Click to See Complete Forum and Search --> : JSP hacking of password in e commerce website .. how to prevent?


7610
06-08-2006, 06:23 AM
hi i am still unable to solve it

<%@page contentType="text/html"%>
<%@page import="java.sql.*"%>
<%@page import="java.security.MessageDigest"%>
<html>
<head>
<title>Check Login</title>
</head>
<body>

<%
String varName=request.getParameter("userName");
String varPass=request.getParameter("userPass");

String DRIVER = "sun.jdbc.odbc.JdbcOdbcDriver";
Connection con = null;
String nextPage = null;
try {
// set up the DSNless connection to the EJewel.mdb database
String source = "jdbcdbcriver={Microsoft Access Driver (*.mdb)}; DBQ=C:\\Program Files\\Apache Software Foundation\\Tomcat 5.5\\webapps\\ROOT\\assessment\\assessment.mdb";
// Open a Database connection with the Driver
Class.forName(DRIVER);
con = DriverManager.getConnection(source);

// Create sql string to check whether userName is found in database
String sql = "Select * from Customers where userName='" + varName + "' and userPass='" + varPass + "'";

// Create statement to connect to Connection
Statement stmt=con.createStatement();

// Execute result set on sql string
ResultSet rs=stmt.executeQuery(sql);


String userPass = "foobar";

MessageDigest mdAlgorithm = MessageDigest.getInstance("MD5");
mdAlgorithm.update(userPass.getBytes());

byte[] digest = mdAlgorithm.digest();
StringBuffer hexString = new StringBuffer();

for (int i = 0; i < digest.length; i++) {
userPass = Integer.toHexString(0xFF & digest[i]);

if (userPass.length() < 2) {
userPass = "0" + userPass;
}

hexString.append(userPass);
}

// We now have a unique MD5 Hash of original input
out.print(hexString.toString());


if (rs.next())
{
out.print("Exist");
session.setAttribute("loginStatus", "login");
session.setAttribute("userName", varName);
session.setAttribute("userPass", varPass);
nextPage="ShowMain.jsp";
}
else
{
//out.print("Does not exist");
nextPage="Showlogin.htm";
}
// close the resultset and statement
rs.close();
rs = null;

stmt.close();
stmt = null;

} // end try
// catch for 3 exceptions
catch (ClassNotFoundException cnfe) {
out.println ("Could not create driver " + cnfe.getMessage ()) ;
}
catch (SQLException sqle) {
out.println ("Could not connect to database " + sqle.getMessage ()) ;
}
catch (Exception excpt) {
out.println ("Could not connect to database, general error " + excpt.getMessage ()) ;
} // end all catch
// finally to close connection
finally {
if (con != null) {
con.close();
}
} // end finally
%>
<jsp:forward page="<%=nextPage%>"/>
</body>
</html>



can help me thanks being racking for quite some time

i was told to use MD5 harsh but i really dunno how to use : pls help thanks a lot

7610
06-08-2006, 06:25 AM
oh i forgot to add on ... my problem is that
i have a question. i found out that when in jsp i type this password for login page :

'' or '1' =
(i din the write the full code to prevent misuse )

it can enter the website. How do i prevent it ?

thanks in advance

BuezaWebDev
06-09-2006, 12:39 PM
Use a prepared statement instead of a regular statement class.

7610
06-11-2006, 11:48 AM
hi what do u mean by prepared statement?