Penetration Testing Tool for Web Services Security

A prototype and demonstrator of Akogrimo’s architecture: An approach of merging grids, SOA, and the mobile Internet

Users of Web and grid services often must temporarily delegate some or all of their rights to a software entity to perform actions on their behalf. The problem with the typical grid services approach (X. 509 proxy certificates) is that commercial Web services tooling fails to recognize these certificates or process them properly. The security assertion markup language (SAML) is a standardized XML-based framework for exchanging authentication, authorization and attribute information. SAML has broadening commercial support but lacks delegation capabilities. To address this shortcoming, we exploit SAML's inherent extensibility to create a delegation framework for Web and grid services that supports both direct and indirect delegation. We develop a set of verification rules for delegation tokens that rely on WS-Security X.509 signatures, but do not force any trust relationship between the delegatee and the target service. We have implemented the framework on two common Web service hosting environments: Java/Tomcat and .NET. By leveraging existing Web services standards, we make it easier for Grid practitioners to build and consume Web and grid services without resorting to grid-specific protocols.

Web services – a new breed of self-contained, self-describing, modular applications published, located, and invoked across the Web – handle functions, from simple requests to complicated business processes. They are defined as network-based application components with a services-oriented architecture (SOA) using standard interface description languages and uniform communication protocols. SOA enables organizations to grasp and respond to changing trends and to adapt their business processes rapidly without major changes to the IT infrastructure. The Inaugural International Conference on Next-Generation Web Services Practices (NWeSP'05) attracted researchers who are also the world's most respected authorities on the semantic Web, Web-based services, and Web applications and services. NWeSP'05 was held in cooperation with the IEEE Computer Society Task Force on Electronic Commerce, the Technical Committee on Internet, and the Technical Committee on Scalable Computing. This special issue presents eight papers focused on different aspects of Web services and their applications. Papers were selected based on fundamental ideas and concepts rather than the thoroughness of techniques employed. Papers are organized as follows: <I>Taher et al.</I> present the first paper, on a Quality of Service Information and Computational framework (QoS-IC) supporting QoS-based service selection for SOA. The framework's functionality is expanded using a QoS constraints model that establishes an association relationship between different QoS properties and is used to govern QoS-based service selection in the underlying algorithm. Using a prototype implementation, the authors demonstrate how QoS constraints improve QoS-based service selection and save consumers valuable time. Due to the complex infrastructure of web applications, response times perceived by clients may be significantly longer than desired. To overcome some of the current problems, <I>Vilas et al.</I>, in the second paper, propose a cache-based extension of the architecture that enhances the current web services architecture, which is mainly based on program-logic or protocol-dependent optimization. In the third paper, Jo and Yoo present authorization for securing XML sources on the Web. One of the disadvantages of existing access control is that the DOM tree must be loaded into memory while all XML documents are parsed to generate the DOM tree, such that a lot of memory is used in repetitive search for tree to authorize access to all nodes in the DOM tree. The complex authorization evaluation process required thus lowers system performance. Existing access control fails to consider information structure and semantics sufficiently due to basic HTML limitations. The authors overcome some of these limitations in the proposed model. In the fourth paper, Jung and Cho propose a novel behavior-network-based method for Web service composition. The behavior network selects services automatically through internal and external links with environmental information from sensors and goals. An optimal service is selected at each step, resulting in a globally optimal service sequence for achieving preset goals. The authors detail experimental results for the proposed model by comparing them with rule-based system and user tests. <I>Kong et al.</I> present an efficient method in the fifth paper for merging heterogeneous ontologies – no ontology building standard currently exists – and the many ontology-building tools available are based on different ontology languages, mostly focusing on how to create, edit and infer the ontology efficiently. Even ontologies about the same domain differ because ontology experts hold different view points. For these reasons, interoperability between ontologies is very low. The authors propose merging heterogeneous domain ontologies by overcoming some of the above limitations. In the sixth paper, Chen and Che provide polynomial-time tree pattern query minimization algorithm whose efficiency stems from two key observations: (i) Inherent redundant "components" usually exist inside the rudimentary query provided by the user, and (ii) nonedundant nodes may become redundant when constraints such as co-occurrence and required child/descendant are given. They show that the algorithm obtained by first augmenting the input tree pattern using constraints, then applying minimization, invariably finds a unique minimal equivalent to the original query. Chen and Che present a polynomial-time algorithm for tree pattern query (TPQ) minimization without XML constraints in the seventh paper. The two-part algorithm is a dynamic programming strategy for finding all matching subtrees within a TPQ. The algorithm consists of one for subtree recognization and a second for subtree deletion. In the last paper, <I>Bagchi et al.</I> present the mobile distributed virtual memory (MDVM) concept and architecture for cellular networks containing server-groups (SG). They detail a two-round randomized distributed algorithm to elect a unique leader and co-leader of the SG that is free of any assumption about network topology, and buffer space limitations and is based on dynamically elected coordinators eliminating single points of failure. As guest editors, we thank all authors featured in this special issue for their contributions and the referees for critically evaluating the papers within the short time allotted. We sincerely believe that readers will share our enjoyment of this special issue and find the information it presents both timely and useful.

