Design of efficient web vulnerability scanner

Marathe, Nilesh; Padiya, Puja

doi:10.1109/inventive.2016.7824873

Cited by 7 publications

(10 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…43 The introduction of CGI led to the appearance of other web application development tools such as PHP, Perl, Java Server Pages (JSP), JavaScript, and VBScript. 43 Figure 1 shows the evolution of web applications. A web application typically includes a client, a web server, an application server (sometimes several), and a persistent database server, often with a firewall placed between the client and the webserver/application.…”

Section: Background and Related Workmentioning

confidence: 99%

“…The web application security consortium (WASC) 41 defines a web application as “a software application executed by a web server, which responds to dynamic web page requests over HTTP.” According to Paulson, 42 the turning point in web application development was the introduction of A synchronous JavaScript and X ML (AJAX), a technique for creating better, faster, and more interactive web applications, which helped transition of the old concept of static web pages into a method for deploying interactive web applications. The common gateway interface (CGI) became the first standard environment used to generate dynamic web pages, with the use of CGI for website processing becoming known as web applications 43 . The introduction of CGI led to the appearance of other web application development tools such as PHP, Perl, Java Server Pages (JSP), JavaScript, and VBScript 43 .…”

Section: Background and Related Workmentioning

confidence: 99%

See 1 more Smart Citation

An empirical comparison of commercial and open‐source web vulnerability scanners

et al. 2020

View full text Add to dashboard Cite

Web vulnerability scanners (WVSs) are tools that can detect security vulnerabilities in web services. Although both commercial and open-source WVSs exist, their vulnerability detection capability and performance vary. In this paper, we report on a comparative study to determine the vulnerability detection capabilities of eight WVSs (both open and commercial) using two vulnerable web applications: WebGoat and Damn vulnerable web application (DVWA). The eight WVSs studied were: Acunetix; HP WebInspect; IBM AppScan; OWASP ZAP; S ; Arachni; Vega; and Iron WASP. The performance was evaluated using multiple evaluation metrics: precision; recall; Youden index; OWASP web benchmark evaluation (WBE); and the web application security scanner evaluation criteria (WASSEC). The experimental results show that, while the commercial scanners are effective in detecting security vulnerabilities, some open-source scanners (such as ZAP and Skipfish) can also be effective. In summary, this study recommends improving the vulnerability detection capabilities of both the open-source and commercial scanners to enhance code coverage and the detection rate, and to reduce the number of false-positives.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Background and Related Workmentioning

confidence: 99%

An empirical comparison of commercial and open‐source web vulnerability scanners

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Then Appelt et al research mutation testing on SQL injection input values so that it can generate random input to detect the existing vulnerable SQL on the website (Appelt, Nguyen, Briand, & Alshahwan, 2014). Patil et al do research to improve efficiency when scanning vulnerabilities while maintaining low false positives and false negatives (Patil, Marathe, & Padiya, 2016). To analyze the target, Patil's research uses a black box testing approach.…”

Section: B Blind Sql Injectionmentioning

confidence: 99%

Study the Best PenTest Algorithm for Blind SQL Injection Attacks

Nugroho

Mandala

2020

ijoict

View full text Add to dashboard Cite

<p>There are several types of SQL injection attacks. One of the most popular SQL Injection Attacks is Blind SQL. This attack is performed by exploiting a gap in the database server when executing query words. If the server responds to an invalid query, the attacker will then reverse the engineering part of the SQL query, which is obtained from the error message of the server. The process of generating a blind SQL injection attack is complicated. As a result, a Pentester often requires a long time to penetrate the database server. This research provides solutions to the problems above by developing the automation of a blind SQL injection attack. The method used in this research is to generate keywords, such as the database name and table name so that the attacker can retrieve information about the user name and password. This research also compares several search algorithms, such as linear search, binary search, and interpolation search for generating the keywords of the attack. Automation of the Blind SQL Injection was successfully developed, and the performance of the keywords generation for each algorithm was also successfully measured, i.e., 1.7852 seconds for Binary Search, 1.789 seconds for interpolation and 1.902 seconds for Linear Search.</p>

show abstract

“…It became the first standard environment which generates dynamic web pages. It must be noted that the use of CGI for website processing is called Web Application [1].after CGI, there are a lot of web application development tools such as PHP, Active Server Pages (ASP), Perl, Java Server Pages (JSP), JavaScript, VBScript, etc. Some of the broad categories of web application technologies are communication protocols, formats, server-side and clientside scripting languages, browser plug-ins, and web server API and Others framework which are flexible and powerful solution for transforming and managing data within web application as shown in the figure 1 Fig: 1 Flow of development for web application…”

Section: Background Of the Study 31 Overviewmentioning

confidence: 99%

“…The inevitable use of web application in our daily life have also attracted the attention of hackers and intruders whose aim is to target the weaknesses in these databases and exploit it maliciously making the functioning of most web application inefficient and ineffective. The cause of a number of vulnerabilities exploited by these unscrupulous people stems from design flaws or an implementation bugs [1] [2]. There exist a number of vulnerabilities including command injection, buffer overflow, data manipulation, path manipulation, authentication, session hijacking, cookie misinterpretation, and others [3].…”

Section: Introductionmentioning

confidence: 99%

An Integrated Approach for Detecting Security Vulnerabilities in Web Applications: A Theoretical Perspective

Amankwah¹,

Kwaku²,

Korkor³

et al. 2018

IJCA

View full text Add to dashboard Cite

Software security vulnerability is a flaw in a software product that could compromise the integrity, availability, or confidentiality of a software system. The growth and development of software have brought about a corresponding increase in vulnerabilities, which has necessitated the need to develop software security assurance tool that can detect and prevent these vulnerabilities. Previous studies have suggested both commercial and open source tools such as Ashcan, Web Inspect, Web King, Skipfish, and OWASP ZAP just to mention but a few to help mitigate against this security gaps. However, each of this approach has its merits and demerits in detecting vulnerabilities. As a result, this paper seeks to develop a more proactive approach which is a merger or integration of the strength of existing techniques into one system: An integrated web vulnerability detector scanner: which is a software assurance tool for detecting vulnerabilities in web application. The analysis involves presenting a general overview of web application, web application scanners and web application vulnerabilities. Lastly, we present the theoretical framework for detecting web application vulnerabilities based on the proposed model. The preliminary findings show that the concept is feasible within the domain of vulnerability detection

show abstract

Design of efficient web vulnerability scanner

Cited by 7 publications

References 5 publications

An empirical comparison of commercial and open‐source web vulnerability scanners

An empirical comparison of commercial and open‐source web vulnerability scanners

Study the Best PenTest Algorithm for Blind SQL Injection Attacks

An Integrated Approach for Detecting Security Vulnerabilities in Web Applications: A Theoretical Perspective

Contact Info

Product

Resources

About