subnet mask divides the IP address into the network address— ‘masking’ or hiding it — and host address. The host part then can be divided into a subnetwork (or a subnet), and host address, in case there is a need for additional subnetwork to boost performance and security of the network.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Systems that are in the same subnet are able to interact directly with each other without additional permission or equipment, while different subnet systems can’t communicate directly — they have to interact via a router. Therefore, subnets are also essential for separating multiple networks and restricting the traffic between them.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">How it works</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Let’s have a look at an IPv4 subnet mask. It consists of four bytes (32 bits) and is written the same way as an IP address of this version — a string of groups of decimal numbers each separated by a full stop. A subnet mask works by setting all the bits of the network to 1s and all the bits of the host to 0s. This transformation allows router not to handle the whole 32-bit address but to look only at the bits chosen by the mask, translating the sequences of eight binary 1s to 255.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">The way it looks</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">There are several network classes such as Class A, B, and C, usually consisting of 8-, 16-, and 24-bits correspondingly, which use slightly different subnet masks. For instance, 255.255.255.0 is the subnet mask commonly used for Class C IP addresses.</div><img class="text-image" src="https://whatismyip.li/images/subnet-mask/subnet-mask-img.png?cb=041" style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px; height: 138.24px; width: 288px;" /><span style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"></span><br /><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">When a subnet mask is applied to an IP address, a bitwise logical AND operation is performed, and as a result, the network address is produced. Let’s take 216.4.128.13 IP address and apply a subnet mask to it:</div><ul style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"><li>IP address: 1101 1000 . 0000 0011 . 1000 0000 . 0000 1100 (216.004.128.013)</li><li>Subnet mask: 1111 1111 . 1111 1111 . 1111 1111 . 0000 0000 (255.255.255.000)</li><li>Network address: 1101 1000 . 0000 0011 . 1000 0000 . 0000 0000 (216.004.128.000)</li></ul><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"></div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">With the help of subnet masks, organizations can subdivide public IP address blocks to get more IP addresses required for ensuring efficient work process, while they don’t have to get new IP network numbers from an Internet Service Provider (ISP).</div>

What is a Subnet Mask? How it works?

What is a Subnet Mask? There are two elements every IP address consists of: one element represents the network address, and the other one re...

6:19 PM

What is an ISP? What are you know?

<h1 style="font-family: "OpenSans Bold"; line-height: initial;">What is an ISP?</h1><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">ISP is short for Internet Service Provider, a company in your area that supplies you with access to the Internet and related services through several types of connection. There is a great number of ISPs throughout the world that offer various types of plans and fees, and the most well-known is AT&T, Verizone, Comcast Xfinity, etc. By the way, it is an ISP who provides you with an IP address - an identifier used while surfing the Internet.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">Performance chain</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">When you make a request to open a web page or download a file through your connected to the Internet device, a whole chain of events occurs. First, the web browser you are using (e.g., Google Chrome, Mozilla Firefox, Internet Explorer, Safari, etc.) uses DNS servers to translate the alphabetic address of your request into its IP address. Then this IP address is sent from your router to your ISP, which in turn forwards it to the ISP of your request destination, and only then, in reverse order, the data you are searching for travels back to your device. However, it takes just a few seconds to perform this complicated process.</div><img class="text-image" src="https://whatismyip.li/images/ips/ips-img.png?cb=041" style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px; height: 191.906px; width: 288px;" /><span style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"></span><br /><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">Types of ISPs</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">With the continuous improvement of technologies, the types of Internet Service Providers have grown in order to provide faster, better, and more reliable Internet. There are Dial-Up, DSL, cable, wireless, and satellite ISPs.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The Dial-Up Internet connection was one of the very first ways of using the Internet and the slowest one. Users need a modem in order to connect to a remote server via a telephone line. The problem users experienced using the Dial-Up method was that being connected to the Internet, no one could get through – the phone-line was occupied. And when someone used a phone, the connection was broken.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The Digital Subscriber Line (DSL) connection is usually provided by a phone company, whose users need a DSL router to be able to access the Internet. The connection is carried out with the help of the extra signals that do not interfere with phone signals. Today this method is widespread, affordable, and much faster than the Dial-Up method.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Cable ISPs are often companies that provide internet access and television together, using electric or fiber optic cabling (the latter transmits the signal using pulses of light and is highly efficient, durable, and fast). As this method has become as common as Dial-Up and DSL connection, some phone companies (which are DSL ones) have begun to provide cable services as well.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Wireless Internet Service Providers (WISPs) provide wireless internet access, which has been getting more and more popular as it doesn’t require such cumbrous equipment as other methods do. However, today wireless speeds are usually lower, comparing to other methods, and there can be connection interruptions due to a big distance between the ISP and the device connected to the Internet.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Another, a less common and much more expensive way, is providing internet access through a satellite in near-earth orbit. This method is usually used in remote areas where it is difficult or impossible to use cable or DSL services. Although its speed is about the same as the speed of the abovementioned services, there is often a cap of the amount of data that can be used per month.</div>

What is an ISP? What are you know?

