Defensive programming: Developing a web application with a secure coding practices

All projects conducted in both the OWASP (Open Web Application Security Project) and the WASC (Web Application Security Consortium) are open-projects in which a company and an individual have voluntarily participated with a vision for web application security. Specifically, these open type projects have studied the web application vulnerabilities and thus have provided their results. Therefore, all these projects can be considered as very influential open-projects. This paper will examine overall introduction of the OWASP and the WASC and then, the major features of their different projects which have been currently conducting as analyzing the similarities and differences between the OWASP and the WASC. Based on the results, the study may suggest a type of synergetic effects from their cooperative work. Finally, with related to the web application security area, this research will discuss about the latest trends in industrial as well academic fields and further directions toward its development.KeywordsWeb service vulnerabilityOWASPWASC

Web application development is error prone and results in applications that are vulnerable to attacks by malicious users. The global accessibility of Web applications makes this an extremely serious problem. According to the Open Web Application Security Project (OWASP)’s top ten list that identifies the most serious web application vulnerabilities, the top three vulnerabilities in 2007 [84] were: (1) Cross Site Scripting (XSS) and (2) Injection Flaws (such as SQL Injection). Even after it has been widely reported that web applications suffer from these vulnerabilities, XSS and SQL Injection vulnerabilities remained among the top three vulnerabilities listed in OWASP’s top ten list in 2010 [85] and 2013 [86].

The powerful Open Web Application Security Project (OWASP)-Zed Attack Proxy (ZAP) tool secures web applications with extensive security testing. Its main goal is to find and fix web application vulnerabilities before they can be exploited. The goal is to improve web application security using OWASP ZAP scans and inspections. Simulating SQL injection and cross-site scripting attacks using the tool reveals an application's security flaws. OWASP ZAP automates testing to protect sensitive data and web application integrity. The purpose is to protect online applications from attacks to reduce security breaches and ensure industry compliance. Modern online applications' security and dependability depend on OWASP ZAP's systematic vulnerability discovery and mitigation. By enhancing scan performance and providing actionable security information, the experimental results show that the OWASP ZAP helps safeguard online applications and reduce the danger of cyberattacks. The objective is to enhance its skills to provide comprehensive, prompt, dependable security evaluations across various situations.

The adoption of digital technologies in healthcare is growing rapidly, and with it, the associated cybersecurity risks are also increasing. In particular, web applications, which can be used to manage and share sensitive health and personal information, require strong security measures to prevent data breaches and ensure compliance with regulatory standards. This paper investigates the applicability of the Open Web Application Security Project (OWASP) guidelines in the healthcare domain. Through a literature review, we identified the most common security requirements considered and used in Digital Health (DH) technologies and assessed their alignment with OWASP Application Security Verification Standard (ASVS). Furthermore, a questionnaire, involving Italian healthcare facilities and Information Technology (IT) companies operating in the healthcare sector, highlighted a significant gap between the availability of security standards and guidelines, and their actual knowledge and use in practice. Based on these findings, we propose a context-aware tool that guides developers and testers in applying OWASP standards throughout the software development lifecycle. The proposed tool aims to provide tailored security recommendations, structured checklists, and test planning based on application context, offering a practical bridge between frameworks and real-world adoption in clinical environments.

Impedance mismatch of data flow is the major problem in the relational database when one is using the web based application development on the computer system. It effects the development of scalable and reusable web application. Due to this, the research cost of development and maintenance increases. Therefore the present work is an attempt towards an object-oriented database system by using Db4o to overcome the impedance mismatch problem. In the current work, the development of web application for Indian Postal Services by using Db4o is demonstrated on dot NET platform. Before developing the application, the authors used a Unified Modeling Language (UML) model in the form of UML class, sequence and use-case diagrams. The Db4o is used to store the object-oriented database and the performance of Db4o is observed through several object-oriented queries and corresponding results are demonstrated.

