Routine Detection Of Web Application Defence FlawsIJTET Journal
Abstract— The detection process for security vulnerabilities in ASP.NET websites / web applications is a complex one, most of the code is written by somebody else and there is no documentation to determine the purpose of source code. The characteristic of source code defects generates major web application vulnerabilities. The typical software faults that are behind of web application vulnerabilities, taking into different programming languages. To analyze their ability to prevent security vulnerabilities ASP.NET which is part of .NET framework that separate the HTML code from the programming code in two files, aspx file and another for the programming code. It depends on the compiled language (Visual Basic VB, C sharp C#, Java Script). Visual Basic and C# are the most common languages using with ASP.NET files, and these two compiled languages are in the construction of our proposed algorithm in addition to aspx files. The hacker can inject his malicious as a input or script that can destroy the database or steal website files. By using scanning tool the fault detection process can be done. The scanning process inspects three types of files (aspx, VB and C#). then the software faults are identified. By using fault recovery process the prepared replacement statement technique is used to detect the vulnerabilities and recover it with high efficiency and it provides suggestion then the report is generated then it will help to improve the overall security of the system.
Analysis of XSS attack Mitigation techniques based on Platforms and Browserscscpconf
In the recent years, everything is in web. It may be Organization’s administration software,
Custom ERP application, Employee portals or Real estate portals. The Social networking sites
like Face book, Twitter, MySpace which is a web application is been used by millions of users
around the world. So web applications have become very popular among users. Hence they are
observed and may be exploited by hackers. Researchers and industry experts state that the
Cross-site Scripting (XSS) is the one of the top most vulnerabilities in the web application. The
cross-site scripting has become a common vulnerability of many web sites and web
applications. XSS consists in the exploitation of input validation flaws, with the purpose of
injecting arbitrary script code which is later executed at the web browser of the victim.
According to OSWAP, Cross-site scripting attacks on web applications have experienced an
important rise in recent year. This demands an efficient approach on the server side to protect
the users of the application as the reason for the vulnerability primarily lies on the server side.
The actual exploitation is within the victim’s web browser on the client-side. Therefore, an
operator of a web application has only very limited evidence of XSS issues. However, there are
many solutions for this vulnerability. But such techniques may degrade the performance of the
system. In such scenarios challenge is to decide which method, platform, browser and
middleware can be used to overcome the vulnerabilities, with reasonable performance over
head to the system. Inspired by this problem, we present performance comparison of two mitigation techniques for Cross-site Scripting (XSS) at the server side based on the parameters like application’s platform, middleware technology and browser used by the end user. We implemented Mitigation parsing technique using database and replace technique in different platforms, middleware and checked its performance. We calculated the time taken by different browsers to render the pages using two techniques under different platform and middleware. In this paper we proposed the best combination of development platform, browser and the middleware for the two mitigation technique with respect to developer and end users.
International Journal of Engineering Research and Applications (IJERA) is an open access online peer reviewed international journal that publishes research and review articles in the fields of Computer Science, Neural Networks, Electrical Engineering, Software Engineering, Information Technology, Mechanical Engineering, Chemical Engineering, Plastic Engineering, Food Technology, Textile Engineering, Nano Technology & science, Power Electronics, Electronics & Communication Engineering, Computational mathematics, Image processing, Civil Engineering, Structural Engineering, Environmental Engineering, VLSI Testing & Low Power VLSI Design etc.
Routine Detection Of Web Application Defence FlawsIJTET Journal
Abstract— The detection process for security vulnerabilities in ASP.NET websites / web applications is a complex one, most of the code is written by somebody else and there is no documentation to determine the purpose of source code. The characteristic of source code defects generates major web application vulnerabilities. The typical software faults that are behind of web application vulnerabilities, taking into different programming languages. To analyze their ability to prevent security vulnerabilities ASP.NET which is part of .NET framework that separate the HTML code from the programming code in two files, aspx file and another for the programming code. It depends on the compiled language (Visual Basic VB, C sharp C#, Java Script). Visual Basic and C# are the most common languages using with ASP.NET files, and these two compiled languages are in the construction of our proposed algorithm in addition to aspx files. The hacker can inject his malicious as a input or script that can destroy the database or steal website files. By using scanning tool the fault detection process can be done. The scanning process inspects three types of files (aspx, VB and C#). then the software faults are identified. By using fault recovery process the prepared replacement statement technique is used to detect the vulnerabilities and recover it with high efficiency and it provides suggestion then the report is generated then it will help to improve the overall security of the system.
