Web Application Vulnerabilities Research Articles

Applied Machine Learning Predictive Analytics to SQL Injection Attack Detection and Prevention

Abstract: The back-end database is pivotal to the storage of the massive size of big data Internet exchanges stemming from cloud-hosted web applications to Internet of Things (IoT) smart devices. Structured Query Language (SQL) Injection Attack (SQLIA) remains an intruder’s exploit of choice on vulnerable web applications to pilfer confidential data from the database with potentially damaging consequences. The existing solutions of mostly signature approaches were all before the recent challenges of big data mining and at such lacks the functionality and ability to cope with new signatures concealed in web requests. An alternative Machine Learning (ML) predictive analytics provides a functional and scalable mining to big data in detection and prevention of SQLIA. Unfortunately, lack of availability of readymade robust corpus or data set with patterns and historical data items to train a classifier are issues well known in SQLIA research. In this project, we explore the generation of data set containing extraction from known attack patterns including SQL tokens and symbols present at injection points. Also, as a test case, we build a web application that expects dictionary word list as vector variables to demonstrate massive quantities of learning data. The data set is pre-processed, labelled and feature hashing for supervised learning. The trained classifier to be deployed as a web service that is consumed in a custom dot NET application implementing a web proxy Application Programming Interface (API) to intercept and accurately predict SQLIA in web requests thereby preventing malicious web requests from reaching the protected back-end database. This project demonstrates a full proof of concept implementation of an ML predictive analytics and deployment of resultant web service that accurately predicts and prevents SQLIA with empirical evaluations presented in Confusion Matrix (CM) and Receiver Operating Curve (ROC).

An Experimental Study on Detecting and Mitigating Vulnerabilities in Web Applications

An Experimental Study on Detecting and Mitigating Vulnerabilities in Web Applications

An efficient artificial intelligence approach for early detection of cross-site scripting attacks

Cross-Site Scripting (XSS) attacks continue to pose a significant threat to web applications, compromising the security and integrity of user data. XSS is a web application vulnerability where malicious scripts are injected into websites, allowing attackers to execute arbitrary code in the victim’s browser. The consequences of XSS attacks can be severe, ranging from financial losses to compromising sensitive user information. XSS attacks enable attackers to deface websites, distribute malware, or launch phishing campaigns, compromising the trust and reputation of affected organizations. This study proposes an efficient artificial intelligence approach for the early detection of XSS attacks, utilizing machine learning and deep learning approaches, including Long Short-Term Memory (LSTM). Additionally, advanced feature engineering techniques, such as the Term Frequency-Inverse Document Frequency (TFIDF), are applied and compared to evaluate results. We introduce a novel approach named LSTM-TFIDF (LSTF) for feature extraction, which combines temporal and TFIDF features from the cross-site scripting dataset, resulting in a new feature set. Extensive research experiments demonstrate that the random forest method achieved a high performance of 0.99, outperforming state-of-the-art approaches using the proposed features. A k-fold cross-validation mechanism is utilized to validate the performance of applied methods, and hyperparameter tuning further enhances the performance of XSS attack detection. We have applied Explainable Artificial Intelligence (XAI) to understand the interpretability and transparency of the proposed model in detecting XSS attacks. This study makes a valuable contribution to the growing body of knowledge on XSS attacks and provides an efficient model for developers and security practitioners to enhance the security of web applications.

Sniping at web applications to discover input-handling vulnerabilities

AbstractWeb applications play a crucial role in modern businesses, offering various services and often exposing sensitive data that can be enticing to attackers. As a result, there is a growing interest in finding innovative approaches for discovering vulnerabilities in web applications. In the evolving landscape of web security, the realm of fuzz testing has garnered substantial attention for its effectiveness in identifying vulnerabilities. However, existing literature has often underemphasized the nuances of web-centric fuzzing methodologies. This article presents a comprehensive exploration of fuzzing techniques specifically tailored to web applications, addressing the gap in the current research. Our work presents a holistic perspective on web-centric fuzzing, introduces a modular architecture that improves fuzzing effectiveness, demonstrates the reusability of certain fuzzing steps, and offers an open-source software package for the broader security community. By addressing these key contributions, we aim to facilitate advancements in web application security, empower researchers to explore new fuzzing techniques, and ultimately enhance the overall cybersecurity landscape.

