Václav Matušek · Digital Repository (National Repository of Grey Literature) · 2014
The Bachelor thesis deals with the security of web applications. The main aim is to create complex view of most frequent attacks in practice and also to describe possibilities in prevention of the attacks. The prevention is described for both, user's and developer's side. Thesis contains also information about their origin and reminds the attacks from the past. It includes review of the standards and Czech legislation, which affect the security or define proper way how to develop the application. Important output of this thesis is also list of rules, which helps the developer to design secure application.
Cited by 0
Mandy Andress · 2007
Cited by 2
Typpi, Teemu · Aaltodoc (Aalto University) · 2010
Security is essential in modern web applications such as Internet banks, online stores and e-mail web interfaces. Unfortunately a large part of applications still have vulnerabilities, which malicious people can exploit for financial benefit or merely to cause harm. This paper gives an overview of web applications and some of the most common vulnerabilities such as SQL injection, Cross Site Scripting, and Cross Site Request Forgery. In recent years there has been research on tools that can automatically detect and/or prevent these vulnerabilities. These tools in combination with good practices that are employed when programming security sensitive components of web applications including session management and input validation procedures can help achieve adequate security. Finally, some of the security solutions in Simple Machines Forum, an open source forum software, are described as examples.
Cited by 0
Foss, Julie-Marie, Ingvaldsen, Nina · BIBSYS Brage (BIBSYS (Norway)) · 2014
As more and more sensitive information is entering web based applications, and thus are available through a web browser, securing these systems is of increasing importance. A software system accessible through the web is continuously exposed to threats, and is accessible to anyone who would like to attempt a break-in. These systems can not rely on only external measures like separate network zones and firewalls for security. Symantecs1 Internet Security Threat Report [34] is published every six months. Main findings in the last one published prove that there is an increase in threats to confidential information and more attacks aimed at web applications. Almost 48 percent of all vulnerabilities documented the last six months of 2004 were vulnerabilities in web applications. Security principles that one should pay attention to developing web applications do exist. This report have taken a look at existing guidelines, and provided an independent guide to developing secure web applications. These guidelines will be published at the homepage of The Centre for Information Security2 (SIS), www.norsis.no. The report also describes how a web application has been developed using the provided security guidelines as reference points. Relevant vulnerabilities and threats were identified and described. Misuse cases have related the various threats to specific system functionality, and a risk analysis ranks the threats in order to see which ones are most urgent. During the design phase, the application areas exposed to threats with a high rank from the risk analysis, have been at center of attention. This is also the case in the implementation phase, where countermeasures to some of these threats are provided on the Java platform. The implemented solutions can be adapted by others developing applications on this platform. The report comes to the conclusion, that the use of security guidelines throughout the entire development process is useful when developing a secure system. 1Symantec works with information security providing software, appliances and services designed to secure and manage IT infrastructures [33]. 2The Centre for Information Security (SIS) is responsible for coordinating activities related to Information and Communications Technology (ICT) security in Norway. The centre receives reports about security related incidents from companies and departments, and is working on obtaining an overall impression of threats towards Norwegian ICT systems [30].
Cited by 0
Hoffman, Andrew · CERN Document Server (European Organization for Nuclear Research) · 2020
Cited by 1
Auerbach Publications eBooks · 2003
It is possible to do almost everything on the Web these days: checking stock quotes, requesting a new service, and buying just about anything. Everyone, it seems, has a Web application. But what exactly does that mean?
Cited by 36
Steve Harris, Rob Macdonald · Apress eBooks · 2002
Security is a contentious issue for Web applications, with developers and administrators sharing overall responsibility, while still focusing on their specialist abilities. As a developer, you need to consider tasks such as user authentication, authorization, and impersonation; you also need to produce a model that the administrators can use when the application goes live. Among other duties, administrators will be responsible for configuring Web server security, applying security patches and fixes, and assigning users to the different groups, roles, or access levels that you've defined. As you can imagine, these two sets of responsibilities are closely interwoven; so, it makes sense for both teams to work together when planning and designing security features, and subsequently, for them to maintain a good rapport as the application is developed and deployed.KeywordsAuthentication SchemeProxy ServerUser AccountAnonymous UserBasic AuthenticationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
Cited by 2
Sushil Jajodia, Pierangela Samarati, Moti Yung · 2025
Cited by 1
Marek Šmolík · Digital Repository (National Repository of Grey Literature) · 2014
This thesis is focused on a web application security subject with an emphasis on ASP.NET MVC platform. Its primary objective is to create a comprehensive methodology for systematic verification of web application security, which contains specific implementation details intended for developers and testers. The methodology takes categorization, technical details and individual vulnerabilities from multiple sources and enhances them with specific examples. Work is valuable for developers and testers of mentioned platform mainly because it provides detailed information not included in available methodologies.