Analysis of XSS attack Mitigation techniques based on Platforms and Browserscscpconf
In the recent years, everything is in web. It may be Organization’s administration software,
Custom ERP application, Employee portals or Real estate portals. The Social networking sites
like Face book, Twitter, MySpace which is a web application is been used by millions of users
around the world. So web applications have become very popular among users. Hence they are
observed and may be exploited by hackers. Researchers and industry experts state that the
Cross-site Scripting (XSS) is the one of the top most vulnerabilities in the web application. The
cross-site scripting has become a common vulnerability of many web sites and web
applications. XSS consists in the exploitation of input validation flaws, with the purpose of
injecting arbitrary script code which is later executed at the web browser of the victim.
According to OSWAP, Cross-site scripting attacks on web applications have experienced an
important rise in recent year. This demands an efficient approach on the server side to protect
the users of the application as the reason for the vulnerability primarily lies on the server side.
The actual exploitation is within the victim’s web browser on the client-side. Therefore, an
operator of a web application has only very limited evidence of XSS issues. However, there are
many solutions for this vulnerability. But such techniques may degrade the performance of the
system. In such scenarios challenge is to decide which method, platform, browser and
middleware can be used to overcome the vulnerabilities, with reasonable performance over
head to the system. Inspired by this problem, we present performance comparison of two mitigation techniques for Cross-site Scripting (XSS) at the server side based on the parameters like application’s platform, middleware technology and browser used by the end user. We implemented Mitigation parsing technique using database and replace technique in different platforms, middleware and checked its performance. We calculated the time taken by different browsers to render the pages using two techniques under different platform and middleware. In this paper we proposed the best combination of development platform, browser and the middleware for the two mitigation technique with respect to developer and end users.
International Journal of Engineering Research and Applications (IJERA) is an open access online peer reviewed international journal that publishes research and review articles in the fields of Computer Science, Neural Networks, Electrical Engineering, Software Engineering, Information Technology, Mechanical Engineering, Chemical Engineering, Plastic Engineering, Food Technology, Textile Engineering, Nano Technology & science, Power Electronics, Electronics & Communication Engineering, Computational mathematics, Image processing, Civil Engineering, Structural Engineering, Environmental Engineering, VLSI Testing & Low Power VLSI Design etc.
Study of Web Application Attacks & Their Countermeasuresidescitation
Web application security is among the hottest issue
in present web scenario due to increasing use of web
applications for e-business environment. Web application has
become the easiest way to provide wide range of services to
users. Due to transfer of confidential data during these services
web application are more vulnerable to attacks. Web
application attack occurs because of lack of security awareness
and poor programming skills. According to Imperva web
application attack report [1] websites are probe once every
two minutes and this has been increased to ten attacks per
second in year 2012. In this paper we have presented most
common and dangerous web application attacks and their
countermeasures.
The International Journal of Engineering and Science (The IJES)theijes
The International Journal of Engineering & Science is aimed at providing a platform for researchers, engineers, scientists, or educators to publish their original research results, to exchange new ideas, to disseminate information in innovative designs, engineering experiences and technological skills. It is also the Journal's objective to promote engineering and technology education. All papers submitted to the Journal will be blind peer-reviewed. Only original articles will be published.
There have been reports such as ‘there is high rate of web application vulnerability’ as well as a range of ways in which web hackers attack web applications. Since the discovery that web applications convey the best content to users, there have been attempts to determine ways in which these systems can be hacked into through defacing, damage and defrauding. As the culture of conveying information across the internet continues to gain ground, there are increasing cases of vulnerabilities of these sites to cyber criminals.
PHP is one of the most commonly used languages to develop web sites because of i
ts simplicity, easy to
learn and it can be easily embedded with any of the databases. A web developer with his basic knowledge
developing an application without practising secure guidelines, improper validation of user inputs leads to
various source code
v
ulnerabilities. Logical flaws while designing, implementing and hosting the web
application causes work flow deviation attacks.
In this paper, we are analyzing the complete behaviour of a
web application through static and dynamic analysis methodologies
A Review paper on Securing PHP based websites From Web Application Vulnerabil...Editor IJMTER
In today’s Era, Web applications are one of the most part ubiquitous platforms for
information sharing and services over Internet which play significant role in individual life as well
as in any country’s growth. Web applications have gone through a very rapid Growth As they are
increasingly used for the financial organization, government, hospitality and many critical services.
Web applications become a popular and precious target for security attacks. at the present time,
billions of transactions are done online through net banking, online shopping, online billing and
many more. Even though these applications are used by lots of people modern web applications
often implements the complex structure requires for user to carry out actions in given order, in
many cases the security level is too low, which makes them vulnerable to get compromised. Even
though a large number of techniques have been developed to build up web applications and
mitigate the attacks toward web applications, there is little effort constant to drawing relations
among these techniques and building a big picture of web application security(WAS) research. In
this paper, we present a survey on various types of web application vulnerabilities(WAV).
