Nscanner: Vulnerabilities Detection Tool for Web Application

Today almost all organizations have changed their traditional systems and have improved their performance using web-based applications. This process will make more profit and at the same time will increase the efficiency of their activities through customer support services and data transactions. Usually, web application take inputs from users through web form and send this input to get the response from database. Modern web-based application use web database to store all critical information such as user credentials, financial and payment information, company statistics etc. However error in validation of user input can cause database vulnerable to Structured Query Language Injection (SQLI) attack. By using SQLI attack, the attackers might insert malicious code in the user input and trying to gain access to the confidential and sensitive data from database. Security tester need to identify the appropriate test cases before starting exploiting SQL vulnerability in web-based application during testing phase. Identifying the test cases of a web application and analyzing the test results of an attack are important parts and consider as critical issues that affects the effectiveness of security testing. Thus, this research focused on the developing a framework for testing and detecting SQL injection vulnerability in web application. In this research, test cases will be generated automatically based on SQLI attack pattern and then the results will be executed automatically based on generated test cases. The primary focus in this paper is to develop a framework to automate security testing based on input injection attack pattern. To test our framework, we install a vulnerable web application and test result shows that the proposed framework can detect SQLI vulnerability successfully.

Phishing is a web-based attack where users are allured to visit fake websites and provide their personal information. Traditional anti-phishing tools are successful to mitigate the attack partially. Most of the tools are focused on protecting users. However, there exists lack of efforts to help anti-phishing professionals who manually verify a reported phishing site and take further actions. Moreover, current tools cannot detect phishing attacks that leverage vulnerabilities in trusted web applications such as cross site scripting. An attacker might generate input forms by injecting script code and steal credentials. This paper attempts to address these issues by leveraging traditional web application testing method which can be seen as a complementary effort to current anti-phishing techniques. We consider a suspected website as a web application and test the application based on a behavior model. The model is described using the notion of Finite State Machine (FSM) that captures submission of forms with fake inputs and corresponding responses. We then identify several heuristic coverage criteria to detect inconsistencies which lead to the conclusion that a website is phishing or real. We implement a tool named Phish Tester to automate the testing process. We evaluate the proposed approach with both phishing and real applications. The initial results show that the approach incurs negligible false negatives (less than 3%) and zero false positive for detecting phishing and real websites, respectively. The approach can be complementary to current anti-phishing tools to discover advanced phishing attacks.

Over the past decade, e-commerce creates exciting new opportunities for business but also brings new web application vulnerabilities and transaction security risks. A stream of news of phishing attacks, website spoofing, payment card skimming (credit /debit cards), fraud in online transactions, malware attack (malicious code attack of viruses, worms, Trojans, and bots), hacker/cracker infiltration, vandalism, identity theft and data breaches of payment card or bank details are increasingly reported. Web application security risk management, therefore, is essential for secure e-commerce online transactions, including order processing, payment transaction, banking and clearing processing. Therefore, the main purpose of this study was to propose a web application security risk management methodology to perform e-commerce web application security risk management, helping organizations understand and improve their e-commerce web application security risks. In order to achieve this purpose, the goal of this study has been two-fold: (1) How will organizations measure threat likelihood, impact consequence and severity of their e-commerce web application security risk? (2) What management methodology is required to prompt the e-commerce web application security vulnerabilities measurement and improvement? Using OWASP Top Ten Vulnerabilities as target items, the proposed management methodology is disciplined in a PDCA based ISO/IEC 27005 iterative process activities, integrating Common Criteria attack potential ratings as threat likelihood scales and the FIPS 199 impact categories as impact consequence scales to categorize severity of every e-commerce web application vulnerabilities. Following the proposed management procedure, all the critical e-commerce web application vulnerabilities can be reviewed, analyzed, prioritized and remedied effectively and efficiently, moving on again in a continuous cycle.

BackgroundPrimary Progressive Aphasia (PPA) is a clinical dementia syndrome characterized by progressive language decline. Access to care for individuals living with PPA is limited by a shortage of evidence‐based interventions and qualified clinicians. While technology‐supported approaches show promise in improving access to care, there has been no systematic exploration of the factors affecting web application use in this population. This study evaluated the usage and feasibility of an app‐based intervention through quantitative application engagement data and qualitative insights from semi‐structured post‐study interviews.MethodParticipants enrolled in Communication Bridge‐2 (NCT03371706, n = 95), a 12‐month NIH stage 2 randomized controlled trial of speech‐language therapy for PPA, were encouraged to complete app‐based home practice exercises five days per week for 30 minutes per day. Usage was measured by weekly logins and completed home practice exercises. Feasibility was assessed through semi‐structured post‐study interviews (PSI; n = 79). Multi‐methods analysis incorporated descriptive statistics and thematic coding of qualitative data.ResultOn average, participants logged into the app 5.88 times per week (SD=1.29, range 1.29‐18.90) to access exercises and educational materials across the ∼12‐month duration of the intervention. On average, users completed 13.7 home practice exercises (SD=5.95) across 3.99 days per week (SD=1.19). PSI dyadic reports indicated few technical challenges with the application (n = 76, 85%) with the most common issues including software updates (n = 12) or connectivity problems (n = 10). Most (n = 80, 90%) found the computer‐based format helpful, and many (n = 26, 29%) described the app as user‐friendly and intuitive after initial training. Participants highlighted the app's role in fostering confidence and motivation for home communication practice.ConclusionThis study demonstrates high usage and feasibility of web applications to support communication and language intervention in PPA. Importantly, all participants logged into the app and completed home practice exercises at least weekly. Most participants experienced minimal technical challenges and found the web‐based format easy to use following a brief technology orientation. These findings challenge assumptions about technology use in older adults with cognitive‐communication impairments and provide support for web applications as viable tools for supporting evidence‐based speech‐language home practice exercises and educational videos to individuals with PPA and their communication partners.

