Web Design Wikiclass | Tutorial / Website Security

Introduction: In this tutorial, you will do two exercises to learn more about website security.

Activity One: Spamming

Modify the Java program so that it can be used to automatically post comments to a blog (the actual target will be given in class for testing purpose).
You need to understand the working of HTML form and the POST method of HTTP.
It may be useful to check the HTTP request headers and modify the program accordingly.

Activity Two: Password Cracking

"There are two ways to crack a password (other than social engineering, which is making you tell me your password by tricking you or phishing): brute force and dictionary attacks. Brute force entails writing a loop that tries all of the different options (much like playing hangman), which can take ages and uses a lot of computing power. Dictionary attacks use a dictionary database to attempt common words instead of going letter by letter."

You will be given a testing website for you to do password cracking.
Use whatever way you like to get access to the website.

Some useful tools

Java program

The following simple program can be used to send any HTTP request to a website program.

import java.io.BufferedReader;

import java.io.IOException;

import java.io.InputStreamReader;

import java.io.OutputStream;

import java.net.URL;

import java.net.URLConnection;

public class Post2WebTest {

    public static void main(String[] args) {

        String postUrl = "";

        String postData = "";

        try {

            URL url = new URL(postUrl);

            URLConnection conn = url.openConnection();

            conn.setDoOutput(true);

            //conn.setRequestProperty("Referer", "");

            // write POST data to server

            OutputStream output = conn.getOutputStream();

            output.write(postData.getBytes());

            output.close();

            // read response from server

            BufferedReader reader = new BufferedReader(

                    new InputStreamReader(conn.getInputStream()));

            String line;

            while ((line = reader.readLine()) != null)

                System.out.println(line);

        } catch (IOException ex) {

            ex.printStackTrace();

        }

    }

}

[Get Code]