WebSec : Exploring and Modulating Vulnerabilities

This research investigates the performance of the OWASP Zed Attack Proxy (OWASP ZAP) and Paros open-source vulnerability scanners on the Damn Vulnerable Web Application (DVWA). By evaluating their capability to identify vulnerabilities, along with assessing their user-friendliness and features, the study highlights each scanner's strengths and weaknesses. The insights aim to assist developers and security professionals in selecting the most effective tools for improving the security posture of web applications. Keywords—Web Application Security, Vulnerability Scanners, OWASP ZAP, Paros, Damn Vulnerable Web Application (DVWA), Open Source Tools, Cybersecurity, Penetration Testing.

A Proposed Framework of VAPT Services in Web Application Deployed on Infrastructure as a Service (Iaas)

Most companies in Malaysia require their employees to work from home due to the COVID-19 pandemic. This situation also increased the number of data generated from various sources, thus exposing them to different security risks. Even though the employees are encouraged to work from home because of the COVID-19 pandemic, they still need to communicate among themselves to do their work. However, working from home depends mainly on cloud computing (CC) applications that help employees accomplish their daily work efficiently. Injection attacks, such as SQL injection and Cross-Site Scripting (XSS), are critical security vulnerabilities that can lead to unauthorized access, data breaches, and potential service disruptions in web applications. With the increasing adoption of cloud computing, web applications deployed on cloud platforms like Amazon Web Services (AWS) are becoming more prevalent and vulnerable to such attacks. Therefore, it is crucial to develop practical Vulnerability Assessment and Penetration Testing (VAPT) techniques specifically tailored to identify and detect injection vulnerabilities in web applications deployed on AWS. However, existing VAPT methodologies often need more comprehensive coverage for injection vulnerabilities in cloud-based web applications, and they may not consider the unique characteristics and challenges associated with the AWS environment. This research addresses this gap by proposing an enhanced VAPT framework focusing specifically on injection attacks in web applications deployed on AWS.

Machine Learning for Web Vulnerability Detection: The Case of Cross-Site Request Forgery

Cross-site request forgery (CSRF) vulnerabilities pose a significant threat to web application security, enabling attackers to execute unauthorized actions on behalf of authenticated users. Conventional CSRF detection methods, such as manual code review and static analysis, are often time-consuming, error-prone, and inefficient. Proposes Mitch, a novel machine learning (ML)-based solution for the black-box detection of CSRF vulnerabilities. Mitch employs supervised learning, trained on a comprehensive dataset of HTTP requests and responses, to effectively identify security-sensitive HTTP requests and uncover CSRF vulnerabilities within them. Rigorous evaluations on a diverse set of real-world web applications demonstrate Mitch's remarkable ability to detect CSRF vulnerabilities with high accuracy, outperforming traditional methods. Mitch's automated nature eliminates the need for manual code review and static analysis, saving time and effort while reducing the risk of human error. Additionally, Mitch's scalability allows seamless integration into continuous integration and continuous delivery (CI/CD) pipelines, enabling continuous security monitoring and vulnerability detection. Mitch's efficacy extends beyond detecting known CSRF vulnerabilities. Its ability to identify patterns and relationships enables it to uncover obscure CSRF vulnerabilities that may have been overlooked by traditional methods, including zero-day vulnerabilities. In conclusion, Mitch emerges as a powerful tool for enhancing web application security, offering a comprehensive and automated solution for detecting CSRF vulnerabilities. Its ability to handle complex web applications, uncover hidden CSRF vulnerabilities, and integrate into CI/CD pipelines makes it an indispensable tool for web security professionals. Mitch's adoption has the potential to significantly reduce the risk of CSRF attacks and safeguard sensitive user data. We propose a methodology to leverage machine learning (ML) for the detection of web application vulnerabilities. We use it in the design of Mitch, the first ML solution for the black-box detection of cross-site request forgery vulnerabilities. Finally, we show the effectiveness of Mitch on real software. In this project, we propose a methodology to leverage Machine Learning (ML) for the detection of web application vulnerabilities. Web applications are particularly challenging to analyses, due to their diversity and the widespread adoption of custom programming practices. ML is thus very helpful for web application security it can take advantage of manually labeled data to bring the human understanding of the web application semantics into automated analysis toolsMitch allowed us to identify 35 new CSRFs on 20 major websites and 3 new CSRFs on production software. Keywords: Mitch, CSRF, CI/CD pipelines, Security Token Service (STS), Same-Origin Policy (SOP).

Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code

Internet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. However, to do so manually is a costly and time-consuming process. To reduce these costs, we designed and implemented Code Auto-Remediation for Enhanced Security (CARES), a web application that automatically identifies and remediates the two most common types of vulnerabilities in Java-based web applications: SQL injection (SQLi) and Cross-Site Scripting (XSS). As is shown by a case study presented in this paper, CARES mitigates these vulnerabilities by refactoring the Java code using the Intercepting Filter design pattern. The flexible, microservice-based CARES design can be readily extended to support other injection vulnerabilities, remediation design patterns, and programming languages.

Comprehensive Exploration of Web Application Security Testing with Burp Suite Tools

This research paper investigates the pivotal role of Burp Suite tools in web application security testing, aligned with the foundational principles of secure coding practices outlined by the Open Web Application Security Project (OWASP). The paper provides an in-depth overview of Burp Suite tools, emphasizing their features and the significance of web application vulnerability scanning in enforcing robust security practices. The exploration includes a detailed examination of Burp Repeater and Burp Intruder, with a practical demonstration of a Burp Suite cluster bomb attack. This research contributes to advancing the understanding and application of Burp Suite tools for effective web application security testing within the framework of OWASP secure coding practices.

Data Leaks Using SQL Injection

The security of digital data is paramount in today's interconnected world. Among the various cyber threats, SQL injection attacks represent a significant menace to the confidentiality, integrity, and availability of sensitive information stored within databases. SQL injection is a technique employed by malicious actors to exploit vulnerabilities in web applications that interact with databases, allowing unauthorized access to or manipulation of the data. This paper presents an in-depth analysis of SQL injection attacks, their mechanisms, and the potential risks they pose to organizational data. It examines various preventive measures and best practices to mitigate the vulnerabilities that lead to SQL injection. Techniques such as input validation, parameterized queries, and the use of prepared statements are explored as effective defences against these attacks

SQL Injection Detection Using RNN Deep Learning Model

SQL injection attacks are a common type of cyber-attack that exploit vulnerabilities in web applications to access databases through malicious SQL queries. These attacks pose a serious threat to the security and integrity of web applications and their data. The existing methods for detecting SQL injection attacks are based on predefined rules that can be easily circumvented by sophisticated attackers. Therefore, there is a need for a more robust and effective method for detecting SQL injection attacks. In this research, we propose a novel method for detecting SQL injection attacks using recurrent neural networks (RNN), which are a type of deep learning model that can capture the syntax and semantic features of SQL queries. We train an RNN model on a dataset of benign and malicious SQL queries, and use it to classify queries as either benign or malicious. We evaluate our method on a benchmark dataset and compare it with the existing rule-based methods. Our experimental results show that our method achieved high accuracy and outperformed the rule-based methods for detecting SQL injection attacks. Our research contributes to the field of web application security by providing a new and effective solution for protecting web applications from SQL injection attacks using deep learning. Our method has both practical and theoretical implications, as it can be easily integrated into existing web application security frameworks to provide an additional layer of protection against SQL injection attacks, and it can also advance the understanding of how deep learning models can be applied to natural language processing tasks such as SQL query analysis.

Secure software development and testing: A model-based methodology

Modern industries widely rely upon software and IT services, in a context where cybercrime is rapidly spreading in more and more sectors. Unfortunately, despite greater general awareness of security risks and the availability of security tools that can help to cope with those risks, many organizations (especially medium/small-size ones) still lag when it comes to building security into their services. This is mainly due to the limited security skills of common developers/IT project managers and to the typically high costs of security procedures. In fact, while automated tools exist to perform code analysis, vulnerability scanning, or security testing, the manual intervention of security experts is still required not only for security analysis and design, but also to configure and elaborate the output of the security testing tools.In this paper, we propose a novel secure software development methodology aimed at supporting developers from security design to security testing, suitable for integration within modern DevOps pipelines according to a DevSecOps (or SecDevOps) approach. The proposed methodology leverages a model-based process that enables identifying existing threats, selecting appropriate countermeasures to enforce, and verify their mitigation effectiveness through both static assessment procedures and targeted security tests. To demonstrate our approach's feasibility and concretely illustrate the devised activities, we provide a step-by-step description of the whole process concerning a containerized microservice-based application case study. In addition, we discuss the application of the proposed methodology, in its threat modeling and security testing phases, to a well-known vulnerable web application widely used for security training purposes, to illustrate that we can identify most of the existing vulnerabilities and determine appropriate test plans to assess and mitigate such vulnerabilities.