Web application vulnerability assessment and policy direction towards a secure smart government

Web applications have become an integral part of the daily lives of millions of users. Unfortunately, web applications are also frequently targeted by attackers, and critical vulnerabilities such as cross-site scripting and SQL injection are still common. As a consequence, much effort in the past decade has been spent on mitigating web application vulnerabilities. Current techniques focus mainly on sanitization: either on automated sanitization, the detection of missing sanitizers, the correctness of sanitizers, or the correct placement of sanitizers. However, these techniques are either not able to prevent new forms of input validation vulnerabilities such as HTTP Parameter Pollution, come with large runtime overhead, lack precision, or require significant modifications to the client and/or server infrastructure. In this paper, we present IPAAS, a novel technique for preventing the exploitation of cross-site scripting and SQL injection vulnerabilities based on automated data type detection of input parameters. IPAAS automatically and transparently augments otherwise insecure web application development environments with input validators that result in significant and tangible security improvements for real systems. We implemented IPAAS for PHP and evaluated it on five real-world web applications with known cross-site scripting and SQL injection vulnerabilities. Our evaluation demonstrates that IPAAS would have prevented 83% of SQL injection vulnerabilities and 65% of cross-site scripting vulnerabilities while incurring no developer burden.

Cross-site scripting (XSS) vulnerabilities are significant threats to web applications. The number of XSS vulnerabilities reported has increased annually for the past three years, posing a considerable challenge to web application maintainers. Black-box scanners are mainstream tools for security engineers to perform penetration testing and detect XSS vulnerabilities. Unfortunately, black-box scanners rely on crawlers to find input points of web applications and cannot guarantee all input points are tested. To this end, we propose a grey-box fuzzing method based on reinforcement learning, which can detect reflected and stored XSS vulnerabilities for Java web applications. We first use static analysis to identify potential input points from components (i.e., Java code, configuration files, and HTML files) of the Java web application. Then, an XSS vulnerability payload generation method is proposed, which is used together with the reinforcement learning model. We define the state, action, and reward functions of three reinforcement learning models for XSS vulnerability detection scenarios so that the fuzz loop can be performed automatically. To demonstrate the effectiveness of the proposed method, we compare it against four state-of-the-art web scanners. Experimental results show that our method finds all XSS vulnerabilities and has no false positives.

In the recent time we have witnessed an expansion of web applications, which are offering a wide range of public and business services. The web applications are efficient and convenient, however, increasing number of new security threats is a risk for both users of web applications and the companies which are offering their services through web applications. In order to defend against these threats, it is important to understand both the vulnerabilites of the web applications and the new types of attacks.

As more and more mobile devices are emerging in the market, we are rapidly entering a multi-device digital world where we expect to have a seamless cross-device experience, e.g., moving elements and functionalities from one device to another device without any interruption, controlling one device from another device remotely, or sharing and synchronizing content and user interactions on multiple devices simultaneously. These cross-device operations are highly desirable to users in web applications, but unfortunately they are not supported by existing application frameworks. In this paper, we propose a virtual browser which can facilitate cross-device operations according to a pre-defined hint file for enabling multi-device web applications. By splitting a single DOM tree into multiple sub-DOM trees, our proposed virtual browser is able to dynamically manage sub-views on multiple devices and logically link them into a single virtual page environment. As compared to existing frameworks, our virtual browser allows developers to build new multi-device web applications or port their existing web applications into a multi-device environment with much less effort.

Based on OWASP, code injection is one of the top lists of security risks. Structured Query Language (SQL) Injection is one of these types of attacks. SQL injection attack is an attack by spoofing the server to execute malicious code. The main object of this paper is to identify relevant works about deep learning methods to detect SQL-Injection on web applications. To achieve that, we conduct a survey review of the literature. In this study, we provide a review of 14 studies using deep learning algorithms to detect SQL Injection on web applications and it provides a comparison between them. Deep learning has great potential in threat intelligence detection.