The security of web-based services is currently playing a vital role for the software industry. In recent years, many technologies and standards have emerged in order to handle the security issues related to web services. This paper shows techniques to enhance the security of web services, and some of the recent challenges and recommendations of a proposed model to secure web services. It shows the security process of a real life web application, which includes; HTML5 forms, login security, and a single signon solution. This paper also aim to discuss the ten (10) most common web security vulnerabilities and how to prevent the web application from three (3) of the vulnerabilities. Amongst them are; SQL Injection, Cross Site Scripting and Broken Authentication, and Session Management.

With the increasing reliance on web applications for business and personal use, ensuring website security has become a critical concern. Cyber threats such as SQL injection, cross-site scripting (XSS), malware infections, and unauthorized access pose significant risks to websites, leading to data breaches and service disruptions. This project aims to develop a comprehensive website security scanner that systematically identifies vulnerabilities and potential security risks.The proposed system integrates automated vulnerability scanning, penetration testing techniques, and real-time monitoring to detect security loopholes. Using machine learning and heuristic-based analysis, the scanner can identify malicious scripts, outdated software versions, weak authentication mechanisms, and misconfigured security policies. The system also performs network security assessments, analyzing potential DDoS (Distributed Denial-of-Service) attack risks and firewall configurations. The scanner generates detailed security reports, providing actionable insights and recommendations for website owners and administrators to mitigate risks effectively. Designed for continuous monitoring and proactive defense, the tool enhances cybersecurity resilience against evolving threats. This project contributes to web security advancements by offering an intelligent, automated, and scalable solution for safeguarding websites from cyberattacks. Keywords: Website Security | Vulnerability Scanner | Cyber Threats | SQL Injection | Cross-Site Scripting (XSS) | Penetration Testing | Machine Learning | Malware Detection | DDoS Protection | Authentication Security | Firewall Analysis | Web Application Security | Risk Assessment | Cybersecurity Resilience

14 - Web Services and SOA for DBA, Data Architects, and Others

Service Oriented Architecture (SOA) introduced the web services as distributed computing components that can be independently deployed and invoked by other services or software to execute composite services that represent an end-to-end business process. An important problem in the SOA is the web service selection and composition problem which involves selecting the right web services mix to construct the best service composition that achieves the consumers Service Level Agreement (SLA) requirements. In this chapter we propose different methods to solve the problem of the business processes execution engine web service selection and services composition construction in the Service Oriented Architecture (SOA).  The chapter provides different mechanisms to improve the web services selection and composition using dynamic techniques. The main goal is to satisfy the services' requirements expressed as the SLA and to enhance the services selection and composition by increasing the availability and decreasing the response time of the service compositions.

