Identify and Describe at Least Six Markwt Segments free essay sample

Customers are people who buy products and services from other people (usually companies of one sort or another). What customers think and feel about a company and/or its products is a key aspect of business success. Attitudes are shaped by experience of the product, the opinions of friends, direct dealings with the company, and the advertising and other representations of the company. Irrespective of whether a business customers are consumers or organisations, it is the job of marketers to understand the needs of their customers. In doing so they can develop goods or services which meet their needs more precisely than their competitors. The problem is that the process of buying a product is more complex than it might at first appear. Customers do not usually make purchases without thinking carefully about their requirements. Wherever there is choice, decisions are involved, and these may be influenced by constantly changing motives. We will write a custom essay sample on Identify and Describe at Least Six Markwt Segments or any similar topic specifically for you Do Not WasteYour Time HIRE WRITER Only 13.90 / page The organisation that can understand why customers make decisions such as who buys, what they buy and how they buy will, by catering more closely for customer’s needs, become potentially more successful. Term buyer are ones who purchases goods or services; also called customer. A consumer makes purchases for his or her own use or purpose. A professional buyer makes bulk purchases on behalf of a retailer or wholesaler. A media buyer purchases media space or time for an advertiser. Factors That Influence Consumer Purchasing Decisions Factors that influence consumer purchasing decisions are price, income, credit facilities, reference groups, and need satisfaction, (uPublish. info, 2005-2012). I believe a factor that is most important is the ‘needs satisfaction. ’ According to uPublish. nfo, 2005-2012, Maslow’s theory of motivation suggests that human beings seek to satisfy lower needs and then the higher needs: 1. Physiological needs- this includes the basic needs such as food and shelter 2. Safety- this include shelter and the needs to protect one from danger 3. Affection- these are the needs for one to belong to certain groups or family 4. Self-esteem- these are th e needs for recognition and dignity 5. Self-actualization- these are the needs to realize our full potential As we saw fuel prices rise, there was less traveling involved, thus this affected airline companies and vacation destinations. For the most part, people need to feel secure with basic needs, such as food, shelter, gas, etc. before making big purchasing decisions. A bad example of this would be the housing market. Many banks were lending money to people who could not afford to make the monthly payments. I do not know whether the people knew this or the bankers convinced them they could make the payments. Somewhere they must have felt ‘secure. ’ Some factors markets can be segmented are environment, demographic, and culture. For example, it does not snow where I live and it is about 100 degrees until winter. There have been some years where we are wearing flip-flips and shorts in December. It would be ridiculous to have ski wear or extreme winter clothing here. Another example is, Whole Foods Market. Market segment Segmentation refers to a process of bifurcating or dividing a large unit into various small units which have more or less similar or related characteristics. Market Segmentation  ¦Market segmentation is a marketing concept which divides the complete market set up into smaller subsets comprising of consumers with a similar taste, demand and preference. A market segment is a small unit within a large market comprising of like-minded individuals.  ¦One market segment is totally distinct from the other segment.  ¦A market segment comprises of individuals who think on the same lines and have similar interests.  ¦The individuals from the same segment respond in a similar way to the fluctuations in the market. Basis of Market Segmentation Gender The marketers divide the marke t into smaller segments based on gender. Both men and women have different interests and preferences, and thus the need for segmentation. Organizations need to have different marketing strategies for men which would obviously not work in case of females. A woman would not purchase a product meant for males and vice a versa. The segmentation of the market as per the gender is important in many industries like cosmetics, footwear, jewellery and apparel industries. Age Group Division on the basis of age group of the target audience is also one of the ways of market segmentation. The products and marketing strategies for teenagers would obviously be different than kids. Age group (0 10 years) Toys, Nappies, Baby Food, Prams Age Group (10 20 years) Toys, Apparels, Books, School Bags Age group (20 years and above) Cosmetics, Anti-Ageing Products, Magazines, apparels and so on Income Marketers divide