A testing framework for Web application security assessment

Huang, Yao-Wen; Tsai, Chung-Hung; Lin, Tsung-Po; Huang, Shih-Kun; Lee, D. T.; Kuo, Sy‐Yen

doi:10.1016/j.comnet.2005.01.003

Cited by 58 publications

(28 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All of these tests are possible through appropriate test scripts. For instance if a test script for assessing SQL injection is available (for instance using the idea presented in [13]) then this test script can be used to perform a security test. Therefore, the main issue is how to represent the logic of a test in a test script.…”

Section: Discussionmentioning

confidence: 99%

“…In [13] a framework is discussed for testing security of the web-based systems. The framework is developed to address two types of security attacks; SQL injection and XSS attacks.…”

Section: Related Workmentioning

confidence: 99%

“…First, all of them are somehow limited both in terms of the test strategy they use (white-box, black-box, gray-box) and the types of tests they are designed for. For instance, [6] addresses only white-box strategy and session-based test case generation, while [13] is addresses only security tests. The second point is that, despite their differences, the way they finally execute a test is almost similar.…”

Section: The Proposed Frameworkmentioning

confidence: 99%

See 2 more Smart Citations

An Agent-Based Framework for Automated Testing of Web-Based Systems

Paydar

Kahani

2011

JSEA

View full text Add to dashboard Cite

show abstract

Section: Discussionmentioning

confidence: 99%

“…In [13] a framework is discussed for testing security of the web-based systems. The framework is developed to address two types of security attacks; SQL injection and XSS attacks.…”

Section: Related Workmentioning

confidence: 99%

Section: The Proposed Frameworkmentioning

confidence: 99%

See 1 more Smart Citation

An Agent-Based Framework for Automated Testing of Web-Based Systems

Paydar

Kahani

2011

JSEA

View full text Add to dashboard Cite

show abstract

“…Prior work has also addressed the performance of web security vulnerability scanners by either evaluating the detection effectiveness of a set of scanners [18,19,32,58] or developing techniques that can be incorporated into these tools to increase their detection accuracy [5,60,61]. Other research attempts focused on comparing the effectiveness of dynamic testing with other security testing approaches (e.g., static testing or manual code review) [62].…”

Section: Web Security Scanners: Detection Effectivenessmentioning

confidence: 99%

Performance-Based Comparative Assessment of Open Source Web Vulnerability Scanners

Alsaleh

Alomar

Alshreef

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

The widespread adoption of web vulnerability scanners and the differences in the functionality provided by these tool-based vulnerability detection approaches increase the demand for testing their detection effectiveness. Despite the advantages of dynamic testing approaches, the literature lacks studies that systematically evaluate the performance of open source web vulnerability scanners. The main objectives of this study are to assess the performance of open source scanners from multiple perspectives and to examine their detection capability. This paper presents the results of a comparative evaluation of the security features as well as the performance of four web vulnerability detection tools. We followed this comparative assessment with a case study in which we evaluate the level of agreement between the results reported by two open source web vulnerability scanners. Given that the results of our comparative evaluation did not show significant performance differences among the scanners while the results of the conducted case study revealed high level of disagreement between the reports generated by different scanners, we conclude that the inconsistencies between the reports generated by different scanners might not necessarily correlate with their performance properties. We also present some recommendations for helping developers of web vulnerabilities scanners to improve their tools' capabilities.

show abstract

“…The secure host and secure application are the most important concerns in the web security. However, when network and host-level entry points are relatively secure, the public interfaces of Web applications become the focus of attacks [1]. Hence, a trustable application and host could provide an appropriate infrastructure for online applications.…”

Section: Introductionmentioning

confidence: 99%

Applied Dynamic Chain of Responsibility in Web Application Security

Shirazi¹,

Hejazi²,

Dolatabadi³

2012

IJCTE

View full text Add to dashboard Cite

Abstract-Software design patterns provide a proven and comprehensive solution for a series of problems that designers confront with them. Web security becomes a critical issue in the online environments. Many techniques strive to achieve web applications to acceptable level of confidence. One of the useful behavioral design patterns is the chain-of-responsibilities pattern that includes several command objects in a series of processing objects. There is a set of logic in each processing object that can handle a command and transfer it to the next processing object. This series of processing objects is stable, and also, the position of each ring in the chain is unchangeable. In this paper, a dynamic chain of responsibilities design pattern that provides a new mechanism for enhance flexibility in security of web application would be presented.

show abstract

A testing framework for Web application security assessment

Cited by 58 publications

References 35 publications

An Agent-Based Framework for Automated Testing of Web-Based Systems

An Agent-Based Framework for Automated Testing of Web-Based Systems

Performance-Based Comparative Assessment of Open Source Web Vulnerability Scanners

Applied Dynamic Chain of Responsibility in Web Application Security

Contact Info

Product

Resources

About