What is an ISP? ISP is short for Internet Service Provider, a company in your area that supplies you with access to the Internet and related...

6:14 PM

What is IPv6?

<h1 style="font-family: "OpenSans Bold"; line-height: initial;">What is IPv6?</h1><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Internet Protocol version 6 (IPv6) is the latest version of Internet Protocol (IP) — a network layer protocol providing computers and other devices on networks with a location and identification system as well as routing traffic over the Internet.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">IPv4 is the predecessor of IPv6, which is still widely used but, due to the shortfall of IP addresses available under it, it was decided to develop an updated version to be able to ensure required number of IP addresses, which is continuously growing due to the increase of the number of devices connected to the Internet.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The most significant improvement in IPv6 is the lengthening from 32 bits to 128 bits. IPv4 uses a 32-bit addressing scheme that can provide about 4.3 billion devices (it was expected that the Internet would have run out of all unique IPv4 addresses by 2010). While IPv6 uses 128-bit addressing capable of providing near 3.4×1038 addresses (which is enough to assign an IPv6 address to each atom of our planet and even to more other planets).</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">IPv6 address consists of eight strings or groups, each containing four alphanumeric characters, separated by colons (e.g., 2001:0db8:0000:0042:0000:8a2e:0370:8899). While IPv4 looks different — it is represented as four groups of three digits with each group separated by dots (e.g., 201. 201. 201. 201).</div><img class="text-image" src="https://whatismyip.li/images/ipv6/ipv6-img.png?cb=041" style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px; height: 192px; width: 288px;" /><span style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"></span><br /><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Another improvement of IPv6 is that it supports auto-configuration that allows correcting most of the drawbacks in version 4. IPv6 has also integrated mobility and security features.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Both versions are successfully used; however, they can’t interact with each other. Thus to exchange the traffic between the two networks one needs additional translator gateways. And although upgrading equipment for IPv6 capabilities is quite time-consuming and expensive, it is expected that the world will move away from IPv4 sooner or later.</div>

What is IPv6?

What is IPv6? Internet Protocol version 6 (IPv6) is the latest version of Internet Protocol (IP) — a network layer protocol providing comput...

6:08 PM

What is a DNS leak?

<h1 style="font-family: "OpenSans Bold"; line-height: initial;">What is a DNS leak?</h1><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">In general, when you type any request in your browser, use an email client, or other apps, your request is sent to a particular DNS server to translate a human-friendly destination URL into its machine-friendly IP address.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">An Internet Service Provider (ISP), which provides you with internet access, usually assigns DNS servers by itself, and thus it can easily track and monitor all your requests. If you want to avoid disclosing your browsing activity, you should use a virtual private network (VPN).</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">VPN keeps you safe</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">VPN guides your request and all soft data (i.e., your passwords, CC details, etc.) you may use on the Internet through an encrypted tunnel from your browser to the VPN’s DNS server, not to your ISP’s DNS server. This way you stay anonymous, and your browsing activity can’t be revealed by third parties.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Unfortunately, under certain conditions, your browser may fail to send your request to the VPN’s server and send it right to your ISP instead. This is what a DNS leak is, and it may occur due to some default settings of your device. You may think that your privacy is kept safe on the net, but your online activity can be actually tracked when a DNS leak occurs.</div><img class="text-image" src="https://whatismyip.li/images/dns-leak/dns-leak-img.png?cb=041" style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px; height: 172.792px; width: 288px;" /><span style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"></span><br /><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">How to prevent it?</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">To spot a DNS leak you can use online leak test services, and if the leak is detected, you can prevent further loss of information. Firstly, you can change the default DNS servers to limit your ISP provider’s surveillance ability. This change may also lead to faster Internet speeds. Secondly, make sure the VPN service you’re using has a DNS leak protection. You can find this information in the VPN settings.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">DNS leak may also happen if you forgot to turn on VPN service, or if it was disconnected because of some problems with internet connection, and started surfing the net without getting your connection encrypted. So be careful and always make sure your VPN is on.</div><div class="col-xs-12" style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"><div class="text-center" id="dns_leak"><h2 style="color: black; font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">Examples of such DNS servers are:</h2><div id="dns_leak-wait_messages"></div><div class="list-group" id="dns_leak-results"><div class="list-group-item" id="159_89_207_144"><b>159.89.207.144</b><br />Singapore<br /></div><div class="list-group-item" id="74_125_190_30"><b>74.125.190.30</b><br />Singapore<br />Residential </div><div class="list-group-item" id="159_89_207_129"><b>159.89.207.129</b><br />Singapore<br /></div><div class="list-group-item" id="172_217_32_130"><b>172.217.32.130</b><br />Singapore<br /></div><div class="list-group-item" id="74_125_190_145"><b>74.125.190.145</b><br />Singapore<br />Residential </div></div><div id="dns_leak-errors"></div></div></div><h2 class="text-center" style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">For IPv6:</h2><div class="text-center" style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">2001:4860:4860::8888<br />2001:4860:4860::8844</div>

What is a DNS leak?

What is a DNS leak? In general, when you type any request in your browser, use an email client, or other apps, your request is sent to a par...

