Madhavan for his invaluable advice, guidance and his enormous patience throughout the development of the research. One of the important steps to ensure the security of web applications is to perform periodic vulnerability assessment. Finally, we also discuss the impact of the vulnerability attacks and proposed possible mitigation strategies.
Introduction
In this research, we will focus on the most prominent web application vulnerabilities from OWASP. According to the Open Web Application Security Project, XSS was the seventh most common web app vulnerability in 2019. Injection is a major problem in web security that remained ranked first in the OWASP Top 10 Web Application Security Risks since the year 2013.
Problem Statement
In the year 2017, the Malaysia Telco hack has made huge headlines with over 46.2 million records leaked due to broken authentication issues. 34;Bendera Negaraku Bukanlah Mainan," while Indonesia's patriotic anthem Tanah Air Beta plays in the background. According to a recent September 2019 The New Strait Times news report, Malaysia-based Malindo Air and its Indonesian parent company Lion Air suffered a massive data breach that caused the personal data of millions of passengers on data exchange have been leaked.
Objective
Reported Incidents based on General Incident Classification Statistic
Research Question
Scope of work
Contribution of the Study
Outline of the Report
Introduction
Literature Review
Recently, reports created by the WhiteHat Security Threat Research Center and the Open Web Application Security Project (OWASP) were published, which describe the TOP 10 most common attacks in 2017. Although it is almost impossible to have a web application 100% without vulnerabilities, if we remove so much vulnerability. as much as possible, we can increase the security of the web application.
Web Application
Web Vulnerability Assessment
Vulnerability assessment is also a method or process of scanning the web application to discover the weakness and loophole within the web application. Penetration testing is trying to exploit the web application in an authorized manner to discover possible exploits in the web application. Penetration testing involves trying to exploit vulnerabilities in a web application or break it by creating a set of malicious input values.
The vulnerability assessment used a vulnerability scan to detect weaknesses or vulnerabilities in the web application. In 2015, Rohan Vibhandik and Arijit Kumar Bose proposed a new testing approach for web application vulnerability assessment by analyzing and using a combined set of tools to address a wide range of security issues. Their technique demonstrates the vulnerability assessment test of a web application using a combination of W3AF and Nikto tools.
It shows how the combination of these two tools can increase the coverage of vulnerability testing for a web application, taking into account threat modeling of the web application based on the OWASP Top 10. In 2015, Jai Narayan Goel, BM Mehtre explained the complete lifecycle of vulnerability assessment and penetration testing (VAPT ), dominant VAPT techniques and the top 15 vulnerability assessment tools. Sangeeta Nagpure and Sonal Kurkure provide a comparative and joint analysis of web application vulnerability assessment and penetration testing methods.
After their study and experimentation using manual and automation testing, they suggest that vulnerability assessment should plan an integrated manual and automated testing approach to increase the accuracy in the identification of vulnerabilities in the web application.
Vulnerability Assessment Techniques i. Static Analysis
In this technique we enter invalid or any random data in the web application and then look for crashes and failures.
Vulnerability Assessment Tools
Founded in 2004 to combat the alarming increase in web attacks, Acunetix is today a market leader in web application security technology. It is a fully automated web vulnerability scanner that detects and reports on more than 4500 web application vulnerabilities, including all variants of SQL Injection and XSS. To keep track of the vulnerabilities detected in your web applications, Acunetix Vulnerability Scanner includes extensive reports to help manage vulnerability escalation and remediation while aiding in task prioritization.
Website Analysis: Acunetix Deep Scan scanner scans the website showing the links and pages linked to the website. Enabling the sensor called Acunetix Acu on the scanner provides web application directories and files. After the scan is complete, the scan results are saved in a document.
The OWASP ZAP is an open source integrated penetration testing tool for finding vulnerabilities in web applications. The first one is an automatic vulnerability scanner that can identify problems and provide a report for developers, system administrators and security professionals with all the details of discovered vulnerabilities to fix them. The second one allows ZAP to work as a proxy and inspect the traffic and all HTTP/S requests and events -- there is also the interesting ability to modify it to analyze behavior that deviates from the norm or their analyzing triggers that could be harmful to the system.
One of ZAP's strengths is its availability for many platforms and operating systems.
Introduction
Research Approach
Vulnerability scanners use web application parameters during scanning. All they need is the IP or URL of the web application. With IP alone, a vulnerability scanner can detect potential places where an attack can be carried out on the web application. The result of a scan includes comprehensive details of all vulnerabilities found within the web application.
That is why further analysis needs to be done on a vulnerability scan report to find out whether the found vulnerability is the right one or not. SQL injection can be detected manually by using a systematic set of tests against each point in the web application. This string is passed as a value of a parameter to the application's page and responds with the injected JavaScript that displays a pop-up message with a browser cookie.