the consumers into small segments as per their income. Individuals are classified into segments according to their monthly earnings. The three categories are: * High income Group * Mid Income Group * Low Income Group Stores catering to the higher income group would have different range of products and strategies as compared to stores which target the lower income group. Pantaloons, Carrefour, Shopper’s stop target the high income group as compared to Vishal Retail, Reliance Retail or Big bazaar who cater to the individuals belonging to the lower income segment. Marital Status Market segmentation can also be as per the marital status of the individuals. Travel agencies would not have similar holiday packages for bachelors and married couples. Occupation Office goers would have different needs as compared to school / college students. A beach house shirt or a funky T Shirt would have no takers in a Zodiac Store as it caters specifically to the professionals. Types of Market Segmentation  ¦Psychographic segmentation The basis of such segmentation is the lifestyle of the individuals. The individual’s attitude, interest, value help the marketers to classify them into small groups.  ¦Behaviouristic Segmentation The loyalties of the customers towards a particular brand help the marketers to classify them into smaller groups, each group comprising of individuals loyal towards a particular brand.  ¦Geographic Segmentation Geographic segmentation refers to the classification of market into various geographical areas. A marketer can’t have similar strategies for individuals living at different places. Nestle promotes Nescafe all through the year in cold states of the country as compared to places which have well defined summer and winter season. McDonald’s in India does not sell beef products as it is strictly against the religious beliefs of the countrymen, whereas McDonald’s in US freely sells and promotes beef products. Criteria for selecting Market Segments Measurable A segment should be measurable. It means you should be able to tell how many potential customers and how many businesses are out there in the segment. Accessible A segment should be accessible through channels of communication and distribution like: sales force, transportation, distributors, telecom, or internet. Durable Segment should not have frequent changes attribute in it. Substantial Make sure that size of your segment is large enough to warrant as a segment and large enough to be profitable Unique Needs Segments should be different in their response to different marketing efforts (Marketing Mix). Consumer and business markets cannot be segmented on the bases of same variables because of their inherent differences. Bases for Consumer Market Segmentation There are number of variables involved in consumer market segmentation, alone and in combination. These variables are:  ¦ Geographic variables  ¦ Demographic variables  ¦ Psychographic variables  ¦ Behavioural variables Geographic Segmentation In geographical segmentation, market is divided into different geographical units like:  ¦ Regions (by country, nation, state, neighbourhood)  ¦ Population Density (Urban, suburban, rural)  ¦ City size (Size of area, population size and growth rate)  ¦ Climate (Regions having similar climate pattern) A company, either serving a few or all geographic segments, needs to put attention on variability of geographic needs and wants. After segmenting consumer market on geographic bases, companies localize their marketing efforts (product, advertising, promotion and sales efforts). Demographic Segmentation In demographic segmentation, market is divided into small segments based on demographic variables like:  ¦ Age  ¦ Gender  ¦ Income  ¦ Occupation  ¦ Education  ¦ Social Class  ¦ Generation  ¦ Family size  ¦ Family life cycle  ¦ Home Ownership  ¦ Religion  ¦ Ethnic group/Race  ¦ Nationality Demographic factors are most important factors for segmenting the customers groups. Consumer needs, wants, usage rate these all depend upon demographic variables. So, considering demographic factors, while defining marketing strategy, is crucial. Psychographic Segmentation In Psychographic Segmentation, segments are defined on the basis of social class, lifestyle and personality characteristics. Psychographic variables include:  ¦ Interests  ¦ Opinions  ¦ Personality  ¦ Self Image  ¦ Activities  ¦ Values  ¦ Attitudes A segment having demographically grouped consumers may have different psychographic characteristics. Behavioural Segmentation In this segmentation market is divided into segments based on consumer knowledge, attitude, use or response to product. Behavioural variables include:  ¦ Usage Rate  ¦ Product benefits  ¦ Brand Loyalty  ¦ Price Consciousness  ¦ Occasions (holidays like mother’s day, New Year and Eid)  ¦ User Status (First Time, Regular or Potential) Behavioural segmentation is considered most favourable segmentation tool as it uses those variables that are closely related to the product itself. Bases for Business Market Segmentation Business market can be segmented on the bases consumer market variables but because of many inherent differences like  ¦ Businesses are few but purchase in bulk  ¦ Evaluate in depth  ¦ Joint decisions are made Business market might be segmented on the bases of following variables:  ¦ Company Size: what company sizes should we serve?  ¦ Industry: Which industry to serve?  ¦ Purchasing approaches: Purchasing-function organization, Nature of existing relationships, purchase policies and criteria.  ¦ Product usage  ¦ Situational factors: seasonal trend, urgency: should serve companies needing quick order deliver, Order: focus on large orders or small. Geographic: Regional industrial growth rate, Customer concentration, and international macroeconomic factors. Explain why the different types of target consumers are chosen for different? As discussed earlier, the countrys consumers can be divided into so many different consumer groups. Based on which consumer groups they li e in, the consumers will have different needs. Also they will find different things that appeal to them. So before you launch a marketing campaign, you need to identify which set of people does your business cater to? What we mean by this is that you need to know who your customers are? What kind of life do they live? Who influences their buying decision? What kinds of media are they exposed to? How much purchasing power do they have? Etc. Knowing this information, you can target your marketing campaign to appeal especially to this group of customers you have chosen. Many a times, you may find that the product or service you are offering is consumed by not only one group of people. You may find that your product has many varied uses and hence has many varied possible consumers. Because of this you may want to choose more than one group of people as your target market. Your marketing strategy will fail if you try to be everything to everybody. When you make a marketing strategy you have to choose only one group of people and design your marketing strategy so that it appeals to the group you have selected. If you have many groups of people to choose from, choose only the group of people that you can best cater too and will offer you the best opportunities to grow. For example, if you are a small firm that makes women’s perfumes, your target market could be teenage girls, house wives, rich women who can fford to spend highly on perfumes and other such accessories etc. You could choose any one of these customer groups as your target market. Suppose you choose the rich women group then your marketing plan will be designed to appeal to rich women. The price of your perfume will be high. Your ads will be designed to appeal to rich women etc. These ads cannot simultaneously appeal to younger middle class women also. If you come up with a marketing strategy to appeal to more than one target group of customers, your strategy will not be effective. Your sales will be eaten away by specialist products or specialist marketing strategies. Just consider the case of shampoo. If someone is looking for a shampoo to deal with their dandruff problem, they are more likely to buy a shampoo which says Anti-dandruff shampoo than a shampoo that says, Hair shine, Hair strength and Anti-Dandruff shampoo. This point will be explained later again in more detail. The thing to understand is that the first step to making a marketing strategy is to select the â€Å"target market† for who the marketing campaign is to be designed.

Jury Duty essays

Jury Duty essays Jury system is a trial system that twelve citizens decide whether defendants are guilty or is unanimous. The jurors are all laypersons , as far as law is concerned. There is a reason verdict. If one jury is against the verdict,it is regarded as being room for doubt. are direct participation of American people, conventional judgement by people, fair stage resistance against polictics' and judical plot, and making of democratic consciousness. public prosecutor submit unlawful proof without trial permission, counsel makes an judge can't admit counsel's objection. Defendant is at a disadvantage. However, there is a jury system will check rotting of trial. Jurors need not explain reason of verdict to court. of investigation is dirty and viorate human rights, they can decide the defendant is can decide defendant is innocent even if a public prosecutor has disadvantageous proofs Juries who are representative of citizen make the decision value about proof. But, Jerome delegates of legal realists, criticized jury system in Law irresponsible juries' products of caprice and prejudice, for example, the defendant is a rich plaintiff is a poor boy and the counsel is an eloquent speaker. Such facts often decide who He characterizes that juries have tendency to like weak people and hate strong people. to have many problems. A sophisticated and rich person, a person of position and a busy not want to become a juror, because juries are bound for all trial period and therefore afford time for trial can become a juror, such as a housewife, an old person and an ...