To facilitate the detection of various vulnerabilities, there are many different tools (scanners) that can help analyze the security of web applications and facilitate the development of their protection. But these tools for the most part can only identify problems, and they are not capable of fixing them. Therefore, the knowledge of the security developer is a key factor in building a secure Web resource. To resolve application security problems, developers must know all the ways and vectors of various attacks in order to be able to develop various protection mechanisms. This review discusses two of the most dangerous vulnerabilities in the field of Web technologies: SQL injections and XSS attacks (cross-site scripting – XSS), as well as specific cases and examples of their application, as well as various approaches to identifying vulnerabilities in applications and threat prevention. Cross-site scripting as well as SQL-injection attacks are related to validating input data. The mechanisms of these attacks are very similar, but in the XSS attacks the user is the victim, and in the SQL injection attacks, the database server of the Web application. In XSS attacks, malicious content is delivered to users by means of a client-side programming language such as JavaScript, while using SQL injection, the SQL database query language is used. At the same time, XSS attacks, unlike SQL injections, harm only the client side leaving the application server operational. Developers should develop security for both server components and the client part of the web application.

Owing to the efficient resource management, accessibility, and high service availability, cloud computing has been leveraged by several intensive-data processing applications such as big data analytics, social media applications. These applications are typically based on the development of web service and web application. Even though web-based technology offers effective communication and implementation, it has been susceptible to various kinds of attack. In this paper, we investigate possible attacks on REST which is a commonly used protocol for the web service implementation. In REST, HTTP requests are mapped to GET, POST, PUT, and DELETE that have been proven to be prone to common attacks including Automated Brute Forcing on web-based login, HTTP flood attacks, SQL injections (SQLi), and Cross-Site Scripting (XSS). To this end, we propose a design and implementation of the cloud-based IDS to detect such attacks by employing Apache Kafka and Spark streaming to classify and process the high volume of user inputs in REST HTTP communication. To detect the anomalous inputs, we apply the signature-based approach to construct an IDS engine based on a set of known attack patterns that will be leveraged by the Spark Streaming. Specifically, we introduce a new string comparison collection that improves the False Positive (FP) rate in SQL injection detection, which has been a major issue in most proposed IDS currently available. In our experiment, the system is able to determine malicious patterns with high performance as well as to generate SMS alerts and log the event in a Google Cloud Storage Bucket in an efficient manner.

Architectural mismatch; the semantic and syntactic gap preventing component composition, can be partially alleviated through the ubiquity of the protocols for service composition (syntax). And yet, the semantics of service or component composition have remained elusive. The contribution of this paper builds on the notions introduced by grammar-oriented object design (GOOD) using the notion of manners to specify the semantics of services and drive their automated composition through dynamically reconfigure architectures enabled through GOOD. This leads to the use of manners for explicit service semantics representation in a re-configurable architectural style. We describe the base requirements for automated component and services composition and show how automated assembly of components and services can be accomplished through a dynamically reconfigurable (DyRec) architectural style. In addition, we show how this vision of dynamic reconfiguration is naturally supported by the Web services framework, because it derives from some of the core requirements of the service oriented architectures (SOA) style embodied by Web services. Further, we discuss how such a DyRec architectural style can be implemented using grammar-oriented object design (GOOD) and describe a project that led to a tool called the Business Compiler, to accomplish dynamic composition and collaboration.

Although web service technology is becoming more prevalent the mechanisms for advertising and discovering web services are still at a rudimentary stage. WSDL provides information about service name and parameters for the purpose of invocation. UDDI provides a set of WSDL documents matching keywords in a query. The aim of the Mathematics On the NET (MONET) project is to deliver a proof-of-concept demonstration of a framework for mathematical web services which uses semantic web technologies to broker between user requirements and deployed services. This requires mechanisms for describing mathematical objects and properties so that a piece of software can evaluate the applicability of a particular service to a given problem. Thus we describe our Mathematical Service Description Language (MSDL), with its ontological grounding in OpenMath and outline its role in service brokerage and service composition within MONET. We believe similar issues arise in many other (scientific) domains, and the leverage obtained here, through the formal background of mathematics, suggests a road-map for the development of similar domain-specific service description languages.

