Sorcha McNally, Kevin Curran · Ulster University Research Portal (Ulster University) · 2024
In the digital age web applications have become a staple of our daily lives due to their convenience and efficiency. It is our main form of communication, transactions and how we access information. With the abilities of web applications, we have become reliant on them for our day-to-day tasks. Although this is not inherently bad, it has become clear that web application security is a paramount tool for online use, particularly among businesses and organisations. Web application security is the practice of protecting websites, applications, and APIs from attacks. This form of security aims to ensure that web applications function smoothly and remain unhindered by cyber vandalism, data theft, and other malicious attacks. This report will explore the top three vulnerabilities highlighted by the most recent OWASP top ten vulnerabilities report, last updated in 2021. These vulnerabilities include broken access control, cryptography failures and injection attacks. Moreover, each section will highlight how these security techniques defend, can be exploited and what measures developers can take to better defend web applications. The paper addresses the future of web application security in the context of emerging technologies such as artificial intelligence (AI) and machine learning. It speculates on how these technologies might be integrated into security strategies to enhance threat detection and response capabilities. The concept of DevSecOps is introduced as an evolutionary approach to integrate security into the development process of web applications, emphasizing the shift towards proactive security practices. In conclusion, the paper highlights the critical nature of web application security in the digital age. It provides a detailed examination of the most pressing vulnerabilities and offers guidance on implementing effective security measures. The aim is to equip developers, security professionals, and organizations with the knowledge and tools necessary to build and maintain secure web applications, ultimately protecting them from the evolving landscape of cyber threats.
Cited by 1Open access
Elsevier eBooks · 2007
Cited by 2
Md. Abdur Rahman, Mahfida Amjad, Byezid Ahmed et al. · 2020
Internet based application services become the essential part of peoples' daily activities. Web applications are a complex organized mess of codes; the software industry often they are built-in extreme pressure to meet a deadline. Therefore, it often retains the vulnerability holes from the development phase to the operational phase. Coding flaws, improper input sanitization, server misconfiguration, etc. causes the application vulnerable to an attacker, which may lead to service interruption and theft of valuable information. This paper conducts an empirical analysis of e-commerce based web applications to evaluate the current web application security scenario in Bangladesh. The most prominent web application security scanner named as Acunetix and Nikto were used to evaluate this study. A breakdown has conjured based on analytical results to find out the types of vulnerability. It is concluded that Cross-Site Request Forgery shows most frequent vulnerability where maximum apps were found having this vulnerability so aptly ranked as number one. However, cross site scripting positioned top for high-level risk vulnerability in Bangladeshi e-commerce platform.
Cited by 10
KC, Samita · Theseus (Ammattikorkeakoulujen) · 2020
The main objective of this thesis was to study the top three web application vulnerabilities such as SQL injection, Cross-Site Scripting and Cross-SiteRequest Forgery.The thesis focuses on the working mechanism of these three vulnerabilities, the implementation of the attack and the prevention method for each vulnerability.During the project, the language, such as HTML, PHP, JavaScript and CSS,was used and MySQL database was in practice for implementing these three vulnerabilities using a localhost as a web host. Each vulnerability in web applications was tested using different techniques.The result of the test shows that web vulnerabilities can do severe damage toan application. Thus, web applications need to include proper preventive measures to avoid these vulnerabilities from being exploited.
Cited by 0
Prabhsharan Kaur, Isha Sharma, Amandeep Kaur · 2021 5th International Conference on Information Systems and Computer Networks (ISCON) · 2021
The web applications are evolving with time to provide the communication environment to interact but they are coming up with various vulnerabilities even with just some basic programming bugs. Therefore, security ought to be a significant in web applications. There are categories of vulnerabilities that occur while working with the web applications and countermeasures needs to be provided so as to cope up with these vulnerabilities. This paper discusses the various threats occurring in web applications along with the examples and provides a solution for preventing them. The paper also classifies the different web applications vulnerabilities as per the EDI matrix (exploitability, detection rate, and impact). The research paper is concluded with various countermeasures which deals with the threats over the web applications and lessen the impact by targeting the weak spots that open the web application to the severity.
Cited by 2
Matt Fisher · Bulletin of Miscellaneous Information (Royal Gardens Kew) · 2006
Cited by 0
Buja, Alya Geogiana, Abd. Jalil, Kamarularifin, Mohd Ali, Fakariah et al. · UiTM Institutional Repositories (Universiti Teknologi MARA) · 2016
The use of web in daily life is increasing and becoming trend now. As the use of the web is increasing, the use of web application is also increasing. Apparently most of the web application exists up to today have some vulnerability that can be exploited by unauthorized person. Some of well-known web application vulnerabilities are Structured Query Language (SQL) Injection, Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). By compromising with these web application vulnerabilities, the system cracker can gain information about the user and lead to the reputation of the respective organization. This research aim to solve these issues by developing a detection model for detecting and recognizing the web vulnerabilities based on the defined and identified criteria. In addition, the proposed detection model will be able to generate the report regarding the level of vulnerability of the web application. The research will be carried out by using design string matching algorithm. The algorithm is used in order to match the defined criteria of each web vulnerability with the input information about web application. The evaluation of the proposed method is via detection accuracy of each web vulnerability.