6:00 PM

SSL OR TLS?

<h2 style="background-color: white; border: 0px; box-sizing: inherit; clear: both; color: #444340; font-family: Yrsa, sans-serif; font-size: 23px; font-weight: inherit; margin: 0px 0px 0.4em; outline: 0px; padding: 0px; vertical-align: baseline;">SSL or TLS?</h2><div style="background-color: white; border: 0px; box-sizing: inherit; color: #444340; font-family: "Source Sans Pro", Helvetica, sans-serif; font-size: 16px; margin-bottom: 1.6em; outline: 0px; padding: 0px; vertical-align: baseline;">New versions of SSL have been released to ensure more secure data transmission, and TLS (Transport Layer Security) is just the updated version of SSL. Previous changes were reflected in the name by adding the number of versions, for example, SSLv2.0 or SSLv3.0. However, instead of naming the next version SSLv4.0, it was called TLSv1.0.</div><div style="background-color: white; border: 0px; box-sizing: inherit; color: #444340; font-family: "Source Sans Pro", Helvetica, sans-serif; font-size: 16px; margin-bottom: 1.6em; outline: 0px; padding: 0px; vertical-align: baseline;">As SSL is more commonly used, it is referred to while talking about securing transmitted data, even if the TLS version is actually used.</div>

SSL OR TLS?

SSL or TLS? New versions of SSL have been released to ensure more secure data transmission, and TLS (Transport Layer Security) is just the u...

9:05 AM

How to recognize SSL-secured websites? SSL certificate A-Z

<h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">How to recognize SSL-secured websites?</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Websites use SSL technology to let their customers feel confident while providing their personal data, for example, while purchasing online. To let you easily see whether the website you are visiting is a trusted one or not, browsers give you visual cues such as an icon of a lock next to the address bar or the whole bar green.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The lock icon means that a website is SSL-secured, while a green address bar implies that a website uses Extended Validation SSL. Another distinctive feature of SSL is that the websites that use it begin not with http but with https.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"><img class="text-image" src="https://whatismyip.li/images/ssl/ssl-img.png?cb=041" style="height: 197.927px; width: 288px;" /></div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">How does it work?</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">All browsers are capable of interacting with SSL-secured web servers, but to make this interaction happen, the browser and the server need an SSL certificate (a small data file used to link a cryptographic key with details of an organization or site) for establishing a secure connection. Therefore, when a browser tries to access an SSL-secured website, an ‘SSL Handshake’ process takes place, which is instant and invisible for users.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Setting up the SSL connection requires three keys; they are the public, private, and session ones. It works this way: any data encrypted with the private key can be decrypted by the public key solely, and vice versa. However, as such an encryption process is quite power-consuming, it is used only during the SSL Handshake, after which a symmetric session key is created. Thus, when the secure connection is established, the transmitted data is encrypted with this session key.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">SSL or TLS?</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">New versions of SSL have been released to ensure more secure data transmission, and TLS (Transport Layer Security) is just the updated version of SSL. Previous changes were reflected in the name by adding the number of versions, for example, SSLv2.0 or SSLv3.0. However, instead of naming the next version SSLv4.0, it was called TLSv1.0.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">As SSL is more commonly used, it is referred to while talking about securing transmitted data, even if the TLS version is actually used.</div>

How to recognize SSL-secured websites? SSL certificate A-Z

How to recognize SSL-secured websites? Websites use SSL technology to let their customers feel confident while providing their personal data...

9:00 AM

What is an SSL Certificate and Why It Is Important?

What is an SSL Certificate and Why It Is Important?

What is an SSL Certificate and Why It Is Important? Secure Sockets Layer (SSL) is an encryption protocol, a security technology, used for es...

