Hi usually I charge for this service but I'm offering free security scan of your own site, it does not matter what script you use. If you have issues with hackers or worried about how secure your site is drop mea PM and I will give you a ditailed information on where the security problem is located, what it does and what needs to be done to fix it.
If you find my help usefull you can donate to WebFlake to say thank you
Please note prove of ovnership of the site might be required
( I will not scan the site for you just so you can hack it )
Also depending on website size it can take anywhere from 1 hour to 6 hours.
Thanks and see you all round.
Here is example of 1 of clients scaned site so you can get better idea.
Blind SQL Injection
1. Vulnerability description Blind SQL Injection
This script is possibly vulnerable to SQL
Injection attacks.
SQL injection is a vulnerability that allows an
attacker to alter backend SQL statements by manipulating the user input. An SQL
injection occurs when web applications accept user input that is directly placed
into a SQL statement and doesn't properly filter out dangerous characters.
This is one of the most common application layer attacks currently being
used on the Internet. Despite the fact that it is relatively easy to protect
against, there is a large number of web applications vulnerable.
This vulnerability affects
/topic/1012-%CF%80%CE%B1%CF%81%CE%BF%CF%85%CF%83%CE%B9%CE%B1%CF%83%CF%84%CE%B5-%CF%84%CE%BF-desktop-%CF%83%CE%B1%CF%82.
Discovered by: Scripting
(Blind_Sql_Injection.script).
Attack details
HTTP Header input client-ip was set to -1' or 58 =
'56
headers
Request
GET /topic/1012-%CF%80%CE%B1%CF%81%CE%BF%CF%85%CF%83%CE%B9%CE%B1%CF%83%CF%84%CE%B5-%CF%84%CE%BF-desktop-%CF%83%CE%B1%CF%82 HTTP/1.1user-agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)client-ip: -1' or 58 = '56X-Requested-With: XMLHttpRequestCookie: PHPSESSID=e76de147dfe45cd368ee6bf9f1b3b304; session_id=google%3D664bba98b2028cb7b36f6ba3439ddbdf_sessionHost: fantastic-forum.infoConnection: Keep-aliveAccept-Encoding: gzip,deflateAccept: */*
Response
HTTP/1.1 200 OKServer: nginx/1.5.0Date: Mon, 01 Jul 2013 21:30:29 GMTContent-Type: text/html;charset=UTF-8Connection: keep-aliveX-Powered-By: PHP/5.3.25Cache-Control: no-cache, must-revalidate, max-age=0Expires: Sun, 30 Jun 2013 21:30:29 GMTPragma: no-cacheVary: Accept-EncodingSet-Cookie: session_id=37c1f21e9de10f14e1282aa45efcf459; path=/; domain=Removed; httponlySet-Cookie: modpids=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=RemovedContent-Length: 157260
HTML response
[Your user agent does not support frames or is currently configured
not to display frames. However, you may visit
<A href="iframes/idf91.html">the related document.</A>]
The impact of this vulnerability
An attacker may execute arbitrary SQL
statements on the vulnerable system. This may compromise the integrity of your
database and/or expose sensitive information.
Depending on the back-end
database in use, SQL injection vulnerabilities lead to varying levels of
data/system access for the attacker. It may be possible to not only manipulate
existing queries, but to UNION in arbitrary data, use subselects, or append
additional queries. In some cases, it may be possible to read in or write out to
files, or to execute shell commands on the underlying operating
system.
Certain SQL Servers such as Microsoft SQL Server contain stored
and extended procedures (database server functions). If an attacker can obtain
access to these procedures it may be possible to compromise the entire
machine.
How to fix this vulnerability
Your script should filter metacharacters
from user input.
Alert 2.
HTTP Parameter Pollution
Vulnerability description
This script is possibly vulnerable to HTTP
Parameter Pollution attacks.
HPP attacks consist of injecting encoded
query string delimiters into other existing parameters. If the web application
does not properly sanitize the user input, a malicious user can compromise the
logic of the application to perform either clientside or server-side attacks. Affected items
[*]/index.php/
The impact of this vulnerability
The impact depends on the affected web
application. An attacker could
[*]Override existing hardcoded HTTP parameters
[*]Modify the application behaviors
[*]Access and, potentially exploit, uncontrollable variables
[*]Bypass input validation checkpoints and WAFs rules
How to fix this vulnerability
The application should properly sanitize
user input (URL encode) to protect against this vulnerability.