Web Application Security Research Articles

WEBSITE SECURITY ANALYSIS CURUG VILLAGE GOVERNMENT USING OPEN WEB APPLICATION SECURITY PROJECT (OWASP)

Cybersecurity has become a crucial issue in the current digital era, especially for government websites that are often targeted by attacks. According to the National Cyber and Crypto Agency (BSSN), government websites are vulnerable to hacking. This study aims to analyze the security of the Curug Village Government website using the Open Web Application Security Project (OWASP). The analysis was conducted on the ten main categories of web application security vulnerabilities listed in OWASP Top 10 2021, including Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-side Request Forgery. The results of the testing showed that 4 out of 8 vulnerabilities fall into the OWASP TOP 10 for 2021, particularly in the categories of Injection and Security Misconfiguration. Recommendations for improvements are provided based on these findings, which are expected to help the Curug Village Government strengthen their cybersecurity.

OWASP A03 Injection Vulnerability in Web Application Development

Web applications are crucial for businesses and individuals by providing efficient communication, collaboration, and access to services and information via browsers, boosting connectedness, productivity, and creativity in the digital era. Insecure web applications pose risks of data breaches, malware, and unauthorized access which jeopardize user privacy, trust, and organizational security. Web developers must be knowledgeable and prepared to deal with common vulnerabilities in web applications. A prototype web application (https://webriska3.tech) with lesson and editor module is developed to train web developers on the Open Web Application Security Project (OWASP) Top Ten security risks, focusing on A03 - Injection vulnerability. OWASP A03 Injection vulnerability is one of the most common vulnerabilities that is at the heart of any database-driven web applications. Evaluation on the prototype in improvement knowledge on A03 – Injection vulnerability, testers are recruited to complete two coding tasks in laboratory environment. 80% of testers mastered Output escaping/encoding defensive technique while Prepared statement/Parameterized Query defensive technique is the hardest to master. The prototype obtained average System Usability Scale (SUS) score of 57 that is below average, indicating issues with the prototype interface. This work showed promising results of increase understanding on A03 Injection vulnerability and implementation skills to protect web application against attack and exploitations.

Design and Development of an Automatic Penetration Test Generation Methodology for Security of Web Applications

Design and Development of an Automatic Penetration Test Generation Methodology for Security of Web Applications

Defending Against Modern Web Attacks: Strategies for Safeguarding User Identities and Data

Abstract: Organizations must adopt a comprehensive approach to safeguard user identities and sensitive data in the face of increasingly sophisticated web-based attacks. This article presents a multi-faceted strategy for defending against modern web threats, addressing key aspects such as phishing prevention, secure authentication mechanisms, protection against cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks, browser and endpoint security, web application security best practices, and the implementation of a Zero Trust security model. By examining the current landscape of web-based threats and providing actionable recommendations, this article aims to empower organizations with the knowledge and tools necessary to combat evolving cyber threats effectively. The proposed defensive measures encompass user awareness and education, robust technical controls, secure coding practices, and adopting technologies such as multi-factor authentication, biometric authentication, web application firewalls, and browser isolation techniques. Additionally, the article emphasizes the importance of a proactive approach to incident response and threat intelligence, enabling organizations to swiftly detect, contain, and mitigate web-based attacks. By implementing these strategies, organizations can significantly enhance their resilience against modern web threats, safeguarding user identities, protecting sensitive data, and maintaining a secure online presence in an increasingly hostile digital environment

MobileNet based secured compliance through open web application security projects in cloud system

The daunting issues that are promptly faced worldwide are the sophisticated cyber-attacks in all kinds of organizations and applications. The development of cloud computing pushed organizations to shift their business towards the virtual machines of the cloud. Nonetheless, the lack of security throughout the programmatic and declarative levels explicitly prone to cyber-attacks in the cloud platform. The exploitation of web pages and the cloud is due to the uncrated open web application security projects (OWASP) fragilities and fragilities in the cloud containers and network resources. With the utilization of advanced hacking vectors, the attackers attack data integrity, confidentiality, and availability. Hence, it’s ineluctable to frame the application security-based technique for the reduction of attacks. In concern to this, we propose a novel Deep learning-based secured advanced web application firewall to overcome the lack of missing programmatic and declarative level securities in the application. For this, we adopted the MobileNet-based technique to ensure the assurance of security. Simulations are effectuated and analyzed the robustness with the statistical parameters such as accuracy, precision, sensitivity, and specificity and made the comparative study with the existing works. Our proposed technique surpasses all the other techniques and provides better security in the cloud.