8:52 AM

How to add Cookie & Consents Banner Widget Guidelines A-Z

<h2 style="background-color: white; box-sizing: border-box; color: #2e4453; font-family: Merriweather, Georgia, "Times New Roman", serif; font-size: 36px; line-height: 1.258; margin: 9px 0px 16px; padding: 0px; text-rendering: optimizelegibility;">Cookie & Consents Banner Widget</h2><div class="entrytext" style="background-color: white; box-sizing: border-box; font-family: "Noto Sans", sans-serif; font-size: 16px; line-height: 1.7; margin: 0px; padding: 0px;"><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;"><span style="box-sizing: border-box;">When browsing sites hosted on WordPress.com, you may see a privacy banner appear across the bottom of the screen:</span></div><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;"><a href="https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;"><img alt="Cookie & privacy banner example" class="aligncenter wp-image-143835 size-full" data-attachment-id="143835" data-comments-opened="0" data-image-description="" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0"}" data-image-title="Cookie &amp; privacy banner example" data-large-file="https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=688" data-medium-file="https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=300" data-orig-file="https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png" data-orig-size="1438,106" data-permalink="https://en.support.wordpress.com/cookie-widget/screen-shot-2018-05-11-at-12-31-02-pm/" sizes="(max-width: 688px) 100vw, 688px" src="https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=688" srcset="https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=688 688w, https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=1376 1376w, https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=150 150w, https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=300 300w, https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=768 768w, https://en-support.files.wordpress.com/2018/05/screen-shot-2018-05-11-at-12-31-02-pm.png?w=1024 1024w" style="background: none 0px 0px repeat scroll rgb(243, 246, 248); border-radius: 3px; border: 1px solid rgb(233, 239, 243); box-sizing: border-box; display: block; height: auto; margin: 2px; max-width: 100%; padding: 5px;" /></a></div><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;"><span style="box-sizing: border-box;">The banner links by default to a <a href="https://automattic.com/cookies/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">page with details</a> on the information we at WordPress.com collect and may store, including an explanation of personalized advertisements. For visitors from the European Union, we will not show you ads that have been personalized to your interests (as determined by an individual cookie) until you click “Close and accept”.</span></div><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;"><span style="box-sizing: border-box;">The privacy banner will automatically display on sites utilizing our no-cost hosting plan, since they <a href="https://en.support.wordpress.com/about-these-ads/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">display advertisements</a></span><span style="box-sizing: border-box;"> in order to keep that part of the service free.</span></div><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;"><span style="box-sizing: border-box;">If you are a site owner with an <a href="https://wordpress.com/plans/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">upgraded hosting plan</a>, both advertising and this banner are optional. You can customize the banner to fit your needs and add your own privacy disclosures, <a href="https://en.support.wordpress.com/cookie-widget/#how-to-enable-the-widget" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">as explained below</a>. This can be useful for following the EU Global Data Protection Regulation (GDPR) or other local laws.</span></div><h3 style="box-sizing: border-box; color: #2e4453; font-size: 20px; line-height: 1.7; margin: 0px 0px 3px; padding: 0px;">Cookie Information</h3><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;">Sites hosted on WordPress.com make use of cookies for a variety of different purposes. Some cookies are only set for registered WordPress.com users, whereas others are set for all visitors. <span style="box-sizing: border-box;">We aim to collect the minimal amount of data necessary to provide our services. </span>For more detailed information, see our dedicated <a href="https://automattic.com/cookies/" rel="noopener" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;" target="_blank">Cookie Policy page</a> and <a href="https://automattic.com/privacy/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">Privacy Policy</a>.</div><h3 style="box-sizing: border-box; color: #2e4453; font-size: 20px; line-height: 1.7; margin: 0px 0px 3px; padding: 0px;">The Widget</h3><h4 class="section-title" id="how-to-enable-the-widget" style="box-sizing: border-box; color: #2e4453; font-size: 18px; line-height: 1.7; margin: -18px 12px 12px 0px; padding: 28px 0px 0px;">How to enable the widget</h4><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;">On upgrade hosting <a href="https://wordpress.com/plans/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">plans</a>, enable the widget by adding it to the Widgets section in your site’s <a href="https://wordpress.com/customize" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">Customizer</a>. Simply click ‘Add a Widget’ and search for “Cookies & Consent Banner”. (For more information on widgets, <a href="https://en.support.wordpress.com/widgets/" rel="noopener" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;" target="_blank">check this support page</a>.) Place it in any widget position, display the banner will display across the bottom of the screen when the site is loaded.</div><blockquote style="background: rgb(243, 246, 248); border-radius: 3px; box-sizing: border-box; margin: 0px 0px 22px; overflow: hidden; padding: 15px 13px 0px;"><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;">Note: The banner will only appear on posts or pages on your site that display the widget area where you add the widget. To display the banner on the front page of your site, be sure to add the widget to a widget area that appears there.</div></blockquote><div class="toc-jump" style="box-sizing: border-box; color: #3d596e; float: right; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif; font-size: 10px; line-height: 1.7em; margin-bottom: 1.4em; margin-top: -18px; padding: 28px 0px 0px;"><a href="https://en.support.wordpress.com/cookie-widget/#toc" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">↑ Table of Contents ↑</a></div><h4 class="section-title" id="features" style="box-sizing: border-box; color: #2e4453; font-size: 18px; line-height: 1.7; margin: -18px 12px 12px 0px; padding: 28px 0px 0px;">Features</h4><ul style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin: 0px 0px 20px 50px; padding: 0px;"><li style="box-sizing: border-box; margin: 0px 0px 4px; padding: 0px;"><strong style="box-sizing: border-box;">Hiding the banner – </strong>The banner can be set to be dismissed in one of three ways: when a visitor specifically clicks the button, when a visitor scrolls, or after a specific time. The minimum length of time is 3 seconds, and the maximum 1000. Once the banner is hidden, a technical cookie named <em style="box-sizing: border-box;">eucookielaw</em> is set, which prevents it from being displayed to the same user again for 30 days.<br style="box-sizing: border-box;" /><span style="box-sizing: border-box;">For members of the <a href="https://wordads.co/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">WordAds program</a>, EU visitors must click the “Close and accept” button in order for their ads to be personalized on your site. Such ads return a higher revenue rate to be shared with you. Keep this in mind when deciding how to hide the banner.  </span></li><li style="box-sizing: border-box; margin: 0px 0px 4px; padding: 0px;"><strong style="box-sizing: border-box;">Banner text</strong> – The banner will display a default cookie notification message, which can be customized if required.</li><li style="box-sizing: border-box; margin: 0px 0px 4px; padding: 0px;"><strong style="box-sizing: border-box;">Color scheme</strong> – Display the banner using a dark or light palette. <span class="s1" style="box-sizing: border-box;">This can be further customized if you have Custom Design, which is a feature of the <a href="http://wordpress.com/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;"><span class="s2" style="box-sizing: border-box;">WordPress.com</span></a> Premium and <a href="http://wordpress.com/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;"><span class="s2" style="box-sizing: border-box;">WordPress.com</span></a> Business plans. The relevant CSS selector is #eu-cookie-law.</span></li><li style="box-sizing: border-box; margin: 0px 0px 4px; padding: 0px;"><strong style="box-sizing: border-box;">Policy URL – </strong>By default this creates a link to the <a href="https://en.support.wordpress.com/cookies/" rel="noopener" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;" target="_blank">WordPress.com cookies policy</a>. Should you wish to link to your own policy, you can do so by adding a <a href="https://en.support.wordpress.com/pages/new-page-screen/" rel="noopener" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;" target="_blank">page</a> to your site, and inserting the link in the field below “Custom:”. After inserting the link you will be able to select the custom option.</li><li style="box-sizing: border-box; margin: 0px 0px 4px; padding: 0px;"><strong style="box-sizing: border-box;">Policy Link Text – </strong>By default this is ‘Our Cookie Policy’, which can be customized as needed.</li><li style="box-sizing: border-box; margin: 0px 0px 4px; padding: 0px;"><strong style="box-sizing: border-box;">Button Text</strong> – The text of the button that users will click to accept, or dismiss the cookie notice.</li></ul><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;">In addition to the widget, you may wish to add a link to the <a href="https://en.support.wordpress.com/cookies/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">WordPress.com cookies policy</a>. This can be achieved by inserting a <a href="https://en.support.wordpress.com/menus/" style="box-sizing: border-box; color: #1e8cbe; cursor: pointer; text-decoration-line: none;">custom link into your menu</a>.</div><h3 style="box-sizing: border-box; color: #2e4453; font-size: 20px; line-height: 1.7; margin: 0px 0px 3px; padding: 0px;">Important Notice</h3><div style="box-sizing: border-box; color: #3d596e; font-size: 15px; line-height: 1.7em; margin-bottom: 1.4em; padding: 0px;"><span style="box-sizing: border-box;">Please note that it is your responsibility to ensure that you comply with the relevant applicable laws in your jurisdiction. This widget is designed to help you take steps towards this, but is not offered as a guaranteed or complete solution for compliance with the GDPR or other laws applicable to you.</span></div></div>

