Vulnerability Assessment and Penetration Testing (VAPT) Framework: Case Study of Government’s Website

Abstract

Information security often neglected by individual or employee or even by the enterprise, with there is no proper strategy to raise awareness, promote consistency and maintain performance regarding protect sensitive, confidential, and critical data. One of the common techniques used is a vulnerability assessment and penetration testing (VAPT) to assure the security strategy has been implemented into the computer system by analyzing both its strength and weakness. SQL plays an essential role in the Relation Database Management System (RDBMS) and its relationship to the existence of a website and its flexible operation because of its simplicity and integrity. To anticipate these types of threats or other Internet attacks, a goal-oriented penetration test that has a framework is recommended to identify specific types of vulnerabilities that lead to business concessions and to avoid the risks that adversely affect the enterprise Thus. This study conducts VAPT to uncover the possibility of threats and evaluate the potential impact to be reported to the system owner through a proper engagement framework that allows systematic measurement. Government websites have been identified for this purpose of the research to show the current trend that occurred in cyber communities, especially in Indonesia. This study has found various vulnerabilities lies in the directory listing, full path disclosure, PHP info disclosure, folder webserver disclosure, and other potential threats, which present 2 (two) critical, 6 (six) medium, and 2 (two) low level of risk.

Vulnerability and risk assessment for operating system (OS) with framework STRIDE: comparison between VulnOS and Vulnix

“…Then, tampering occurs when attackers modify or edit official information and repudiation occurs at the time of someone execute certain action while later on try to claim the otherwise. It usually comes down to the specific activity process such as credit card transactions where users buy something and then claim they did not to obtain certain benefit [15]- [18]. On information disclosure, data breaches or unauthorized access to confidential information and denial of service (DoS) related to creating service interruptions for legitimate users and most recently related to elevation of privilege to gain higher privileged access to system elements 1645 by users with limited authority.…”

Mitigating Security Risks in Firewalls and Web Applications using Vulnerability Assessment and Penetration Testing (VAPT)

“…Furthermore, it highlights the significance of VAPT tools in streamlining the assessment and exploitation of vulnerabilities. Ahmad et al [5] conducted a study on the Vulnerability Assessment and Penetration Testing (VAPT) Framework, focusing on the case study of a government website. In this research, VAPT is highlighted as a technique to analyze the strengths and weaknesses of computer systems to ensure the implementation of security measures.…”

“…Almaarifa et al [5] propose a systematic VAPT framework to identify and prioritize vulnerabilities, demonstrating its effectiveness through a case study. This approach uncovers various security risks, from directory listings to critical SQL injections, highlighting the importance of regular VAPT practices to protect sensitive data and strengthen digital infrastructure against cyber threats.…”

Investigating the Security Threats on Using M-Payment Applications in Saudi Arabia: Exploratory Study

“…The biggest challenge for most mobile systems is related to cybersecurity threats, as mobile payments can be affected by cyber-attacks and require sophisticated approaches to achieve the desired security [9]. It is necessary to mitigate cyber dangers and threats [16]. Ease of use and trust influence the attitude toward using e-payment systems [17].…”