Sqlas tool to detect and prevent attacks in php web applicationsijsptm
Web applications become an important part of our daily lives. Many other activities are relay on the functionality and security of these applications. Web application injection attacks, such as SQL injection (SQLIA), Cross-Site Scripting (XSS) and Cross-Site Request Forgery (XSRF) are major threats to the
security of the Web Applications. Most of the methods are focused on detection and prevention from these
web application vulnerabilities at Run Time, which need manual monitoring efforts. Main goal of our work
is different in the way it aims to create new systems that are safe against injection attacks to begin with, thus allowing developers the freedom to write and execute code without having to worry about these attacks. In this paper we present SQL Attack Scanner (SQLAS) a Tool which can detect & prevent SQL injection Attack in web applications. We analyzed the performance of our proposed tool SQLAS with various PHP web applications and its results clearly determines the effectiveness of detection and prevention of our proposed tool. SQLAS scans web applications offline, it reduces time and manual effort due to less overhead of runtime monitoring because it only focus on fragments that are vulnerable for attacks. We use XAMPP for client server environment and developed a TESTBED on JAVA for evaluation of our proposed tool SQLAS.
Web Applications Assessment Tools: Comparison and DiscussionEECJOURNAL
Recently web applications have proliferated rapidly, with the world increasingly dependent on financial transactions, purchasing, billing, education, medicine, and many more. But the security of these applications is worrying because it directly affects the end-user. Therefore, it is necessary to detect security vulnerabilities in those applications that may cause significant user problems. Most commonly used approach to detect those vulnerabilities are assessments tools like web scanners. This paper will focus on usage of these web scanners and their related methodology to detect the various vulnerabilities in web applications and then compare these scanners depending on results.
Last month a hacker breached Yahoo!'s security systems and acquired full access to certain Yahoo! databases, leading to full access on the server. Technically, this highlights the danger of SQLi. From a business perspective, we see the security problem posed third-party code.
Now-a-days the world of information era, we can get information just our single click by using Web
application. Web applications are popular due to the ubiquity of web browsers, and the convenience of
using a web browser as a client, sometimes called a thin client. It are playing a major role in this, every
organization are mapping their business from a room to the world with the help of these Web Application.
It consist of a three tier structural design where database is in the third pole, which is the most valuable
assets in any organization, as the adaptation of web applications are increases day by day, various attacks
are possible increasing day by day. An attack which is directly compromises the database that is most
threatening attack is called SQL injection. There are various Vulnerability scanners has been proposed to
deal with this attack, but none of them are able to detect SQLI completely. In my tools have the accuracy
ratio very less as well as they produce a high rate of false positive, apart from that all these tools take
much time to scan. To avoid these problem and detect SQL completely we are presenting a NVS that is
Network Based Vulnerability Scanner approach this provides a better coverage and with no false positive
with a short span of time.
Recent hacks of major international and regional banks have occurred due to exploits from the following vulnerabilities:
1. Cross-Site Scripting (XSS) vulnerability using redirects
2. Local File Inclusion (LFI) vulnerability
3. Cross-Site Request Forgery (CSRF) vulnerability
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
Study of Web Application Attacks & Their Countermeasuresidescitation
Web application security is among the hottest issue
in present web scenario due to increasing use of web
applications for e-business environment. Web application has
become the easiest way to provide wide range of services to
users. Due to transfer of confidential data during these services
web application are more vulnerable to attacks. Web
application attack occurs because of lack of security awareness
and poor programming skills. According to Imperva web
application attack report [1] websites are probe once every
two minutes and this has been increased to ten attacks per
second in year 2012. In this paper we have presented most
common and dangerous web application attacks and their
countermeasures.
The International Journal of Engineering and Science (The IJES)theijes
The International Journal of Engineering & Science is aimed at providing a platform for researchers, engineers, scientists, or educators to publish their original research results, to exchange new ideas, to disseminate information in innovative designs, engineering experiences and technological skills. It is also the Journal's objective to promote engineering and technology education. All papers submitted to the Journal will be blind peer-reviewed. Only original articles will be published.
There have been reports such as ‘there is high rate of web application vulnerability’ as well as a range of ways in which web hackers attack web applications. Since the discovery that web applications convey the best content to users, there have been attempts to determine ways in which these systems can be hacked into through defacing, damage and defrauding. As the culture of conveying information across the internet continues to gain ground, there are increasing cases of vulnerabilities of these sites to cyber criminals.