How to add Cookie & Consents Banner Widget Guidelines A-Z

Cookie & Consents Banner Widget When browsing sites hosted on WordPress.com, you may see a privacy banner appear across the bottom of th...

8:33 AM

What is the Internet? Know You??

<h1 style="font-family: "OpenSans Bold"; line-height: initial;">What is the Internet?</h1><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The Internet, “a network of networks,” has become an integral part of our life, and most of the people can’t even imagine their day-to-day activities without it. However using the Internet, we may not fully understand what it is and how it works.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">Performance and origin</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The Internet is the worldwide network that connects computers and other smart devices throughout the world together via dedicated servers and routers. Cables, telephone lines, as well as satellites, and wireless connections are used to let all kinds of data (i.e., graphics, voice, video, text, and software) travel from one device to another for data exchange and communication purposes.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Such telecommunication systems are owned by telephone companies in the countries they locate, but there is no owner of the Internet. However, there are several organizations that contribute to the development and functioning of the Internet.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The ancestor of the Internet was the Advanced Research Projects Agency’s Wide Area Network (ARPANET) founded by the US federal government in the 1960s to create robust communication with networks for military research. Only in the 1980s US universities and other institutions connected to ARPANET, which caused its unexpected growth and change in the name to the Internet (short for ‘international’ or ‘inter network’).</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">When hypertext-based technology (the World Wide Web) was developed, it became possible to display graphics, text, animations, and tools for navigation and searching, which have made the Internet popular across the globe. With further development of computer technologies, a lot of functions and features have been created, allowing us to enjoy what we can do with the help of the Internet today.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;"><img class="text-image" src="https://whatismyip.li/images/internet/internet-img.png?cb=041" style="height: 191.875px; width: 288px;" /></div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">The things we have got used to</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The Internet is probably one of the most significant breakthroughs in the world’s history. It is just invaluable! With its help, we work, plan vacations, do shopping, research, communicate, study, pay bills, trace locations, read news and books, watch movies, play games, and do lots of other activities. It allows us to have all the knowledge of the humankind right in our pockets — just research any topic with the help of search engines like Google, Bing, Yahoo, and others, and learn whatever you need.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">The Internet shortens the distances. Today you can talk to and see people from different parts of the world just in one click! Weren’t video calls a plot of science fiction movies just a couple of decades ago? Emailing, online messaging, and sharing our thoughts and pictures with friends on the social media has become as ordinary as drinking a cup of tea or coffee in the morning.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Now working remotely is a common practice, which has many advantages. You can take a laptop and work anywhere, as with the help of the Internet, you can have access to your company’s computers, corporate email, cloud services; you can find partners, sell your products or services, sign contracts, etc. Studying at a foreign college or taking an online course while staying at home is not about teleportation — it’s about opportunities we are provided by the Internet.</div><h2 style="font-family: "OpenSans Bold"; line-height: initial; padding-top: 20px;">What to expect?</h2><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Futurists predict the rapid expansion of the Internet in the near future, the impacts of which will be much more significant than those we have already experienced.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">They predict education revolution – cheaper schools without buildings and teachers; new online ‘nations’ – people with common interests beyond nation-state control; quicker lifecycle of businesses and industries, etc.</div><div style="color: #444444; font-family: "OpenSans Regular", Raleway, sans-serif; font-size: 14px;">Soon the Internet will become even more vital, but it will be up to us to determine how it influences each of our lives.</div>

