Web Application Security Research Articles

REVIEW ON IOT BASED THREATS, VULNERABILITIES & CHALLENGES OF INCIDENT RESPONSE USING EMBEDDED SYSTEM FOR SENSOR NODES

The Internet of Things (IoT) is the technology innovation of the century and will forever impact how future generations communicate, work, and handle personal day-to-day tasks. IoT devices streamline processes and often automate everyday household tasks. Despite all the hype and added benefits to their uses, they continue to be the spotlight of recent breaches, privacy concerns, and security vulnerabilities and incidents. The purpose of this study is to shed light on the current threat landscape as it relates to the Internet of Things (IoT) while addressing the reasons why IoT devices are prime targets for attack.Additionally, the study examines the challenges of network defenders, incident responders, and forensic examiners face when investigating incidents.The study found IoT devices are plagued by many software and hardware vulnerabilities, most of which are examined and researched heavily by the Open Web Application Security Project (OWASP). Solutions include providing education to consumers on the risks and mitigations associated some of the more common vulnerabilities. Device manufacturers have a role to play in securing devices before they are released to the general market. Solutions to the challenges faced by Incident Responders and Computer Forensics examiners includes preparation before the incident or crime occurs. Proposed solutions include creating investigative and analytical procedures applying specifically to the Internet of Things. Including understanding their internal makeup, where data is stored, and to whom data is transferred. Answering each of these questions provides potential sources of evidence used to paint an overall picture of the root cause of incidents and events.

Vulnerability Scanning Technology on Web Applications

Modern society is far more dependent on web applications than the previous generations. Even though our dependence is increasing rapidly, the security level is far lower than required. To guarantee the security of the data system in the industry and our daily life, it is especially crucial to find out web application security vulnerabilities quickly and accurately. A vulnerability is a state of being unprotected from the prospect of an attack. It permits an attacker to gain a certain level of command of the site, and possibly the hosting server. One such vulnerability is the cross-site scripting vulnerability. In this exposition, a generic vulnerability scanner is proposed which can be customized to find any number of vulnerabilities. The scanner maps out the website and gives a report of all the vulnerabilities. For the purpose of evaluation, it has been customized to find XSS vulnerability in web applications.

Defending Virtual Gross System from Software GUSTY

The aim of our project is to build a secure Web Application platform for auditing. The auditee uploads their financial records to the platform and the uploaded records can only be accessed by an authorized auditor. The data integrity is ensured by using cryptography. We can prevent malware like Trojan. The data will be in an encrypted format. Even if a hacker manages to get his hands on the data, it cannot be exploited.

Poor Coding Leads to DoS Attack and Security Issues in Web Applications for Sensors

As the SQL injection attack is still at the top of the list at Open Web Application Security Project (OWASP) for more than one decade, this type of attack created too many types of issues for a web application, sensors, or any similar type of applications, such as leakage of user private data and organization intellectual property, or may cause Distributed Denial of Service (DDoS) attacks. This paper focused on the poor coding or invalidated input field which is a big cause of services unavailability for web applications. Secondly, it focused on the selection of program created issues for the WebSocket connections between sensors and the webserver. The number of users is growing to use web applications and mobile apps. These web applications or mobile apps are used for different purposes such as tracking vehicles, banking services, online stores for shopping, taxi booking, logistics, education, monitoring user activities, collecting data, or sending any instructions to sensors, and social websites. Web applications are easy to develop with less time and at a low cost. Due to that, business community or individual service provider’s first choice is to have a website and mobile app. So everyone is trying to provide 24/7 services to its users without any downtime. But there are some critical issues of web application design and development. These problems are leading to too many security loopholes for web servers, web applications, and its user’s privacy. Because of poor coding and validation of input fields, these web applications are vulnerable to SQL Injection and other security problems. Instead of using the latest third-party frameworks, language for website development, and version database server, another factor to disturb the services of a web server may be the socket programming for sensors at the production level. These sensors are installed in vehicles to track or use them for booking mobile apps.