If the browser cookie request is answered and displayed as in Figure 3.2, the application is very likely vulnerable to XSS. This can be seen in the figure below when we inject the JavaScript code and it is reflected and executed on the response page. Vulnerabilities can exist in several areas of the network, such as in firewalls, FTP servers, web servers, operating systems or CGI trays.
It is an open framework that provides transparency to the individual characteristics and methodology used to derive a score.
Web Application Selection
Vulnerability Assessment Tools Selection
Information Gathering
The more information collected about the target, the greater the chance of relevant results. There are a variety of tools, techniques, and websites, including public resources such as Whois, nslookup, that can help gather information. ZAP is an open source tool for Linux, MacOSX and Windows that can be downloaded for free from httpa://github.com/zaproxy.
Spidering is an automated method of discovering web application pages by following links. Once a site is scanned, it can be actively scanned using the ZAP "Active Scan" function. Once complete, the vulnerabilities will be displayed under the Alert tab in the bottom frame of the ZAP interface.
Some high-risk vulnerabilities such as input-based vulnerabilities can be detected by testing for standard query language (SQL injection) and cross-site. This type of vulnerability will be tested using a manual method based on the information gathered by scanning the report. Source code review is the best method to detect if applications are vulnerable to injection, closely followed by automated testing of all parameters, headers, URLs, cookies, JSON, SOAP and XML data inputs.
This changes the meaning of both queries to return all records from the accounts table.
Avoiding from Detection
Conclusion
Introduction
Analysis of data-set based on Information Gathered
20 http://jpnmelaka.moe.gov.my/eaduanhrmis - None Table 4.1: List of the 20 web applications that were in the scope of the study 4.3 Analysis of dataset based on the severity level of vulnerability.
OPTION
Web application no. 14 had a total of 38 vulnerabilities, it was the web application with the greatest vulnerability found in this study.
Total Vulnerability Found In 15 Web Aplication
Analysis of data-set based on the category of vulnerability
- Cross-Site Scripting (XSS)
Based on the results, all 15 successful scanning web applications have vulnerabilities, and at least two categories of vulnerabilities were found in each web application. Based on Chart 4.2, the highest category vulnerability found is Cross-site Scripting (XSS) in a total of 37 items. The second is 13 items of Security Misconfiguration, followed by 12 items of Broken Access Control and 11 items of Injection.
A total of 37 articles in the Cross-site Scripting (XSS) category, Web Application no.14 contributed 9 articles, the details shown in Figure 4.1 as below.
Cases Found In 15 Web Application by Category Vulnerability
Security Misconfiguration
The total 13 items in Security Misconfiguration category, web application #5 contributed 1 item, details shown in Figure 4.3 and Figure 4.4 show the evidence of this vulnerability. The total 12 items in Broken Authentication and Session Management category, Web Application No. 5 contributed 1 item, details shown in Figure 4.5 as below. Web Application Vulnerability Injection allows an attacker to interfere with the queries an application makes to its database.
Conclusion
Vulnerability By Severity Level
- Introduction
- Impact from SQL Injection
- Remediation for SQL Injection
- A2: Broken Authentication and Session Management
- Impact from Broken Authentication and Session Management
- Remediation for Broken Authentication and Session Management Fixing the broken authentication issue can start with the basics, no application should
- A6: Security Misconfiguration
- Impact from Security Misconfiguration
- Remediation
- A7: Cross-Site Scripting (XSS)
- Impact from Cross-Site Scripting (XSS)
- Remediation for Cross-Site Scripting (XSS)
- Conclusion
Based on the result and discussion in Chapter 4, we have identified 4 most common vulnerabilities found in government web applications. The purpose of this chapter is as a reference for developers to act on the vulnerable web application and also to promote awareness about them. Attackers can make an attack on the internal network, which can destroy the service of the web application.
Security misconfiguration vulnerabilities occur when a web application component is susceptible to attack due to misconfiguration or an unsafe configuration option. Sanitizing user input is the only thing that protects a web application from XSS. CSP is proposed to mitigate XSS without changing the source code of the web application.
Therefore, this vulnerability assessment is best implemented by the developer when the web application is in the development stage. From the test result, a total of 166 vulnerabilities were found from 15 government web applications, which also means that 75% of web applications are vulnerable. While the current statistics on the number of vulnerabilities in the government's online application are certainly worrying, increased awareness of the issue and a sustained program of strengthening security may lead to better results in the future.
Amar Shah Mohsen (2017) 'Indonesian hackers retaliate for flag blunder by trashing M'sian websites', The Sun, August. 2009) 'Threat modeling for CSRF attacks', Proceedings - 12th IEEE International Conference on Computational Science and Engineering, CSE 2009, 3, pp.
