SECURING WEB APPLICATIONS WITH OWASP ZAP FOR COMPREHENSIVE SECURITY TESTING

The adoption of digital technologies in healthcare is growing rapidly, and with it, the associated cybersecurity risks are also increasing. In particular, web applications, which can be used to manage and share sensitive health and personal information, require strong security measures to prevent data breaches and ensure compliance with regulatory standards. This paper investigates the applicability of the Open Web Application Security Project (OWASP) guidelines in the healthcare domain. Through a literature review, we identified the most common security requirements considered and used in Digital Health (DH) technologies and assessed their alignment with OWASP Application Security Verification Standard (ASVS). Furthermore, a questionnaire, involving Italian healthcare facilities and Information Technology (IT) companies operating in the healthcare sector, highlighted a significant gap between the availability of security standards and guidelines, and their actual knowledge and use in practice. Based on these findings, we propose a context-aware tool that guides developers and testers in applying OWASP standards throughout the software development lifecycle. The proposed tool aims to provide tailored security recommendations, structured checklists, and test planning based on application context, offering a practical bridge between frameworks and real-world adoption in clinical environments.

Day after day, SQL Injection (SQLI) attack is consistently proliferating across the globe. According to Open Web Application Security Project (OWASP) Top Ten Cheat Sheet-2014, SQLI is at top in the list of online attacks. The cause of spread of SQLI is thought to be Unsecure Software Engineering. The Software Development process itself appears to look at security as an add-on to be checked and deployed towards the end of the software development lifecycle which leads to vulnerabilities in web applications. This paper is an attempt to integrate security in early stages of SDLC i.e. in design phase to mitigate SQLI vulnerability. How SQLI attack happens is illustrated. Threat Modeling is performed to mitigate the SQLI vulnerability.

Web application is the base of online businesses through the Internet. The emergence of COVID 19 forced almost every job to operate online so as to bridge the distance amongst individuals. The rapid increment in the needs of web application increases security threats on information and data. According to the Open Web Application Security Project, Structured Query Language Injection Attack (SQLIA) is a top security threat for web application. SQLIA inserts malicious code to gain access or to manipulate database information by cheating the server to bypass the code to the database, thereby causing a severe impact on web application. In this paper, permutation encoding method has been proposed to prevent SQLIA, which is based on encoding all database information using the proposed method. Initially, a special character is inserted to restrict the method from reversing. Subsequently, permutation encoding method is applied. Permutation refers to the method wherein the bit location is changed within three characters and then radix encoding is applied. Permutation is based on the primitive root value. Encoding has been used to hide permutation. The proposed method is implemented and tested using PHP and MySQL databases, where the proposal result has been compared with those of other proposal methods. The results with security analysis prove that the proposal method prevents SQLIA and protects database information.

All projects conducted in both the OWASP (Open Web Application Security Project) and the WASC (Web Application Security Consortium) are open-projects in which a company and an individual have voluntarily participated with a vision for web application security. Specifically, these open type projects have studied the web application vulnerabilities and thus have provided their results. Therefore, all these projects can be considered as very influential open-projects. This paper will examine overall introduction of the OWASP and the WASC and then, the major features of their different projects which have been currently conducting as analyzing the similarities and differences between the OWASP and the WASC. Based on the results, the study may suggest a type of synergetic effects from their cooperative work. Finally, with related to the web application security area, this research will discuss about the latest trends in industrial as well academic fields and further directions toward its development.KeywordsWeb service vulnerabilityOWASPWASC

Web application development is error prone and results in applications that are vulnerable to attacks by malicious users. The global accessibility of Web applications makes this an extremely serious problem. According to the Open Web Application Security Project (OWASP)’s top ten list that identifies the most serious web application vulnerabilities, the top three vulnerabilities in 2007 [84] were: (1) Cross Site Scripting (XSS) and (2) Injection Flaws (such as SQL Injection). Even after it has been widely reported that web applications suffer from these vulnerabilities, XSS and SQL Injection vulnerabilities remained among the top three vulnerabilities listed in OWASP’s top ten list in 2010 [85] and 2013 [86].