Secured web application based on CapsuleNet and OWASP in the cloud

The tremendous use of sensitive and consequential information in the advanced web application confronts the security issues. To defend the web application while it processing the information must requires the security system. The detection of attacks of web is made by the payload or HTTP request-based detection in association with the scholars. Some of the scholars provide secured attack model detection; however, it fails to achieve the optimal detection accuracy. In concern with these issues, we propose an innovative technique for the attack detection the web applications. The proposed attack detection is based on the novel deep CapsuleNet based technique and the process begins with pre-processing steps known as decoding, generalization, tokenization/standardization and vectorization. After the pre-processing steps the information are passed to deep CapsuleNet for extracting the features for attaining the temporal dependencies from the sequential data. The subtle patterns in the information also detected using the proposed work. Simulation is effectuated to demonstrate the effectiveness of the proposed work and compared with other existing works. Our proposed system provides better accuracy in detecting the attacks than the state-of-art works.

Developing an Open-Source, User-Friendly, OWASP-Compliant Architecture for Healthcare Web Application Testing.

Nowadays, web applications are fundamental in the healthcare sector. However, with the widespread use of this technology, risks related to cybersecurity attacks also increase. To mitigate this phenomenon, every 3-4 years, the nonprofit foundation Open Worldwide Application Security Project (OWASP) compiles a top 10 ranking of the most critical web application security risks. Along with the top 10 Web Application Security Risks, OWASP also provides the Web Security Testing Guide, which offers comprehensive guidelines for conducting security tests. This guide includes suggestions for specific tools to use when performing different tests, among other valuable insights. However, the use of these recommended tools can be costly and can require advanced technical skills and a deep understanding of security best practices and web technologies. In addition, since the OWASP work on web security is generic, it would be useful to restrict and adapt it to the healthcare area. This would help in reducing the overhead when dealing with the needed tools. The goal of this study is to make web application security assessment in healthcare more accessible by developing tools that simplify the process and makes it user- friendly. Before developing such tools, an in-depth feasibility study must be conducted to verify the existence of open-source libraries to carry out the necessary testing procedures. It will be also necessary to identify how tools could be simplified and enhanced when focusing on healthcare.

Security Analysis of Web-Based Academic Information System using OWASP Framework

A The Academic Information System plays a crucial role in efficiently managing student, faculty, and campus administration data. However, system security needs to be a primary concern as it is vulnerable to cyber attacks. This research aims to analyze the security of the Academic Information System at the Muhammadiyah Business Institute Bekasi. The research method used is a comprehensive security analysis based on the OWASP framework. The study includes identifying potential vulnerabilities, penetration testing, and system improvement recommendations. Testing is conducted through simulated attacks based on the OWASP-released security risk list (OWASP Top Ten Most Critical Web Application Security Risks). The analysis results indicate that the system is vulnerable to Broken Authentication due to weak passwords, Sensitive Data Exposure due to URLs pointing to direct directories, and Security Misconfiguration due to open protocols. Furthermore, in CVSS scoring, SQL Injection scored 2.6 (Low), Broken Authentication scored 4.8 (Medium), Sensitive Data Exposure and Security Misconfiguration scored 5.3 (Medium), Cross-Site Scripting scored 2.0 (Low), while XXE, Broken Access Control, Insecure Deserialization, Using Components with Known Vulnerabilities, and Insufficient Logging and Monitoring scored 0.0 (No Vulnerability). Recommendations for future system improvements include regularly updating the system to prevent new security vulnerabilities, tighter server configurations, and routine system monitoring to promptly anticipate suspicious activities.