Cited by 0
Bulletin of Miscellaneous Information (Royal Gardens Kew)
Cited by 0
Šnajdr, Václav · Brno University of Technology Digital Library (Brno University of Technology) · 2021
Diplomová práce se zabývá návrhem a implementaci webové aplikace pro testování bezpečnosti SSL/TLS protokolů na vzdáleném serveru. Webová aplikace je vyvíjena ve frameworku Nette. V teoretické části jsou popsány SSL/TLS protokoly, zranitelnosti, doporučení a použité technologie v praktické části. Praktická část se věnuje tvorbě webové aplikace s procesem použití automatických skriptů pro testování a zobrazení výsledků na webové stránce s hodnocením A+ až C. Webová aplikace zároveň zobrazí seznam detekovaných zranitelností a jejich doporučení.
Cited by 0
Ajjarapu Kusuma Priyanka, Siddemsetty Sai Smruthi · 2020 International Conference on Electrotechnical Complexes and Systems (ICOECS) · 2020
Web application security has become a major challenge due to the common vulnerabilities found in web applications. Attackers possess a never-ending list of vulnerabilities and payloads to exploit them in order to gain access over various web applications maliciously. Each time when there are any changes made at some layer of web-application architecture, there exists a chance of creating novel vulnerabilities. In this paper, we brief out our analysis on common and familiar vulnerabilities like Sql Injection (SQLi), Cross site Scripting (XSS) and Cross site Request Forgery (CSRF) and demonstrate the exploitation of these vulnerabilities by considering DVWA, a highly vulnerable web application designed for education purpose. We carry out exploitation both manually and through automated tools. We conclude our research by inferring some preventive mechanisms to be adopted while designing the web applications to mitigate such types of attacks.
Cited by 10
Julia Juremi, Ali Allouche, Kazi Farhan Ishraq · The Journal of Applied Technology and Innovation · 2025
World Wide Web also known as www has been used by almost everybody in the world for education, entertainment, commerce and many more. As World Wide Web expands more it has become vulnerable for cyber-attacks from cybercriminals across the world. This paper aims to explore the most common web application attacks and vulnerabilities, what is the cause of it, what affect it might have, and how to prevent it from happening by using best practices and tools. In this paper OWASP top 10 and modern security frameworks will be focused on to understand how to secure web applications against threats. Various tools and best practices will also be discussed to mitigate these risks and protect sensitive data.
Cited by 0Open access
K. Nirmal, B. Janet, R. Kumar · 2018 International Conference on Inventive Research in Computing Applications (ICIRCA) · 2018
In today's online era, a web application is an integral part of every business. A web application may be a single page HTML website or a large web portal that offers various services on a web browser. There are many tools and methodologies that are relied upon to develop a web application. The development methodologies incorporate specialized frameworks, libraries in order to have the application more standardized and have it developed at a rapid pace to meet market demands. Web applications (web app) are hardened to mitigate security issues which are commonly referred as web application vulnerabilities. A web app security vulnerability is any kind of loop hole that allows an attacker to break into the web application to perform undesired actions on the target website. This may range from a cross site scripting (XSS) to vulnerabilities like Server Side Request Forger (SSRF) and its implications like XML External Entity (XXE). Though web applications are hardened to mitigate vulnerabilities, large scale web applications are still vulnerable post release in most cases. As a part of security research, critical vulnerabilities on large scale web applications were identified and the same were reported to the concerned security research team. The reporting was acknowledged and mitigated through appropriate channels. Common Vulnerabilities and Exposures (CVEs) were filed on Microsoft and CISCO products and the same were logged in National Vulnerability Database (NVD). Insights and tenets regarding web application and its vulnerabilities are highlighted in this manuscript.
Cited by 20
Steven C. Palmer · CERN Document Server (European Organization for Nuclear Research) · 2007
Cited by 17
Nilesh Yadav, Narendra Shekokar · Lecture notes on data engineering and communications technologies · 2018
Cited by 1
Zulie Pan, Yu Chen, Yu Chen et al. · Applied Sciences · 2022
Web applications widely use the logging functionality, but improper handling can bring serious security threats. An attacker can trigger the execution of malicious data by writing malicious data to the web application logs and then accessing the view–logs interface, resulting in a vulnerability of the web application log injection. However, detecting this type of vulnerability requires automatic discovery of log-injectable interfaces and view–logs interfaces, which is difficult. In addition, bypasssing the application-specific input-filtering checks to write an effective payload to the log is also challenging. This paper proposes LogInjector, an efficient web application log injection vulnerability detection method. First, it obtains the log storage form and location and then finds the log-injectable interfaces through the extended dynamic crawler. Second, it automatically identifies the web application view–logs interfaces. Finally, LogInjector utilizes a dynamic testing approach based on the feedback-guided mutation to detect web application log injection vulnerabilities. To verify the effectiveness of LogInjector, we test it in 14 popular web applications in real-world cases and compare it with Black Widow, the state-of-the-art web vulnerability scanner. LogInjector detects 16 web application log injection vulnerabilities, including 6 zero-day vulnerabilities, while Black Widow can only detect three log injection vulnerabilities, demonstrating the effectiveness of LogInjector in practice.
