Pythia

Software maintenance and evolution are important processes in software development. Developers usually face issues in the process of maintaining and evaluating software. The common problem is software code not well structured and organized. This will have an impact on the difficulty of the process of maintaining and evolving software. Maintenance and evolution process is done in all types of applications. In this research, we focus on web-based applications. Web-based applications are chosen because the development of web-based applications is very evolving. One of the most widely used design patterns in web applications is the Model View Controller (MVC) design pattern. This research focuses on the model layer in web applications. Because this layer automatically changes if there is a change in the data structure or database. Therefore, to make the maintenance and evolution process easier, it is necessary to analyze and reorganize the model layer. In this study, we trying to group the functions on the model layer by looking at the similarity of table reference access in the query. For the analysis process of the reorganization of the function structure, we use DSM (Design Structural Matrix). in this research, we use DSM in a new field that is in the model layer on MVC based application. The preliminary result, the reorganization of the function structure provides better contex recommendations that following the reference table for each function.

Most people in the industrial world use a wide variety of web applications daily with the majority being insecure and vulnerable. This gives hackers the opportunity to steal data from the user’s web application, which may contain sensitive information. Vulnerability detection may be conducted by a rigorous penetration test. A penetration tester’s duty is to define and exploit the web applications’ vulnerabilities.This paper describes a technique for automatic vulnerable web application generation application. Firstly, the prepared web application is sent to the tool to create the vulnerable web application version. This tool does this by the injection of Cross Site Request Forgery (CSRF) and Cross Site Scripting (XSS) into the web application. Different variant vulnerabilities may be injected too, so different methods are needed, in order to exploit vulnerabilities dependent on the variant. One of the tool’s tasks is to produce web applications, which will be used to train the penetration testers.

With the widespread adoption of web applications and cloud services, the OAuth 2.0-based OpenID Connect (OIDC) Single Sign-on (SSO) protocol has become the core of modern digital identity authentication. Although the OIDC protocol itself has strict security specifications, its implementation in real-world web frameworks can introduce critical vulnerabilities, particularly the improper omission of the state parameter, which leads to severe authentication forgery risks. Existing research often overlooks these implementation-level flaws, especially from a formal analysis perspective. This paper addresses this gap by formally analyzing the authentication forgery attack resulting from the missing state parameter. We construct a high-fidelity web framework model and, using the Tamarin formal analysis tool, systematically analyze the flawed OIDC implementation. Specifically, we demonstrate an attack path where cross-site request forgery is leveraged as a vector to deceive the relying party, ultimately achieving identity binding forgery—linking the attacker’s identity to the victim’s session. In response to this forgery vulnerability, this article proposes and formally verifies corresponding patches to successfully defend against such attacks. Finally, this paper provides concrete guidance for developers. This research, through formal methods, characterizes a replicable authentication forgery pattern within modern web architectures, providing a robust theoretical and practical foundation for hardening SSO systems against such advanced forgery threats.

Electronic Integrated Antenatal Care (e-iANC) was built as a web-based application to assist midwives in recording Antenatal Care (ANC) data including Patient Registration; Anamnesis; Physical Examination; Laboratory Test, Screening of Risk Pregnancy; Communication, Information and Education; Treatment and follow-up; Patient Disposition. To ensure e-iANC becomes a safe system, security system testing was needed. Our goals were to test the security system by using the Open Web Application Security Project (OWASP). It was conducted in computer laboratory at Universitas Esa Unggul Jakarta in August 2017. The OWASP detect include Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Level Access Control, Cross Site Request Forgery (CSRF), Using Known Vulnerable Components, Unvalidated Redirects and Forwards. The results indicated the risk level of e-iANC was the low category in the aspect of Cross-Domain JavaScript Source File Inclusion, Private IP Disclosure, XSS Protection Not Enabled Web Browser.

Currently, websites are widely used in various fields, including government. However, government websites are often the target of hacking. The XY Regency Communication and Information Agency experienced a website breach in 2023, which affected one of its subdomains, e-office.xy-regency.go.id, which stored employee data. This hack resulted in the leakage of sensitive data, user account takeovers, service disruptions, and a decline in public trust. The purpose of this study was to identify and test the vulnerabilities of the e-office.xy-regency.go.id website using the NIST SP 800-115 method, which includes the planning, discovery, attack, and reporting phases. Vulnerabilities were classified using the Common Vulnerability Scoring System (CVSS) and the OWASP Top 10 standard. This study identified two high-level vulnerabilities, namely Cross-Site Scripting (XSS) with a CVSS score of 8.2, classified as High severity, and Cross-Site Request Forgery (CSRF) with a CVSS score of 9.3, classified as Critical severity. These vulnerabilities could allow hackers to execute malicious scripts and manipulate users without their knowledge. Recommendations include implementing input validation on text boxes by limiting characters to letters or combinations of letters and numbers, and ensuring that all forms and endpoints that handle sensitive data are protected with unique and unpredictable CSRF tokens. Future research should focus on analyzing domain vulnerabilities, identifying the origin and potential of attacks, and developing effective protection and recovery strategies.