Web Application Development has shown progressive and rapid growth using various techniques. Nonetheless, web application security is a major component in web development that is often overlooked or not properly focused on. Due to ad hoc existence and poor code written, most available web applications are vulnerable and desirable target for the attackers. To alleviate this issue, the use of defensive programming basic technique allows the developers to develop secure applications. Defensive programming includes validate output and correctly manages error messages. This avoids the misuse of snippets and builds the program in a consistent way despite unpredictable inputs. The purpose of this paper is twofold. Firstly, this paper discussed the development of a web application program using PHP as server-side scripting exploiting defensive programming techniques to overwhelm web application vulnerabilities. Secondly, this paper examined common vulnerabilities of web application risks refer to Open Web Application Security Project to validate the effectiveness of defensive programming technique. The work presented in this paper shall be a fundamental guideline for the development of secure web-based applications.

Various information can be found on the internet by accessing the website. Information on the internet should be guaranteed integrity and service / layananya from the source to the user. In website development, technology profile, access speed, and security is a factor that must be taken to ensure that the information and services contained therein can be useful for the user. Internet network is public and global, at the time of service of data sent from one computer to another on the Internet, the data will pass through a number of computers. Denial-of-Service Attack is one of the attacks on web security system which can inhibit the activity of the working of a service or turn it off, so the user has the right / interest can not use these services as expected. Services web application has vulnerability to an attack. One way to detect security flaws in web applications is to use a search application security loopholes. OWASP (Open Web Application Security Project) capable of searching for security loopholes website. There are some striking technique, among others: Cross Site Scripting, Injection, Malicious File Execution, Insecure Direct Object Reference and others. Results from this study is the method of coping and prevention techniques of Denial Of Service Attack, and improved service website. Keywords: Technology profile, OWASP, Denial Of Service Attack.

In SQLIA, attacker injects an input in the query in order to change the structure of the query intended by the programmer and therefore, gain access to the data in the underlying database. Due to the significance of the stored data, web application's security against SQLIA is vital. In this paper we propose a tool that is capable of reporting the transformations needed to reinforce the security of a Java-based web application and its database against SQLIAs. This tool which is based on static analysis and runtime validation uses our new technique for detection and prevention of SQLIAs. In our technique user inputs in SQL queries are removed and some information is gathered in order to make the detection easier and faster at runtime. According to these information the tool reports the transformations needed and the location of the transformations in source code and therefore after applying the transformations the result would be a reinforced web application against SQLIAs.

-- OWASP (Open Web Application Security Project) version 4 issued by a non-profit organization called owasp.org which is dedicated to the security of web-based applications. This systematic review is intended to review whether the Open Web Application Security Project (OWASP) method is widely used to detect security in a website-based Information System. In this systematic review, we review 3 literature from several publisher sources and make a comparison regarding OWASP version 4 results and the security level of a web server from the publisher's source.Keywords— OWASP, Website Vulnerability, Website Security Detection

The delivery of a framework in place for secure application development is of real value for application development teams to integrate security into their development life cycle, especially when a mobile or web application moves past the scanning stage and focuses increasingly on the remediation or mitigation phase based on static application security testing (SAST). For the first time, to the author’s knowledge, the industry-standard Open Web Application Security Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous software errors are synced up in a matrix with Checkmarx vulnerability queries, producing an application security framework that helps development teams review and address code vulnerabilities, minimise false positives discovered in static scans and penetration tests, targeting an increased accuracy of the findings. A case study is conducted for vulnerabilities scanning of a proof-of-concept mobile malware detection app. Mapping the OWASP/SANS with Checkmarx vulnerabilities queries, flaws and vulnerabilities are demonstrated to be mitigated with improved efficiency.

Over the years, injection vulnerabilities have been at the top of the Open Web Application Security Project Top 10 and are one of the most damaging and widely exploited types of vulnerabilities against web applications. Structured Query Language (SQL) injection attack detection remains a challenging problem due to the heterogeneity of attack loads, the diversity of attack methods, and the variety of attack patterns. It has been demonstrated that no single model can guarantee adequate security to protect web applications, and it is crucial to develop an efficient and accurate model for SQL injection attack detection. In this paper, we propose synBERT, a semantic learning-based detection model that explicitly embeds the sentence-level semantic information from SQL statements into an embedding vector. The model learns representations that can be mapped to SQL syntax tree structures, as evidenced by visualization work. We gathered a wide range of datasets to assess the classification performance of the synBERT, and the results show that our approach outperforms previously proposed models. Even on brand-new, untrained models, accuracy can reach 90% or higher, indicating that the model has good generalization performance.