The web Application For Information Systems And Transactions For Teaching Materials (SITTA) is an application that is used to support operational activities in the distribution service of teaching materials at State Universities of the Open University. The SITTA web application can be accessed on the https://distributions.ut.ac.id/ website with internal access to UT at the center and UPBJJ (Distance Learning Program Unit). The SITTA web application was used by UT employees as users of the SITTA web application, which was used recently because the SITTA web application was only implemented in early 2018. Therefore, it was deemed necessary to test its usability. This is to assess the success of the usability aspect of an information system application while at the same time knowing that the application can be useful and has been by its function or not for user needs. One of the tests that can be done is usability testing. This test is carried out using the USE Questionnaire method using 4 aspects of testing. 4 aspects tested are aspects of Usefulness, Satisfaction, and Ease of Use. The purpose of this paper is to determine user acceptance of the SITTA web application based on usability criteria. This research is a quantitative descriptive type that is carried out on users of the SITTA web application by distributing a USE Questionnaire consisting of 30 questions and using 5 points of assessment on a Likert Scale. This study obtained the results of measuring the usability of the SITTA web application with a score of 88.10% on the measurement of the usefulness aspect, 78.29% on the ease of use, 82.14% on the ease of learning, and 81.26% on the satisfaction aspect. satisfaction.

Most people in the industrial world use a wide variety of web applications daily with the majority being insecure and vulnerable. This gives hackers the opportunity to steal data from the user’s web application, which may contain sensitive information. Vulnerability detection may be conducted by a rigorous penetration test. A penetration tester’s duty is to define and exploit the web applications’ vulnerabilities.This paper describes a technique for automatic vulnerable web application generation application. Firstly, the prepared web application is sent to the tool to create the vulnerable web application version. This tool does this by the injection of Cross Site Request Forgery (CSRF) and Cross Site Scripting (XSS) into the web application. Different variant vulnerabilities may be injected too, so different methods are needed, in order to exploit vulnerabilities dependent on the variant. One of the tool’s tasks is to produce web applications, which will be used to train the penetration testers.

Strong security in web applications is critical to the success of your online presence. Security importance has grown massively, especially among web applications. Dealing with web application or website security issues requires deep insight and planning, not only because of the many tools that are available but also because of the industry immaturity. Thus, finding the proper tools requires deep understanding and several steps, including analyzing the development environment, business needs, and the web applications’ complexity. In this paper, we demonstrate the architecture of web applications then list and evaluate the widespread security vulnerabilities. Those vulnerabilities are: Fingerprinting, Insufficient Transport Layer Protection, Information Leakage, Cross-Site Scripting, SQL Injection, and HTTP Splitting. In addition, this paper analyzes the tools that are used to scan for these widespread vulnerabilities in web applications. Finally, it evaluates tools due to security vulnerabilities and gives recommendations to the web applications’ users and administrators aiming to educate them.

Web technologies are typically built with time constraints and security vulnerabilities. Automatic software vulnerability scanners are common tools for detecting such vulnerabilities among software developers. It helps to illustrate the program for the attacker by creating a great deal of engagement within the program. SQL Injection and Cross-Site Scripting (XSS) are two of the most commonly spread and dangerous vulnerabilities in web apps that cause to the user. It is very important to trust the findings of the site vulnerability scanning software. Without a clear idea of the accuracy and the coverage of the open-source tools, it is difficult to analyze the result from the automatic vulnerability scanner that provides. The important to do a comparison on the key figure on the automated vulnerability scanners because there are many kinds of a scanner on the market and this comparison can be useful to decide which scanner has better performance in term of SQL Injection and Cross-Site Scripting (XSS) vulnerabilities. In this paper, a method by Jose Fonseca et al, is used to compare open-source automated vulnerability scanners based on detection coverage and a method by Yuki Makino and Vitaly Klyuev for precision rate. The criteria vulnerabilities will be injected into the web applications which then be scanned by the scanners. The results then are compared by analyzing the precision rate and detection coverage of vulnerability detection. Two leading open source automated vulnerability scanners will be evaluated. In this paper, the scanner that being utilizes is OW ASP ZAP and Skipfish for comparison. The results show that from precision rate and detection rate scope, OW ASP ZAP has better performance than Skipfish by two times for precision rate and have almost the same result for detection coverage where OW ASP ZAP has a higher number in high vulnerabilities.

Phishing is a social engineering attack which aims to manipulate people and encourage them to expose their confidential information. The most common methods and techniques used for phishing are emails, chats or websites. Furthermore, there are various types of phishing attacks, for instance, spear-phishing and smishing. Many solutions have been proposed to prevent and detect phishing attacks such as users' awareness methods and detection tools. However, phishing still on the top of attacks with a high number of victims. One of the main reasons is the lack of users' knowledge. This could have more severe effects on Arabic users as most of the proposed mitigation solutions have not considered Arabic users. Furthermore, there is an enormous lack of knowledge in computing and security. It is highly likely that they can be victimized using social engineering attacks. This paper presents a framework to protect against phishing attacks by enhancing the users' awareness to detect phishing attacks. The proposed framework has two major components, which are animation videos for training awareness and gamification part to assess the delivered knowledge.