Perusal of web application security approach

In current information era, every small-scale industry, MNC's, Schools, and Colleges utilise Web Applications to promote their organizations and provide services to society. Web Applications have become a simple and vital medium for communicating with society. This leads to an increase in website utilization. Threats and cyber-attacks are increasing according to the rate of growth of Web Applications. Any organization must ensure the privacy and security of its users' data in order to maintain the company's and users' integrity. Web application vulnerabilities represent major security risks, making it critical to conduct extensive assessments and penetration testing to discover and remediate such flaws. The paper provides a complete overview of web application vulnerability assessment and penetration testing, emphasizing the need of proactive security measures in protecting sensitive data and preserving application integrity. This study aims to identify and categorize web application vulnerabilities (OWASPs) that may compromise the security of the application and result in user data breaches. The primary focus of this project is the security and privacy of user data. Integrating security practices into the software development life cycle through investigating real-world case studies and industry standards. Ultimately, our research adds to the growing body of knowledge in web application security, assisting organizations in creating resilient defenses against cyber threats.

SummaryThis work presents an extended and enhanced gray‐box combinatorial security testing methodology for SQL injection vulnerabilities in web applications. We propose multiple new attack grammars modelling SQLi attacks against MySQL‐compatible databases, each one targeting a different injection context. Additionally, these grammars are also dynamically refined at the beginning of each attack against an endpoint of a web application, as a further optimization of the used attack model by taking into account the specifics of the generated query of that endpoint. Our goal is to enhance existing combinatorial approaches for detecting SQL injection vulnerabilities. The newly developed methodology is implemented in a prototype security testing tool called SQLInjector+, which is an extension of an earlier prototype developed by us in prior work. This improved tool can attack (i.e. test) any web application that uses a MySQL‐compatible database management system. We evaluate our revised approach and improved prototype tool in a case study comprising of different kinds of web applications to which SQLi is a potential security threat. The case study contains the well‐known verification framework WAVSEP among other five real‐world web applications and one web application firewall. Our generated attack vectors, constructed via combinatorial methods applied to our improved and dynamically optimized attack grammars, are capable of injecting every known vulnerable endpoint in WAVSEP and also of finding new vulnerable parameters in some of the real‐world applications investigated in this paper. Our approach performs equally well or better when compared with existing state‐of‐art of SQL injection security testing tools (sqlmap, w3af, wapiti and fuzzdb) across all tested web applications in the case study.

The biggest challenge of Web application is the inestimable losses arising from security flaws. Two approaches were advanced by a number of scholars to provide security to Web space. One of such approach is vulnerability assessment, which is a conscious effort to isolate, identify and recognize potentials vulnerabilities exploited by attackers. The second being the estimation and determination of level of risks/threats posed to Web applications by vulnerabilities obvious to the developer (or tester); this is generally referred to as penetration testing. Recently, there is Vulnerability Assessment and Penetration Testing (VAPT) that combined these two schemes to improve safety and effectively combat the menace of attackers on Web applications. This paper proposed Fuzzy Classifier-based Vulnerability and Assessment Testing (FCVAPT) model to provide security for sensitive data/information in Web applications. Cross Site Scripting (XSS) and Structured Query Language (SQL) injections were selected for evaluation of proposed FCVAPT model. FCVAPT model’s classification performance for MSE, MAPE and RMSE were 33.33, 14.81% and 5.77% respectively. FCVAPT is considerably effective for detecting vulnerability and ascertaining the nature of threats/risks available to Web applications.

Web applications are not protected by today's network level firewalls, because they allow access to TCP port 80 without restrictions. However, many successful attacks today are not on the network level, but on application level. For protecting against application level attacks, a firewall must understand the application protocols, that are used on its open ports. This happens in application level firewalls and for Web application in Web application firewalls. The underlying concepts of Web application firewalls differ much from the concepts of traditional network level firewalls. This book explains the underlying concepts of Web application firewalls. Afterwards, they are applied to a collection of security requirements, that application developers should respect today for developing a secure Web application. A Web application firewall is capable of automatically implementing many of these requirements. As a result, Web application developers can ignore these requirements, because the Web applications firewall already ensures their implementation and therefore the security of the Web application. This book is intended for anyone, who is interested in securing his Web application.