Cited by 5Open access
Arhant Bararia, Ms. Vandana Choudhary · INTERANTIONAL JOURNAL OF SCIENTIFIC RESEARCH IN ENGINEERING AND MANAGEMENT · 2023
Organizations are increasingly worried about web application vulnerabilities because they can be used by cybercriminals to access private data without authorization. In this review, we examine the current state of the vulnerabilities in the web application layer. We begin by discussing the different types of vulnerabilities that can affect web applications, including cross-site scripting (XSS), brute force, SQL injection, and cross-site request forgery (CSRF) attacks. And then for each vulnerability, we discuss the various approaches that have been developed to detect and prevent these vulnerabilities. Finally, we discuss the challenges and limitations of current approaches and suggest directions for future research. Key Words: web application, vulnerabilities, cyber-security, SQL injection, XSS, CSRF.
Cited by 4Open access
R. Utaya Surian, Nor Azlina Abd Rahman, Yogeswaran Nathan · Journal of Physics Conference Series · 2020
Abstract Internet has been dominating the world nearly a decade. Web application is known to be the most widespread platform of the internet especially when it comes to share resources, e-commerce services, education and business platforms. Since the usage of web applications are increasing dramatically, it’s becoming more vulnerable for security attacks. Each year, organizations facing many security attacks towards their web applications. Although many security practices and mitigations have been applying in web application, however there are still some security loophole issues can be found in web application. For instance, these loopholes can be referred as lack of secure coding (standards) implemented in web application, lack of formal security training approach for web developers and improper security testing for their web application. Besides, social engineering attacks also tremendously increasing each year. Many organizations were compromised through phishing attacks due to lack of awareness among users (employees). As a solution to overcome the issues, a research project will be carried out to implement a system called Nscanner to detect Structured Query Language injection (SQLi) and Cross-Site Scripting (XSS) vulnerabilities for web application. Moreover, the developer also will design a malware detection feature based on machine learning approach to detect malware found in attachments from emails in order to prevent malware phishing attacks.
Cited by 8Open access
Dinesh Gopal Dommeti, Persis Voola · South Asian Journal of Engineering and Technology · 2023
Web application vulnerabilities involve flaws or weaknesses in web-based applications. This study employs Damn Vulnerable Web Application (DVWA) and Portswigger as testbeds, using the Burp Suite proxy tool to intercept and analyse web traffic. The aim is to identify and exploit common vulnerabilities to enhance application security. Key vulnerabilities explored include Authentication issues, SQL injection, Cross-site scripting (XSS), and Cross-site request forgery (CSRF). The study offers insights into preventing such exploits by securing applications before real-world attacks occur.
Cited by 1Open access
Ravinder Singh, Mukesh Kumar Gupta, Dipak R. Patil et al. · 2024
In the era of ubiquitous digital connectivity, securing software applications against cyber threats is paramount. Dynamic Application Security Testing (DAST) has emerged as a crucial methodology in the realm of cybersecurity, providing a dynamic, real-time approach to identify and mitigate vulnerabilities within software applications. This research paper delves into the significance and application of DAST in fortifying cybersecurity measures. DAST represents a departure from traditional static testing methods, which analyze source code or binaries, by assessing applications during runtime. The methodology involves the active, controlled probing of live applications through simulated cyber-attacks, including injection of malicious payloads and emulation of common exploit techniques. By dynamically assessing how applications respond to these simulated threats, DAST offers a real-world evaluation of security posture, facilitating the identification of potential vulnerabilities.This research paper analyzed the Dynamic Application Security Testing (DAST) reports for different web applications over the past two years and provide a valuable resource for cybersecurity practitioners, researchers, and organizations striving to adopt effective strategies in safeguarding their digital assets against evolving cyber threats in the current environment.
Cited by 6
Vrána, Jaroslav · Brno University of Technology Digital Library (Brno University of Technology) · 2011
Práce se zabývá problematikou zranitelností DoS v oblasti webových aplikací. Nejdříve jsou popsány principy počítačové bezpečnosti, obecné principy DoS a penetračního testování. Dále text popisuje části OWASP Testing Guide v3, které se zabývají DoS testováním webových aplikací. Na základě dosažených zkušeností je navržena vlastní aplikace na automatizovaný audit. Tato aplikace je následovně implementována a testována na webových aplikacích.
Cited by 0