Application Security Testing Research Articles

Systematic Approach to Prevent Code Vulnerabilities using CI/CD Pipelines

This paper discusses a systematic approach to integrating Static Application Security Testing (SAST), Software Composition Analysis (SCA), Code Coverage, and Code Quality Checks into Continuous Integration/Continuous Delivery (CI/CD) pipelines. Modern CI/CD pipelines accelerate software delivery but introduce significant security and quality challenges. By incorporating SAST and SCA for security testing, along with code coverage and quality checks, organizations can prevent code vulnerabilities and ensure the maintainability and reliability of their applications. This approach helps development teams shift security and quality controls left, catching issues early in the development lifecycle. Keywords — CI/CD, DevSecOps, Static Application Security Testing (SAST), Software Composition Analysis (SCA), Code Coverage, Code Quality, Vulnerability

Developing a framework for enhancing security testing of android applications

Mobile applications have advanced a lot and now offer several features that help make our lives easier. Android is currently the most popular mobile operating system, and it is susceptible to exploitation attempts by malicious entities. This has led to an increased focus on the security of Android applications. This dissertation proposed the development of a framework which provides a systematic approach to testing the security of Android applications. This framework was developed based on a comprehensive review of existing security testing methodologies and tools. In achieving the study objectives, a test application was run on an emulator, Burp Suite was used as a proxy tool to capture HTTP and HTTPS traffic for analysis, reverse engineering was carried out, static and dynamic analysis were executed, network traffic was captured and analysed with tcpdump and Wireshark, intent sniffing was carried out, fuzz testing was discussed, and a proof-of-concept tool (automation script) was developed. This work covers various aspects of Android applications’ security testing, and the proposed framework provides developers with a practical and effective approach to testing the security of their Android applications, thereby improving the overall security of the Android application ecosystem.

Web of Threats: A Comprehensive Analysis of Various Injection Attacks on Web Application Software

With the ever-increasing reliance on software systems for critical functions across various domains, the threat landscape has evolved to exploit vulnerabilities within these systems. This research paper explores the clandestine domain of software injection attacks, presenting a comprehensive analysis of their methodologies and severity. The study begins by providing an in-depth exploration of various software injection techniques, such as SQL injection, cross-site scripting (XSS), and code injection etc elucidating the mechanisms through which attackers exploit vulnerabilities to compromise the integrity and confidentiality of sensitive data. Through a detailed examination of Dynamic Application Security Testing reports of different websites over the past two years, the paper sheds light on the diverse ways in which software injection attacks have been employed to compromise systems in different industries. This research paper provides a holistic understanding of software injection attacks, aiming to raise awareness among developers, security practitioners, and policymakers about the gravity of this threat. By elucidating the intricacies of these attacks and proposing effective countermeasures, the paper contributes to the ongoing efforts to bolster the resilience of software systems against evolving cyber threats.

SAST Tools and Manual Testing to Improve the Methodology of Vulnerability Detection in Web Applications

Statically analyzing code during development is a common process of the development process, using Static Application Security Testing tools. SAST analyzes code without its execution and is also very fast compared to dynamic means and therefore focuses on a certain program part. However, the results of static analysis tools are not always accurate, either missing vulnerabilities or reporting false positives. This paper considers an evaluation of several SAST tools and an analysis of student code samples with known vulnerabilities, comparing manual analysis with the results of SAST tools. The results confirmed that SAST tools properly identify critical vulnerabilities and provide errors. A tool has identified ShiftLeft as the most efficient tool; however, its findings overlapped with the results of other tools for some applications. In addition, an analysis of student projects showed the most frequent vulnerabilities as Cross-site Scripting (XSS), NoSQL/SQL Injection, and Server-Side Request Forgery (SSRF) which make up more than 52% of the found vulnerabilities.

Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We?

Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We?

On the Benefits of Vulnerability Data Consolidation in Application Security

This research aims to build upon a conceptual idea of consolidating all application security vulnerability data from monitoring, detection, and discovery tools into a physical system that allows for convergence of observation and response to an event that is a threat. Multiple application security testing and monitoring tools are deployed at different layers of an application architecture and capture activities that occur at that layer. This multi-layer data capture is disconnected without any analysis of data lineage from the externally exposed web attack surface to deep down into the application and data layers. It is only through this data consolidation can one provide a reliable statistical analysis of correlating multiple vulnerability information and synthesize an attack pattern and predict possible events accurately. The benefits of such a system are discussed in this paper that includes how one can organize the data, identifying temporal and spatial correlation of events, focusing on specific web requests that point to a specific vulnerability, and formulating a fast response to such events. Advantages of integrating with Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR/XSOAR), Extended Detection Response (XDR) are briefly discussed. The analysis can be further used to develop a predictive system using deep learning (DL) techniques using correlation of application security vulnerability information.