PHP is one of the most commonly used languages to develop web sites because of i
ts simplicity, easy to
learn and it can be easily embedded with any of the databases. A web developer with his basic knowledge
developing an application without practising secure guidelines, improper validation of user inputs leads to
various source code
v
ulnerabilities. Logical flaws while designing, implementing and hosting the web
application causes work flow deviation attacks.
In this paper, we are analyzing the complete behaviour of a
web application through static and dynamic analysis methodologies
A Review paper on Securing PHP based websites From Web Application Vulnerabil...Editor IJMTER
In today’s Era, Web applications are one of the most part ubiquitous platforms for
information sharing and services over Internet which play significant role in individual life as well
as in any country’s growth. Web applications have gone through a very rapid Growth As they are
increasingly used for the financial organization, government, hospitality and many critical services.
Web applications become a popular and precious target for security attacks. at the present time,
billions of transactions are done online through net banking, online shopping, online billing and
many more. Even though these applications are used by lots of people modern web applications
often implements the complex structure requires for user to carry out actions in given order, in
many cases the security level is too low, which makes them vulnerable to get compromised. Even
though a large number of techniques have been developed to build up web applications and
mitigate the attacks toward web applications, there is little effort constant to drawing relations
among these techniques and building a big picture of web application security(WAS) research. In
this paper, we present a survey on various types of web application vulnerabilities(WAV).
Sqlas tool to detect and prevent attacks in php web applicationsijsptm
Web applications become an important part of our daily lives. Many other activities are relay on the functionality and security of these applications. Web application injection attacks, such as SQL injection (SQLIA), Cross-Site Scripting (XSS) and Cross-Site Request Forgery (XSRF) are major threats to the
security of the Web Applications. Most of the methods are focused on detection and prevention from these
web application vulnerabilities at Run Time, which need manual monitoring efforts. Main goal of our work
is different in the way it aims to create new systems that are safe against injection attacks to begin with, thus allowing developers the freedom to write and execute code without having to worry about these attacks. In this paper we present SQL Attack Scanner (SQLAS) a Tool which can detect & prevent SQL injection Attack in web applications. We analyzed the performance of our proposed tool SQLAS with various PHP web applications and its results clearly determines the effectiveness of detection and prevention of our proposed tool. SQLAS scans web applications offline, it reduces time and manual effort due to less overhead of runtime monitoring because it only focus on fragments that are vulnerable for attacks. We use XAMPP for client server environment and developed a TESTBED on JAVA for evaluation of our proposed tool SQLAS.
Web Applications Assessment Tools: Comparison and DiscussionEECJOURNAL
Recently web applications have proliferated rapidly, with the world increasingly dependent on financial transactions, purchasing, billing, education, medicine, and many more. But the security of these applications is worrying because it directly affects the end-user. Therefore, it is necessary to detect security vulnerabilities in those applications that may cause significant user problems. Most commonly used approach to detect those vulnerabilities are assessments tools like web scanners. This paper will focus on usage of these web scanners and their related methodology to detect the various vulnerabilities in web applications and then compare these scanners depending on results.
Last month a hacker breached Yahoo!'s security systems and acquired full access to certain Yahoo! databases, leading to full access on the server. Technically, this highlights the danger of SQLi. From a business perspective, we see the security problem posed third-party code.
Now-a-days the world of information era, we can get information just our single click by using Web
application. Web applications are popular due to the ubiquity of web browsers, and the convenience of
using a web browser as a client, sometimes called a thin client. It are playing a major role in this, every
organization are mapping their business from a room to the world with the help of these Web Application.
It consist of a three tier structural design where database is in the third pole, which is the most valuable
assets in any organization, as the adaptation of web applications are increases day by day, various attacks
are possible increasing day by day. An attack which is directly compromises the database that is most
threatening attack is called SQL injection. There are various Vulnerability scanners has been proposed to
deal with this attack, but none of them are able to detect SQLI completely. In my tools have the accuracy
ratio very less as well as they produce a high rate of false positive, apart from that all these tools take
much time to scan. To avoid these problem and detect SQL completely we are presenting a NVS that is
Network Based Vulnerability Scanner approach this provides a better coverage and with no false positive
with a short span of time.
Recent hacks of major international and regional banks have occurred due to exploits from the following vulnerabilities:
1. Cross-Site Scripting (XSS) vulnerability using redirects
2. Local File Inclusion (LFI) vulnerability
3. Cross-Site Request Forgery (CSRF) vulnerability
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
IJERA (International journal of Engineering Research and Applications) is International online, ... peer reviewed journal. For more detail or submit your article, please visit www.ijera.com
The Web AppSec How-To: The Defender's ToolboxCheckmarx
Web application security has made headline news in the past few years. In this article, we review the various Web application security tools and highlight important decision factors to help you choose the application security technology best suited for your environment.
