Penetration Testing on Sandbox environment

With the increasing reliance on web applications for business and personal use, ensuring website security has become a critical concern. Cyber threats such as SQL injection, cross-site scripting (XSS), malware infections, and unauthorized access pose significant risks to websites, leading to data breaches and service disruptions. This project aims to develop a comprehensive website security scanner that systematically identifies vulnerabilities and potential security risks.The proposed system integrates automated vulnerability scanning, penetration testing techniques, and real-time monitoring to detect security loopholes. Using machine learning and heuristic-based analysis, the scanner can identify malicious scripts, outdated software versions, weak authentication mechanisms, and misconfigured security policies. The system also performs network security assessments, analyzing potential DDoS (Distributed Denial-of-Service) attack risks and firewall configurations. The scanner generates detailed security reports, providing actionable insights and recommendations for website owners and administrators to mitigate risks effectively. Designed for continuous monitoring and proactive defense, the tool enhances cybersecurity resilience against evolving threats. This project contributes to web security advancements by offering an intelligent, automated, and scalable solution for safeguarding websites from cyberattacks. Keywords: Website Security | Vulnerability Scanner | Cyber Threats | SQL Injection | Cross-Site Scripting (XSS) | Penetration Testing | Machine Learning | Malware Detection | DDoS Protection | Authentication Security | Firewall Analysis | Web Application Security | Risk Assessment | Cybersecurity Resilience

A novel approach for service level management of corporate IT infrastructures is considered. Decomposition-compensation method of service level management of corporate IT infrastructures is proposed in this work. The method assumes the decomposition of tasks related to service level management and the compensation of negative impact of various factors by allocating extra resources for critical applications. The approach is based on the interaction of three integrated hierarchical processes—matching the level of services, resource planning, and service level management.

The subject of study in this article is modern penetration testing technologies, in which the test object is the implementation of a service based on a platform using Field Programmable Gate Array (FPGA) resources. The goal of this study is to improve modern methods of penetration testing of services provided by FPGA as a Service (FaaS) to find vulnerabilities for further fixing and increasing the level of services security and trust. Task: to analyze the technological capabilities for the development of FPGA as a Service; to analyze possible threats for FPGA as a Service platform; to analyze the structure of the FPGA as a Service platform and the peculiarities of attacks on it; to analyze options for using the penetration testing standard; to propose the classification of possible use of FPGA as a Service platform for solving of cybersecurity tasks; and to propose the sequence of critical components of ensuring of the cybersecurity of FPGA as a Service platform. The following results were obtained based on the tasks. The analysis of the capabilities of existing chips, FPGA accelerator cards, programming technologies, and the integrated environments of a leading company for creation of FPGA as a Service is performed. A study on the cybersecurity problems of FPGA as a Service platforms is conducted, and a set of components to ensure the cybersecurity of FPGA as a Service Platform is proposed. Modern cybersecurity threats of FPGA as a Service platforms are analyzed. A threat structure for FPGA as a Service is proposed. The possibility of applying a penetration testing standard to FPGA services is considered. Regular audits and penetration testing are crucial elements of a cybersecurity strategy and help maintain customer and user trust in FPGA services. Based on the analysis of the possible use of FPGA as a Service to solve cybersecurity tasks, a classification of five variants considering FPGA as an object and tool is proposed. The sequence of critical components of ensuring of the cybersecurity of FPGA as a Service platform is proposed to correspond to modern known threats. Complex activities, including the software updates, security monitoring, auditing, and penetration testing, based on security standards. Conclusions. The primary contribution and scientific novelty of the obtained results is the research into the possibilities of penetration testing for services, where the test object is a platform with access to FPGA. As in many other areas, ensuring the cybersecurity of FPGA as a Service platform is complex, and ignoring any component can lead to critical consequences. Applying only penetration testing is not enough; therefore, a comprehensive list of cybersecurity measures for FPGA as a Service platforms is provided, underlining the urgency and necessity of their implementation.

The increasing use of the internet is attributed to the growing reliance on web-based systems, as nearly every aspect of present-day life utilizes such systems. According to the HackerOne 2021 report, there has also been a rise in cyberattacks, particularly targeting web-based systems. One method of identifying vulnerabilities in web-based systems is through penetration testing. The conducted research involves the implementation of distributed penetration testing on web-based systems using the Dynamic Infrastructure Framework Axiom as a tool for constructing distributed infrastructure. The researchers tested three vulnerabilities: Cross-site Scripting (XSS), SQL Injection, and Arbitrary Code Injection. These three vulnerabilities are among the top ten most frequently identified vulnerabilities according to the HackerOne 2021 report. The results of the research reveal a significant difference in testing times between distributed and non-distributed automated penetration testing. Distributed automated penetration testing was notably faster compared to both non-distributed and non-automated penetration testing.

In this paper we propose a novel, network-based, distributed anomaly detection framework for smart phones. Our approach is based upon the distributed collection of arbitrary, static and dynamic smart phone features. Our approach is not limited to features that can be obtained directly on a device, but also includes features that are provided by other services running in the respective, corporate IT infrastructure (e.g. an IDS). Furthermore, we tag each collected feature with two kinds of information: (1) context-information and (2) trust-information. This way, anomaly detection methods are not limited to work on the actual feature values, but can also consider the context and the trustworthiness of collected features.

