Open Web Application Security Project Research Articles

Evaluation of Common Security Vulnerabilities of State Universities and Colleges Websites Based on OWASP

The security of state universities' and colleges' websites in the Philippines is vital because they play a critical role in delivering education and information to a wide variety of users. However, these institutions are also exposed to several security flaws due to their growing reliance on digital platforms. The objective of this study is to analyze security vulnerabilities in state universities and colleges websites, utilizing the OWASP Zed Attack Proxy (ZAP), an open-source tool. By adhering to the Open Web Application Security Project (OWASP) Top 10, we can identify potential hazards and suggest appropriate measures to mitigate risks. The steps of the test include gathering data about the test target, using OWASP ZAP to do automatic scanning, exploitation of the scan results, reporting, and offering recommendations. Seventeen (17) SUCs were examined, and the results show that 23.53% are vulnerable to injection, 40.06% had insecure design, 70.59% had outdated components, 88.24% have security misconfiguration, and 94.12% are vulnerable to Broken Access Control. Malicious actors use these vulnerabilities to obtain unauthorized access to software, networks, and systems. By raising the privileges and granting the user ID additional access inside the ecosystem, it can harm the availability, confidentiality, or integrity of data. SUCs should embrace the OWASP Top 10 and begin the process of ensuring that the risks associated with their websites are minimized.

Common Vulnerabilities and Exposures Assessment of Private Higher Educational Institutions Using Web Application Security

The advancements in technology has led to advancements in threats and vulnerabilities as well. Academic websites are not spared from this. This study aims to evaluate the common vulnerabilities and exposures of private higher educational institution’s website using Open Web Application Security Project. Seven private higher education institutions were evaluated using Open Web Application Security Project Zed Attack Proxy and Open Web Application Security Project top 10. The top vulnerabilities the higher educational institutions were exposed to were broken access control, insecure design and software and data integrity failures. There were two higher educational institutions with high level of risks. Also, a total of thirty-two risks or vulnerabilities were identified in the study. The identification of vulnerabilities or exposures in websites will help the private schools to become aware of possible cyberattacks to their institution’s website. This will help the institution to identify and prevent further loss or damage.

Comprehensive Exploration of Web Application Security Testing with Burp Suite Tools

This research paper investigates the pivotal role of Burp Suite tools in web application security testing, aligned with the foundational principles of secure coding practices outlined by the Open Web Application Security Project (OWASP). The paper provides an in-depth overview of Burp Suite tools, emphasizing their features and the significance of web application vulnerability scanning in enforcing robust security practices. The exploration includes a detailed examination of Burp Repeater and Burp Intruder, with a practical demonstration of a Burp Suite cluster bomb attack. This research contributes to advancing the understanding and application of Burp Suite tools for effective web application security testing within the framework of OWASP secure coding practices.

A quantitative security evaluation and analysis model for web applications based on OWASP application security verification standard

In today's digital world, web applications are popular tools used by businesses. As more and more applications are deployed on the web, they are seen as increasingly attractive targets by malicious actors eager to exploit any security gaps present. Organizations are always at risk for potential vulnerabilities in their web-based software systems, which can lead to data loss, service interruption, and lack of trust. Therefore, organizations need to have an effective and efficient method for assessing and analyzing the security of acquired web-based software to ensure adequate confidence in its use. Quantitative security evaluation employs mathematical and computational techniques to express the security level that a system reaches. This research focuses on improving the quantitative analysis of web application security evaluation. We strive to unite the Open Web Application Security Project's (OWASP) Application Security Verification Standard (ASVS) into a structural and analyzable model, which aims to efficiently evaluate web application security levels while providing meaningful insights into their strengths and weaknesses.

Hash and Physical Unclonable Function (PUF)-Based Mutual Authentication Mechanism.