A Multidimensional View of Critical Web Application Security Risks: A Novel '...Cognizant
An actionable guide for website application developers to successfully ward off threats to vulnerabilities in a range of functionalities: user authentication, payment records, cross-site scripting, search, registration, file loading and privilege escalation.
Injecting Security into Web apps at Runtime WhitepaperAjin Abraham
This paper discusses the research outcomes on implementing a runtime application patching algorithm on an insecurely-coded application to protect it against code injection vulnerabilities and other logical issues related to web applications, and will introduce the next generation web application defending technology dubbed as Runtime Application Self-Protection (RASP) that defends against web attacks by working inside your web application. RASP relies on runtime patching to inject security into web apps implicitly without introducing additional code changes. The talk concludes with the challenges in this new technology and gives you an insight on future of runtime protection.
Study of Cross-Site Scripting Attacks and Their CountermeasuresEditor IJCATR
In present-day time, most of the associations are making use of web services for improved services to their
clients. With the upturn in count of web users, there is a considerable hike in the web attacks. Thus, security becomes
the dominant matter in web applications. The disparate kind of vulnerabilities resulted in the disparate types of attacks.
The attackers may take benefit of these vulnerabilities and can misuse the data in the database. Study indicates that
more than 80% of the web applications are vulnerable to cross-site scripting (XSS) attacks. XSS is one of the fatal
attacks & it has been practiced over the maximum number of well-known search engines and social sites. In this paper,
we have considered XSS attacks, its types and different methods employed to resist these attacks with their
corresponding limitations. Additionally, we have discussed the proposed approach for countering XSS attack and how
this approach is superior to others.
The following slides present an
application security checklist — a look at how your company can counter the
impact of seven top application security threats.
Base Paper Abstract:
Most web applications have critical bugs (faults) affecting their security, which makes them vulnerable to attacks by hackers and organized crime. To prevent these security problems from occurring it is of utmost importance to understand the typical software faults. This paper contributes to this body of knowledge by presenting a field study on two of the most widely spread and critical web application vulnerabilities: SQL Injection and XSS. It analyzes the source code of security patches of widely used web applications written in weak and strong typed languages. Results show that only a small subset of software fault types, affecting a restricted collection of statements, is related to security. To understand how these vulnerabilities are really exploited by hackers, this paper also presents an analysis of the source code of the scripts used to attack them. The outcomes of this study can be used to train software developers and code inspectors in the detection of such faults and are also the foundation for the research of realistic
vulnerability and attack injectors that can be used to assess security mechanisms, such as intrusion detection systems, vulnerability scanners, and static code analyzers.
http://kaashivinfotech.com/
http://inplanttrainingchennai.com/
http://inplanttraining-in-chennai.com/
http://internshipinchennai.in/
http://inplant-training.org/
http://kernelmind.com/
http://inplanttraining-in-chennai.com/
http://inplanttrainingchennai.com/
Devoid Web Application From SQL Injection AttackIJRESJOURNAL
ABSTRACT: The entire field of web based application is controlled by the internet. In every region, World Wide Web is hugely necessary. So, network assurance is badly assuring job for us. Several kind of attacker or application programmer is attempting to split the immunity of information and destroy the instruction composed in the database. The SQL Injection Attack is very large safety measure risk in that present day. The indicated attacks allow to attacker’ s unlimited access from the database or still authority of database those determine web based application. That manages conscious and secret records and put the injurious SQL query put to modify the expected function. Many database reviewer and theorist give distinct concept to avoid regarding SQL Injection Attack. But no one of the concept is completely adaptable to. This research introduces a latest framework to protecting web based application from the SQL Injection Attack. Introduced framework i.e. present in this research is based on two techniques known as SQM (SQL Query Monitor) and Sanitization Application. That is the two ways filter program which analyses the user query and generate a separate key for user before it is sent to the application server. Several aspects of SQL Injection Attack are also discussed in that research.
Web Vulnerabilities And Exploitation - Compromising The WebZero Science Lab
One of the main problems of all big companies is how their applications are secured from cyber attacks. New types of vulnerabilities and attack vectors are being developed every day, therefore they pose a potential threat to all applications that rely on some kind of web technology. This document explains the most common and most dangerous web attacks as well as techniques how to secure your infrastructure from being compromised. We focus on SQL injections, XSS, CSRF, RFI/LFI and Server Side Includes. We discuss the attack vectors of web vulnerabilities and exploitation schemas. However, regardless of the security measures taken and defenses being deployed, there will always be a way in. Nevertheless, security analysis provide a valuable insight that can grant the advantage over said attackers and allow us to stay one step ahead.