Wants vs. Needs Essay Example | Topics and Well Written Essays - 750 words

Wants vs. Needs - Essay Example The notion of wants and needs will be accorded in this instance in the context of desert survival with the semi-nomadic Ju/'hoansi Bushmen in the Kalahari desert. Contrary to the common views that desert survival is relatively easy, being stuck or to live in a desert for an indefinite period of time needs a lot of careful planning and effective strategy. Before deciding which things I need to bring with me, it is important to describe the prospective conditions. Half of the Kalahari Desert does not qualify as a desert because it â€Å"receives much more rainfall† (Encyclopaedia Britannica, â€Å"Kalahari Desert†), than the other half of the desert. While rains occur at a significantly large volume annually with â€Å"a mean precipitation of more than 20 [Student’s Last Name] 2 inches† (Encyclopaedia Britannica, â€Å"Kalahari Desert†), still the area is extremely dry and there are no surface water. By and large, the sand is red and hot. Edible veget ation and fruit-bearing trees are present in some parts of the desert but occur on a single season within a year. Semi-nomadic tribes like the Bushmen live in Kalahari Desert. Majority of the Bushmen, also known as â€Å"Shan†, have shelters of their own. Water is their main concern. In dry seasons, they use sip-well to extract water from the ground. While they are hunter-gatherers and plant eaters, they also consume a considerable amount of insects especially during hot seasons (Morris 57). They also have common household necessities like knives, cloaks, blankets, etc. Given these conditions, I have come up with a list of things, either a need or a want, which I will be bringing with me in a stay with the Bushmen for an indefinite period of time: (1) distilled water; (2) medical kit; (3) communication tools; (4) wool jacket; (5) alcohol. Living in a stern environment in so far as water is concerned is both difficult and life threatening. Thus, water is a dire need for someon e who will have to spend an indefinite period of time in the desert. To prevent diarrhoea or other related diseases, it is absolutely helpful to bring large volumes of distilled drinking water. Similarly, dangers are very common in the desert. Poisonous creatures like scorpions and snakes are lurking everywhere. It is especially important to anticipate the possibility of encountering these dangers, or even worse, getting bitten by these deadly creatures in order to carefully plan the travel. Hence, a medical kit should not be discounted as it helps preclude the possibility of injury or even death. Similarly, deserts like Kalahari have very erratic weather conditions. Temperatures are normally high during the day but go too low during the night. If the body is not used to recurrent weather changes, one may [Student’s Last Name] 3 not be able to survive; therefore, a wool jacket should be brought together with the traveller. This somehow neutralizes the body temperature, which may help in regulating the blood flow. As aforementioned, water is the prime concern in Kalahari; water is scarce in the area. Thus, it is rather inappropriate to employ the same hygienic practices in the desert; in other words, taking a bath is relatively not a possibility. Nevertheless, this should not serve as a

Combating compassion fatigue Assignment Example | Topics and Well Written Essays - 1500 words

Combating compassion fatigue - Assignment Example In its entirety, compassion fatigue occurs when the caregiver remains focused on processes of giving care to others that they fail to realize and provide care for themselves. Notably, most of the caregivers went into the practice with the hope of facilitating assistance to those in need. Additionally, the caregivers rely extensively on their compassionate capacity to manage the intensity of the work that comes with the profession. However, at times, the intensity of the various situations and life experiences that the caregivers encounter causes them vulnerable to the possibilities of suffering compassion fatigue. In its nature, compassion fatigue entails all the symptoms that the caregiver experience causing them to suffer from overwhelming exposure to physical and emotional stressors that leave them feeling traumatized as helpers (Ochberg & Gift from Within (Organization), 2012). The core causes of the cases of compassion fatigue; thus, entail the exposure to the stressors that cause their feelings and experiences face challenges in managing their actions. Notably, the encounter with the clients exposes the caregivers to various elements, which can sig nificantly affect the cause of personal development of the caregiver. For instance, in a case where the caregiver is engaging with clients who suffer fears, pain, extreme suffering, intrusive thoughts, nightmares and hyper-vigilance; they face aspects of cumulative stresses. The caregiver bares the suffering of such people, in addition, to that of their personal lives such as family and friend issues can result to significant buildup of extreme states of anxiety and preoccupation of such sufferings (Ochberg & Gift from Within (Organization), 2012). These developments constitute the causative agents of the situations where the caregivers suffer compassion fatigue. The caregivers suffer vicarious traumatization, which results in various aspects of emotional, physical and

Economics for the global manager Essay Example | Topics and Well Written Essays - 1750 words

