A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions

Abstract

The growing use of the internet has resulted in an exponential rise in the use of web applications. Businesses, industries, financial and educational institutions, and the general populace depend on web applications. This mammoth rise in their usage has also resulted in many security issues that make these web applications vulnerable, thereby affecting the confidentiality, integrity, and availability of associated information systems. It has, therefore, become necessary to find vulnerabilities in these information system resources to guarantee information security. A publicly available web application vulnerability scanner is a computer program that assesses web application security by employing automated penetration testing techniques that reduce the time, cost, and resources required for web application penetration testing and eliminates test engineers’ dependency on human knowledge. However, these security scanners possess various weaknesses of not scanning complete web applications and generating wrong test results. Moreover, intensive research has been carried out to quantitatively enumerate web application security scanners’ results to inspect their effectiveness and limitations. However, the findings show no well-defined method or criteria available for assessing their results. In this research, we have evaluated the performance of web application vulnerability scanners by testing intentionally defined vulnerable applications and the level of their respective precision and accuracy. This was achieved by classifying the analyzed tools using the most common parameters. The evaluation is based on an extracted list of vulnerabilities from OWASP (Open Web Application Security Project).

Feasibility Analysis of Bengkel Koding Website Using Black Box Testing and Boundary Value Analysis

“…SQL injection occurs when malicious SQL queries are inserted into input fields, potentially leading to unauthorized access to the database or manipulation of data. On the other hand, LFI exploits vulnerabilities in file upload functionalities to execute arbitrary code, potentially exposing sensitive information or compromising the integrity of the application (Shahid et al, 2022). In the context of the Bengkel Koding web application, LFI can be used to upload a malicious PHP file that, when executed, can reveal the source code of the web server running PHP.…”

Enhancing Web Application Security through Automated Penetration Testing with Multiple Vulnerability Scanners

“…OWASP, on the other hand, focuses on the top ten most critical vulnerabilities. For this reason, and since other studies [6,8,16,[19][20][21][22] have used OWASP for web application security guidelines, we also adopted OWASP as our preferred security guideline for use in this project.…”

Analisis Metode Open Web Application Security Project (OWASP) Menggunakan Penetration Testing pada Keamanan Website Absensi

“…Pengujian menggunakan alat OWASP-ZAP memiliki deteksi kerentanan yang lebih tinggi beri peringkat dalam kategori open source kemudian Acunetix dan NetSparker memiliki tingkat positif palsu yang lebih sedikit [9]. Hasil pemindaian menggunakan alat vulnerability scanner dapat memberikan informasi kerentanan berdasarkan tingkat risiko [10].…”