Server-Side Template Injection with Custom Exploit

Cyber attacks are getting progressively incessant, causing a great deal of harm. Attackers take our valuable information by compromising web application security loopholes. Dynamic content that is being incorporated into the html that has been served to the client. assume when you open a site page then you see your name so that is dynamic substance for each client who additionally at any point visits that page. We can inject input fields and they are shipped off the web worker. So ,we need to check for all information handled whose worth is reflected in some structure to get the prepared payload. Then attempt to misuse it dependent on the layouts. This paper discusses the idea of an template injection and its impact on template based web application

Performance evaluation of Convolutional Neural Network for web security

Due to the daily use of web applications in several critical domains such as banking and online shopping, cybersecurity has become a challenge. Recently, deep learning techniques have achieved promising results and attracted cybersecurity researchers. In this paper, we explore and evaluate deep learning techniques used for the security of web applications. We analyze through experiments the different factors influencing the performance of the Convolutional Neural Network (CNN) technique for web attacks detection. The experiments done in this paper focus on CNN and have three goals. First, we evaluate the performance of different CNN models using two different methods of data input presentation and data input splitting. Second, we study the impact of the different CNN hyper-parameters on the attack detection rate. Third, we select the best deep learning toolbox that will be used in our future proposed detection technique. Through the experiments conducted in this paper, we reveal that an adequate tuning of hyper-parameters and the way of pre-processing data input have a significant impact on the attack detection rate.

Diversity, Equity, and Inclusion in Academic Nuclear Medicine: National Survey of Nuclear Medicine Residency Program Directors.

A diverse health-care workforce is a necessary component of equitable care delivery to an increasingly diverse U.S. population. In nuclear medicine (NM), there is a paucity of data on the numbers of women and members of racial and ethnic groups that are underrepresented in medicine in the United States (URiMs). This study sought to characterize the current state of women and URiMs in academic NM, describe the demographics of Accreditation Council for Graduate Medical Education (ACGME)-accredited NM residency program faculty and trainees, and assess the extent of NM exposure during medical school. Methods: This study was reviewed by the Institutional Review Board and deemed exempt. In this cross-sectional study, a link to an online 15-item survey was emailed to 41 ACGME-accredited NM residency program directors (PDs) in the United States. Data were collected between September 2018 and December 2018 using a secure web application that serves as an electronic data capture tool for research studies. Results: 23 of 41 (56.1%) PDs responded to the survey, 18 of 23 (78.3%) of whom were men and 5 of 23 (21.7%) women. Three of 23 (13.0%) PDs reported being URiMs. Of the 60 residents in the 23 NM residency programs whose PDs responded, 37 of 60 (61.7%) were men (7/37 [18.9%] URiMs) and 23 of 60 (38.3%) women (5/23 [21.7%] URiMs). Fourteen of 60 (23.3%) residents were U.S. medical school graduates (U.S. grads). PDs described demographics of 121 current NM faculty members: 86 of 121 (71.1%) were men (8/121 [6.6% URIMs] and 35 of 121 (28.9%) women (7/121 (5.8% URiMs). Sixty-five of 121 (53.7%) were U.S. grads. Sixteen of 23 (69.6%) divisional chiefs were men, and 7 of 23 (30.4%) were women. Four of 23 (17.4%) divisional chiefs were URiMs, and 7 of 20 (35.0%) NM PDs reported that NM was part of the medical school curriculum. Conclusion: Women and URiMs are underrepresented in NM training programs. This diversity gap is more pronounced among NM faculty and to an even greater extent in leadership positions. A greater proportion of NM trainees are international medical graduates compared with NM faculty members, suggesting declining NM recruitment among U.S. grads. NM is included in the medical school curriculum at fewer than one third of academic centers with NM residency programs, typically toward the end of medical school. Increased and earlier exposure to NM, especially for women and URiMs, may improve recruitment and mitigate diversity gaps.

Risks and Threats to Web Applications and Their Preventions : A Theoretical Study on Vital Risks and Threats

With the rapid evolution of technology, almost every business is now online connecting them to the widest and narrow corners of the world. Therefore, instead of physical security, their online security is a pivotal concern the business which all depends on the web applications security. Web application attacks and their risks have become normal since past many years, and the security of web applications has received increased attentions at present. Many attacks work on real time and mostly prevention mechanisms focus on prevention and detection of these attacks on the web applications. This research focuses on giving attention to the top 10 threats that organizations need to know and to ensure the web applications are protected from these risks and attacks.

