Vulnerable Web Research Articles

NoSQL Racket: A Testing Tool for Detecting NoSQL Injection Attacks in Web Applications

A NoSQL injection attack targets interactive Web applications that employ NoSQL database services. These applications accept user inputs and use them to form query statements at runtime. During NoSQL injection attack, an attacker might provide malicious query segments as user input which could result in a different database request. In this paper, a testing tool is presented to detect NoSQL injection attacks in web application which is called “NoSQL Racket”. The basic idea of this tool depends on checking the intended structure of the NoSQL query by comparing NoSQL statement structure in code query statement (static code analysis) and runtime query statement (dynamic analysis). But we faced a big challenge, there is no a common query language to drive NoSQL databases like the same way in relational database using SQL as a standardized query language. The proposed tool is tested on four different vulnerable web applications and its effectiveness is compared against three different well known testers, none of them is able to detect any NoSQL Injection attacks. However, the implemented testing tool has the ability to detect the NoSQL injection attacks.

Analyzing the traffic of penetration testing tools with an IDS

Many papers have been published comparing the accuracy of automated tools in looking for vulnerabilities in web applications. In those previous studies the researchers analyze vulnerable web applications with pentesting tools and then the reports that automated tools generate are compared to each other. The aim of this work is not only to know the detection capabilities of tools, but also to know what tests are performed, which vulnerabilities they try to detect and which really has the web application. This way it can be known whether the tests carried out by automated tools are efficient and meet two important aspects of the analysis tools: the automated tool has to try to detect all vulnerabilities in the web applications if it has a feature to do it; and also they have to report all vulnerabilities that they detect.

How to Train Your Browser

Cross-Site Scripting (XSS) is one of the most common web application vulnerabilities. It is therefore sometimes referred to as the “buffer overflow of the web.” Drawing a parallel from the current state of practice in preventing unauthorized native code execution (the typical goal in a code injection), we propose a script whitelisting approach to tame JavaScript-driven XSS attacks. Our scheme involves a transparent script interception layer placed in the browser’s JavaScript engine. This layer is designed to detect every script that reaches the browser, from every possible route, and compare it to a list of valid scripts for the site or page being accessed; scripts not on the list are prevented from executing. To avoid the false positives caused by minor syntactic changes (e.g., due to dynamic code generation), our layer uses the concept of contextual fingerprints when comparing scripts. Contextual fingerprints are identifiers that represent specific elements of a script and its execution context. Fingerprints can be easily enriched with new elements, if needed, to enhance the proposed method’s robustness. The list can be populated by the website’s administrators or a trusted third party. To verify our approach, we have developed a prototype and tested it successfully against an extensive array of attacks that were performed on more than 50 real-world vulnerable web applications. We measured the browsing performance overhead of the proposed solution on eight websites that make heavy use of JavaScript. Our mechanism imposed an average overhead of 11.1% on the execution time of the JavaScript engine. When measured as part of a full browsing session, and for all tested websites, the overhead introduced by our layer was less than 0.05%. When script elements are altered or new scripts are added on the server side, a new fingerprint generation phase is required. To examine the temporal aspect of contextual fingerprints, we performed a short-term and a long-term experiment based on the same websites. The former, showed that in a short period of time (10 days), for seven of eight websites, the majority of valid fingerprints stay the same (more than 92% on average). The latter, though, indicated that, in the long run, the number of fingerprints that do not change is reduced. Both experiments can be seen as one of the first attempts to study the feasibility of a whitelisting approach for the web.

Toward an artificial immune server against cyber attacks

This paper proposes a novel framework for an artificial immune server with both innate and adaptive immune functions. The innate immune function detects cyber attacks on a known or unknown vulnerability. Upon detecting a cyber attack, the innate immune function creates a new process of the server application and terminates the compromised process. The adaptive immune function learns the requests with exploit code detected by the innate immune function. The adaptive immune function enables the server application to maintain its own service without terminating the server application after the innate immune function recognizes the attack. Performance tests of a prototype system implemented on a vulnerable web server showed that this prototype system was able to maintain the web service during all attacks except the first.

Parasitism and Food Web Structure in Defoliating Lepidoptera - Parasitoid Communities on Soybean.