Various information can be found on the internet by accessing the website. Information on the internet should be guaranteed integrity and service / layananya from the source to the user. In website development, technology profile, access speed, and security is a factor that must be taken to ensure that the information and services contained therein can be useful for the user. Internet network is public and global, at the time of service of data sent from one computer to another on the Internet, the data will pass through a number of computers. Denial-of-Service Attack is one of the attacks on web security system which can inhibit the activity of the working of a service or turn it off, so the user has the right / interest can not use these services as expected. Services web application has vulnerability to an attack. One way to detect security flaws in web applications is to use a search application security loopholes. OWASP (Open Web Application Security Project) capable of searching for security loopholes website. There are some striking technique, among others: Cross Site Scripting, Injection, Malicious File Execution, Insecure Direct Object Reference and others. Results from this study is the method of coping and prevention techniques of Denial Of Service Attack, and improved service website. Keywords: Technology profile, OWASP, Denial Of Service Attack.

Web application is the base of online businesses through the Internet. The emergence of COVID 19 forced almost every job to operate online so as to bridge the distance amongst individuals. The rapid increment in the needs of web application increases security threats on information and data. According to the Open Web Application Security Project, Structured Query Language Injection Attack (SQLIA) is a top security threat for web application. SQLIA inserts malicious code to gain access or to manipulate database information by cheating the server to bypass the code to the database, thereby causing a severe impact on web application. In this paper, permutation encoding method has been proposed to prevent SQLIA, which is based on encoding all database information using the proposed method. Initially, a special character is inserted to restrict the method from reversing. Subsequently, permutation encoding method is applied. Permutation refers to the method wherein the bit location is changed within three characters and then radix encoding is applied. Permutation is based on the primitive root value. Encoding has been used to hide permutation. The proposed method is implemented and tested using PHP and MySQL databases, where the proposal result has been compared with those of other proposal methods. The results with security analysis prove that the proposal method prevents SQLIA and protects database information.

-- OWASP (Open Web Application Security Project) version 4 issued by a non-profit organization called owasp.org which is dedicated to the security of web-based applications. This systematic review is intended to review whether the Open Web Application Security Project (OWASP) method is widely used to detect security in a website-based Information System. In this systematic review, we review 3 literature from several publisher sources and make a comparison regarding OWASP version 4 results and the security level of a web server from the publisher's source.Keywords— OWASP, Website Vulnerability, Website Security Detection

Research into web application security is still in its initial phase. In spite of enhancements in web application development, large numbers of security issues remain unresolved. Login attacks are the most malevolent threats to the web application. Authentication is the method of confirming the stated identity of a user. Conventional authentication systems suffer from a weakness that can compromise the defense of the system. An example of such vulnerabilities is login attack. An attacker may exploit a pre-saved password or an authentication credential to log into web applications. An added problem with current authentication systems is that the authentication process is done only at the start of a session. Once the user is authenticated in the web application, the user's identity is assumed to remain the same during the lifetime of the session. This chapter examines the level login attacks that could be a threat to websites. The chapter provides a review of vulnerabilities, threats of login attacks associated with websites, and effective measures to counter them.

The delivery of a framework in place for secure application development is of real value for application development teams to integrate security into their development life cycle, especially when a mobile or web application moves past the scanning stage and focuses increasingly on the remediation or mitigation phase based on static application security testing (SAST). For the first time, to the author’s knowledge, the industry-standard Open Web Application Security Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous software errors are synced up in a matrix with Checkmarx vulnerability queries, producing an application security framework that helps development teams review and address code vulnerabilities, minimise false positives discovered in static scans and penetration tests, targeting an increased accuracy of the findings. A case study is conducted for vulnerabilities scanning of a proof-of-concept mobile malware detection app. Mapping the OWASP/SANS with Checkmarx vulnerabilities queries, flaws and vulnerabilities are demonstrated to be mitigated with improved efficiency.

Over the years, injection vulnerabilities have been at the top of the Open Web Application Security Project Top 10 and are one of the most damaging and widely exploited types of vulnerabilities against web applications. Structured Query Language (SQL) injection attack detection remains a challenging problem due to the heterogeneity of attack loads, the diversity of attack methods, and the variety of attack patterns. It has been demonstrated that no single model can guarantee adequate security to protect web applications, and it is crucial to develop an efficient and accurate model for SQL injection attack detection. In this paper, we propose synBERT, a semantic learning-based detection model that explicitly embeds the sentence-level semantic information from SQL statements into an embedding vector. The model learns representations that can be mapped to SQL syntax tree structures, as evidenced by visualization work. We gathered a wide range of datasets to assess the classification performance of the synBERT, and the results show that our approach outperforms previously proposed models. Even on brand-new, untrained models, accuracy can reach 90% or higher, indicating that the model has good generalization performance.