Search of real network addresses of web applications using the CDN service

In the following research, we have considered the problem of finding real network addresses of web applications. For this purpose, we have used a service, which based on providing content delivery to networks. Thus, the known solutions are analyzed, and their features of use are established. Among them, the focus of this service on speeding up the operation and security of web applications is highlighted. Taking into account these features, this issue is complicated by the focus on describing the technical capabilities of the already known solutions. This limits the detection of web application of configuration vulnerabilities. To prevent this, the capabilities of content delivery networks have been used. This use is based on redirecting HTTPS traffic through their servers and, as a result, hiding the real IP address of the web application. The most common implementations of the service based on content delivery networks are highlighted. The focus on the web application firewall is shown. Its applicability at the configuration of DNS requests and finding of real network addresses is established. Also, the most typical methods of their search are identified. Among them, the emphasis is placed on the use of services for viewing current and archival data of Internet resources; using MX records as sources of IP addresses; sending letters by e-mail to the specified (correct or incorrect) e-mail addresses; finding subdomains without a configured service of content delivery networks; obtaining an SSL certificate; using DNS name research tools. The implementation of these methods is demonstrated by the selected software. To do this, the criteria are introduced and their capabilities are compared. The results of using the selected software show the limitations of its functionality. To prevent this, it is recommended to combine methods of searching for real network addresses of web applications using the service of content delivery networks.

Pattern Image based Dynamic Framework for Security in Web Application

Web Application Security is one of the most important non functional requirements whenever we build a web application. A chain is just as though it were effective as its weakest relation, as is the case with defence. We might be having very strong applications and might be having very strong infrastructure because one small flaw can break the security. In terms of image based security the image processing techniques are used. The image can be used for authentication of the system like in the present work the image is being used as “pattern image based authentication system”. In majority of the web systems the security can be comprised by visualizing the passwords on runtime or accessing the system by unwanted calls like phishing attacks. In the current work the image based pattern is being used which actually is dynamic in nature like changes after every attempt made by the user either successful or unsuccessful, the patterns are drawn on the basis of the passcode generated. The system works for the manual hacking of the user id and password and also hacking the data by visualization. The developed system is prone to many type of attacks like phishing attack where the attackers shares information over mail, message and other medium to get the secure information from the user. This technique is used to develop an effective web application, and the results show that our method provides a quick and secure image transmission process

Web Application Security Threats and Analysis of Vulnerability Scanners

Web Application Security Threats and Analysis of Vulnerability Scanners

AN INVESTIGATION AND ANALYSIS OF CYBER SECURITY INFORMATION SYSTEMS: LATEST TRENDS AND FUTURE SUGGESTION

Network protection includes of the strategies and procedures implemented in this paper to avoid and monitor intrusion attempts, infringement, manipulation or violation of a computer system and services accessed by the network. Network protection applies to the different countermeasures put in place to secure or flow through the network and data collected on or through it. Protection for web applications is the method of securing websites and internet resources from multiple security attacks that target weaknesses in an application. Security for web apps is a data management division that primarily deals with the security of websites, web applications and web services. Risks to cyber security include a broad range of allegedly criminal practices on the web. For years, computer security risks against utility assets were identified, cyber-attacks arising from the exploitation of data device weaknesses by unauthorized access users This study is a cyber infrastructure assault, vulnerability and vulnerabilities, including hardware and software devices, networks, business networks, intranets, and cyber intrusion usage. Only big organisations are at risk of cyber-attacks, a widespread misunderstanding. Even then, the targeting of small and medium sized enterprises has seen a large improvement. This is since less-sophisticated cyber defence mechanisms appear to be used by these smaller organisations. As many as 50% of all cyber-attacks hit small companies, wasting $200,000 on average, sufficient to get out of business for less-established entities. an enterprise-grade protection device and awareness of the various forms of cyber threats facing corporations in 2025 to safeguard company from hacking attacks. fight cyber threats successfully and decrease the exposure of enterprise.