[Abstract]: Security of transactions in mobile commerce is moving away from an IT concern to a business concern because of potential loss of revenue to businesses due to lack of privacy, integrity or confidentiality, system slowdown or downtime. While most of the various security procedures are limited to corporate IT infrastructure, in mobile commerce, issues concerned with transaction security appear to have extended beyond the corporate network to embrace the complete business process. Any lapse in procedures that maintain confidentiality of data, or violation of privacy could affect corporate image and hence would impact customer relationships. Any adverse effect on customer relationship would negatively impact business revenue. In addition to existing security problems in a wired commerce environment, the emergence of mobile devices have renewed calls for addressing security threats to financial transactions. These problems are discussed in this paper as key issues in terms of organisation’s architectural and procedural approaches to security, reliability and availability of business transactions.

To facilitate the detection of various vulnerabilities, there are many different tools (scanners) that can help analyze the security of web applications and facilitate the development of their protection. But these tools for the most part can only identify problems, and they are not capable of fixing them. Therefore, the knowledge of the security developer is a key factor in building a secure Web resource. To resolve application security problems, developers must know all the ways and vectors of various attacks in order to be able to develop various protection mechanisms. This review discusses two of the most dangerous vulnerabilities in the field of Web technologies: SQL injections and XSS attacks (cross-site scripting – XSS), as well as specific cases and examples of their application, as well as various approaches to identifying vulnerabilities in applications and threat prevention. Cross-site scripting as well as SQL-injection attacks are related to validating input data. The mechanisms of these attacks are very similar, but in the XSS attacks the user is the victim, and in the SQL injection attacks, the database server of the Web application. In XSS attacks, malicious content is delivered to users by means of a client-side programming language such as JavaScript, while using SQL injection, the SQL database query language is used. At the same time, XSS attacks, unlike SQL injections, harm only the client side leaving the application server operational. Developers should develop security for both server components and the client part of the web application.

System penetration testing is an important measure of discovering information system security issues. This paper summarizes and analyzes the high-risk problems found in the penetration testing of the artificial storm prediction system for power grid storm disasters from four aspects: application security, middleware security, host security and network security. In particular, in order to overcome the blindness of PGRDAIPS current SQL injection penetration test, this paper proposes a SQL blind bug based on improved second-order fragmentation reorganization. By modeling the SQL injection attack behavior and comparing the SQL injection vulnerability test in PGRDAIPS, this method can effectively reduce the blindness of SQL injection penetration test and improve its accuracy. With the prevalence of ubiquitous power internet of things, the electric power information system security defense work has to be taken seriously. This paper can not only guide the design, development and maintenance of disaster prediction information systems, but also provide security for the Energy Internet disaster safety and power meteorological service technology support.

Web technologies are typically built with time constraints and security vulnerabilities. Automatic software vulnerability scanners are common tools for detecting such vulnerabilities among software developers. It helps to illustrate the program for the attacker by creating a great deal of engagement within the program. SQL Injection and Cross-Site Scripting (XSS) are two of the most commonly spread and dangerous vulnerabilities in web apps that cause to the user. It is very important to trust the findings of the site vulnerability scanning software. Without a clear idea of the accuracy and the coverage of the open-source tools, it is difficult to analyze the result from the automatic vulnerability scanner that provides. The important to do a comparison on the key figure on the automated vulnerability scanners because there are many kinds of a scanner on the market and this comparison can be useful to decide which scanner has better performance in term of SQL Injection and Cross-Site Scripting (XSS) vulnerabilities. In this paper, a method by Jose Fonseca et al, is used to compare open-source automated vulnerability scanners based on detection coverage and a method by Yuki Makino and Vitaly Klyuev for precision rate. The criteria vulnerabilities will be injected into the web applications which then be scanned by the scanners. The results then are compared by analyzing the precision rate and detection coverage of vulnerability detection. Two leading open source automated vulnerability scanners will be evaluated. In this paper, the scanner that being utilizes is OW ASP ZAP and Skipfish for comparison. The results show that from precision rate and detection rate scope, OW ASP ZAP has better performance than Skipfish by two times for precision rate and have almost the same result for detection coverage where OW ASP ZAP has a higher number in high vulnerabilities.

- In an era where web applications are increasingly targeted by sophisticated cyber threats, ensuring robust and continuous security testing has become essential. This paper presents Autopen Test, a real-time automated framework designed to identify and assess vulnerabilities in web applications with minimal human intervention. Autopen Test integrates dynamic analysis, intelligent crawling, and adaptive scanning techniques to detect common and complex security flaws such as SQL injection, cross-site scripting (XSS), and insecure configurations. By leveraging automation and real-time feedback mechanisms, the framework provides immediate insights into potential threats, significantly reducing the time between vulnerability discovery and mitigation. Extensive experiments demonstrate Autopen Test’s effectiveness and efficiency compared to existing tools, showcasing its potential as a valuable asset in modern DevSecOps pipelines. This research contributes a scalable and extensible solution to the field of web application security, emphasizing the importance of real-time, automated approaches in proactive vulnerability management. Key Words: Web Application Security, Automated Vulnerability Assessment, Real-Time Scanning, Autopen Test, Dynamic Analysis, Intelligent Crawling, Adaptive Scanning, SQL Injection, Cross-Site Scripting (XSS). DevSecOps.