Today almost all organizations have changed their traditional systems and have improved their performance using web-based applications. This process will make more profit and at the same time will increase the efficiency of their activities through customer support services and data transactions. Usually, web application take inputs from users through web form and send this input to get the response from database. Modern web-based application use web database to store all critical information such as user credentials, financial and payment information, company statistics etc. However error in validation of user input can cause database vulnerable to Structured Query Language Injection (SQLI) attack. By using SQLI attack, the attackers might insert malicious code in the user input and trying to gain access to the confidential and sensitive data from database. Security tester need to identify the appropriate test cases before starting exploiting SQL vulnerability in web-based application during testing phase. Identifying the test cases of a web application and analyzing the test results of an attack are important parts and consider as critical issues that affects the effectiveness of security testing. Thus, this research focused on the developing a framework for testing and detecting SQL injection vulnerability in web application. In this research, test cases will be generated automatically based on SQLI attack pattern and then the results will be executed automatically based on generated test cases. The primary focus in this paper is to develop a framework to automate security testing based on input injection attack pattern. To test our framework, we install a vulnerable web application and test result shows that the proposed framework can detect SQLI vulnerability successfully.

Web applications security is indeed the most talked about and a vital topic of discussion in cyber security world. In the recent years, websites have become a main target for hackers. Attackers exploit vulnerabilities present in the web applications. Application level attacks are increasing day by day in websites. Some of the main application level attacks are SQL injections, cross-site scripting attacks, cookie poisoning attack, command injection attack, etc. According to OWASP, injection attacks occupy first place in breaching website security. There are several government, private and e-commerce websites that become victim of SQL injection attack each year. This paper includes the detailed study of mitigation strategies proposed by various researchers related to SQL injection attack. Furthermore, defence mechanism to safeguard web applications from SQLi attacks and future research directions is also indicated.KeywordsStructured query language injection (SQLi)OWASPVulnerabilitiesWebsitesMalicious queryAttacksDetection

SQL injection attack (SQLIA) is considered one of most threats used to attack web applications. Therefore, attackers used SQL injection vulnerability to gain ultimate access to databases that belong to applications and expose their sensitive information. Thus, attackers use SQL injections vulnerability to manipulate data also it could be used to take full control of the target machine. Accordingly, several methods were proposed in the literature to address this vulnerability widely because of its importance and high impact on the security of web applications. Thus, we propose a model to detect and prevent SQL injection attacks, which uses runtime validation to detect the occurrence of such attacks, our proposed model is adaptable to any existing system, with no need to modify the client or server and either no need to know web application source code. Furthermore, the modification independence is done by adding additional middleware between client and server. Thus, any check process is done on this middleware, and it is represented as a proxy that can do sanitize the inputs for detecting and preventing SQLIA. Furthermore, our proposed model accuracy reaches 86:6% for detecting and preventing SQLIA.

In today’s present time, SQL injection has become a significant security threat over the web for diverse dynamic web applications and websites. SQL Injection may be a sort of associate injection attack that produces it doable to execute malicious SQL statements into an online application consisting of SQL information. Attackers use these SQL Injection Queries or Statements specified if an Internet site or an application hosted on web contain SQL vulnerabilities to bypass application security measures. The Attacker will even go around authentication associated with authorization of an online page or Internet application and might bypass these methods and retrieve the content of the whole SQL information of an online application. The purpose of the proposed system is to predict the occurrence of a SQL injection attack on a particular server where an application is deployed from a given supply at a particular point in time. This predictive experiment is managed using the JMeter tool. From network logs, you can now pre-measure, exclude choices, analyze, and feed machine learning models to predict SQLIA.KeywordsSQL injectionWeb applicationClassificationPredictionJMeter