Economics for the global manager - Essay Example All benefits have a corresponding cost. The air we breathe, kept clean through laws costing millions of dollars to enforce, is not free. If your friend treats you for lunch, it is not free for you either, because the time you spent with your friend has an opportunity cost that may probably be more than the price of the lunch. 3. Why might the government want to influence transactions The government wants to influence transactions for many reasons. First, as in nations with free market economies, the government wants to make sure the market's rules are fair as part of its mandate to keep the people happy. One danger of a free market economy is explained by what is called asymmetric information: sellers may hide vital information from buyers that does not allow a fair price to be paid for a good (think second-hand car dealers). Otherwise, people cheated all the time will be aggravated and may move to change the government. Second, the government wants to control the supply and flow of money in the economy, because if they do not, there will be trouble in the form of inflation that can lead to social unrest (Solomon 1972 cited in Samuelson 1992, p. 712). Third, the government wants to influence transactions, like the Fed setting interest rates, Congress cutting budget deficits, or the Commerce Department ne gotiating trade agreements, because of the add-on effects that these actions (all are forms of market intervention) have on the nation's macroeconomic conditions. And fourth, government wants to ensure the country's patrimony is safe, for example to prevent some scam artist from selling the Statue of Liberty to foreigners. 4. What does the spillover or externality principle measure Use examples. This principle measures the costs or benefits of externalities, activities that affect others, without meaning to, either positively in the form of benefits not paid for or negatively in the form of inconvenience or costs for which they are not compensated. An example of the first (called external economies) is having a wife who is a doctor (you can consult her for "free" or, at least, you don't have to pay someone else to prescribe the right medicine). An example of the second (called external diseconomies) is driving recklessly on the freeway, which makes many other drivers nervous and increases their consumption of tranquilizers. 5. Currently our demand for gasoline is rising as our economy is expanding. However, we expect OPEC to keep the supply stable. Use a graph to show what your prediction is for the price of gasoline. USE A GRAPH INDICATING WHEN THE DEMAND INCREASES. I predict the price will increase, because as shown in the graph on Figure 1, with the supply constant and the demand increasing, the demand curve shifts to the right, moving the equilibrium point to the right, with the effect of increasing the equilibrium price, or the point at which the current supply curve intersects the increased demand curve, from p to p'. At price p, the gasoline market is in equilibrium, that is, supply equals demand. OPEC's move holds the supply curve steady, but an expanding/growing economy needs more fuel,

Static Code Analysis

Static Code Analysis Jim Kielt Table of Contents (Jump to) 1.0 Analysis 1.1 Cross-Site Scripting: 239 vulnerabilities detected. 1.2 File Manipulation: 9 vulnerabilities detected. 1.3 SQL Injection: 4 vulnerabilities detected. 2.0 Bibliography Table of Figures Figure 1 RIPS results output for bWAPP Figure 2 Line of code from xss_json.php vulnerable to Cross-Site Scripting detected by RIPS Figure 3 Returned message from xss_json.php Figure 4 Returned message from xss_json.php with a script being passed to the application. Figure 5 Returned message from secured xss_json.php with the script being passed to the application. Figure 6 Vulnerable to File Manipulation code detected by RIPS Figure 7 Link to uploaded file on unrestricted_file_upload.php showing path to uploads Figure 8 Attempted upload of a PDF file on unrestricted_file_upload.php Figure 9 Vulnerable to SQL Injection code detected by RIPS Figure 10 Message from SQL Injection on sqli_3.php 1.0 Analysis The open source project for analysis for source code vulnerabilities is The Buggy Web App or bWAPP. This application is deliberately insecure to help security experts and students of IT security learn about the vulnerabilities that exist on the Internet today, how they can be exploited and how they can then be secured. bWapp is a PHP application that makes use of a MySQL database. [1] To analyse the source code for vulnerabilities, a static source code analysis tool is required. RIPS is such a tool which is written in PHP and designed to find vulnerabilities in PHP applications. It transforms the PHP source code that it is analysing; into a programme model that can detect potentially vulnerable functions or sensitive sinks that could then be tainted by user input that causes vulnerabilities. [2] So a potentially vulnerable function in source code that uses a source containing user input creates a vulnerability. bWAPP is available as a virtual machine called buzz-box where it can run as a stand-alone web server on a lab/testing network. To analyse the buzz-box server, the RIPS application files need to be extracted to the buzz-box server’s document root i.e. /var/www/rips/. Then on the host machine’s browser, navigate to http://localhost/rips to bring up the main scanning page. The path to the file or directory and/or subdirectories to be scanned is entered