What is the Internet? Know You??

What is the Internet? The Internet, “a network of networks,” has become an integral part of our life, and most of the people can’t even imag...

8:25 AM

Why it's important to use VPN?

<h2 style="font-family: arial, sans-serif; padding-top: 20px;">Why it's important to use VPN?</h2><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">The Internet has become a vital part of our everyday lives; we keep our information, our media, our property in a supposedly “safe” place.<br />So what happens when our private data’s security is compromised? Or when strangers can access all that we keep sealed and locked?</div><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">It is clear that you need to have your own security network. You need to have a VPN.<br />A technology that allows you to generate a connection between two or more computers or servers through another network is called VPN (Virtual Private Network).<br />Using encryption and cryptography makes the security level in the core network irrelevant, allowing you to use even public Internet for the connection.</div><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">Having a VPN makes your life much easier: You can keep your activity online to yourself, protecting yourself from any prying eyes. You can connect to any public WiFi network without being vulnerable to various hackers trying to steal your information. You can access worldwide content, withdrawing any boundaries that might have been established on your network’s location! And the list goes on and on…</div><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">Not having a VPN in the 21st century is pretty much like storing all of your valued possessions in the street, where anyone can take possession of it.</div>

Why it's important to use VPN?

Why it's important to use VPN? The Internet has become a vital part of our everyday lives; we keep our information, our media, our prope...

8:16 AM

What is a VPN?? Guidelines

<h2 style="font-family: arial, sans-serif; padding-top: 20px;">What is a VPN</h2><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">A secure communication’s channel between your computer and a server is called a VPN (Virtual Private Network). A VPN encrypts any data passing through it.</div><span style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">The VPN’s components are what makes it work:</span><span style="color: #444444; font-family: arial, sans-serif; font-size: 14px;"></span><br /><ol style="color: #444444; font-family: arial, sans-serif; font-size: 14px; margin-bottom: 0px; margin-top: 0px;"><li>Encryption and Security protocols - by creating a secure connection and affecting the type of data encryption, the VPN protects any data passing through the server.</li><li>Server - while using a VPN, your data is sent to the VPN server, and only afterwards - to the resource you are looking for.</li></ol><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">It’s pretty simple - the request you sent hits the server of the resource, but your data (information) can only be moved between your device and the VPN server, which also passes through a secure communication’s channel, so that the server you are requesting cannot receive any information about you.</div><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">When connecting to a VPN, your ISP cannot decrypt the data itself or track the websites you visit, but it can only track encrypted traffic coming to the VPN server.</div><div style="color: #444444; font-family: arial, sans-serif; font-size: 14px;">Most often, VPN is used to protect confidential information (electronic correspondence, online banking) and to view blocked sites from anywhere.<br />VPN is also used to hide the real location by changing your IP address, which changes according to the server you are connected to.</div>

What is a VPN?? Guidelines

What is a VPN A secure communication’s channel between your computer and a server is called a VPN (Virtual Private Network). A VPN encrypts ...

8:08 AM

What is IP address?

What is IP address?

What is IP address? An IP address, or simply an "IP," is a unique address that identifies a device on the Internet or a local netw...

8:01 AM

Acunetix Release Web Site Security Pen Testing Tools Free

Acunetix Release Web Site Security Pen Testing Tools Free

Acunetix Release Web Site Security Pen Testing Tools Free HTTP editor, fuzzer and sniffer tools help pen testers identify vulnerabilities Lo...