The security of web applications in an enterprise is of paramount importance. To strengthen the security of applications, the identification and mitigation of vulnerabilities through appropriate countermeasures becomes imperative. The Open Web Application Security Project (OWASP) Top 10 API Security Risks, 2023 Edition, indicates the prominent vulnerabilities of API security risks. Broken authentication, however, is placed in second position with level-3 exploitability, level-2 prevalence, level-3 detectability, and level-3 technical impact. To mitigate this vulnerability, many mitigation strategies have been proposed by using the cryptographic primitives wherein two techniques, namely hashing and PUF, are used. Some of the proposals have integrated the concepts of hashing and PUF. However, the unnecessarily lengthy and complex mathematics used in these proposals makes them unsuitable for current API-based application scenarios. Therefore, in this paper, the authors propose a privacy-preserving authentication protocol that incorporates the capability of both mechanisms in an easy and low-complexity manner. In addition to overcoming existing limitations, the proposed protocol is tested to provide more security properties over existing schemes. Analysis of their performance has demonstrated that the proposed solutions are secure, efficient, practical, and effective for API-based web applications in an enterprise environment.

Security Analysis of Web Open-Source Projects Based on Java and PHP

During website development, the selection of suitable computer language and reasonable use of relevant open-source projects is imperative. Although the two languages, PHP and Java, have been extensively investigated in this context, there are not many security test reports based on their open-source projects. In this article, we conducted separate security analyses on web-related open-source projects based on PHP and Java. To this end, different open-source frameworks and services are used to design websites used to test experimental attacks on 12 popular open-source filters available on GitHub, as well as investigate the use of Lightweight Directory Access Protocol (LDAP) in the Firefox browser environment. Using malicious payloads published by Open Web Application Security Project (OWASP) and others, Cross-site Scripting (XSS), Local File Inclusion (LFI), SQL injection, and LDAP injection are performed on the test targets. The experimental results reveal that although PHP-based open-source projects are more vulnerable to attacks than Java-based ones, there is significant room for improvement. Finally, a whitelist-based filtering scheme is proposed. This scheme filters the inline attributes of label elements so that the filter has an excellent detection rate of malicious payloads while having an excellent pass rate of benign payloads. Effective references and suggestions for web developers are also included to aid the selection of open-source web projects, and feasible solutions to improve filter performance are proposed.

A real-time hypertext transfer protocol intrusion detection system on web server

Behind the rapid development of the internet in today’s era, various types of crime are also targeting vital players in the internet industry. With many online crime types rampant, an antidote is also needed to suppress internet crime. Therefore, the researcher proposes a solution in the form of a Keris, namely the hypertext transfer protocol (HTTP) intrusion detection system (IDS) that runs on the server where our website is running. Keris works by detecting rampant intrusions that attack servers or websites. When an intrusion is detected, Keris will notify the system admin using the Keris Telegram chatbot or an alternative Keris mobile application with firebase cloud messaging (FCM) technology. The research was conducted by comparing the results of one-way delay (OWD) between Telegram Webhook and FCM with the help of the open web application security project (OWASP) zed attack proxy (ZAP) test tool. From the results of the tests, OWD against directory brute force attacks on Telegram Webhook for 0.72 seconds and on FCM for 0.44 seconds. In this case, FCM is more suitable for real-time notifications if we need a very responsive notification.

Analisis Kerawanan Pada Aplikasi Website Menggunakan Standar OWASP Top 10 Untuk Penilaian Risk Rating

Since 2011, SMA N “ABC” has implemented a web-based information system. The information system is intended as an introduction to information and learning media for students. The system has never been audited and/or tested for security, so the vulnerability is not yet known. To test the security of the SI SMA N “ABC” application, vulnerability scanning and vulnerability assessment were carried out using the Open Web Application Security Project (OWASP) Top 10 Security Risk 2017 and the Open Web Application Security Project (OWASP) Risk Rating Methodology. From the results of scanning vulnerabilities found thirteen vulnerabilities ranging from high to low categories. Based on the assessment of detected vulnerabilities, resulting in a scale of 5.72 for the possibility of vulnerabilities being exploited by attackers and a scale of 3,315 for the impact on business processes at SMA N “ABC”

Abnormal network packets identification using header information collected from Honeywall architecture

ABSTRACT Most devices are now connected through the Internet, so cybersecurity issues have raised concerns. This study proposes network services in a virtual environment to collect, analyze and identify network attacks with various techniques. Our contributions include multi-fold. First, we deployed Honeynet architecture to collect network packets, including actual cyber-attacks performed by real hackers and crackers. In the second contribution, we have leveraged some techniques to normalize data and extract header information with 29 features from 200,000 samples of many types of network attacks for abnormal packet identification with machine learning algorithms. Furthermore, we introduce an Adaptive Cybersecurity (AC) system to detect attacks and provide warnings. The system can automatically collect more data for further analysis to improve performance. Our proposed method performs better than Snort in detecting dangerous malicious attacks. Finally, we have experimented with different cyber-attack approaches to exploit the ten website security risks recommended by the Open Web Application Security Project (OWASP). From the research results, the system is expected to be able to detect cybercriminal attacks and provide early warnings to prevent a potential cyber-attack.