Web applications are essential to the digital world but remain susceptible to common threats like SQL Injection (SQLi) and Cross-Site Scripting (XSS). Automated vulnerability scanners are vital for security, yet many current solutions are too slow and resource-intensive. This makes them impractical for rapid development cycles or for integration into modern Software-Defined Security (SDS) systems. This paper proposes that focused, lightweight scanners are wellsuited as specialized modules within SDS, offering quick, targeted feedback for immediate security policy enforcement. To demonstrate this, we developed a lightweight, Pythonbased automated vulnerability scanner. Its design emphasizes a focused, modular architecture, using Python’s efficient processing and minimal libraries for enhanced performance. We quantitatively assessed its effectiveness, benchmarking detection speed and accuracy (true positive and false positive rates) against the Open Web Application Security Project Zed Attack Proxy (OWASP Zed) Attack Proxy on a standard vulnerable test site. Results show a significant performance improvement: the scanner reduced average scan time from about 55 minutes to just 58.7 seconds. In terms of accuracy, it successfully identified and confirmed an exploitable SQL Injection vulnerability with a low false positive rate. This research confirms that a targeted, lightweight approach can effectively close the performance gap in automated scanning, providing a practical solution for environments needing fast feedback, like Continuous Integration and Continuous Delivery (CI/CD) pipelines. Future work will expand its coverage to include more complex vulnerabilities while retaining its performance benefits.

In recent years, there has been a demand for Web applications with complex functions. In addition, most web applications efficiently manage data based on databases. While the key and critical dimension of developing these Web applications is analysis and design, most object-oriented analysis and design methods do not have a consistent view of the database. In addition, Java Enterprise Edition (EE) -based technologies are used in Web application implementations, but they do not provide any correlation with the database. On the other hand, as users' demands for security increase, security becomes more important. To this end, Java EE and database systems provide security solutions. However, it does not provide any correlation with object-oriented analysis and design methodology. As a result, it is difficult to develop secure web applications in a consistent way from analysis to implementation. In this paper, we propose a consistent software development methodology from analysis to implementation of secure web applications. The proposed software development methodology for web application development uses UMLsec, a security-emphasized modeling language, and object-relational (O-R) mapping for relational database design. It also uses Java servlets and SQL to implement analysis and design results based on role-based access control (RBAC). The software development methodology for the secure web application proposed in this paper has been applied to the development of the online banking system, from the design stage of the user's requirements analysis to the implementation of the web application.

In the development and design of Web application, the choice of framework development is very important. A good framework development can speed up the development of Web application, reduce development costs and the workload of developers. Meanwhile, Web application has good expansibility and portability. The framework based on SpringMVC + Spring + Mybatis (SSM) has good performance and rapid development efficiency, gradually becoming a mainstream development framework of Web application.

In Current scenario, many Web applications go through rapid development phases like adopting agile methodology of development with very short turnaround time, making it difficult to identify and eliminate vulnerabilities. This paper provides analysis of requirement of Secure Development and Web application security assessment mechanisms in order to identify poor coding practices that render Web applications vulnerable to attacks such as SQL injection and cross-site scripting. This paper also list out the different categories of vulnerability with the small examples along with prevention guidance and a sample of research by different vendors about the State of Software Security Report and Web Application Vulnerability Statistics of 2012. This paper reviews need of secure development, resource s available for creating secure Web applications. These resources ranges from the security features of the development, to automated tools evaluating an existing Web application, to Web sites dedicated to all facets of Web application security. In Web application security, making one single mistake can lead to many unwanted flaws. By using the different resources available, the risk of the applications to be vulnerable can be reduced to an acceptable level. In addition, some risk can be avoided at the very beginning of the project life cycle when the requirements for the system are defined.