Ensemble learning techniques against structured query language injection attacks

Structured query language (SQL) injection threats pose severe risks to web applications, necessitating robust detection measures. This study introduced DSQLIA, employing ensemble learning algorithms-Bagging, Stacking, and AdaBoost classifiers-for SQL injection detection. Results unveiled the bagging classifier's 84% accuracy with perfect precision (100%) but moderate recall (68%). The stacking classifier achieved 85% accuracy, exceptional precision (99%), and balanced memory (72%), yielding an 83% F1-Score. Remarkably, the AdaBoost classifier outperformed, achieving 99% accuracy, high precision (98%), and outstanding recall (99%), leading to a remarkable 99% F1-Score. These findings highlight AdaBoost's superior ability to identify malicious queries with minimal false positives accurately. Overall, this research underscores the potential of ensemble learning in fortifying web application security against SQL injection attacks, emphasizing the AdaBoost classifier's exceptional performance in achieving precise and comprehensive detection.

Machine Learning-Driven Detection of Cross-Site Scripting Attacks

The ever-growing web application landscape, fueled by technological advancements, introduces new vulnerabilities to cyberattacks. Cross-site scripting (XSS) attacks pose a significant threat, exploiting the difficulty of distinguishing between benign and malicious scripts within web applications. Traditional detection methods struggle with high false-positive (FP) and false-negative (FN) rates. This research proposes a novel machine learning (ML)-based approach for robust XSS attack detection. We evaluate various models including Random Forest (RF), Logistic Regression (LR), Support Vector Machines (SVMs), Decision Trees (DTs), Extreme Gradient Boosting (XGBoost), Multi-Layer Perceptron (MLP), Convolutional Neural Networks (CNNs), Artificial Neural Networks (ANNs), and ensemble learning. The models are trained on a real-world dataset categorized into benign and malicious traffic, incorporating feature selection methods like Information Gain (IG) and Analysis of Variance (ANOVA) for optimal performance. Our findings reveal exceptional accuracy, with the RF model achieving 99.78% and ensemble models exceeding 99.64%. These results surpass existing methods, demonstrating the effectiveness of the proposed approach in securing web applications while minimizing FPs and FNs. This research offers a significant contribution to the field of web application security by providing a highly accurate and robust ML-based solution for XSS attack detection.

Genetic fuzzy rules and hybrid QDCNN-F-DSAE for detecting attacker behavior with tuning of firewall

ABSTRACT The application of computer technology is increasing quickly as the field of information technology develops over time. Because of the growth of computer networks, there is a rise in network attacks. Moreover, the majority of transactions are conducted via the Internet, and then the web application security is becoming increasingly important. A network firewall shields the web servers from unauthorised and dangerous traffic. In this work, the hybrid Quantum Dilated Convolutional Neural Network fused Deep-Stacked Auto Encoder (QDCNN-F-DSAE) model with Genetic Fuzzy System (GFS) is developed for network protection. With the utilisation of genetic fuzzy system (GFS) and firewall tuning, the QDCNN-F-DSAE identified the attack, ransomware activity, and prompt decision-making. The data offered by the simulated environment is used to make decisions, and the decisions should be made quickly within a few seconds using the proposed QDCNN-F-DSAE with GFS. Furthermore, it identifies the attacks and alerts the users to store the data from the supplied source. The malicious function and protected private Local Area Network (LAN) are discovered and removed by the firewall after the formation of genetic fuzzy rules. Moreover, this model is estimated using the accuracy, sensitivity, and specificity measures that offered the finest values of 0.915, 0.908, and 0.920.