along with some available options before the scan button is clicked. The available options for scanning are as follows: Verbosity level:1. User tainted 2. User, file and database tainted 3. User, file and database tainted secured 4. User, file and database untainted secured 5. Debug mode Vulnerability type: All or one of the following: Server-side all or one of the following: Code Execution, Command Injection, Header Injection, File Disclosure, File Inclusion, File Manipulation, LDAP Injection, SQL Injection, XPath Injection, and other. Client-side all or one of the following: Cross-Site Scripting and HTTP Response Splitting Unserialized / POP For the bWAPP analysys, /var/www/bWAPP was entered as the path with the subdirectories option checked. Verbosity level option 2 (User, file and database tainted) and vulnerability type option All was selected. After clicking the scan button, 198 files were scanned in the web directory and after just under a minute, the statistical output in figure 1 was generated. According to RIPS, the scanner works by tokenizing and parsing all of the PHP source code in the file or directory structure and tranforms the code into a program model which detects sensitive sinks that can be tainted by user input, the source throughout execution of the program. At a glimpse it can be seen that Cross-Site Scripting has been heavely detected along with some of the other top vulnerablilties found in web apps today. Of the 198 files scanned, 4251 sensitive sinks (vulnerable functions) were found of which 293 could be tainted by user input and therefore considered vulnerabilities. The three chosen vulnerabilites for futher analysis are as follows: 1.1 Cross-Site Scripting:239 vulnerabilities detected. Cross-site scripting (XSS) is an injection attack where malicious scripts can be passed through user input on to the web application to create undesired effects and generally performed through a client browser. An attacker can use his browser to use XSS to execute a malicious script to another browser user visiting the same page and have the script display unintended information or perform an unintended action. Because the user’s browser has no way to know if the script should be trusted or not, it has no option but to execture the script. The script or tainted data becomes embedded into the HTML output by the application and rendered by the users browser which can lead to website defacement, phishing or cookie stealing and session hijacking.[3] A potentially vulnerable function like echo() which prints data to the screen that uses a source like $_GET containing user input can create Cross-Site Scripting vulnerability, e.g: $title = $_GET[title]; echo ($title]); The above code would display whatever the user enters and could therefore be exploited. To demonstrate the Cross-Site Scripting vulnerability in bWAPP, the focus is on the bWAPP/xss_json.php file/page. Figure 2 shows the code snipit where user input was found and marked by the scanner (white dots) as a potential entry point for exploitation. Line 34 of the program places unchecked user input straight into a function which causes the vulnerablility. Figure 2 Line of code from xss_json.php vulnerable to Cross-Site Scripting detected by RIPS This page was opened in a browser and was titled ‘XSS-Reflected(JSON)’, displaying one textfield and a search button looking for the name of a movie to be entered. To test how this page works, ‘Spiderman’ was entered using the ‘Marvel’ hint ans submitted. The resulting message appeared below the textfield based on the input (see figure 3). Figure 3 Returned message from xss_json.php So the user input was displayed back in the output message which could mean that the input was probably unchecked. To test how the texfield responded to a simple script to display cookie information in an alert box, the following was entered and submitted: alert(document.cookie) The message this time did not display the entered script statement but instead tried to execute the script and displayed lines of the code from the page (see figure 4): Figure 4 Returned message from xss_json.php with a script being passed to the application. This message reveals information about the application that should never be dispayed and raises a security concern. A hacker could learn further how to exploit the application using this information. Mitigation: We should never trust user data entered into an aplication which needs to be screened for the likes of scripting code. All entered data should be encoded before being embedded into the output. HTML encoding converts untrusted user input into a safe format that can be used as output instead of executing as code in the browser e.g Converts ‘’ to ‘amp’. For PHP applications, HTML entity encoding is done via the htmlspecialchars() function which convert all special characters to HTML entities.[4] To encode any double or single quotation marks that could be interpreted by the application as code, the ENT_QUOTES parameter is used to prevent any injections and defining the correct charset prevents any special characters being used in the input e.g UTF-8 ASCII compatible multi-byte 8-bit Unicode. Line 34 shows the vulnerable code which was updated to incorporate the mitigation to make it secure. Vulnerable code: $title = $_GET[title]; Secure code: $title = htmlspecialchars ($_GET[title], ENT_QUOTES, utf-8); Once the code was secured, the same script code was entered and submitted and this time, the message showed the script statement in the message but this time treated it as a string and did not attempt to execute it (see figure 5): Figure 5 Returned message from secured xss_json.php with the script being passed to the application. 