Comparative Analysis of Open-Source Tools for Conducting Static Code Analysis.

The increasing complexity of web applications and systems, driven by ongoing digitalization, has made software security testing a necessary and critical activity in the software development lifecycle. This article compares the performance of open-source tools for conducting static code analysis for security purposes. Eleven different tools were evaluated in this study, scanning 16 vulnerable web applications. The selected vulnerable web applications were chosen for having the best possible documentation regarding their security vulnerabilities for obtaining reliable results. In reality, the static code analysis tools used in this paper can also be applied to other types of applications, such as embedded systems. Based on the results obtained and the conducted analysis, recommendations for the use of these types of solutions were proposed, to achieve the best possible results. The analysis of the tested tools revealed that there is no perfect tool. For example, Semgrep performed better considering applications developed using JavaScript technology but had worse results regarding applications developed using PHP technology.

The role of program analysis in security vulnerability detection: Then and now

Program analysis techniques play an important role in detecting security vulnerabilities. In this paper we describe our experiences in developing a variety of tools that detect security vulnerabilities in an industrial setting. The main driving forces for adoption of program analysis tools by a development organisation are low false positive rate, ease of integration in the developer's workflow, scalability to handle industrial size systems and results that are easy to understand. Even if one the above dimensions is not supported, the tool will not be used in practice.We show how the analyses of program analysis tools have changed over more than a decade due to differences in languages, e.g., code written in systems-level languages like C tend to focus on memory-related vulnerabilities, in contrast to languages like Java, JavaScript and Python where the focus is more on injection vulnerabilities in web or cloud applications. Based on language, static or dynamic analysis approaches are needed, including hybrid approaches.We conclude with our vision on Intelligent Application Security – how program analysis tools will keep changing to enable the DevSecOps model given the fertile ground that the DevOps model provides today. We foresee different program analysis tools working together by sharing information, including the results they produce, while addressing newer security issues such as those related to supply chain issues. In this way, program analysis tools would be extended with relevant machine learning techniques and be integrated in all different phases of the code development, building, testing, deployment and monitoring cycle.

DetAC: Approach to Detect Access Control Vulnerability in Web Application Based on Sitemap Model with Global Information Representation

Access control vulnerabilities that lead to elevated privileges are among the most dangerous vulnerabilities in Web applications. Most of the existing detection methods use dynamic or static analysis techniques alone, which suffer from high manual involvement, low automation, high leakage rate, low page coverage, and other deficiencies. To this end, this paper proposes a novel access control vulnerability detection method (DetAC) based on a sitemap model with global information representation. This method first constructs a static site-wide sitemap model based on the page link addresses in the Web application source code through static analysis techniques. After that, the application is logged in and executed dynamically with different role users. During this process, execution traces and request parameters are collected and converted into annotations to fill the corresponding edges of the static site-wide sitemap model. Then, the sitemap model with global information representation is obtained. This model can represent both the global control flow and data flow of the application. Then DetAC analyzes the role-based and user-based access control policies of the Web application based on the node reachability and annotated data features of the model. And according to the information such as role, user, and access resources, it generates attack vectors to achieve different roles and the same role of different users to access each other’s resources. Finally, access control vulnerabilities are detected based on the equivalence of the results obtained using attack vector access and normal access to the Web application server. DetAC was validated on five real open-source Web applications, and the results showed that DetAC successfully detected up to 12 access control vulnerabilities, which are more than those of the traditional seven tools. The dynamic analysis page coverage rate was significantly improved during the detection process, reaching an average of 91.37%.