Resilient cloud cluster with DevSecOps security model, automates a data analysis, vulnerability search and risk calculation

Automated, secure software development is an important digitalization task, solved with the DevSecOps approach. An important part of the DevSecOps approach is continuous risk assessment, which is necessary to identify and evaluate risk factors. Combining the development cycle with continuous risk assessment creates software development and operation synergies and minimizes vulnerabilities. The article presents the main methods of deploying web applications and ways to increase information security at all stages of product development. It also compares different types of infrastructures and cloud computing providers and analyzes modern tools used to automate processes. The cloud cluster was deployed using Terraform and the Jenkins pipeline, written in the Groovy programming language, which checks program code for vulnerabilities and allows you to fix violations at the earliest stages of developing secure web applications. The developed cluster implements the proposed algorithm for automated risk assessment based on the calculation (modeling) of cloud infrastructure threats and vulnerabilities, which operates in real-time, periodically collecting all information and adjusting the system according to the risk and applied controls. The algorithm for calculating risk and losses is based on statistical data and FAIR information risk assessment methodology. The risk value obtained using the proposed method is quantitative, which allows more efficient forecasting of information security costs in software development.

Enhancing the security of web applications through innovative patterns of integration of artificial intelligence

Ensuring the security of digital operations, especially in the areas of e-commerce and financial transactions, remains increasingly relevant. Therefore, the subject of research is the development of a specialized software library. This library aims to improve the security of web applications. The purpose of this study is to develop a software library that uses artificial intelligence and machine learning methods to analyze and improve the level of security of financial transactions. The use of these advanced technologies helps automate the detection of potentially fraudulent or risky transactions, thereby providing a higher level of user protection. The following tasks are solved in the article: analysis of modern methods of processing financial transactions and identification of possible security threats; development of a UML diagram of library classes for processing and analyzing financial transactions; testing and validation of the developed artificial intelligence model for assessing the security of financial transactions on real financial data. Machine learning methods were defined and applied using the scikit-learn library in Python, the algorithms of which are capable of analyzing large volumes of data and identifying potential risks with high accuracy. This ensures effective integration of artificial intelligence technologies. The following results were obtained in the work: the criteria for assessing the riskiness of financial transactions for the identification of potential risks are defined; the program operation algorithm is described, which includes procedures for determining and classifying transaction risks; pseudocode is presented, which illustrates the structure of classes and methods of the model, opening opportunities for its adaptation and scaling; methods of generating test data reproducing realistic scenarios of financial transactions have been developed; an analysis of the results was carried out to assess the effectiveness of the developed model. In conclusion, the results of research and testing allow us to evaluate the model's response to various data and its effectiveness in real conditions, as the work presents examples of processing various types of transactions. In addition, the study presents not only the development and validation of the developed model, but also the prospects of its use on a larger scale, integration with existing web applications.

Automate the verification of session cookie attributes

In this research, we focus on a critical web security topic, namely the security of session cookies, which play a key role in the functioning of modern web applications. As a standard mechanism for storing data on the client side, cookies are crucial for authentication, authorization and maintaining the state of a user's session. However, despite their necessity and convenience, cookies can also pose serious security risks. Our research focuses on the analysis and automation of cookie attribute verification, which is critical to ensuring protection against various web attacks. Identifying and eliminating weaknesses in cookie attributes can significantly reduce the risk of malicious attacks such as session hijacking, cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. We take an in-depth look at modern methods and tools for securing cookies, including implementing strict policies on cookie attributes such as Secure, HttpOnly, and SameSite. These attributes help to restrict access to cookies from unauthorized use via client-side scripts and provide additional protection against cross-site attacks. In addition, we consider the importance of updating the cookie standard, RFC6265bis, which offers improved security mechanisms, including the SameSite attribute, which allows controlling the sending of cookies during cross-requests, thereby reducing the risk of CSRF attacks. Our research also includes an analysis of potential threats and vulnerabilities associated with the misuse or misconfiguration of cookies, as well as a discussion of strategies to minimize these risks. We demonstrate how detailed automated verification of cookie attributes can significantly improve the security of web applications. The results of the study point to the need to constantly monitor and evaluate the protection of session cookies, as well as the importance of implementing security best practices and standards to ensure the reliability and security of web applications.