A Comparative Analysis and Benchmarking of Dynamic Application Security Testing (DAST) Tools

Cybersecurity is crucial in today's era of advanced technology, rapidly developing scientific understanding, and a completely interconnected global society to guarantee high safety in all aspects of life. Furthermore, there is an ever-increasing number of difficulties and dangers to achieving security in cyberspace. One of the most basic and essential ways to avoid cybersecurity is to conduct security testing for vulnerabilities. In order to make the most of the potential synergies between various types of analysis tools, this paper combines static white box security analysis (SAST), dynamic black box security analysis (DAST), and interactive white box security analysis (IAST) in that order. This investigation aims to improve security vulnerability detection while decreasing false positives.

Comprehensive Empirical Study of Python JWT Libraries

JSON Web Token (JWT) is a simple, compact way to share claims in a space-constrained environment. JWT is part of the interoperable JSON-based identity suite. Many libraries that provide JWT-based authentication and authorization exist. While the JWT standard is secure, some implementations still need to be made. This research paper delves into a comprehensive analysis of the prominent Python libraries utilized for JWT authentication. By meticulously examining these libraries, we aim to provide an in-depth understanding of their features and capabilities. Our investigation encompasses an enumeration of the distinct signing algorithms that are supported by each of these JWT Python libraries.To ensure the robustness and security of these libraries, we employ a multifaceted approach that utilizes various statistical application Security Testing (SAST) tools. These tools play a pivotal role in our assessment by not only evaluating the adherence of the codebase to the PEP8 standard but also by meticulously scanning for common security vulnerabilities and bugs that could potentially compromise the integrity of the authentication process.Our research goes beyond mere identification; we meticulously analyze each warning generated by the SAST tools, emphasizing those warnings that hold the most tremendous significance regarding potential security risks. Furthermore, our investigation extends to gauging the popularity and adoption of each library. To achieve this, we leverage GitHub statistics and harness the power of the Sourcegraph code search utility. By delving into these metrics, we gain a comprehensive view of the community’s engagement, usage trends, and overall traction of each library. In summary, this paper thoroughly explores the landscape of JWT authentication in Python, encompassing library evaluation, security assessment, warning analysis, and popularity metrics.

Comprehensive Exploration of Web Application Security Testing with Burp Suite Tools

This research paper investigates the pivotal role of Burp Suite tools in web application security testing, aligned with the foundational principles of secure coding practices outlined by the Open Web Application Security Project (OWASP). The paper provides an in-depth overview of Burp Suite tools, emphasizing their features and the significance of web application vulnerability scanning in enforcing robust security practices. The exploration includes a detailed examination of Burp Repeater and Burp Intruder, with a practical demonstration of a Burp Suite cluster bomb attack. This research contributes to advancing the understanding and application of Burp Suite tools for effective web application security testing within the framework of OWASP secure coding practices.

Why Is Static Application Security Testing Hard to Learn?

Why Is Static Application Security Testing Hard to Learn?

Analysis of vulnerabilities and security problems of web applications

The article provides a comprehensive analysis of vulnerabilities, methods, tools and problems faced by web application security testing. The analysis of scientific research in the field of web application security testing revealed a significant interest of scientists in finding effective ways to minimize site security risks and vulnerabilities. It was found out that the list of the most common web application vulnerabilities includes: broken access control, cryptographic failures, misconfiguration of security, SQL and other injections, insecure design, identification and authentication errors, etc. Specific features of the security vulnerabilities of web applications are highlighted. The problems faced by automated tools for web security testing are separately considered, namely the development of automated tools for web security testing, the use of RIA (Rich Internet Application) web applications, and the use of insecure cryptographic storage. Web application security risks can be associated with the design phase, the development phase, the deployment phase, and the maintenance phase. It is security testing that is used to identify these risks of the web application, to investigate the vulnerabilities and weak points of the web application. The conducted analysis of security vulnerabilities, methods and problems of testing web applications revealed the presence of different approaches to protect software products. A combination of manual and automated web application security testing techniques is advisable, starting with automated security testing and complementing it with manual penetration testing. A comprehensive approach should integrate testing into all stages of the software development life cycle. Such approach helps to use the most appropriate and effective available methods for the current phase of software product development.