1.2 File Manipulation:9 vulnerabilities detected. File Manipulation can occur with Full Path Disclosure vulnerabilities where an attacker can see the path of a file in the url of a webapp, e.g. /var/www/htdocs/file. This gives the attacker a partial knowldege of how the application is structured or how the underlying operating system is arranged in order to mount different kinds of attacks. [5] Knowing the location of a particular file, the attacker could access and manipulate it by adding malicious code to compromise the webapp server or even upload an attack tool to that location. A potentially vulnerable function like move_uploaded_file() that uses a source like $_FILES directly from user input (upload) can create File Manipulation, e.g. move_uploaded_file($_FILES[file][tmp_name], images/ . $_FILES[file][name]); To demonstrate File Manipulation in bWAPP, the bWAPP/unrestricted_file_upload.php page was examined. Figure 6 shows the vulnerable code where unchecked user input (the selected file for upload) is used by the application. Figure 6 Vulnerable to File Manipulation code detected by RIPS When the page was opened in the broswer, a ‘Browse’ and ‘Upload’ button were displayed where an image file could be uploaded to the server. A test image file was uploaded and the resulting message returned the link to where the file is stored on the server. The link was followed to a directory called ‘images’in the bWAPP directory. Navigating to the images directory brought up a list of all files in the that directory (see figure 7). A PDF file was then selected and successfully uploaded so no file type check was in place. Effectively these files could be manipulated as described above or malicious files uploaded and executed like a webscript that take control of the server. Figure 7 Link to uploaded file on unrestricted_file_upload.php showing path to uploads Mitigation: Sensitive information like file locations should not be visable to the user and any path or file names displayed should be encoded to prevent leakage of this information. This could be achieved by changing the path and filename to a format that the server understands like a hashing function. The move_uploaded_file function should have the file checked that the files being uploaded are image files before being uploaded to the ‘images’ directory. Line 34 shows the vulnerable code which uploads any file to the ‘images’ directly without being firstly checked. The preg_match() function can be used to check for particular file extensions, in this case images file types, in a new $filename variable. [6] A file check statement was added to the vulnerable code that checks for the file type and will now only execute the original code as long as the file has the correct extension using an if statement. Line 166 uses the $file_error variable to determine if the upload is successful or not which determines the output, so $file_error is firslty set to an unsuccessful attempt message by default which is cleared if the correct file extension executes. Vulnerable code: move_uploaded_file($_FILES[file][tmp_name], images/ . $_FILES[file][name]); Secure code: $filename = $_FILES[file][name]; $file_error = Not an image file, try again; if(preg_match(/.(gif|png|jpg)$/, $filename)) { move_uploaded_file($_FILES[file][tmp_name], images/ . $_FILES[file][name]); $file_error = ; } Once the code was secure, another PDF file was browsed to and the ‘Upload’ button clicked and this time because the file is now firstly checked for file type and because pdf in not in the array of allowable files, the upload function does not execute (see figure 8): Figure 8 Attempted upload of a PDF file on unrestricted_file_upload.php 1.3 SQL Injection:4 vulnerabilities detected. SQL Injection attacks happen when SQL queries are successfully injected through user input data into the application that can reveal information about the database to allow for further attacks where the database can be modified by the insertion, updating and deletion of data. [7] The user input is crafted in such a way that it is interpreted by the application as SQL commands allowing the attacker contol over the database in even the operating system itself. A potentially vulnerable function like mysql_query() that uses a source like $_POST containing user input can create SQL Injection e.g $login = $_POST[login]; $password = $_POST[password]; $sql = SELECT * FROM heroes WHERE login = . $login . AND password = . $password . ; $recordset = mysql_query($sql, $link); To demonstrate the SQL Injection in bWAPP, the bWAPP/ sqli_3.php page was examined. Figure 9 shows the vulnerable code where unchecked user input is used by the application. Figure 9 Vulnerable to SQL Injection code detected by RIPS When this webpage is loaded, it shows a login screen for ‘superhero’ credentials requesting a login and password. A basic test for web applications for SQL Injection is the entering of the following command in place for the username and/or password: or 1=1 The single quote is interpreted by the web application as a special character in SQL which allows for the additional condition to the SQL command 1=1 which is of course always true and the double hyphen is intrepreted by the web application as a comment which closes off the query. When the or 1=1 statement is entered into the login and password fields, a