This comprehensive review identifies gaps in current frameworks, such as limited support for real-time compliance auditing and challenges in scaling security measures for large-scale applications. The evolution of full-stack development frameworks has revolutionized the software development landscape, enabling seamless integration of front-end and back-end functionalities. With increasing reliance on web and mobile applications, security and compliance have become critical focal points in framework design and implementation. This review examines advances in full-stack development frameworks, emphasizing their security and compliance models to address modern-day challenges such as data breaches, unauthorized access, and regulatory non-compliance. The study explores prominent full-stack frameworks, including MEAN (MongoDB, Express.js, Angular, Node.js), MERN (MongoDB, Express.js, React, Node.js), and Django, highlighting their inherent security features. These include robust authentication mechanisms, encryption protocols, and defense against common threats such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). Furthermore, the review delves into compliance models embedded within these frameworks, focusing on their adaptability to global standards like GDPR, HIPAA, and PCI DSS, which govern data privacy and security. Emerging trends such as the integration of artificial intelligence (AI) for anomaly detection, serverless architecture for reducing attack surfaces, and blockchain for enhancing data integrity are also discussed. The adoption of DevSecOps practices in full-stack frameworks has further streamlined the embedding of security measures during the development lifecycle, mitigating risks proactively. Recommendations for future research include enhancing framework modularity to incorporate evolving security technologies, leveraging AI for predictive threat modeling, and ensuring compatibility with emerging compliance mandates. By presenting a thorough analysis of existing and emerging security and compliance paradigms, this review serves as a valuable resource for developers, researchers, and organizations aiming to enhance the reliability and trustworthiness of full-stack applications in an increasingly digital and regulated environment.

The article analyzes current trends in the use of unique identifiers of the UUID (Universal Unique Identifier) type in databases for creating key records. It highlights areas of application of such identifiers in software systems across various domains and identifies relevant challenges related to their use in the context of modern data security requirements. The advantages of ULID (Universally Unique Lexicographically Sortable Identifier)—next-generation identifiers distinguished by higher performance and the ability to support lexicographical sorting through a monotonic generation principle—are examined. Based on an analysis of modern data protection needs, it is concluded that UUID-based identifiers require a high level of security, particularly against SQL (Structured Query Language), XSS (Cross-Site Scripting), CSRF (Cross-Site Request Forgery), and Insecure Direct Object Reference (IDOR) attacks. It is emphasized that protection methods must consider the specifics of the data types on which key identifiers are built. As an extension of security tools, a method for converting UUIDs into a graphical form visually resembling a unique chart is proposed. An algorithm and a diagram for determining the coordinates of UUID and ULID are developed, with an example of transformation and visual representation provided. The forms and areas of application of the proposed method are discussed, including the possibility of reverse conversion for integrity verification, masking in client–server interactions, data reconciliation, and recovery after attacks or failures. The use of both the graphical image itself and the coordinate array that forms it is described. Approaches to encoding and encrypting coordinate data at the stage of chart generation and rendering are proposed. The method enables concealing an identifier in graphical form, which complicates its identification during unauthorized access (for example, in the case of cookie theft) and can also serve as a graphical hash. A combined method of application in web systems is proposed: encrypted coordinates generated by this method are stored in a hidden field of the client form and verified on the server based on session data. This approach ensures identifier authenticity verification (protection against IDOR) while simultaneously functioning as an anti-CSRF token. In the field of data storage, approaches are proposed for applying the method to integrity verification and data recovery after security incidents without the immediate need to restore backup copies. The proposed conversion method can be implemented either as a graphical hash or as a protected copy. It allows operations with both the graphical image and the coordinate array in a format that is more secure compared to symbolic representation. The method has several advantages over QR codes: unlike the latter, the structure of the graphical hash is not standardized and therefore can only be decoded by a server possessing the generation parameters and decoding algorithm, while also providing the possibility of visual output. The proposed UUID-to-graph conversion method can help address several applied problems and enhance tools for ensuring data security and confidentiality across all areas where such identifiers are used.

Spam is no longer just commercial unsolicited email messages that waste our time, it consumes network traffic and mail servers’ storage. Furthermore, spam has become a major component of several attack vectors including attacks such as phishing, cross-site scripting, cross-site request forgery and malware infection. Statistics show that the amount of spam containing malicious contents increased compared to the one advertising legitimate products and services. In this paper, the issue of spam detection is investigated with the aim to develop an efficient method to identify spam email based on the analysis of the content of email messages. We identify a set of features that have a considerable number of malicious related features. Our goal is to study the effect of these features in helping the classical classifiers in identifying spam emails. To make the problem more challenging, we developed spam classification models based on imbalanced data where spam emails form the rare class with only 16.5% of the total emails. Different metrics were utilized in the evaluation of the developed models. Results show noticeable improvement of spam classification models when trained by dataset that includes malicious related features.