Sql Injection Attacks And A Web Application Environment
A26001006
1. Padmaja K / International Journal of Engineering Research and Applications (IJERA) ISSN:
2248-9622 www.ijera.com Vol. 2, Issue 6, November- December 2012, pp.001-006
A Study on web Applications & Protection against Vulnerabilities
Padmaja K
Abstract
Web applications are widely adopted and application vulnerabilities have sharply increased.
their correct functioning is mission critical for For example, in the last two years, the three top
many businesses. Online banking, emails, e- positions in the annual Common Vulnerabilities and
shopping, has become an integral part of today’s Exposures (CVE) list published by Mitre [3] were
life. Vulnerabilities in web application can lead to taken by web application vulnerabilities. To
a variety of erroneous behavior at dynamic run identify and correct bugs and security
time. We encounter the problem of forceful vulnerabilities, developers have a variety of testing
browsing in many web applications, username tools at their disposal. These programs can be
enumeration can help an attacker who attempts broadly categorized as based on black-box
to use guessable passwords, such as test/test, approaches or white-box approaches. White-box
admin/admin, guest/guest, and so on. These testing tools, such as those presented in [1] use static
accounts are often created by developers for analysis to examine the source code of an
testing purposes, and many times the accounts application. They aim at detecting code fragments
are never disabled or the developer forgets to that are patterns of instances of known vulnerability
change the password, hacking reduces the classes [2]. Since these systems do not execute the
performance or function of the application, application, they achieve large code coverage, and,
further more, the modified system itself becomes in theory, can analyze all possible execution paths
a constraint to counter newer types of [4]. A drawback of white-box testing tools is that
vulnerabilities that may crop up from time to each tool typically supports only very few (or a
time. Hence, the best solution would be to finds single) programming language. A second limitation
the steps to solve that are web-based (firewall) is the often significant number of false positives.
independent for protecting against vulnerabilities Since static code analysis faces undecidable
in web applications. In our work algorithm is to problems, approximations are necessary. Especially
analyze vulnerabilities that are caused by for large software applications, these approximations
breaking of the data dependency using problem can quickly lead to warnings about software bugs
which work efficient with existing one. that do not exist [5].
Attacks against Web applications come in a
Keywords – Web Application, Vulnerabilities, variety of forms, but it is important to understand
Forceful browsing, Testing, Dynamic Testing that viewing Web application security with merely
an attack-verses-vulnerability perspective results in
INTRODUCTION I an overly narrow focus. Studies such as conducted
Web applications are collections of static by Erickson and Howard reinforce the point that the
files linked with each other by means of HTML overall security posture of a Web application
references. With this dynamic feature was depends on a variety of factors such as proper
traditionally implemented by CGI scripts were added configuration, continuity within application logic
to web page to accept the user input, changing and workflow, as well as factors such as competent
presentation and content of the pages accordingly. administration and observance to security policies on
Currently more often web sites are created the part of corporations that own and manage
dynamically, to send the sites content is stored in application data. Several organizations have
database entries and present them to the user. While published lists of the top categories of Web
in the beginning user interaction was typically application vulnerabilities, notably the OWASP Top
limited to simple request-response pairs, web 107 and the WASC Threat Classification8.
applications today often require a multitude of However, each list differs both in the level of
intermediate steps to achieve the desired results. abstraction and types of Web application
When developing software, an increase in vulnerabilities included among its top threats. The
complexity typically leads to a growing number of Cenzic Intelligent Analysis (CIA) Lab uses its own
bugs. Of course, web applications are no exception. framework for classifying the top vulnerability threat
Moreover, web applications can be quickly deployed classes, the methodology having been derived from
to be accessible to a large number of users on the its proprietary HARM system, the Hailstorm®
Internet, and the available development frameworks Application Risk Metric (ARC™), which is
make it easy to produce (partially correct) code that explained in detail later in this document. Analysis
works only in most cases. As a result, web provided below will show vulnerability information
from all three categories, for comparative purposes,
1|Page
2. Padmaja K / International Journal of Engineering Research and Applications (IJERA) ISSN:
2248-9622 www.ijera.com Vol. 2, Issue 6, November- December 2012, pp.001-006
so that organizations using any one of the threat An attacker user input control e.g enter
classification systems will have Q1 2007 data related ,;DROP („articles‟);
to the methodology they are presently using. Adds a command to the SQL query which then
becomes:
SECTION II
2. Software vulnerabilities: vulnerabilities occurs SELECT * FROM articles WHERE id=‟
in different ways hardware, sites, software, „;DROP(„articles‟);‟;
organizations, we focusing on software in input
validation errors such as These SQL commands will select some
data, delete the table articles in the database and then
2.1. Format String: The Format String exploit generate an SQL error due to the single quotation
occurs when the submitted data of an input string is mark. SQL injection gives an attacker the
evaluated as a command by the application. In this opportunity to manipulate the database and in
way, the attacker could execute code, read the stack, special cases execute arbitrary code on the database
or cause a segmentation fault in the running server. It is therefore an effective attack on web
application, causing new behaviors that could applications. Typical attack are logins, search forms
compromise the security or the stability of the and the URL of dynamically generated pages e.g
system. http://vulnerableSite.com/article?id=42 could result
To understand the attack, it‟s necessary to in a SQL query similar to the one in the example.