Bug Bounty Hunting: A Case Study of Successful Vulnerability Discovery and Disclosure

This research is a case study on bug bounty hunting as a successful approach to finding and uncovering vulnerabilities in software. The purpose of this study is to understand the effectiveness of bug bounty hunting and its benefits in improving company security. Qualitative research methods were used by analyzing data from bug bounty programs that were successful in finding significant vulnerabilities. The results showed that bug bounty hunting proved to be effective in capturing various types of vulnerabilities, including web application vulnerabilities, network protocol vulnerabilities, hardware security vulnerabilities, and mobile app vulnerabilities. Security researchers play a critical role in the success of the bug bounty hunt, with their expertise in bug hunting and deep understanding of the technology. The benefits of bug bounty hunting include increased software security, cost efficiency, and increased company reputation for security and credibility. However, challenges such as finding hidden vulnerabilities and coordinating with enterprises need to be overcome. Recommendations include strengthening collaboration between enterprises and security researchers, establishing effective communication channels, and proactively responding to vulnerability reports.

Web Application Vulnerabilities and Best Practices: A Comprehensive Analysis

Web applications are integral to our digital lives, but they are also prone to numerous security vulnerabilities that can lead to data breaches, unauthorized access, and other malicious activities. This research paper aims to provide a comprehensive analysis of common web application vulnerabilities and propose best practices for mitigating these risks. The study examines a wide range of vulnerabilities, including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and insecure direct object references. By exploring real-world examples and conducting in-depth analysis, this research aims to raise awareness and provide practical recommendations for developers, security professionals, and organizations to enhance the security of their web applications.

N-Gram Tabanlı Tahmin Modeli ile XSS Saldırısı Algılama

The increment developments in technology has empowered the web applications. Meanwhile, the existence of Cross-Site Scripting (XSS) vulnerabilities in web applications has become a concern for users. In spite of the numerous current detection approaches, attackers have been exploiting XSS vulnerabilities for years, causing harm to the internet users. In this paper, a text-mining based approach to detect XSS attacks in web applications is introduced. This approach is built to extract a set of features from a publicly available source code files, which are then used to build a prediction model. The findings include few comparisons between Word Tokenization and N-Gram in accuracy, time spend to build the model and AUC-ROC curve. The results show that N-Gram tokenization outperforms the Word Tokenization.

Detecting and Preventing Common Web Application Vulnerabilities: A Comprehensive Approach

Web applications are becoming very important in our lives as many sensitive processes depend on them. Therefore, it is critical for safety and invulnerability against malicious attacks. Most studies focus on ways to detect these attacks individually. In this study, we develop a new vulnerability system to detect and prevent vulnerabilities in web applications. It has multiple functions to deal with some recurring vulnerabilities. The proposed system provided the detection and prevention of four types of vulnerabilities, including SQL injection, cross-site scripting attacks, remote code execution, and fingerprinting of backend technologies. We investigated the way worked for every type of vulnerability; then the process of detecting each type of vulnerability; finally, we provided prevention for each type of vulnerability. Which achieved three goals: reduce testing costs, increase efficiency, and safety. The proposed system has been validated through a practical application on a website, and experimental results demonstrate its effectiveness in detecting and preventing security threats. Our study contributes to the field of security by presenting an innovative approach to addressing security concerns, and our results highlight the importance of implementing advanced detection and prevention methods to protect against potential cyberattacks. The significance and research value of this survey lies in its potential to enhance the security of online systems and reduce the risk of data breaches.

Harbinger: A Toolkit for Vulnerability Testing of IoT Devices and Web Clients

Abstract: The need for efficient tools to identify and mitigate vulnerabilities has never been more critical due to the complexity and proliferation of online applications and embedded systems. We introduce a Python toolkit in this study that combines a variety of security testing and analysis methodologies, allowing users to locate and fix web application vulnerabilities and examine firmware files. Our toolkit offers aggregated reports summarizing the outcomes of firmware analysis and web application vulnerability testing, in addition to being adaptable and user-friendly so customers may change and add features to meet their unique needs. We provide the findings from testing and analysis carried out on a variety of online apps and firmware files, as well as the design and implementation of our tools. The integration of additional security testing tools, compatibility for other file formats, and the introduction of machine learning-based analysis are just a few of the future directions we could take our toolset. This Python toolkit makes a significant addition to the realm of cybersecurity by offering customers a strong and adaptable solution for web application vulnerability testing and firmware analysis.