1. The Main Access Password: This password gives the client full access to all files and folders.
2. Specific File Or Folder Password: Speaks for its self.

The most common methods of authentication used by web sites is either CGI-based or JavaScript-based. Another type of Authentication that is popular is HTTP Basic authentication. Basically password protected web sites, which pop-up a dialog box with the following text:

• Username and Password Required
• Enter Username and Password for xxxx here
• Username  :
• Password   :

Cracking The HTTP Basic Authentication Passwords :

This changes from server to server slightly, also it depends on how the administrator has set up the service :

1. First of all find out if the server is actually running HTTP Basic authentication service, to do this just enter a wrong password; if you get a 401 Error message you can be sure its running HTTP Basic authentication. To hack the HTTP Passwords, you need to get the sniffer logs, which would contain what a request would look like if you were able to request the page. It would be something like the following:

GET /pagehere HTTP/1.1

Authorization: Basic rTyna2yrqw2ADGHsghis==

• The text after the Basic is the password altho it looks encrypted its not, its just Base 64 encoding. You can easily decode it in perl useing the MIME::Base 64 module. The code would be as follows:

use MIME: :Base64;

print decode_base64("rTyna2yrqw2ADGHsghis==");

• You can get the MIME::Base64 module from HERE . After it has been decoded you will something like name.name:passwordhere. The first two are the username and the last is the passwordin plain text.

1. Do not use words from a dictionary, this will prevent you from dictionary attacks.
2. Do not leave it blank or use your username or part of it.
3. Do not use you name followed by your birthdate, or anything someone can find on a profile page.
4. Do not repeat your password.
5. Do not use the same password at multiple places.

And some basic things to do :

1. Make your password a combination of numbers, letters & special characters, try to use both lowercase & uppercase.
2. You should change your password regularly.
3. Try to random your password, but not so much you forget it.

Theres a few programs out there which are good for storeing passwords Click Here  for a good one.

A look into SQL injection !

Bypassing login prompts with the help of SQL injection attacks is extremely easy to perform. An attacker with some basic knowledge about how SQL works can use this with input validation attacks, there are a number of web sites on the Internet which require a user to enter a username & password to gain access to the site.If the correct pair is not entered the user will get an access denied, as with the correct input access is granted.

Mostly when a user fills the form on a web site the following SQL query is executed:

SELECT PEOPLE from database

WHERE Username='<the input username>'

AND Password='<the input password>'

IF <Above SELECT command evaluates to true> {Authorize User}

ELSE {User not authorized}   

The SQL query searches the entire database looking for a record whose username & password match the input on the form.If the data input matches  the data in the database then access is granted,if not then access is denied.

However an attacker can easily manipulate the input (username & password) entered in the online login form to execute a SQL injection attack & then bypass the security features. An attacker can enter the following data as input on the online login form:

   Username: abcd' OR 1=1 --

   Password : <blank>

For the above set of values the following SQL query gets executed for access :

SELECT PEOPLE from database

WHERE Username='abcd' OR 1=1- -

AND Password=' '

IF <Above SELECT command evaluates to true> {Authorize User}

ELSE {User not authorized}

The part of the query that contains the - - comment denotation that represents the beginning of comments. As a result everything after the - - is treated as commented code & ignored. This means this part of the SQL query can be written as follows :

SELECT PEOPLE from database

WHERE Username='abcd' OR 1=1

The above SQL query is always evaluated as true since the condition 1=1 can never be false. This means that if an attacker enters 'abcd' OR 1=1 - - as the username and <blank> as the password he/she will automatically be logged in as the first user in the database & have access to restricted files.

How To Prevent This

You can prevent SQL injection attacks by filtering out all the special characters like 'quotation marks, semicolons, slashes, backslashes, etc from user input, cookie files & URL parameters. This will make it more difficult for attackers to use SQL attacks against input validation. 

1. Click start menu click run & type "regedit" then ok (Always be careful when editing the registry this is your computers brain)
2. In the registry editor open HKEY_CURRENT_USER\Software\Yahoo\pager\Test.
3. On the right hand side of the editor hover your mouse over the clear area & right click.
4. Select new / string value & type the word plural.
5. Right click the word plural & select modify.
6. Set the value data to 0.
7. Thats it now you can open as many instances of YM as you like !