The biggest challenge of Web application is the inestimable losses arising from security flaws. Two approaches were advanced by a number of scholars to provide security to Web space. One of such approach is vulnerability assessment, which is a conscious effort to isolate, identify and recognize potentials vulnerabilities exploited by attackers. The second being the estimation and determination of level of risks/threats posed to Web applications by vulnerabilities obvious to the developer (or tester); this is generally referred to as penetration testing. Recently, there is Vulnerability Assessment and Penetration Testing (VAPT) that combined these two schemes to improve safety and effectively combat the menace of attackers on Web applications. This paper proposed Fuzzy Classifier-based Vulnerability and Assessment Testing (FCVAPT) model to provide security for sensitive data/information in Web applications. Cross Site Scripting (XSS) and Structured Query Language (SQL) injections were selected for evaluation of proposed FCVAPT model. FCVAPT model’s classification performance for MSE, MAPE and RMSE were 33.33, 14.81% and 5.77% respectively. FCVAPT is considerably effective for detecting vulnerability and ascertaining the nature of threats/risks available to Web applications.

Gamification is the use of game mechanics in a non-gaming environment in order to solve problems and engage users. One of the problems that face corporate IT departments is the ongoing training and education of their employees such as programmers. The industry is changing so fast that it is difficult to find the time to keep everybody up-to-date with latest trends and techniques. This paper describes research into the use of gamification in mobile micro-learning in a corporate IT department. The IT department under research did most of its programming development in Java. The employees in the department ranged in education and training levels from some tertiary education up through two employees having PhDs. In an effort to keep all employees abreast of latest programming techniques and trends in addition to providing new training for some junior employees, a gamified approach to mobile micro-learning was implemented. The micro-learning was instantiated as Friday treasure hunts with clues and lessons being provided to the participants using QR codes.

XML-based SOAP Web Services are a widely used technology, which allows the users to execute remote operations and transport arbitrary data. It is currently adapted in Service Oriented Architectures, cloud interfaces, management of federated identities, eGovernment, or millitary services. The wide adoption of this technology has resulted in an emergence of numerous - mostly complex - extension specifications. Naturally, this has been followed by a rise in large number of Web Services attacks. They range from specific Denial of Service attacks to attacks breaking interfaces of cloud providers [1], [2] or confidentiality of encrypted messages [3]. By implementing common web applications, the developers evaluate the security of their systems by applying different penetration testing tools. However, in comparison to the wellknown attacks as SQL injection or Cross Site Scripting, there exist no penetration testing tools for Web Services specific attacks. This was the motivation for developing the first automated penetration testing tool for Web Services called WS-Attacker. In this paper we give an overview of our design decisions and provide evaluation of four Web Services frameworks and their resistance against WS-Addressing spoofing and SOAPAction spoofing attacks.

Red teaming is a well-established methodology for ensuring and augmenting cyber system security; however, the training, expertise, and knowledge of appropriate tools and techniques required to perform effective red teaming come with a significant cost in time and resources. Large organizations such as the Department of Defense (DOD) use vulnerability assessment to identify software patches and other remediations for cyber systems to mitigate cyberspace exploitation. If a patch cannot be applied in a timely manner, for instance to minimize network downtime, measuring and identifying the impact of such unpatched vulnerabilities is left to scarce red teaming services. These services typically concentrate on initial access exploitation, which stops short of exploring the larger security impacts of cyber threats performing post-exploitation actions. This gap in post-exploitation red team analysis results in increased susceptibility to adversary offensive cyberspace operations (OCO) against DOD systems. This research extends the Cyber Automated Red Team Tool (CARTT), developed at the Naval Postgraduate School, by implementing automated red team post-exploitation analysis. The intent of this extended capability is to reduce the workload on limited DOD red teams and penetration testers by providing system administrators with the ability to perform deeper system analysis for the impacts of exploited vulnerabilities.

As web applications is becoming more prominent due to the ubiquity of web services, web applications have become main targets for attackers. In order to steal or leak sensitive user data managed by web applications, attackers exploit a wide range of input validation vulnerabilities such as SQL injection, path traversal (or directory traversal), cross-site scripting (XSS), etc. This paper propose a technique that can verify input values of Java-based web applications using static bytecode instrumentation and runtime input validation. The technique searches for target methods or object constructors in compiled Java class files, and statically inserts bytecode modules. At runtime, the instrumented bytecode modules validate input values of the targets, and take countermeasure against malicious inputs. The proposed technique can mitigate the input validation vulnerabilities in Java-based web applications without source codes. To evaluate the effectiveness of the proposed technique, experiments are carried out with an insecure web application maintained by OWASP WebGoat Project. The experimental results show that the proposed technique successfully mitigates input validation vulnerabilities such as SQL injection and path traversal.