Food webs are usually regarded as snapshots of community feeding interactions. Here, we describe the yearly and cumulative structure of parasitoid-caterpillar food webs on soybean in central Argentina, analyzing parasitism rates and their variability in relation to parasitoid diversity and food web vulnerability in the system. Lepidoptera larvae were collected along four seasons from soybean crops and reared in laboratory to obtain and identify adults and parasitoids. Eleven species of defoliating Lepidoptera and ten parasitoid species were recorded. Food web statistics showed rather low annual variability, with most variation coefficients in the order of 0.20 and generality showing the most stable values. Parasitism showed the highest variability, which was independent of parasitoid diversity and food web vulnerability, although parasitism rates were negatively related to parasitoid richness. Our study highlights the need to consider food web structure and variability in order to understand the functioning of ecological communities in general and in extensive agricultural ecosystems in particular.

An algorithm to find relationships between web vulnerabilities

Over the past years, there has been a high increase in web sites using cloud computing. Like usual web site, those web applications can have most of the common web vulnerabilities, like SQL injection or cross-site scripting. Therefore, cloud computing has become more attractive to cyber criminals. Besides, in many cases it is necessary to comply with regulations like PCI DSS or standards like ISO/IEC 27001. To face those threats and requirements it is a common task to analyze web applications to detect and correct their vulnerabilities. The most used tools to analyze web applications are automatic scanners. But it is difficult to comparatively decide which scanner is best or at least is best suited to detect a particular vulnerability. To evaluate scanner capabilities some evaluation criteria have been defined. Often a web vulnerability classification is also used to evaluate scanners, but current web vulnerability classifications do not usually include all vulnerabilities. To face evaluation criteria which are not up-to-date and to have the fullest possible classification, in this paper a new method to map web vulnerability classifications is proposed. The result will be the vulnerabilities an automatic scanner has to detect. As classifications change over time, this new method could be executed when the existing classifications change or when new classifications are developed. The vulnerabilities described this way can also be seen as a web vulnerability classification that includes all vulnerabilities in the classifications taken into account.

English

show limits on intrusion detection/attacks by the fact that most web vulnerabilities are specifically for specific applications may be developed in-house by companies. Behavioral methods are therefore an interesting approach in this area. An IPS (Intrusion Prevention System) is a tool that is used to enhance the security level. We present here the secure IPS architecture web server. We will also discuss measures that define the effectiveness of our IPS and very recent work of standardization and homogenization of our IPS platform. The approach relies on preventive mechanisms: it is then to develop devices capable of preventing any action that would result in a violation of the security policy. However, experience and results show that it is impossible to build a fully secure system for technical or practical reasons.

Web vulnerabilities: identifying patterns and remedies

Web vulnerabilities: identifying patterns and remedies

An Enhanced Rule-Based Web Scanner Based on Similarity Score

This paper proposes an enhanced rule-based web scanner in order to get better accuracy in detecting web vulnerabilities than the existing tools, which have relatively high false alarm ...

Automated Discovery of JavaScript Code Injection Attacks in PHP Web Applications

This paper discussed some of the performance issues in the existing defensive solutions of Java Script injection attacks (e.g. Cross-Site Scripting (XSS) attacks). Moreover, a high level of comparison for such existing solutions has been done based on some useful metrics. Based on the identified performance issues, this paper proposed an automated detection system, which scans the numerous possible locations of web sites for JavaScript injection vulnerabilities. Our detection system, firstly, scans the web site for discovering the injection locations. Secondly, it injects the malicious XSS attack vectors in such injection points. Lastly, it takes an input as the list of different XSS attacks exploited in the second step and scan for these attacks in the vulnerable web application. Detection capability of our automated system is evaluated on a real world PHP web application i.e. BlogIt and results obtained are very promising.

A Protection Mechanism against Malicious HTML and JavaScript Code in Vulnerable Web Applications

The high-profile attacks of malicious HTML and JavaScript code have seen a dramatic increase in both awareness and exploitation in recent years. Unfortunately, exiting security mechanisms provide no enough protection. We propose a new protection mechanism named PMHJ based on the support of both web applications and web browsers against malicious HTML and JavaScript code in vulnerable web applications. PMHJ prevents the injection attack of HTML elements with a random attribute value and the node-split attack by an attribute with the hash value of the HTML element. PMHJ ensures the content security in web pages by verifying HTML elements, confining the insecure HTML usages which can be exploited by attackers, and disabling the JavaScript APIs which may incur injection vulnerabilities. PMHJ provides a flexible way to rein the high-risk JavaScript APIs with powerful ability according to the principle of least authority. The PMHJ policy is easy to be deployed into real-world web applications. The test results show that PMHJ has little influence on the run time and code size of web pages.