Web Vulnerability Through Cross Site Scripting (XSS) Detection with OWASP Security Shepherd

Web applications are needed as a solution to the use of internet technology that can be accessed globally, capable of displaying information that is rich in content, cost effective, easy to use and can also be accessed by anyone, anytime and anywhere. In the second quarter of 2020, Wearesocial released information related to internet users in the world around 4.54 billion with 59% penetration. People become very dependent on the internet and also technology. This condition was also triggered due to the Covid-19 pandemic.One thing that becomes an issue on website application security is internet attacks on website platforms and we never expected the vulnerability. One type of attack or security threat that often arises and often occurs is Cross Site Scripting (XSS). XSS is one of Top 10 Open Web Application Security Projects (OWASP) lists.There are several alternatives that we can use to prevent cyber-attack. OWASP Security Shepherd can be used as a way to prevent XSS attacks. The OWASP Security Shepherd project allows users to learn or develop their manual penetration testing skills. In this research, there are several case examples or challenges that we can use as a simulation of the role of OWASP Security Shepherd to detect this XSS. The purpose of this paper is to conduct a brief and clear review of technology on OWASP Security Shepherd. This technology was chosen as an appropriate and inexpensive alternative for users to ward off XSS attacks.

A Secure Software Specification Development Strategy for Enterprises : A Case Study Approach

Although Security is a non-functional requirement, it is a very essential requirement for software systems, to achieve secure software specification development for enterprises we need to find and fix vulnerabilities in the early phase of SDLC. For the successful achievement of secure software specification development in the software enterprise, the security of software application plays a very vital role. During the software development lifecycle, improper security can lead to thoughtful and serious consequences in any enterprise. In this paper, the case study approach is followed regarding the achievement of a secure web application, finding and fixing vulnerabilities in the early software development lifecycle, and applying the re-engineering process on a developed web application using the best security assessment model considering the literature review. Also, validation of the developed application is done with the help of Penetration testing.

A cross-platform informatics system for the Gut Cell Atlas: integrating clinical, anatomical and histological data.

The Gut Cell Atlas (GCA), an initiative funded by the Helmsley Charitable Trust, seeks to create a reference platform to understand the human gut, with a specific focus on Crohn's disease. Although a primary focus of the GCA is on focusing on single-cell profiling, we seek to provide a framework to integrate other analyses on multi-modality data such as electronic health record data, radiological images, and histology tissues/images. Herein, we use the research electronic data capture (REDCap) system as the central tool for a secure web application that supports protected health information (PHI) restricted access. Our innovations focus on addressing the challenges with tracking all specimens and biopsies, validating manual data entry at scale, and sharing organizational data across the group. We present a scalable, cross-platform barcode printing/record system that integrates with REDCap. The central informatics infrastructure to support our design is a tuple table to track longitudinal data entry and sample tracking. The current data collection (by December 2020) is illustrated with types and formats of the data that the system collects. We estimate that one terabyte is needed for data storage per patient study. Our proposed data sharing informatics system addresses the challenges with integrating physical sample tracking, large files, and manual data entry with REDCap.

A hybrid of CNN and LSTM methods for securing web application against cross-site scripting attack

<span>Cross-site scripting (XSS) is today one of the biggest threatthat could targeting the Web application. Based on study published by the open web applications security project (OWASP), XSS vulnerability has been present among the TOP 10 Web application vulnerabilities.Still,an important security-related issue remains how to effectively protect web applications from XSS attacks.In first part of this paper, a method for detecting XSS attack was proposed by combining </span><span lang="EN-GB">convolutional</span><span> neural network (CNN) with long short term memories<strong> (</strong>LSTM), Initially, pre-processing was applied to XSS Data Set by decoding, generalization and tokanization, and then word2vec was applied to convert words into word vectors in XSS payloads. And then we use the combination CNN with LSTM to train and test word vectors to produce a model that can be used in a web application. Based on the obtaned results, it is observed that the proposed model achevied an excellent result with accuracy of 99.4%.</span>