ANALISIS KEAMANAN SEBUAH DOMAIN MENGGUNAKAN OPEN WEB APPLICATION SECURITY PROJECT (OWASP) Zap

Along with the development of information technology among the wider community, information systems make it easier for people to access and search for information in the form of websites. The problem of security risk is one of the important aspects of an information system. But, security risks are somehow less priority to be considered. In the present work, a security analysis of a domain was conducted using the Open Web Application Security Project (OWASP) Zap. The research method used is literature review and observation. The literature review is used to collect relevant previous research literatures as well as relevant theories and concepts in terms of Vulnerability Analysis. The literatures are obtained from journals, books, scientific papers, and digital media such as the internet. While observation is used to determine, sort, collect, and review the data needed in the test. The results of show that several vulnerabilities on the akprind.ac.id site that can have a detrimental impact on the campus. The security system on several akprind subdomains still does not meet the CIA TRIAD security principle, namely confidentiality. The OWASP Zap tools are still good as a basis for conducting penetration testing on several sites with the akprind.ac.id domain. Because there are still some security issues that match the owasp list. It is hoped that for the IST AKPRIND web, further research needs to be carried out using the ISSAF (Information System Security Assessment Framework) method so that it can be known more deeply if there are vulnerabilities from the web server.

Automation of Quantifying Security Risk Level on Injection Attacks Based on Common Vulnerability Scoring System Metric

An injection attack is a cyber-attack that is one of The Open Web Application Security Project Top 10 Vulnerabilities. These attacks take advantage of insufficient user input validation into the system through the input surface of a Web application as that user in the browser. The company’s cyber security team must filter thousands of attacks to prioritize which attacks are considered the most dangerous to be mitigated first. This activity of filtering thousands of attacks takes much time because you have to check these attacks one by one. Therefore, a method is needed to assess how dangerous a cyber-attack is that enters an organization’s or company’s server. Injection attack detection can be done by analyzing the request data in the web server log. Our research attempts to perform quantification modeling of the variations of two types of injection attacks, SQL Injection (SQLi) and Cross-Site Scripting (XSS), using Common Vulnerability Scoring System Metrics (CVSS). CVSS metrics are generally used to calculate the level of dangerous weakness in the system. This metric is never used to calculate the level of how dangerous an attack is. The modeling that we have made shows that SQLi and XSS attacks have many variations in levels ranging from low to high levels. We discovered that when classified with Common Weakness Enumeration Database, SQLi and XSS attacks CVE values would have high-level congruence with almost 94% value between one another vector on CVSS.

A Semantic Learning-Based SQL Injection Attack Detection Technology

Over the years, injection vulnerabilities have been at the top of the Open Web Application Security Project Top 10 and are one of the most damaging and widely exploited types of vulnerabilities against web applications. Structured Query Language (SQL) injection attack detection remains a challenging problem due to the heterogeneity of attack loads, the diversity of attack methods, and the variety of attack patterns. It has been demonstrated that no single model can guarantee adequate security to protect web applications, and it is crucial to develop an efficient and accurate model for SQL injection attack detection. In this paper, we propose synBERT, a semantic learning-based detection model that explicitly embeds the sentence-level semantic information from SQL statements into an embedding vector. The model learns representations that can be mapped to SQL syntax tree structures, as evidenced by visualization work. We gathered a wide range of datasets to assess the classification performance of the synBERT, and the results show that our approach outperforms previously proposed models. Even on brand-new, untrained models, accuracy can reach 90% or higher, indicating that the model has good generalization performance.