A deliberately insecure RDF-based Semantic Web application framework for teaching SPARQL/SPARUL injection attacks and defense mechanisms

The Semantic Web uses the Resource Description Framework (RDF) and the Simple Protocol and Query/Update Languages (SPARQL/SPARUL) as standardized logical data representation and manipulation models allowing machines to directly interpret data on the Web. As Semantic Web applications grow increasingly popular, new and challenging security threats emerge. Semantic query languages owing to their flexible nature introduce new vulnerabilities if secure programming practices are not followed. This makes them prone to both existing attacks such as command injection as well as novel attacks, making it necessary for application developers to understand the security risks involved when developing and deploying semantic applications. In this research, we have analyzed and categorized the possible SPARQL/SPARUL injection attacks to which semantic applications are vulnerable. Moreover, we have developed a deliberately insecure RDF-based Semantic Web application, called SemWebGoat – inspired by the open source vulnerable web application, WebGoat – which offers a realistic teaching and learning environment for exploiting SPARQL/SPARUL oriented injection vulnerabilities. With the aim of teaching both developers and web administrators the art of protecting their Semantic Web applications, we have implemented web application firewall (WAF) rules using the popular open-source firewall – ModSecurity – and extended some penetration testing tools to detect and mitigate SPARQL/SPARUL injections. For the evaluation, we conducted a user study to determine the usability of SemWebGoat attack lessons as well as a detection rate and false alarm analysis of our proposed firewall rules based on OWASP top-ten attack dataset. The results of the user study conclude that web developers are not normally familiar with the injection vulnerabilities demonstrated. The positive test results of our ModSecurity rule set show that it a suitable defense mechanism for protecting vulnerable Semantic Web application against injection attacks.

A study on Web security incidents in China by analyzing vulnerability disclosure platforms

Understanding the nature of a country's World Wide Web security can allow analysts to evaluate the security awareness of local organizations, the technology employed by researchers, and the defense capabilities of the whole country. In this paper, we put forward a new framework to evaluate the security situation in China with real vulnerability disclosure platforms. The focus of this research is to analyze the current situation of Chinese websites using 57,112 Web vulnerability incidents submitted by 5371 researchers from 2012 to 2015. The dataset is distributed into four types of organizations, including listed companies, government institutions, educational institutions, and startups. We present an approach, based on machine learning and natural language processing technologies, to classify the vulnerability type for each incident. Furthermore, our experimental results show that the vulnerability distribution and response speed toward important issues are so different among the four types of organizations that researchers at various levels of experience begin to take part in submitting vulnerabilities to public disclosure platforms. Based on the results, we propose security some best-practices for organizations and show that the security situation of Chinese websites has changed quickly in the last three years but is still facing several big problems.

Testing and Comparing Result Scanning Using Web Vulnerability Scanner

Testing and Comparing Result Scanning Using Web Vulnerability Scanner

웹 취약점 스코어링 기법의 advanced 모델 연구

웹 취약점 분석은 기업이 웹 애플리케이션의 보안 문제점을 파악하고 개선하는데 도움을 주며 미래창조과학부는 취약점 분석 평가 기준을 배포하여 이를 지원하고 있다. 그러나 기준에서 제시하는 방법으로는 취약 항목에 대한 구분은 가능하지만 취약점 항목의 위험을 분석하기에는 부족하여 효과적인 대응이 어렵다는 문제점이 있다. 본 연구에서는 국내외 취약점 스코어링 기법에 대해 분석하고 올바른 웹 취약점 분석 평가를 위한 스코어링 방법을 제시하고자 한다. Web application security problems are addressed by the web vulnerability analysis which in turn supports companies to understand those problems and to establish their own solutions. Ministry of Science, ICT and Future Planning (MSIP) has released its guidelines for analysis and assessment of the web vulnerability. Although it is possible to distinguish vulnerability items in a manner suggested in the MSIP's guidelines, MSIP's factors and criteria proposed in the guidelines are neither sufficient nor efficient in analyzing specific vulnerability entries' risks. This study discusses analysis of the domestic and international Vulnerability Scoring system and proposes an appropriate evaluating method for web vulnerability analysis.

An Introduction to Remote Installation Vulnerability in Content Management Systems

Web-based applications are being increasingly used to share data and remote access. These applications form an integral part of the financial, education, and government sectors in most countries. The most important issue in web-based applications is maintaining basic principles of security: integrity, confidentiality and availability. Many web vulnerabilities have been identified and should be always considered by web-based applications developers and security professionals. Lack of vigilance in attending to these vulnerabilities may result in the software system being attacked by hackers and the most important asset of an organization, i.e., protected data, being compromised. This paper identifies a new type of web susceptibility termed remote installation vulnerability (RIV) which renders content management systems (CMS) and websites exploitable to cyber-attacks. A simple strategy is recommended to address this vulnerability.