Cited by 0
Carlos Serrão, Vicente Aguilera Díaz · Communications in computer and information science · 2010
Cited by 2
Charpentier Rojas, Jose Enrique · KTH Publication Database DiVA (KTH Royal Institute of Technology) · 2013
Problems related to web application security comes in many ways, one example is inexperience programmers but not only in the way they code and program but also which language and structure they use to code. Not only programmers but Software companies left holes in the software they developed of course without intention.Because is proven that most of the vulnerabilities start in the web application side, as developers we need to follow certain principles, test our code and learn as much as possible about the subject, as a foundation of web application security in order to know how to prevent issues to the most significant treats.The penetration test aimed to help the IT business to discover vulnerabilities in their system ensure their integrity and continue further in the web application security process. The vulnerability research perform in this report is the introduction of a big work that is under continuity for the company.Finally the success of following security standards, process and methodologies applied on this field is considered the best approach to ensure web application security and priceless information you can benefit from.
Cited by 0Open access
Kuukasjärvi, Joni · Theseus (Ammattikorkeakoulujen) · 2025
This thesis investigates the critical domain of web application security, focusing on prevalent vulnerabilities that can damage the confidentiality and integrity of online applications. Through a comprehensive analysis of common vulnerabilities, such as cross-site scripting, SQL injection, and insecure authentication, this research explores their root causes and examines effective mitigation strategies. The findings of this thesis aim to contribute to a deeper understanding of web application security principles and provide practical guidance for developers and security professionals in enhancing the security posture of online applications.
Cited by 0Open access
Nenad Jovanović · reposiTUm (TU Wien) · 2007
Cited by 3
CERN. Geneva · CERN Document Server (European Organization for Nuclear Research) · 2009
Cited by 0
Lirias (KU Leuven) · 2014
status: Published
Cited by 0Open access
Γεώργιος Βαλλάτος · Dione (University of Piraeus) · 2016
Η Ασφάλεια των ηλεκτρονικών υπολογιστών και των εφαρμογών του Διαδικτύου \nείναι ένα θέμα που ακούμε όλο και περισσότερο τον τελευταίο καιρό. Η παραπάνω \nσυζήτηση φαντάζει όλο και πιο λογική άμα αναλογιστούμε ότι το ηλεκτρονικό \nέγκλημα ή όπως συνηθίζεται να λέγεται κυβερνο-έγκλημα έχει σημειώσει τρομακτική \nέξαρση σε παγκόσμια κλίμακα. Οι εκτιμήσεις που έχουμε από την Norton είναι ότι \nπαγκόσμια πάνω από δεκαοχτώ ενήλικες πέφτουν θύματα ηλεκτρονικού εγκλήματος \nκάθε δευτερόλεπτο ενώ παγκόσμια το 2012 υπήρχαν απώλειες περίπου \n$110.000.000.000.Αυτές οι εκτιμήσεις και τα νούμερα άμα αναλογιστεί κανένας την \nόλο και μεγαλύτερη διείσδυση στον παγκόσμιο ιστό(Internet) αλλά και την τάση του \nεμπορίου και των συναλλαγών να παίρνουν ηλεκτρονική μορφή, παρουσιάζουν μια \nσυνεχόμενη άνοδο. \nΜια λανθασμένη άποψη που επικρατεί είναι ότι ο τομέας της Ασφάλειας είναι ότι \nαφενός αφορά μόνο λίγους ειδικούς αλλά και αφετέρου ότι είναι κάτι που κάποιος \nχρειάζεται να ασχοληθεί μία φορά μόνο. Η αλήθεια όμως δεν είναι αυτή, διότι ούτε \nλίγες μετατροπές στον κώδικα ενός προγράμματος δεν εξασφαλίζει για πάντα την \nασφάλεια καθώς μέρα με την μέρα οι επιτιθέμενοι βρίσκουν όλο και πιο έξυπνους και \nστοχευόμενους τρόπους επίθεσης και επίσης το ζήτημα της ασφάλειας είναι κάτι που \nαφορά από τους προγραμματιστές μέχρι τους χρήστες και τους οργανισμούς και \nπρέπει ο καθένας από την μεριά του να