Vulnerability Detection Using Two-Stage Deep Learning Models

Application security is an essential part of developing modern software, as lots of attacks depend on vulnerabilities in software. The number of attacks is increasing globally due to technological advancements. Companies must include security in every stage of developing, testing, and deploying their software in order to prevent data breaches. There are several methods to detect software vulnerability Non-AI-based such as Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). However, these approaches have substantial false-positive and false-negative rates. On the other side, researchers have been interested in developing an AI-based vulnerability detection system employing deep learning models like BERT, BLSTM, etc. In this paper, we proposed a two-stage solution, two deep learning models were proposed for vulnerability detection in C/C++ source codes, the first stage is CNN which detects if the source code contains any vulnerability (binary classification model) and the second stage is CNN-LTSM that classifies this vulnerability into a class of 50 different types of vulnerabilities (multiclass classification model). Experiments were done on SySeVR dataset. Results show an accuracy of 99% for the first and 98% for the second stage.

Application of AI and ML in the Field of DevSecOps

Security is a paramount concern in DevOps. The adoption of Infrastructure as Code (IaC) has increased the potential impact of even minor flaws, particularly in critical domains like healthcare and maritime applications. Existing solutions typically focus on either Static Application Security Testing (SAST) or run-time behavior analysis. This paper introduces the IaC Scan Runner, an open-source tool developed in Python for inspecting various IaC languages during application design, and LOMOS, a run-time anomaly detection tool. Both tools work together to enhance the security of DevOps processes. In today’s rapidly evolving technological landscape, the vulnerability of infrastructure and applications is growing due to a combination of factors. Attackers are becoming more sophisticated, leveraging improved intelligence to exploit weaknesses. At the same time, there is a lack of technical capability in many organizations to effectively secure their systems. This paper explores a dual approach to cybersecurity: static security monitoring through rule matching and the application of self-supervised machine learning. By combining these approaches, organizations can better defend against cyber threats. One area of focus is supply chain resilience and smart logistics, where the integration of these methods is particularly critical. This approach emphasizes a self-learning and self-healing approach, allowing systems to adapt and respond to new threats autonomously. Integrating Artificial Intelligence (AI) and Machine Learning (ML) into DevSecOps practices is essential for improving security, efficiency, and innovation in software development and deployment. This paper delves into strategies and best practices for leveraging AI/ML within the DevSecOps framework. It discusses automated threat detection, predictive analytics for vulnerability management, and intelligent automation for continuous integration and deployment. However, this integration also presents challenges, such as data privacy, algorithm transparency, and ethical implications. The paper addresses these challenges and showcases how organizations can use AI/ML to optimize their DevSecOps pipelines, mitigate security risks, and foster continuous improvement. The adoption of Infrastructure as Code (IaC) has increased the potential impact of even minor flaws, especially in critical domains like healthcare and maritime applications. Existing solutions typically focus on either Static Application Security Testing (SAST) or run-time behavior analysis.

Comparative analysis of the effectiveness of OWASP ZAP, Burp Suite, Nikto and Skipfish in testing the security of web applications

Application security is one of the key aspects necessary for its proper functioning. Ensuring security consists primarily in conducting regular penetration tests and checking the vulnerability of the application to various types of attacks. The recommended solution is to use tools dedicated to detecting security holes in applications. Choosing the right tool from among those available on the market can be difficult. This article presents a comparative analysis of the effectiveness of popular application security testing tools in terms of the number of detected vulnerabilities. The analysis was based on the obtained results of scanning two Internet applications containing a number of security vulnerabilities, used to learn ethical hacking.

Automating the Detection of Access Control Vulnerabilities in Web Applications

The importance of automated and reproducible security testing of web applications is growing, driven by increasing security requirements, short software development cycles, and constraints with respect to time and budget. Existing automated security testing tools are already well suited to detect some types of vulnerabilities, e.g., SQL injection or cross-site scripting vulnerabilities. However, other vulnerability types are much harder to uncover in an automated way. One important representative of this type are access control vulnerabilities, which are highly relevant in practice as they can grant unauthorized users access to security-critical data or functions in web applications. In this paper, a practical solution to automatically detect HTTP GET request-based access control vulnerabilities in web applications is presented. The solution is based on previously proposed ideas, which are extended with novel approaches to enable completely automated access control testing with minimal configuration effort, which in turn enables frequent and reproducible testing. An evaluation with seven web applications based on different technologies demonstrates the general applicability of the solution and that it can automatically uncover most access control vulnerabilities while keeping the number of false positives low.