understand the components that constitute it. SQL injection can be avoided through user input
• The Format Function is an ANSI C conversion validation, ensuring appropriate handling of
function, like printf, fprintf, which converts a characters with a special meaning in SQL.
primitive variable of the programming language
into a human-readable string representation. 2.3. Cross-site Scripting: The main purpose of
• The Format String is the argument of the Format cross-site scripting is a XSS attacks [5]. To steal the
Function and is an ASCII Z string which contains credentials i.e cookies of an authenticated user.
text and format parameters, like: printf ("The .request in the web contains an authentication cookie
magic number is: %dn", 1911); is treated by the server as a request of the
• The Format String Parameter, like %x %s defines corresponding user as long as does not explicitly log
the type of conversion of the format function. out. Everyone who manages to steal cookies is able
to impersonate its owner for the current sessions.
The attack could be executed when the The browser automatically sends a cookie only to
application doesn‟t properly validate the submitted the web sites that created it, but with JavaScript
input. In this case, if a Format String parameter, program are restricted by the same origin policy.
like %x, is inserted into the posted data, the string is XSS attacks circumvent the same –origin policy by
parsed by the Format Function, and the conversion injecting malicious java script into the output of
specified in the parameters is executed. However, vulnerable applications. In this case, the malicious
the Format Function is expecting more arguments as code appears to originate from the trusted site and
input, and if these arguments are not supplied, the thus, has complete access to all (sensitive) data
function could read or write the stack. related to this site. For example, consider the
If the application uses Format Functions in the following simple PHP script, where a user‟s search
source-code, which is able to interpret formatting query is displayed after submitting it:
characters, the attacker could explore the
vulnerability by inserting formatting characters in a echo "You searched for " . $_GET[’s’];
form of the website. For example, if the printf The user‟s search query is retrieved from a
function is used to print the username inserted in GET parameter. Therefore, it can also be supplied in
some fields of the page, the website could be a specifically crafted URL such as the following,
vulnerable to this kind of attack, as showed below: which results in the
printf (username); user‟s cookie being sent to
“evilserver.com”:
2.2. SQL Injection: It have more severe http://vulnerable.com/post.php?s=<script>d
consequences than XSS due to the fact that a ocument.location
successful SQL injection can comprise the integrity =‟evilserver.com/steal.php?‟+document.
of a database. Vulnerable in web application is a Cookie</script>
SQL injection if unvalidated user input is used to
generate SQL queries . typical SQL query used to All that the attacker has to do is to trick a
generate dynamic web pages user into clicking this link, for example, by sending
it to the victim via email. As soon as the user clicks
SELECT * FROM ARTICLES on this link, her browser visits the page post.php on
WHERE id=‟<user input>‟ the vulnerable site, with the GET parameter “s” set
2|Page
3. Padmaja K / International Journal of Engineering Research and Applications (IJERA) ISSN:
2248-9622 www.ijera.com Vol. 2, Issue 6, November- December 2012, pp.001-006
to the malicious JavaScript code. As a result, the can deface web sites, poison cache and trigger cross-
malicious code is embedded in the application‟s site scripting.
reply page, and now has access to the user‟s cookie. Normally,
The JavaScript code sends the cookie to the attacker, http://www.mysite.com/test/default.aspx?text=esiu
who can now use it to impersonate the victim. The sets the cookie
particular type of XSS vulnerability discussed above //Query parameter text is not checked before saving
is called reflected XSS, in user cookie
since the attacker‟s malicious input is NameValue collection request =
immediately returned (i.e., reflected) to the victim. RequestQuerystring:
There also exists a second type of XSS, where the //Adding cookies to the response
application first stores the input into a database or Response.Cookies[“UserName”]Value=request[“tex
the file system. At a later stage, the application t”];
retrieves this data through database queries or files Set-Cookie header is used in HTTP response to
reads, and finally sends it to the victim. For instance, request browser to save a cookie, %0D%0A is a new
such stored XSS vulnerabilities often occur in web line character
guest books or forums, where a visitor leaves a On a HTTP response encoded by URL encoding,
comment that is later accessed by another visitor. In this is usually represented as “rn” in code.