Study of web application development methodology for a medical clinic using React

The article explores in detail the methodologies for developing web applications for medical clinics using the popular React library. The main goal of this study is the analysis of modern approaches to the creation of web applications that meet the specific requirements of medical institutions. Particular attention is paid to the functional and non-functional characteristics that are critical to such systems, including data security, user experience, integration with existing systems, and compliance with regulatory standards. First of all, a comprehensive analysis of the requirements of medical clinics for web applications was carried out. Data security is one of the most important aspects as healthcare institutions work with sensitive information. The study examines methods for ensuring the confidentiality and integrity of medical data, including compliance with HIPAA and GDPR standards. React makes it easy to integrate modern security tools such as JWT (JSON Web Tokens) for authentication and authorization, and use secure HTTP connections for data transfer. In addition, special attention is paid to the user experience (UX/UI), which should ensure the convenience and efficiency of using the web application by both medical personnel and patients. React allows you to create dynamic and interactive interfaces that can adapt to different devices and screens, thus providing a high-quality user experience. This is especially important for medical applications, where the accuracy and speed of interaction can affect the quality of healthcare delivery. A detailed description of best practices and approaches to web application development using React is provided. A component architecture is considered, which provides modularity and code reuse, which is a key factor in creating scalable and easily maintainable applications. Different methods of state management in the application, such as the use of Context API and Redux, have been explored, which allows for efficient data management and stable operation of the application. Guidelines for configuring routing using the React Router library are described, allowing you to create dynamic and multi-page applications while providing smooth navigation and a good user experience. In addition, ways to ensure application security are considered, including protection against XSS attacks, CSRF and other types of vulnerabilities, which is critical in medical applications. The article provides specific recommendations for implementing a web application for a medical clinic. They include practical code examples that demonstrate the implementation of key functionalities such as user registration and authentication, medical record processing, and database interaction. The process of setting up the infrastructure for development, testing and deployment of the application is described, including the use of CI/CD tools to automate these processes, which contributes to increasing the efficiency of development and the quality of the final product. The article provides valuable information for developers who seek to create effective and secure web applications for medical clinics using modern technologies. The conclusions and recommendations presented in the study will help ensure high quality and compliance of the developed solutions with modern industry standards and requirements, which will contribute to increasing the efficiency of the work of medical institutions and the quality of medical services provided to patients

Unveiling The Detection of File Less Malware from Dark Web: A Stealthy Arsenal for Web Application Exploitation

The proliferation of fileless malware poses a significant threat to web application security, especially when sourced from the dark web. This paper presents a novel detection tool designed to identify and mitigate fileless malware sourced from the dark web, specifically targeting web applications. Leveraging advanced anomaly detection and behavioral analysis techniques, the tool monitors real-time traffic and user interactions, enabling the early detection of malicious activities. Additionally, the tool integrates seamlessly with threat intelligence sources, enhancing its ability to recognize emerging threats. A user-centric alerting system ensures that administrators are promptly notified of potential security breaches, allowing for immediate remediation actions. The tool's adaptability and continuous enhancement mechanisms ensure that it stays ahead of evolving threats. By employing this detection tool, organizations can bolster their web application security posture and protect sensitive data from sophisticated fileless malware attacks.

User Preferences and Needs for Health Data Collection Using Research Electronic Data Capture: Survey Study.