The Development of a Web-Based Application Security Testing Framework in Addis Ababa, Ethiopia

The web-based application is the most significant platform to promote business. Nowadays the number of customers of web-based applications increases rapidly. This study aims to use both qualitative and quantitative research methodology to study the challenge the software companies in Addis Ababa, Ethiopia are facing, in the process of software security testing while developing a web-based application. Most software company and organization in Ethiopia test the web-based application at the end of the SDLC which make it less secure. Data for this study was collected using questionnaires and an interview. This research was applied in eight software companies and in two well-known organizations that develop their software. The contribution of this study is to mitigate the challenges the developer has when they perform security testing in a WBA. This study also contributes to having visible data about security testing performance and processes in Addis Ababa, Ethiopia. Keywords: Software securıty testıng, Web-based application, Case of addıs Ababa.

Code Analysis with Static Application Security Testing for Python Program

Code Analysis with Static Application Security Testing for Python Program

Semantic web Racer: Dynamic security testing of the web application against race condition in the business layer

The parallel execution of multiple threads of a web application will cause races if the web application is not synchronized correctly. Detecting the race condition in web applications depends on the application’s business logic. No logic-aware approach has been presented so far for detecting various race conditions in web applications. The existing approaches only detect part of server-side races or a few client-side race conditions. Most existing approaches result in DoS or they have a high vulnerability detection time.In this study, various race conditions existing in a web application, both on the server-side and on the client-side, are classified and described. In addition, we present Semantic Web Racer, a black-box approach for dynamic application security testing, to detect the business-layer vulnerability of the web application against race conditions both on the server-side and on the client-side. Semantic Web Racer detects race conditions by identifying the business logic of the web application. First, it identifies the business processes in the web application and, by defining a trace pattern for each type of race condition, identifies critical business processes. The detected critical processes are performed in the defined race window in both normal mode and race-prone mode, and the results are checked to identify vulnerabilities.The evaluation of well-known and widely used web applications and web pages shows that Semantic Web Racer can detect the business layer vulnerabilities of these applications against race conditions. Experiments showed that out of 38 detected race conditions by Semantic Web Racer in selected applications, 24 are new vulnerabilities that were not identified by related works. The amount of traffic generated to identify vulnerabilities has been improved by about 98.29% by identifying the business layer of the application. Thus, Semantic Web Racer does not result in DoS. Semantic Web Racer has improved race detection time by about 96.78%.

Challenges and solutions when adopting DevSecOps: A systematic review

DevOps (Development and Operations) has become one of the fastest-growing software development paradigms in the industry. However, this trend has presented the challenge of ensuring secure software delivery while maintaining the agility of DevOps. The efforts to integrate security in DevOps have resulted in the DevSecOps paradigm, which is gaining significant interest from both industry and academia. However, the adoption of DevSecOps in practice is proving to be a challenge. This study aims to systemize the knowledge about the challenges faced by practitioners when adopting DevSecOps and the proposed solutions reported in the literature. We also aim to identify the areas that need further research in the future. We conducted a Systematic Literature Review of 54 peer-reviewed studies. The thematic analysis method was applied to analyze the extracted data. We identified 21 challenges related to adopting DevSecOps, 31 specific solutions, and the mapping between these findings. We also determined key gap areas in this domain by holistically evaluating the available solutions against the challenges. The results of the study were classified into four themes: People, Practices, Tools, and Infrastructure. Our findings demonstrate that tool-related challenges and solutions were the most frequently reported, driven by the need for automation in this paradigm. Shift-left security and continuous security assessment were two key practices recommended for DevSecOps. People-related factors were considered critical for successful DevSecOps adoption but less studied. We highlight the need for developer-centered application security testing tools that target the continuous practices in DevSecOps. More research is needed on how the traditionally manual security practices can be automated to suit rapid software deployment cycles. Finally, achieving a suitable balance between the speed of delivery and security is a significant issue practitioners face in the DevSecOps paradigm.

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (Iast) and Runtime Application Self-Protection (Rasp) Tools in A Large Java-Based System

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (Iast) and Runtime Application Self-Protection (Rasp) Tools in A Large Java-Based System