Web vulnerabilities in web‐based applications may be detected, classified and documented. Several Web scanners exist for vulnerabilities in Web applications implemented via different technologies. However, none of them provides the technology‐independent, generic coverage of possible vulnerabilities. In this project that is funded by Mindef Singapore, we propose a new approach for Web application security and vulnerability analysis. The design addresses the categorization of scanner results with a generic data model and the design of a language‐independent rule‐based engine that detects, analyses and reports suspected vulnerabilities in web‐based applications.

Finding differences between programs with similar functionality is an important security problem as such differences can be used for fingerprinting or creating evasion attacks against security software like Web Application Firewalls (WAFs) which are designed to detect malicious inputs to web applications. In this paper, we present SFADIFF, a black-box differential testing framework based on Symbolic Finite Automata (SFA) learning. SFADIFF can automatically find differences between a set of programs with comparable functionality. Unlike existing differential testing techniques, instead of searching for each difference individually, SFADIFF infers SFA models of the target programs using black-box queries and systematically enumerates the differences between the inferred SFA models. All differences between the inferred models are checked against the corresponding programs. Any difference between the models, that does not result in a difference between the corresponding programs, is used as a counterexample for further refinement of the inferred models. SFADIFF's model-based approach, unlike existing differential testing tools, also support fully automated root cause analysis in a domain-independent manner. We evaluate SFADIFF in three different settings for finding discrepancies between: (i) three TCP implementations, (ii) four WAFs, and (iii) HTML/JavaScript parsing implementations in WAFs and web browsers. Our results demonstrate that SFADIFF is able to identify and enumerate the differences systematically and efficiently in all these settings. We show that SFADIFF is able to find differences not only between different WAFs but also between different versions of the same WAF. SFADIFF is also able to discover three previously-unknown differences between the HTML/JavaScript parsers of two popular WAFs (PHPIDS 0.7 and Expose 2.4.0) and the corresponding parsers of Google Chrome, Firefox, Safari, and Internet Explorer. We confirm that all these differences can be used to evade the WAFs and launch successful cross-site scripting attacks.

Vulnerability Assessment & Penetration Testing as a Cyber Defence Technology

Web application firewall (WAF) examines malicious traffic to and from a web application via a set of security rules. It plays a significant role in securing Web applications against web attacks. However, as web attacks grow in sophistication, it is becoming increasingly difficult for WAFs to block the mutated malicious payloads designed to bypass their defenses. In response to this critical security issue, we have developed a novel learning-based framework called <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small>, designed to unveil potential bypasses in WAF detections and suggest rules to fortify their security. Using a combination of shadow models and payload generation techniques, we can identify malicious payloads and remove or modify them as needed. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small> generates signatures for these malicious payloads using advanced clustering and regular expression matching techniques to repair any security gaps we uncover. In our comprehensive evaluation of eight real-world WAFs, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small> improved the true rejection rate of mutated malicious payloads from 21% to 96%, with no false rejections. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small> achieves a false acceptance rate 3× lower than State-of-the-Art methods for generating malicious payloads. With <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small>, we have taken a step forward in securing web applications against the ever-evolving threats.

Most people in the industrial world use a wide variety of web applications daily with the majority being insecure and vulnerable. This gives hackers the opportunity to steal data from the user&#x2019;s web application, which may contain sensitive information. Vulnerability detection may be conducted by a rigorous penetration test. A penetration tester&#x2019;s duty is to define and exploit the web applications&#x2019; vulnerabilities.This paper describes a technique for automatic vulnerable web application generation application. Firstly, the prepared web application is sent to the tool to create the vulnerable web application version. This tool does this by the injection of Cross Site Request Forgery (CSRF) and Cross Site Scripting (XSS) into the web application. Different variant vulnerabilities may be injected too, so different methods are needed, in order to exploit vulnerabilities dependent on the variant. One of the tool&#x2019;s tasks is to produce web applications, which will be used to train the penetration testers.

The increasing complexity and sophistication of web-based applications have made them vulnerable to various security threats. Web Application Firewalls (WAFs) have emerged as an essential security measure to protect web applications from common attacks such as SQL injection, cross-site scripting (XSS), and others. This research paper explores the techniques and challenges involved in controlling web traffic using a Web Application Firewall. The paper discusses the working principles of WAFs, the various methods employed to analyze and filter web traffic, and the effectiveness of these techniques in mitigating different types of attacks. Additionally, the paper highlights the challenges faced in deploying and managing WAFs and provides insights into potential future developments in the field. This research paper delves into the techniques and challenges associated with controlling web traffic using a Web Application Firewall. It explores the fundamental principles of WAFs, including signature-based filtering, behavior-based analysis, whitelisting, blacklisting, rate limiting, and protection against common vulnerabilities. The paper evaluates the effectiveness of these techniques in mitigating various attacks and highlights the challenges involved in deploying and managing WAFs, such as configuration complexity, false positives and negatives, performance impact, and integration with existing security infrastructure. Furthermore, the paper discusses emerging trends and potential future directions in the field, including the integration of machine learning and artificial intelligence, advanced behavioral analysis techniques, and cloud-based architectures.