6:01 PM

What is SQL Injection and How to Prevent It use Guidelines A-Z Part 1

<header class="entry-header" style="background-color: white; box-sizing: border-box; color: #333333; font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 30px; margin: 20px 0px; outline: 0px !important; padding-bottom: 0px; padding-top: 8px;"><h1 class="entry-title" style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 24px; height: auto; line-height: 1.1; margin: 0px 0px 10px; outline: 0px !important; overflow: visible; text-overflow: clip;">What is SQL Injection (SQLi) and How to Prevent It</h1></header><div class="entry-content" style="background-color: white; box-sizing: border-box; color: #333333; font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; outline: 0px !important;"><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">SQL Injection (SQLi) is a type of an <a href="https://www.acunetix.com/blog/articles/injection-attacks/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">injection attack</a> that makes it possible to execute malicious SQL statements. These statements control a database server behind a web application. Attackers can use SQL Injection vulnerabilities to bypass application security measures. They can go around authentication and authorization of a web page or web application and retrieve the content of the entire SQL database. They can also use SQL Injection to add, modify, and delete records in the database.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">An SQL Injection vulnerability may affect any website or web application that uses an SQL database such as MySQL, Oracle, SQL Server, or others. Criminals may use it to gain unauthorized access to your sensitive data: customer information, personal data, trade secrets, intellectual property, and more. SQL Injection attacks are one of the oldest, most prevalent, and most dangerous web application vulnerabilities. The OWASP organization (Open Web Application Security Project) lists injections in their <a href="https://www.acunetix.com/vulnerability-scanner/owasp-top-10-compliance/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">OWASP Top 10</a> 2017 document as the number one threat to web application security.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;"><img alt="SQL Injection" class="alignnone size-large wp-image-18541" height="555" sizes="(max-width: 910px) 100vw, 910px" src="https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-1024x624.jpg" srcset="https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-1024x624.jpg 1024w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-300x183.jpg 300w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-768x468.jpg 768w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-910x554.jpg 910w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-100x61.jpg 100w" style="border-radius: 4px; border: 0px; box-sizing: border-box; height: auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="910" /></div><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;">How and Why Is an SQL Injection Attack Performed</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">To make an SQL Injection attack, an attacker must first find vulnerable user inputs within the web page or web application. A web page or web application that has an SQL Injection vulnerability uses such user input directly in an SQL query. The attacker can create input content. Such content is often called a malicious payload and is the key part of the attack. After the attacker sends this content, malicious SQL commands are executed in the database.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">SQL is a query language that was designed to manage data stored in relational databases. You can use it to access, modify, and delete data. Many web applications and websites store all the data in SQL databases. In some cases, you can also use SQL commands to run operating system commands. Therefore, a successful SQL Injection attack can have very serious consequences.</div><ul style="box-sizing: border-box; margin-bottom: 10px; margin-top: 0px; outline: 0px !important; padding-left: 20px;"><li style="box-sizing: border-box; outline: 0px !important;">Attackers can use SQL Injections to find the credentials of other users in the database. They can then impersonate these users. The impersonated user may be a database administrator with all database privileges.</li><li style="box-sizing: border-box; outline: 0px !important;">SQL lets you select and output data from the database. An SQL Injection vulnerability could allow the attacker to gain complete access to all data in a database server.</li><li style="box-sizing: border-box; outline: 0px !important;">SQL also lets you alter data in a database and add new data. For example, in a financial application, an attacker could use SQL Injection to alter balances, void transactions, or transfer money to their account.</li><li style="box-sizing: border-box; outline: 0px !important;">You can use SQL to delete records from a database, even drop tables. Even if the administrator makes database backups, deletion of data could affect application availability until the database is restored. Also, backups may not cover the most recent data.</li><li style="box-sizing: border-box; outline: 0px !important;">In some database servers, you can access the operating system using the database server. This may be intentional or accidental. In such case, an attacker could use an SQL Injection as the initial vector and then attack the internal network behind a firewall.</li></ul><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">There are several types of SQL Injection attacks: in-band SQLi (using database errors or UNION commands), blind SQLi, and out-of-band SQLi. You can read more about them in the following articles: <a href="https://www.acunetix.com/websitesecurity/sql-injection2/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Types of SQL Injection (SQLi)</a>, <a href="https://www.acunetix.com/websitesecurity/blind-sql-injection/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Blind SQL Injection: What is it</a>.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">To follow step-by-step how an SQL Injection attack is performed and what serious consequences it may have, see: <a href="https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Exploiting SQL Injection: a Hands-on Example</a>.</div><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;">Simple SQL Injection Example</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The first example is very simple. It shows, how an attacker can use an SQL Injection vulnerability to go around application security and authenticate as the administrator.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following script is pseudocode executed on a web server. It is a simple example of authenticating with a username and a password. The example database has a table named <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">users</code> with the following columns: <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">username</code> and <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">password</code>.