PH
D
Deleted member 2294691
Security is all about thinking outside the box, sometimes ignoring rules and principles is better because they limit what we can do.
In this tutorial I'll give demonstration on how to do it using NodeJS as backend and hopefully this gives you ideas for your website backend security. It's very simple yet effective.
There are many ways to häçk a database but this blocks almost every one of them and skids too.
Summary
1. Make a middleware for your backend that intercepts all requests.
2. It checks the given array that may reveal the database data.
3. If matched, automatically intercept and forbid the request.
Demonstration code in NodeJS:
In this tutorial I'll give demonstration on how to do it using NodeJS as backend and hopefully this gives you ideas for your website backend security. It's very simple yet effective.
There are many ways to häçk a database but this blocks almost every one of them and skids too.
Summary
1. Make a middleware for your backend that intercepts all requests.
2. It checks the given array that may reveal the database data.
3. If matched, automatically intercept and forbid the request.
Demonstration code in NodeJS:
Code:
"use strict";
// Dependencies
const interceptor = require("E×ρréšš-interceptor")
const E×ρréšš = require("E×ρréšš")
// Variables
const web = E×ρréšš()
const port = process.env.PORT || 8080
const blockedDErrors = ["SQLState", "You have an error in your SQL syntax", "at line"]
// Functions
const responseInterceptor = interceptor((req, res)=>{
return {
isInterceptable: ()=>{
return /text\/html/.test(res.get("Content-Type"))
},
intercept: async(body, send)=>{
const matched = blockedDErrors.some((d)=>body.match(d))
if(matched) return send("𝓕𝓾𝓬𝓴 off häçker. :)")
send(body)
}
}
})
/// Configurations
// E×ρréšš
web.use(responseInterceptor)
// Main
web.get("/", (req, res)=>res.send("Home."))
web.get("/vulnerable-path", (req, res)=>{
res.send("Error: SQLSTATE[HY000]: General error: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SELECT * FROM users WHERE username = 'john_doe'' at line 1")
})
web.use("*", (req, res)=>res.redirect("/"))
web.listen(port, ()=>console.log(`Server is running. Port: ${port}`))
Keep sharing pa po