A Survey on SQL Injection Attacks Types & their Prevention Techniques

In the world of connectedness even more than ever before we are using digital technologies in daily life from bank transactions to social networking. While all of this data is residing in databases and with increasing usage, the importance of confidentiality and integrity of the data seems to be a challenging and most pressing issue of today’s world. SQL injection are commonly used attacks to gain access to unauthorized data and one such example out of many where an attacker breach the corporate system and stole 130 million credit card details and even after two decades, SQL injection is still one of top ten security threats by open web application security project (OWASP) moving forward with more digitalization in the future it will always be a serious concern since it impacts the core principle of information security such as confidentiality, integrity and availability. In this research project I will be discussing the types of SQL injection mainly in-band, inferential and out of band attacks and keeping scope over in-band SQL injection to further discuss prevention techniques using traditional methods and lastly discussing some of the prevention techniques using advanced algorithms of machine learning and deep learning in the literature.

A comparative study of web application security scanners for vulnerability detection

A Web Vulnerability Scanner (WVS) is a software tool that assesses the security of web applications by conducting automated penetration tests. It speeds up the process, reduces costs, and eliminates the need for specialized testing engineers. This study evaluates the vulnerability detection capabilities of six WVSs, three commercial scanners, and three open-source scanners. The goal is to identify and mitigate potential security risks before they are exploited by malicious users. The study employed two well-known vulnerable web applications and four relevant metrics, such as detection rate of accuracy, recall, precision, and the ability to detect different vulnerabilities using the Open Web Application Security Project (OWASP) as a reference.

Threat modeling in application security planning citizen service complaints

The mobile-based service complaint application is one way to implement good governance today. Public facilitated to make complaints without going through a complicated process. Security aspects must be considered to protect user privacy. The security design must be considered so that no one is harmed by the application's users damaged in the application's use. This study used threat modeling during the planning stage of developing a citizen service complaint application to obtain information about vulnerabilities. The researcher uses the threat modeling process that the open web application security project (OWASP) organization has formulated as a framework. The researchers took steps to describe application information, determine and rank threats, countermeasures, and mitigation. In the final stage, the spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege (STRIDE) threat modeling methodology is used to analyze and assess mitigation actions against threats in the application. The researcher gets a defense strategy to reduce the danger based on the threat analysis results. Threat modeling in the early phase software development life cycle process is constructive in ensuring that software is developed with adequate security based on threat mitigation from the beginning.

A Deep Learning Approach for The Detection of Structured Query Language Injection Vulnerability

With the rapid development of Web 2.0 technology, network applications have gradually become an indispensable part of our lives. At the same time, Web applications are confronted with more challenges. As announced by the OWASP (open web application security project) organization, injection attack has been the first of the top 10 security vulnerabilities in 2013 and 2017, and SQL injection attack is one of the most important types among the injection attacks. Due to the rapid growth of SQL injection attacks on web application, this research developed a deep learning model in detecting SQL injection attack. The model was trained on a dataset that contains about 30,635 queries, which includes both injected and non-injected queries. The dataset was gotten from Kaggle database. The dataset was then processed by removing null and duplicate values. Further pre-processing was carried out in terms of tokenization and conversion of text to arrays. CountVectorizer () function was used for data normalization in converting the dataset to arrays in form of 0s and 1s. After the pre-processing stage, Feature selection was done on the dataset using the tfidvectoriser. The selected features were passed to the deep feed forward neural network for training. The model was trained on a step of 20 epochs, the model achieved an accuracy of 97.65%. Confusion matrix depicts the total number of correct prediction and the total number of false classifications. The confusion matrix shows that out of 590 classifications on attacks that are of normal, the model predicted correctly for 572 and predicted falsely for 16 times. Then for attacks that are of SQL injection, the model predicted correctly 251 times and predicted falsely for just 1. This shows the performance of the model is in good shape. The model was saved and deployed to web using python flask for easy testing and usage. The model was compared with other existing models and it outperformed the existing model in terms of accuracy. This research can further be extended by using combinations of deep learning algorithms. It can further be extended by deploying the model to android applications.