</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;"># Define POST variables<br /><span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">uname = request.POST['username']</span><br /><span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">passwd = request.POST['password']</span><br /><br /># SQL query vulnerable to SQLi<br />sql = “SELECT id FROM users WHERE username=’” + <span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">uname</span> + “’ AND password=’” + <span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">passwd</span> + “’”<br /><br /># Execute the SQL statement<br />database.execute(sql)</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">These input fields are vulnerable to SQL Injection. An attacker could use SQL commands in the input in a way that would alter the SQL statement executed by the database server. For example, they could use a trick involving a single quote and set the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">passwd</code> field to:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">password' OR 1=1</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">As a result, the database server runs the following SQL query:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">SELECT id FROM users WHERE username='username' AND password=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">'password' OR 1=1</span>'</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">Because of the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">OR 1=1</code> statement, the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">WHERE</code> clause returns the first <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">id</code> from the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">users</code> table no matter what the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">username</code> and <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">password</code> are. The first user <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">id</code> in a database is very often the administrator. In this way, the attacker not only bypasses authentication but also gains administrator privileges. They can also comment out the rest of the SQL statement to control the execution of the SQL query further:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code class="nohighlight" style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">-- MySQL, MSSQL, Oracle, PostgreSQL, SQLite<br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">--</span><br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">/*</span><br />-- MySQL<br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">#</span><br />-- Access (using null characters)<br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;"></span><br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">%16</span></code></pre><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;">Example of a Union-Based SQL Injection</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">One of the most common types of SQL Injection uses the UNION operator. It allows the attacker to combine the results of two or more SELECT statements into a single result. The technique is called <em style="box-sizing: border-box; outline: 0px !important;">union</em>-based SQL Injection.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following is an example of this technique. It uses the web page <span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">testphp.vulnweb.com</span>, an intentionally vulnerable website hosted by Acunetix.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following HTTP request is a normal request that a legitimate user would send:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">GET http://testphp.vulnweb.com/artists.php?artist=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">1</span> HTTP/1.1<br />Host: testphp.vulnweb.com</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;"><img alt="HTTP request a legitimate user would send" class="size-full wp-image-15943 aligncenter" height="603" sizes="(max-width: 718px) 100vw, 718px" src="https://www.acunetix.com/wp-content/uploads/2012/10/image02.png" srcset="https://www.acunetix.com/wp-content/uploads/2012/10/image02.png 718w, https://www.acunetix.com/wp-content/uploads/2012/10/image02-300x252.png 300w, https://www.acunetix.com/wp-content/uploads/2012/10/image02-100x84.png 100w" style="border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="718" /></div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">artist</code> parameter is vulnerable to SQL Injection. The following payload modifies the query to look for an inexistent record. It sets the value in the URL query string to <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">-1</code>. Of course, it could be any other value that does not exist in the database. However, a negative value is a good guess because an identifier in a database is rarely a negative number.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">In SQL Injection, the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">UNION</code> operator is commonly used to attach a malicious SQL query to the original query intended to be run by the web application. The result of the injected query will be joined with the result of the original query. This allows the attacker to obtain column values from other tables.</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">GET http://testphp.vulnweb.com/artists.php?artist=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">-1 UNION SELECT 1, 2, 3</span> HTTP/1.1<br />Host: testphp.vulnweb.com</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;"><img alt="SQL injection using the UNION operator" class="size-full wp-image-15941 aligncenter" height="603" sizes="(max-width: 718px) 100vw, 718px" src="https://www.acunetix.com/wp-content/uploads/2012/10/image00.png" srcset="https://www.acunetix.com/wp-content/uploads/2012/10/image00.png 718w, https://www.acunetix.com/wp-content/uploads/2012/10/image00-300x252.png 300w, https://www.acunetix.com/wp-content/uploads/2012/10/image00-100x84.png 100w" style="border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="718" /></div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following example shows how an SQL Injection payload could be used to obtain more meaningful data from this intentionally vulnerable site:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">GET http://testphp.vulnweb.com/artists.php?artist=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">-1 UNION SELECT 1,pass,cc FROM users WHERE uname='test'</span> HTTP/1.1<br />Host: testphp.vulnweb.com</code></pre><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;"><img alt="SQL injection using the UNION operator with a FROM clause" class="size-full wp-image-15942 aligncenter" height="603" sizes="(max-width: 718px) 100vw, 718px" src="https://www.acunetix.com/wp-content/uploads/2012/10/image01.png" srcset="https://www.acunetix.com/wp-content/uploads/2012/10/image01.png 718w, https://www.acunetix.com/wp-content/uploads/2012/10/image01-300x252.png 300w, https://www.acunetix.com/wp-content/uploads/2012/10/image01-100x84.png 100w" style="border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="718" /><br style="box-sizing: border-box; outline: 0px !important;" />How to Prevent an SQL Injection</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The only sure way to prevent SQL Injection attacks is input validation and parametrized queries including prepared statements. The application code should never use the input directly. The developer must sanitize all input, not only web form inputs such as login forms. They must remove potential malicious code elements such as single quotes. It is also a good idea to turn off the visibility of database errors on your production sites. Database errors can be used with SQL Injection to gain information about your database.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">If you discover an SQL Injection vulnerability, for example using an Acunetix scan, you may be unable to fix it immediately. For example, the vulnerability may be in open source code. In such cases, you can use a web application firewall to sanitize your input temporarily.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">To learn how to prevent SQL Injection attacks in the PHP language, see: <a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Preventing SQL Injection Vulnerabilities in PHP Applications and Fixing Them</a>. To find out how to do it in many other different programming languages, refer to the <a href="http://bobby-tables.com/" rel="noopener" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;" target="_blank">Bobby Tables guide to preventing SQL Injection</a>.</div></div>