Self-administered web-based questionnaires are widely used to collect health data from patients and clinical research participants. REDCap (Research Electronic Data Capture; Vanderbilt University) is a global, secure web application for building and managing electronic data capture. Unfortunately, stakeholder needs and preferences of electronic data collection via REDCap have rarely been studied. This study aims to survey REDCap researchers and administrators to assess their experience with REDCap, especially their perspectives on the advantages, challenges, and suggestions for the enhancement of REDCap as a data collection tool. We conducted a web-based survey with representatives of REDCap member organizations in the United States. The survey captured information on respondent demographics, quality of patient-reported data collected via REDCap, patient experience of data collection with REDCap, and open-ended questions focusing on the advantages, challenges, and suggestions to enhance REDCap's data collection experience. Descriptive and inferential analysis measures were used to analyze quantitative data. Thematic analysis was used to analyze open-ended responses focusing on the advantages, disadvantages, and enhancements in data collection experience. A total of 207 respondents completed the survey. Respondents strongly agreed or agreed that the data collected via REDCap are accurate (188/207, 90.8%), reliable (182/207, 87.9%), and complete (166/207, 80.2%). More than half of respondents strongly agreed or agreed that patients find REDCap easy to use (165/207, 79.7%), could successfully complete tasks without help (151/207, 72.9%), and could do so in a timely manner (163/207, 78.7%). Thematic analysis of open-ended responses yielded 8 major themes: survey development, user experience, survey distribution, survey results, training and support, technology, security, and platform features. The user experience category included more than half of the advantage codes (307/594, 51.7% of codes); meanwhile, respondents reported higher challenges in survey development (169/516, 32.8% of codes), also suggesting the highest enhancement suggestions for the category (162/439, 36.9% of codes). Respondents indicated that REDCap is a valued, low-cost, secure resource for clinical research data collection. REDCap's data collection experience was generally positive among clinical research and care staff members and patients. However, with the advancements in data collection technologies and the availability of modern, intuitive, and mobile-friendly data collection interfaces, there is a critical opportunity to enhance the REDCap experience to meet the needs of researchers and patients.

Development of Mathematical Algorithm for Detecting XSS Attacks on Web Applications

The widespread usage of web applications has led to an increase in security threats, with Cross-Site Scripting (XSS) attacks being one of the most prevalent and damaging. Detecting and mitigating XSS attacks is crucial to ensure the integrity and confidentiality of sensitive user data. This article presents the mathematical algorithm and a way to identify XSS attacks using a bounded function from below, which depends on the input string, and highlights its potential impact in bolstering web application security. To construct this function, we used special characters and keywords that are frequently found in the construction of XSS attacks.

Evaluasi Risiko Celah Keamanan Aplikasi E-Office menggunakan Metode OWASP

Based on data from Badan Siber dan Sandi Negara (BSSN) in 2022, it was reported that a total of 1,950 security vulnerabilities were found in 457 electronic systems across various applications widely used by the public. The purpose of this research is to evaluate the risk of existing security vulnerabilities in the E-Office application and determine the level and impact that these vulnerabilities can cause. This research focuses on information system security, specifically evaluating the risk of security vulnerabilities in the E-Office application of the Ogan Ilir Regency. The research was conducted using the Open Web Application Security Project (OWASP) method with a risk rating assessment. The research process began with a literature review to gather data and information sources, determine the scope and research objectives, test, identify security vulnerabilities, analyze security vulnerabilities, and the results of the analysis. The research subject is the E-Office application of Ogan Ilir Regency, with the object of the research being the security vulnerabilities in that application. OWASPZap was used as a tool to obtain data on security vulnerabilities, and using OWASPZap, 38 security vulnerabilities were found, with 18 of them meeting the criteria of the OWASP Top 10. Our findings indicate that the security vulnerabilities in the E-Office application of Ogan Ilir Regency include vulnerabilities in authentication levels, access control, configuration, and data validation processes.

An explainable machine learning-based web attack detection system for industrial IoT web application security

ABSTRACT Within Industry 4.0, the integration of Industrial IoT (IIoT) marks a transformative phase for modern industries, fostering the development of smart factories and intelligent manufacturing systems. Despite the substantial growth of IIoT, a critical research gap persists in web security within IIoT environments. This paper addresses this gap by proposing an explainable and robust machine learning-based web attack detection system to ensure IIoT web application security using ToN-IoT and NF-ToN-IoTv2 datasets that accurately reflects IIoT traffic. Given eXplainable Artificial Intelligence’s (XAI) capability to instill trustworthiness and transparency in learning models, the authors opted for the SHAP technique for feature selection, leveraging its global insights to explain feature contributions to the system’s decision-making. Compared to the existing works, the system demonstrated strong performance across various metrics, including accuracy, recall, precision, specificity, F-value, FPR, FNR, AUC-ROC curve, MCE, training, and prediction times, in binary and multi-classification scenarios.