An improved filter against injection attacks using regex and machine learning

Injection-based attacks have consistently made the Open Web Application Security Project (OWASP)Top 10 vulnerabilities for years. 1 Common types of injection attacks include SQL injection, cross-site scripting (XSS) and code injection. Filter engines are used to detect and sanitise user inputs for these malicious attacks. The user input is assumed to be tainted by default. Thus, the ability of a filter in terms of accuracy and latency is important. There exist various approaches to improve filters, primarily including techniques based on regular expressions (regexes), abstract syntax tree, machine learning and so on. However, the testing of modern solutions has achieved no more than 98.5% accuracy for XSS. This article looks at ways to improve accuracy.

IMPLEMENTASI OWASP ZAP UNTUK PENGUJIAN KEAMANAN SISTEM INFORMASI AKADEMIK

Information security is an important thing that must be considered for every individual and institution in order to avoid crime. Poor information systems can threaten the critical infrastructure of an organization. Problems with system security vulnerabilities or disruptions are widely scattered on the internet. Early detection of the weakness of a system is the initial solution in securing a system. Therefore we need an analysis of the vulnerability of a system that refers to the security standardization of the Open Web Application Security Project (OWASP) by performing an active scan. Website vulnerability analysis using the OWASP ZAP technique with the help of several security tools is able to determine the security level of a website based on the results of scans and tests that have been carried out where almost every test category is able to find vulnerabilities, although there are several categories that do not have vulnerabilities. The purpose of this study is to identify the vulnerabilities contained in the University Academic Information System website and conduct testing and analysis to determine the condition of the vulnerability of the University Academic Information System website using the Open Web Application Security Project (OWASP). The research method used as a website security parameter is OWASP Top-10 2021.

Detection of SQL Injection Attack Using Machine Learning Based On Natural Language Processing

There has been a significant increase in the number of cyberattacks. This is not only happening in Indonesia, but also in many countries. Thus, the issue of cyber attacks should receive attention and be interesting to study. Regarding the explored security vulnerabilities, the Open Web Application Security Project has published the Top-10 website vulnerabilities. SQL Injection is still become one of the website vulnerabiliteis which is often exploited by attacker. This research has implemented and tested five algorithms. They are Naïve Bayes, Logistic Regression, Gradient Boosting, K-Nearest Neighbor, and Support Vector Machine. In addition, this study also uses natural language processing to increase the level of detection accuracy, as a part of text processing. Therefore, the main dataset was converted to corpus to make it easier to be analyzed. This process was carried out on feature enginering stage. This study used two datasets of SQL Injection. The first dataset was used to train the classifier, and the second dataset was used to test the performance of classifier. Based on the tests that have been carried out, the Support Vector Machine get the highest level of accuracy detection. The accuracy of detection is 0.9977 with 0,00100 micro seconds per query time of process. In performance testing, Support Vector Machine classifier can detect 99,37% of second dataset. Not only Support Vector Machine, the study have also revealed the detection accuracy level of further tested algorithms: K-Nearest Neighbor (0,9970), Logistic Refression (0,9960), Gradient Boosting (0,99477), and Naïve Bayes (0,9754).

Analisis Keamanan Sistem Informasi Akademik Menggunakan Open Web Application Security Project Framework

Information system security is one of the important things in the development of technology to protect comprehensive and structured data or information. The Academic Information System (SIA) has a service to receive requests in the form of HTTP or HTTPS protocol website pages from clients called browsers. Intruders can hack websites without the owner's knowledge. This research was conducted to find the vulnerability of SIA STIKES Guna Bangsa Yogyakarta. The framework used is the Open Web Application Security Project (OWASP) which is usually used to evaluate systems or applications. The tools used are WhoIs, SSL Scan, Nmap, and OWASP Zap. The results obtained were finding 12 vulnerabilities with four vulnerabilities at the medium level, namely Absence of Anti-CSRF Tokens, Cross-Domain Misconfiguration, Missing Anti-clickjacking Header, and Vulnerable JS Library, six at the low level namely Cookie Without Secure Flag, Cookie without SameSite Attribute, Cross-Domain JavaScript Source File Inclusion, Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s), Timestamp Disclosure – Unix, and X-Content-Type-Options Header Missing, and two at the informational level namely Content-Type Header Missing and Information Disclosure - Suspicious Comments.