A lot of web
applications have an administrators area/panel for easier managing and control
of the application. Ideally, this area should only be accessed by people
with the right privileges, however, there are situations where unauthorized or
standard users are able to access the area and perform undesired actions.
Some times, when
accessing the admin area, no authentication takes place. In other words, access is given to anyone who access the
supposed "private" URL.
Hackers can guess the location of this area through various methods.
These includes trying common directories such as /admin and /administrator
or viewing the comments and html code of
a public page for administrator specific code.
The best way to
prevent unauthorized access is to both force authorization/authentication upon
logging in and also limited the area to specific users/IP address/network
range.
No comments:
Post a Comment