ξέρει τι μπορεί να κάνει για να προφυλαχτεί. \nΑυτή λοιπόν η εργασία έχει ως στόχο την παρουσίαση των συνηθέστερων και πιο \nεπικίνδυνων επιθέσεων που στοχεύουν τις διαδικτυακές εφαρμογές (web \napplications) από κακόβουλους χρήστες αλλά και τις αντίστοιχες καλές \nπρακτικές (αντίμετρα) που μπορούμε να λάβουμε με σκοπό την αποτελεσματικότερη \nαντιμετώπιση τους. Αρχικά θα αποσαφηνίσουμε βασικές έννοιες που σχετίζονται με \nτις διαδικτυακές εφαρμογές όπως και τα πρωτόκολλα που τις περικλείουν και έπειτα \nθα αναλύσουμε ποιες είναι οι κυριότερες ευπάθειες που συναντάμε στις διαδικτυακές \nεφαρμογές, πως ένας κακόβουλος χρήστης μπορεί να τις εκμεταλλευτεί και ποιο είναι \nτο χρέος των σχεδιαστών αυτών των εφαρμογών αλλά και των απλών χρηστών για \nτην αποφυγή ζημιάς είτε από την μεριά αυτού που παρέχει την εφαρμογή είτε από \nτην μεριά του ατόμου που την χρησιμοποιεί. Οι επιθέσεις που θα αναλύσουμε \nστηρίζονται στην λίστα του OWASP με τις κύριες ευπάθειες των διαδικτυακών \nεφαρμογών. Ο OWASP (Open Web Application Security Project) είναι μία \nπρωτοβουλία που έχει σαν στόχο την αντιμετώπιση τρωτών σημείων στα λογισμικά \nτων εφαρμογών. Είναι ένας μη κερδοσκοπικός οργανισμός ο οποίος ακολουθεί την \nιδεολογία του ανοιχτού/ελεύθερου κώδικα(open source). \nΗ εργασία αυτή έγινε με κατευθυντήριες σημειώσεις και διαλέξεις του Jim Manico \nο οποίος είναι ενεργό μέλος του OWASP από το 2008, διάφορα επιστημονικά \nσυγγράμματα όπως και άρθρα πάνω στο αντικείμενο της Ασφάλειας.
Cited by 0Open access
Daniel Císař · Digital Repository (National Repository of Grey Literature) · 2007
Práce pojednává o běžných bezpečnostních ohrožních webových aplikací, kterou jsem napsané v programovacím jazyce PHP. Nabízí přehled následujících útoků: XSS, CSRF, SQL injection, session stealing, session fixation. V práci je uvedeno, jak se těmto útokům vyvarovat či minimalizovat jejich riziko.
Cited by 0
Ondřej Bukovský · Digital Repository (National Repository of Grey Literature) · 2012
This work is aimed on documenting the use of tools for security testing of web applica-tions. First part of the work lists and describes most common vulnerabilities. Then tools to detect these vulnerabilities are tested. The most suitable tool, or a combination of tools, suitable for repeated and automated security testing, is selected. Another goal is the inte-gration of automated security testing into the development lifecycle of web application. The benefit would be facilitation of web application security testing for individuals or small teams.
Cited by 0
Shopa, P, Sumitha, N, Patra Prabir · 2014
Internet services and applications have become a part of daily life, enabling communications from anywhere. To accommodate this increase in applications and data complexity, web services has moved to multi-tiered design wherein the webserver runs the application as the front end logic and data are outsourced to a database. Existing, request from user directly access to main server which connected to database. So there is a possibility of hacking the request also attacks plays a key role in this situation. In order to overcome this drawback, double guard is proposed for the user session across both the front-end logic and back-end database. By monitoring both web and subsequent database request, paved for detecting the attacks that an intrusion detection system would not able to identify. Double guard achieved by using a technique named Light Weight Virtualization, in which a container is maintained for detecting attacks. Here the web container acts as intermediate server between user and main server. Furthermore, technique has been enhanced by not only detecting the attacks also for security purpose.
Cited by 1
B Swetha, J Thirulogaveni, Susmitha Nrk et al. · SSRN Electronic Journal · 2023
Cited by 6Open access