welcome note is displayed (see figure 10): Figure 10 Message from SQL Injection on sqli_3.php This shows that this web page is vulnerable to SQL Injection attacks which uses unchecked user input directly by the application which could be exploited in compromising the server. Mitigation: The most successful defence against SQL injections is to never use user input directly in the application and to use parameterized queries (prepared statements) instead — which is supported by most languages — and to avoid using dynamic SQL queries or SQL queries with string concatenation. For PHP the mysql_real_escape_string() function can be used to escape special characters in a string for use in an SQL statement. Lines 137 and 137 of the code takes in the user inputs which are executed in the SQL statement in line 140 which is the vulnerable code really is. By implementing the mysql_real_escape_string() function into the code it will escape any special characters. [8] Vulnerable code: $sql = SELECT * FROM heroes WHERE login = . $login . AND password = . $password . ; Secure code: $sql = SELECT * FROM heroes WHERE login = . mysql_real_escape_string($login) . AND password = . mysql_real_escape_string($password) . ; Once the code was secured, the or 1=1 statement was entered again into the login and password fields and this time instead of getting the previous message as above, the invalid message displayed (see figure 11) Figure 11 Message after attempted SQL injection on secured sqli_3.php 2.0 Bibliography [1] itsecgames. 2015. itsecgames. [ONLINE] Available at: http://www.itsecgames.com/. [Accessed 19 February 2015]. [2] RIPS free PHP security scanner using static code analysis. 2015. RIPS free PHP security scanner using static code analysis. [ONLINE] Available at: http://rips-scanner.sourceforge.net/. [Accessed 19 February 2015]. [3] Cross-site Scripting (XSS) OWASP. 2015. Cross-site Scripting (XSS) OWASP. [ONLINE] Available at: https://www.owasp.org/index.php/XSS. [Accessed 19 February 2015]. [4] PHP: htmlspecialchars Manual . 2015. PHP: htmlspecialchars Manual . [ONLINE] Available at: http://php.net/manual/en/function.htmlspecialchars.php. [Accessed 25 February 2015]. [5] Full Path Disclosure OWASP. 2015. Full Path Disclosure OWASP. [ONLINE] Available at: https://www.owasp.org/index.php/Full_Path_Disclosure. [Accessed 02 March 2015]. [6] PHP: preg_match Manual . 2015. PHP: preg_match Manual . [ONLINE] Available at: http://php.net/manual/en/function.preg-match.php. [Accessed 25 February 2015]. [7] SQL Injection OWASP. 2015. SQL Injection OWASP. [ONLINE] Available at: https://www.owasp.org/index.php/SQL_Injection. [Accessed 19 February 2015]. [8] PHP: mysql_real_escape_string Manual . 2015. PHP: mysql_real_escape_string Manual . [ONLINE] Available at: http://php.net/manual/en/function.mysql-real-escape-string.php. [Accessed 25 March 2015].

Five Proofs That God Exists Essays -- thomas aquinas, summa theologica

Instinctually, humans know that there is a greater power in the universe. However, there are a few who doubt such instinct, citing that logically we cannot prove such an existence. St. Thomas Aquinas, in his Summa Theologica, wrote of five proofs for the existence of God. The Summa Theologica deals with pure concepts; these proofs rely on the world of experience - what one can see around themselves. In these proofs, God will logically be proven to exist through reason, despite the refutes against them. St. Thomas’s five proofs rely on the causality of God. Causality, in simple terms, is the fact that you cannot make something greater from lesser parts; the more perfect does not come from the less perfect. In order for something to exist, there must be something greater to have caused it to exist. This means that you cannot trace back causes infinitely - there must be a first, uncaused cause. Therefore, there must be something that caused everything. This we call God. One of the first things that must be said, is that God does not exist. At least, he does not exist as a physical thing. God is not something among all the other things in this world, like a tree, building, or rock. God does not exist in that sense. Instead, according to St. Thomas, God is existence. The first way St. Thomas argues for the existence of God is with the Argument from Motion. The Argument from Motion consists of five main points. The first states that our senses prove that some things are in motion. For St. Thomas, motion didn’t just mean movement as with a car moving down the road from point A to point B or any other thing physically moving from one place to another. St. Thomas takes the Aristotelian sense of the word, which he defined as... ...potentiality to be. For example, a cat cannot give birth to a dog. Simply because it does not biologically have the potential to do it. In the same way, an object cannot suddenly become what it does not have the potential to be. On the other hand, what caused God? If everything didn’t exist, than what caused God to exist? Nothing created God, He has always existed There can only be one being that can be uncaused. If there were more than one uncaused being, then beings would have potential. They would be striving to be what the other uncaused being is. This counteracts what an uncaused being is. It’s impossible because it would make an uncaused cause no longer be a being that is pure act. The being or beings would potentially be striving to be more than it or the other is. Works Cited Aquinas, Thomas. Summa Theologica. New York: Benziger Bros., 194748.