Effect of multiple disturbances on food web vulnerability to biodiversity loss in detritus‐based systems

Global biodiversity is affected by human pressure and climate change, and the present rate of biodiversity loss is probably higher than ever before. Community composition is also changing, and interspecific interactions are under severe pressure. The extinction of one species within a food web can result in further secondary extinctions, due to bottom‐up effects that can be even more intense and less predictable than the direct effects of disturbance, undermining our capacity for ecosystem management and conservation. Here we investigated a metric for assessing the structural stability of food webs in the face of species loss, referred to as “Resistance”, based on two fundamental web properties: (1) the proportion of key species in the web, a “key” species being one whose deletion leads to at least one secondary extinction, and (2) the mean number of secondary extinctions observed per key species deletion. We compared web Resistance with web Robustness (Dunne et al. 2002) based on 12 detritus‐based riverine food webs under four species extinction scenarios on various temporal and spatial scales. We investigated the effect of multiple disturbances (extreme flood and river basin urbanization) on community vulnerability to biodiversity loss, assessing the behavior of Robustness and Resistance under the applied species extinction scenarios and testing their dependence on web topology. We estimated the contribution of the rarest and the most dominant species, and that of the most and least connected species, to web Resistance.Urbanization negatively affected community vulnerability to biodiversity loss. Only food web Resistance showed a significant flood effect and interaction between flood and urbanization. The most connected species contributed the most to food web resistance, whereas the rarest and the most abundant species had a similar, intermediate structural importance. Both food web Resistance and the role of selected key species varied across web description scales. Food web Resistance values were coherent across species extinction scenarios, demonstrating the suitability of the proposed approach for quantifying community vulnerability to species loss and the importance of considering food webs in monitoring and impact assessment programs. The approach is thus seen to be a promising research pathway supporting ecosystem management.

Identification and Illustration of Insecure Direct Object References and their Countermeasures

The insecure direct object reference simply represents the flaws in the system design without the full protection mechanism for the sensitive system resources or data. It basically occurs when the web application developer provides direct access to objects in accordance with the user input. So any attacker can exploit this web vulnerability and gain access to privileged information by bypassing the authorization. The main aim of this paper is to demonstrate the real effect and the identification of the insecure direct object references and then to provide the feasible preventive solutions such that the web applications do not allow direct object references to be manipulated by attackers. The experiment of the insecure direct object referencing is carried out using the insecure J2EE web application called WebGoat and its security testing is being performed using another JAVA based tool called BURP SUITE. The experimental result shows that the access control check for gaining access to privileged information is a very simple problem but at the same time its correct implementation is a tricky task. The paper finally presents some ways to overcome this web vulnerability. General Terms Web Vulnerability; Authorization Keywords IDOR; Web Application; Authorization; Access control; Web exploit

Design and implementation of website information disclosure assessment system.

Internet application technologies, such as cloud computing and cloud storage, have increasingly changed people’s lives. Websites contain vast amounts of personal privacy information. In order to protect this information, network security technologies, such as database protection and data encryption, attract many researchers. The most serious problems concerning web vulnerability are e-mail address and network database leakages. These leakages have many causes. For example, malicious users can steal database contents, taking advantage of mistakes made by programmers and administrators. In order to mitigate this type of abuse, a website information disclosure assessment system is proposed in this study. This system utilizes a series of technologies, such as web crawler algorithms, SQL injection attack detection, and web vulnerability mining, to assess a website’s information disclosure. Thirty websites, randomly sampled from the top 50 world colleges, were used to collect leakage information. This testing showed the importance of increasing the security and privacy of website information for academic websites.

Countering Cross-Site Scripting in Web-based Applications

Today's dynamic web-based applications have become a normal and critical asset to an organizations business. They come with an increase in the number of web vulnerabilities and attacks. These weaknesses allow hackers to focus their attention on attacking this important information source. The most common vulnerability is cross-site scripting (XSS) and one of the Open Web Application Security project (OWASP) top ten web-threats. XSS occurs when a Web-based application allows untrusted information be accepted and sent back to a browser. Also they can execute scripts within a browser that can deface web sites, redirect users to malicious content and hijack browsers. One reason for this problem was the lack of developers understanding the causes of XSS. In this paper, the authors address the causes of XSS and countermeasures to defense against these threats.