A web service is a software system that supports interoperable machine to machine interaction over the network. It can be any kind of service provided on the web that can exchange data between applications. In simple terms, it is any program that is callable by another program across the web using standard protocols. Web services are special because they are independent of the platform, programming language, and model design. In current web applications, more businesses are gradually publishing their business as services over the web. This growing number of web services available within an organization and on the Web raises a new and challenging search problem: locating desired web services. Searching for web services with conventional web search engines is insufficient in this context. In this paper, a latent semantic web service discovery and composition framework, addressing both discovery and composition of web services, is introduced. The framework provides a graphical visualization interface that can facilitate users in finding the desired web service beyond the general keyword search and provide composition of complex services if the service does not exist. A novel approach based on an information retrieval technique known as latent semantic analysis is applied to a large web service descriptions data set collection. By using co-occurrence patterns across the entire data collection, and then using those patterns to infer semantic relationships between documents, relevant results in a ranked order can be retrieved. Moreover, a back to front algorithm is applied to the composition search interface in order to compose complex web services in full or partial terms from pre-existing web services when the requested service does not exist. An experimental study conducted on a collection of 2525 publicity available web service shows improved performance to the technique applied in obtaining much better search results.

The advent of Web Services (WS) has signaled a true revolution in the way service-oriented computing and remote procedure invocation over the Web are conducted. Web Services comprise of a set of loosely coupled specifications to coordinate process execution from distance, based on common and widely accepted Web protocols such as HTTP, FTP, and XML, and therefore, providing increased development flexibility. Since the WS Framework was built on top of those protocols, Web Services have been widely acclaimed by the Web development community and paradoxically; they have marked one of the few examples in the history of computer protocols where a global consensus has been reached. The Web Service framework consists of essentially three basic components: 1. The Web Service Description Language (WSDL), a language that allows formal functional characterization of the provided functionalities; 2. The Simple Object Access Protocol (simply SOAP from its version 1.2), a protocol that defines the format of the information interchange; and 3. The UDDI (Universal Description, Discovery and Integration) is a catalog of Web Service descriptions. All three of these components are specified using XML markup. The elegance of the WS architecture lies in the fact that every WS transaction is taking place over established Web protocols such as HTTP and FTP. As remarked in Ballinger (2003, p. 5): “A Web Service is an application logic that is accessible using Internet standards.” This very fact has accounted for the rapid and universal adoption of Web Services. This work is organized as follows: First, a review of underlying technologies and tools is presented. Consequently, existing techniques for design methodologies are described. Next, an overview of storage and retrieval techniques for Web Services is given followed by real-world applications of Web Services. We conclude with open issues and discussion.

Service Oriented Architecture (SOA) refers to an architectural paradigm that describes how organizations, people and systems provide and use services to achieve their goals. Moreover, with the evolution of SOA, the focus in software development has shifted from applications to reusable services. Besides, reuse in SOA has more focused on service composition rather than reuse of existing implementations to build new services with additional functionalities. The preferred way to realize SOA remains web services which explain our interest in promoting reuse of Web services by managing variability. In this paper, we propose a model driven method for managing Web service's variability based on MDA (Model Driven Architecture). In fact, through MDA, the method enables the automation of Web service's realization regardless of the supported platforms. Moreover, we present a WSDL extension meta-model called VarWSDL which enhances Web services by variability notions. That permits Web services reuse.

Service Oriented Architecture (SOA) has been widely used during the past decade due to its ability to seamlessly integrate various applications developed using different technologies. Web services based on open standards are the most commonly used technology to realize an SOA. Business processes are executed by appropriate orchestration of various services from different departments that belong to a single organization or from multiple organizations. Security is an important quality attribute that has to be built into any application that is developed using SOA. XML is the underlying technology for Web Service Description Language (WSDL), SOAP protocol and Business Process Execution Language (BPEL). It is highly probable that an attacker could inject malicious information into these XML files to modify the flow of the business process. Further, SOAP was not designed with security in mind, it is possible to tamper the SOAP messages while they are in transit. There exist a number of such potential vulnerabilities which lead to possible security breach in the individual services. In an orchestrated business process, there are possibilities of more vulnerabilities. One of the existing tools namely WS-Attacker is only capable of testing the security of individual web services alone. In spite of the widespread usage of SOA, currently there is limited automatic tool support for testing the security provided by an entire SOA application involving service orchestration. In this context, this paper focuses on designing and implementing a plug-in for WS-Attacker to analyze a few security vulnerabilities present in SOA business processes.