The article discusses key issues of web application security and methods of protection against hacker attacks. With businesses increasingly dependent on online services, web application security is becoming one of the top priorities for organizations. Sufficient attention should be paid to security measures to protect user data from unwanted access and malicious use. This article reviewed the main types of hacker attacks on web applications, such as SQL injection (SQLi), Cross-site scripting (XSS), Cross-site request forgery (CSRF), Server-side request forgery (SSRF) and file attacks, as well as examples of protection measures against each type of attacks. Updated and improved basic principles of web application security are proposed based on threat modeling techniques.

The growing importance of cybersecurity in the digital age necessitates a comprehensive approach to securing web applications, particularly through robust front-end development practices. This review paper proposes a conceptual framework for integrating security best practices into front-end development to mitigate common vulnerabilities such as Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). The framework emphasizes key components: threat modeling, secure coding practices, security automation, integration into Continuous Integration/Continuous Deployment (CI/CD) pipelines, and continuous monitoring. By embedding security into every stage of the development process, the framework enhances the security of web applications. It aligns with U.S. national interests in bolstering cybersecurity. The paper also discusses the implications of secure front-end development for national cybersecurity, highlighting the framework's potential to reduce the attack surface of critical web applications significantly. Recommendations are provided for policymakers and industry leaders to promote adopting secure front-end practices, ensuring a resilient digital infrastructure. Keywords: Secure Front-End Development, Cybersecurity, Web Application Security, Threat Modeling, Security Automation, National Cybersecurity.

The present research focuses on the security of Macedonian websites. It involves the analysis of HTTP Security header responses for 756 websites in the country, of which 246 are the most popular. This analysis is conducted across 13 different categories of websites, including government bodies and institutions, public institutions and enterprises, educational, commercial, news and media, entertainment, sports, etc. We intend to create a comprehensive security profile for the country's websites, which will help raise their overall security level. It is critical to understand and implement proper HTTP security headers to prevent or limit the dangers that can cause website attacks such as Denial of Service (DoS), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), SQL Injection, clickjacking, etc. Our analysis was performed with the help of the Mozilla Observatory tool. We have discovered a significant lack of implementation and/or misconfiguration of HTTP security headers in all categories. Almost half of the websites (n=375; 49.60\%) have an F grade, while more than a quarter of all websites (n=214; 28.31\%) have a minimal security score of 0.

Security testing is essential for website and web applications in current days. It is easy for an attacker to invade the security and do malicious activities through web applications if they are not properly protected against known attacks. General practice in web application before release is using testing tools to recognize the possible set of vulnerabilities, which can be true-positive or false-positive. Then the developer team will be asked to revise code to protect against true-positive vulnerabilities. For that, the testing team needs to classify each reported vulnerability into true-positive and false-positive individually, which is very time-consuming. This article suggests innovation in this practice to reduce the time of recognizing true-positive vulnerabilities. It presents a novel approach to classify reported multiple vulnerabilities of different attacks using a single script and in single go. These attacks should share common triggering events or testing process. Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks are chosen to illustrate the approach.

With the rise of the web as a dominant application platform, web security vulnerabilities are of increasing concern. Ideally, the web application development process would detect and correct these vulnerabilities before they are released to the public. This research aims to quantify the effectiveness of software developers at security code review as well as determine the variation in effectiveness among web developers. We hired 30 developers to conduct a manual code review of a small web application. The web application supplied to developers had seven known vulnerabilities, including three different types: Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection. Our findings include: (1) none of the subjects found all confirmed vulnerabilities, (2) more experience does not necessarily mean that the reviewer will be more accurate or effective, and (3) reports of false vulnerabilities were significantly correlated with reports of valid vulnerabilities.

Web browsers play a crucial role in accessing and interacting with information on the internet. However, they also present significant security challenges due to their complexity and the diverse range of threats they face. This paper provides an overview of web browser security, focusing on the key challenges, vulnerabilities, and defences. It discusses common attack vectors, such as cross-site scripting (XSS) and cross-site request forgery (CSRF), as well as browser security features like sandboxing, secure storage, and Content Security Policy (CSP). Additionally, the paper explores emerging threats and future directions in web browser security, highlighting the importance of ongoing research and collaboration among browser vendors, developers, and security experts to ensure a more secure browsing experience for users.

The dynamic nature of the Web 2.0 and the heavy obfuscation of web-based attacks complicate the job of the traditional protection systems such as Firewalls, Anti-virus solutions, and IDS systems. It has been witnessed that using ready-made toolkits, cyber-criminals can launch sophisticated attacks such as cross-site scripting (XSS), cross-site request forgery (CSRF) and botnets to name a few. In recent years, cyber-criminals have targeted legitimate websites and social networks to inject malicious scripts that compromise the security of the visitors of such websites. This involves performing actions using the victim browser without his/her permission. This poses the need to develop effective mechanisms for protecting against Web 2.0 attacks that mainly target the end-user. In this paper, we address the above challenges from information flow control perspective by developing a framework that restricts the flow of information on the client-side to legitimate channels. The proposed model tracks sensitive information flow and prevents information leakage from happening. The proposed model when applied to the context of client-side web-based attacks is expected to provide a more secure browsing environment for the end-user.