A hybrid fuzzy rule-based multi-criteria framework for sustainable-security assessment of web application

The present day environment of cyber-attacks is a threat to even the most secure systems. With each passing day, the attackers are adapting new technologies to infiltrate systems and exploit even the minutest of the vulnerabilities. In such a scenario, it is imperative to design and develop web applications that are not only secure but sustainable as well. While security is the most defined feature of a web application, sustainability also must be prioritized because any web application will be more efficacious if it proffers both to the users. In this league, it is imperative to reckon in on mechanisms that can effectively evaluate the web applications’ sustainable–security during the development process. To achieve the high level of sustainable-security in web applications, this contribution has used the Fuzzy Analytic Hierarchy Process (Fuzzy AHP) for evaluating the efficacy of the overall sustainable-security and its characteristics. Furthermore, the study tests the Fuzzy AHP method on ten successive versions of an institutional web application to corroborate the efficiency of this approach. Despite the web application's sensitivity, this study has used various versions of three web applications of the university. Results have been conclusive and far more effective when compared to the existing processes for testing the sustainable–security of web applications. Besides saving upon the time and resource investments, the mechanism proposed in our study seeks to set a template which the web developers can adhere to for optimizing on the sustainable-security while developing the web applications.

Evaluating the Impact of Software Security Tactics: A Design Perspective

Design architecture is the edifice that strengthens the functionalities as well as the security of web applications. In order to facilitate architectural security from the web application’s design phase itself, practitioners are now adopting the novel mechanism of security tactics. With the intent to conduct a research from the perspective of security tactics, the present study employs a hybrid multi-criteria decision-making approach named fuzzy analytic hierarchy process-technique for order preference by similarity ideal solution (AHP-TOPSIS) method for selecting and assessing multi-criteria decisions. The adopted methodology is a blend of fuzzy analytic hierarchy process (fuzzy AHP) and fuzzy technique for order preference by similarity ideal solution (fuzzy TOPSIS). To establish the efficacy of this methodology, the results are obtained after the evaluation have been tested on fifteen different web application projects (Online Quiz competition, Entrance Test, and others) of the Babasaheb Bhimrao Ambedkar University, Lucknow, India. The tabulated outcomes demonstrate that the methodology of the Multi-Level Fuzzy Hybrid system is highly effective in providing accurate estimation for strengthening the security of web applications. The proposed study will help experts and developers in developing and managing security from any web application design phase for better accuracy and higher security.

Combinatorial Method with Static Analysis for Source Code Security in Web Applications

Security weaknesses in web applications deployed in cloud architectures can seriously affect its data confidentiality and integrity. The construction of the procedure utilized in the static analysis tools of source code security differs and therefore each tool finds a different number of each weakness type for which it is designed. To utilize the possible synergies different static analysis tools may process, this work uses a new method to combine several source codes aiming to investigate how to increase the performance of security weakness detection while reducing the number of false positives. Specifically, five static analysis tools will be combined with the designed method to study their behavior using an updated benchmark for OWASP Top Ten Security Weaknesses (OWASP TTSW). The method selects specific metrics to rank the tools for different criticality levels of web applications considering different weights in the ratios. The findings show that simply including more tools in a combination is not synonymous with better results; it depends on the specific tools included in the combination due to their different designs and techniques.

Защита данных веб-приложений от внутренних угроз

With the rapid development of the Internet, web applications are becoming more and more popular. Many people, groups, organizations, or governments use web applications as a means to share information or support business tasks. With the growing number of threats and attacks on web applications, organizations need a more effective concept of web application security. The article is devoted to the security of web applications and methods of ensuring security on a three-level data protection architecture. A three-level architecture is an architectural model of a software package that assumes that it has three components: a client, an application server, and a database server. Web application security is about protecting the privacy, integrity, and availability of an organization's web resources, as well as its reputation. It also includes policies, procedures, laws, people, and practices. Security, like other components of a web application, is best managed if it is planned at the initial stage of application development. The article also describes the methods of ensuring security. These methods will help security professionals develop security policies, conduct risk assessments, and eliminate potential risks in a cost-effective way.