Input sanitization and validation of user inputs are well-established protection mechanisms for microservice architectures against XML injection attacks (XMLi). The effectiveness of the protection mechanisms strongly depends on the quality of the sanitization and validation rule sets (e.g., regular expressions) and, therefore, security analysts have to test them thoroughly. In this demo, we introduce JCOMIX, a penetration testing tool that generates XMLi attacks (test cases) exposing XML vulnerabilities in front-end web applications. JCOMIX implements various search algorithms, including random search (traditional fuzzing), genetic algorithms (GAs), and the more recent co-operative, co-evolutionary algorithm designed explicitly for the XMLi testing (COMIX). We also show the results of an empirical study showing the effectiveness of JCOMIX in testing an open-source front-end web application.

Attackers can exploit vulnerabilities in web applications to commit malicious acts such as corrupting application functionality and Trojan horse implantation. For injection vulnerabilities in Web applications, existing methods are limited by the variety of programming languages and the difficulty in extracting semantic information to detect complex vulnerabilities. The paper proposes a pattern matching-based method for identifying injection vulnerabilities in Web applications, which transforms vulnerability identification into path matching in graphical databases by modifying the code property graph to enable it to handle more complex inter-functional relationships in Web applications. In this paper, we designed and implemented a prototype system, VulnFinder. By collecting 100 randomly selected Github high star open-source projects as the dataset for performance testing, we found 262 real vulnerabilities and conducted comparison experiments with static scanning tools RIPS and Cobra, VulnFinder far exceeded the comparison tools in terms of vulnerability determination accuracy, and in terms of the dataset VulnFinder was 94% accurate in determining vulnerabilities in the dataset. In scanning large projects, VulnFinder was approximately 21% more efficient than the comparable methodology tool RIPS.

Internet and computer systems are an indispensable part of daily life. The number of web applications have increased with the development of technology and digital transformation. Web applications have high risk for security since the applications is not developed securely, contains vulnerabilities and easily accessible by hackers. Web application firewall is used to protect web applications from attacks. Signature-based and anomaly-based methods are used in web application firewalls. In this research, anomaly-based web application firewall model was developed using natural language processing techniques and linear support vector machine learning algorithm. Word n-gram and character n-gram natural language processing techniques were compared by performing separate models. Proposed model achieve higher detection performance with using the character n-gram compared to other studies. According to the results of the experiment proposed model is capable of detection web attacks effectively with the overall detection accuracy rate of 99.53%.

In the contemporary digital landscape, the security of web applications is a pressing concern. Cyber threats continue to evolve, challenging the resilience of existing defense mechanisms. This project introduces an innovative Web Application Firewall (WAF) strengthened by Neural Network (NN) technologies. The primary aim of this project is to enhance web application security by proactively identifying and thwarting malicious attacks. Leveraging deep learning techniques, the NN-based WAF analyzes incoming HTTP requests in real time, distinguishing between legitimate and potentially harmful traffic. Through meticulous data collection, feature engineering, and model training, the WAF exhibits robust and adaptive behavior. This project represents a pivotal advancement in web application security. By harnessing the power of neural networks, it provides real-time protection against a wide spectrum of cyber threats. The NN-based WAF adapts to the evolving threat landscape, making it an indispensable tool for safeguarding web applications in an era of dynamic and persistent security challenges.

In most cases, web applications communicate with web services (SOAP and RESTful). The former act as a front-end to the latter, which contain the business logic. A hacker might not have direct access to those web services (e.g., they are not on public networks), but can still provide malicious inputs to the web application, thus potentially compromising related services. Typical examples are XML injection attacks that target SOAP communications. In this paper, we present a novel, search-based approach used to generate test data for a web application in an attempt to deliver malicious XML messages to web services. Our goal is thus to detect XML injection vulnerabilities in web applications. The proposed approach is evaluated on two studies, including an industrial web application with millions of users. Results show that we are able to effectively generate test data (e.g., input values in an HTML form) that detect such vulnerabilities.