Web Application Penetration Testing Using SQL Injection Attack

Alanda, Alde; Satria, Deni; Ardhana, M.Isthofa; Dahlan, Andi Ahmad; Mooduto, Hanriyawan Adnan

doi:10.30630/joiv.5.3.470

Cited by 14 publications

(3 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Also, [19] stated that 80 percent of the websites that underwent normal testing still had vulnerabilities to SQL injection attacks, indicating that this significant threat exists for web applications. Attackers can gain access to private data, including databases, through flaws in web programs.…”

Section: Owasp Top 10mentioning

confidence: 99%

Common Vulnerabilities and Exposures Assessment of Private Higher Educational Institutions Using Web Application Security

Ellen F. Mangaoang

2024

jes

View full text Add to dashboard Cite

The advancements in technology has led to advancements in threats and vulnerabilities as well. Academic websites are not spared from this. This study aims to evaluate the common vulnerabilities and exposures of private higher educational institution’s website using Open Web Application Security Project. Seven private higher education institutions were evaluated using Open Web Application Security Project Zed Attack Proxy and Open Web Application Security Project top 10. The top vulnerabilities the higher educational institutions were exposed to were broken access control, insecure design and software and data integrity failures. There were two higher educational institutions with high level of risks. Also, a total of thirty-two risks or vulnerabilities were identified in the study. The identification of vulnerabilities or exposures in websites will help the private schools to become aware of possible cyberattacks to their institution’s website. This will help the institution to identify and prevent further loss or damage.

show abstract

Section: Owasp Top 10mentioning

confidence: 99%

Common Vulnerabilities and Exposures Assessment of Private Higher Educational Institutions Using Web Application Security

Ellen F. Mangaoang

2024

jes

View full text Add to dashboard Cite

show abstract

“…Not handling special sign characters, such as single quotes (') or double minuses (−), which might enable an application to inject SQL instructions, is what leads to SQL injection, which allows an attacker to input SQL commands into a parameter or form [19]. Additional harmful attacks that SQL injections can carry out include updating, deleting, and inserting data by executing server-side commands that can take and install malicious software such as viruses, exporting valuable information such as emails and passwords to the attacker's remote server, and obtaining user login information [20].…”

Section: Sql Injectionmentioning

confidence: 99%

The Reality of Internet Infrastructure and Services Defacement: A Second Look at Characterizing Web-Based Vulnerabilities

et al. 2023

View full text Add to dashboard Cite

In recent years, the number of people using the Internet has increased worldwide, and the use of web applications in many areas of daily life, such as education, healthcare, finance, and entertainment, has also increased. On the other hand, there has been an increase in the number of web application security issues that directly compromise the confidentiality, availability, and integrity of data. One of the most widespread web problems is defacement. In this research, we focus on the vulnerabilities detected on the websites previously exploited and distorted by attackers, and we show the vulnerabilities discovered by the most popular scanning tools, such as OWASP ZAP, Burp Suite, and Nikto, depending on the risk from the highest to the lowest. First, we scan 1000 URLs of defaced websites by using three web application assessment tools (OWASP ZAP, Burp Suite, and Nikto) to detect vulnerabilities which should be taken care of and avoided when building and structuring websites. Then, we compare these tools based on their performance, scanning time, the names and number of vulnerabilities, and the severity of their impact (high, medium, low). Our results show that Burp Suite Professional has the highest number of vulnerabilities, while Nikto has the highest scanning speed. Additionally, the OWASP ZAP tool is shown to have medium- and low-level alerts, but no high-level alerts. Moreover, we detail the best and worst uses of these tools. Furthermore, we discuss the concept of Domain Name System (DNS), how it can be attacked in the most common ways, such as poisoning, DDOS, and DOS, and link it to our topic on the basis of the importance of its infrastructure and how it can be the cause of hacking and distorting sites. Moreover, we introduce the tools used for DNS monitoring. Finally, we give recommendations about the importance of security in the community and for programmers and application developers. Some of them do not have enough knowledge about security, which allow vulnerabilities to occur.

show abstract

“…The Open Web Application Security Project (OWASP) puts SQL injection as the top 10 vulnerabilities [5]. The list order of the top 10 vulnerabilities is SQL Injection, broken authentication, sensitive data exposure, XML external entities (XXE), broken access control, security misconfiguration, cross-site scripting (XSS), insecure deserialization, using components with known vulnerabilities, and insufficient logging and monitoring [6], [7]. Furthermore, phishing typically uses fake emails to trick targets into visiting malicious links [8].…”

Section: Introductionmentioning

confidence: 99%

The Reliability Analysis for Information Security Metrics in Academic Environment

Ibnugraha

Satria

Nagari

et al. 2023

JOIV : Int. J. Inform. Visualization

View full text Add to dashboard Cite

Today, academic institution involves digital data to support the educational process. It has advantages, especially related to ease of access and process. However, security problems appear related to digital data. There were several information security incidents in the academic environment. In order to mitigate the problem, metrics identification is required to determine the risk of incidents. There are many risks model and metrics to estimate the risk, such as DREAD, OWASP, CVSS, etc. However, specific metrics are required to obtain appropriate risk values. Therefore, this study aims to define metrics for an academic institution. The proposed metrics are obtained from The Family Educational Rights and Privacy Act (FERPA) regulation. It consists of directory information, educational information, personally identifiable information, and risk of information leakage. In order to achieve the objective, this study involves survey and reliability analysis to result in output. The survey is conducted by involving 90 respondents with various levels of education and jobs. The Cronbach's alpha and Test-retest are methods to determine this study's reliability. According to reliability analysis, the Cronbach's alpha method results in coefficients for the metrics between 0.730 - 0.911, while the Test-retest method results in coefficients between 0.630 - 0.797. These coefficients have a reliable category, so the proposed metrics are adequate for determining risk of information security incidents in academic environments. The reliable metrics will be developed as variables of the risk assessment model for the academic environment in the future study.

show abstract

Web Application Penetration Testing Using SQL Injection Attack

Cited by 14 publications

References 13 publications

Common Vulnerabilities and Exposures Assessment of Private Higher Educational Institutions Using Web Application Security

Common Vulnerabilities and Exposures Assessment of Private Higher Educational Institutions Using Web Application Security

The Reality of Internet Infrastructure and Services Defacement: A Second Look at Characterizing Web-Based Vulnerabilities

The Reliability Analysis for Information Security Metrics in Academic Environment

Contact Info

Product

Resources

About