general, an XSS vulnerability is present in a web
application if malicious content (e.g., JavaScript) 2.5. HTTP Response Splitting: attack involved in
received by the application is not properly stripped 3 types
from the output sent back to a user. When speaking Web server which has a security hole
in terms of the sketched class of taint-style enabling HTTP Response splitting
Vulnerabilities, XSS can be roughly described by the Target – Entity that interacts with the web
following properties: server perhaps on behalf of the attacker. Typically
this is a cache server forward/reverse proxy or
• Entry points into the program: GET, browser attacker which initiates the attack.
POST and COOKIE arrays.
• Sanitization routines: PHP functions such 2.6. Forceful Browsing: Forceful browsing is
as htmlentities () and htmlspecialchars (), making several requests to the web server with the
and type casts that destroy potentially malicious URL patterns of typical web application components
characters or transform them into harmless ones such as CGI programs. The common with many of
(such as casts to integer). the exploits is that lack of server side validation
• Sensitive sinks: All routines that display makes them possible. Client side validation doesn‟t
data on the screen, such as echo(), print() and provide real protection as it is always possible to
printf(). create a custom user agent or use an intermediary
This tool can only handle reflected XSS tool. These attacks against web[9] applications are
vulnerabilities. However, it is straight forward to use that there are so many things can do wrong.
it for the detection of stored XSS as well, given a
certain program policy with regard to the taint status
of persistently stored data. For instance, it is SECTIONIII
customary that data is not sanitized before it is 3. Problem definition: Today‟s life hectic with our
stored to a database or to the file system, which schedules we go for online banking, emails, chats, e-
means that it has to be sanitized after its later shopping become an integral part. Thus web-based
retrieval. In the System, this can be modeled by techniques are widely adopted and their correct
adding the corresponding data retrieval functions to functioning is mission critical for many business
the set of entry points. Analogously, the applications, vulnerabilities are readily exploited by
application‟s policy can demand that all data is attackers. Unfortunately software failures occur to
sanitized before it is stored. In this case, data storage reduce system availability and efficiency of the
functions have to be defined as sensitive sinks. system as a whole. Here we have method to solve
Mixed policies are more difficult to handle. For the vulnerabilities.
instance, an application could expect a certain
database table to contain only sanitized values,
whereas some other table might also be allowed to
contain unsanitized values. Here, the analysis would
also have to resolve the names of the tables that are
used for storage and retrieval.
2.4.HTTP Header Injection: It allows attackers to
split a HTTP response into multiple ones by
injecting malicious response HTTP headers. This Figure 1. User Login Screen
3|Page
4. Padmaja K / International Journal of Engineering Research and Applications (IJERA) ISSN:
2248-9622 www.ijera.com Vol. 2, Issue 6, November- December 2012, pp.001-006
email files. Depending upon the program we are
using, often can configure the automatic update for
virus signatures.
3.2.4. Do Not Unsubscribe: If we receive
unsolicited email do not click to unsubscribe to the
list as it could contain malware or lead you to a
website that is infected with malware. Simply delete
the unsolicited message or if it ended up in your
spam folder, clear the folder altogether.
Username enumeration can help an attacker
who attempts to use some trivial usernames with 3.2.5. Administrator: Avoid running email client
easily guessable passwords, such as test/test, under administrator privileges. If this is not possible,
admin/admin, guest/guest, and so on. These accounts try to restrict the privileges while logged on as
are often created by developers for testing purposes, administrator. The administrator privileges can open
and many times the accounts are never disabled or up your email clients to exploits by a hacker.
the developer forgets to change the password.
During testing assignments, have found such 3.2.6Attachments: Make sure attachments are
accounts are not only common and have easily scanned by your antivirus program before you open
guessable passwords, but at times they also contain them. Most antivirus programs contain this feature
sensitive information like valid credit card numbers, and will let you know if there is a threat of a virus
passport numbers, and so on. Needless to say, these before you open the attachment.
could be crucial details for social engineering
attacks. 3.2.7. Receipts and Confirmations: Configure the
settings in email client so it does not automatically
3.1. Email Vulnerabilities: Email is one of the most send return receipts or read confirmations. If an
widely used applications on the Internet due to its email is infected automatically opening or sending a
convenience, cost effectiveness, and time saving message could spread the infection to the recipient's
ability. Because of its ubiquitous capability it can be email client.
left open to many different types of vulnerability.
3.2.8.Use Encryption: To ensure that confidential
There are multiple ways that hackers can information is secure, use encryption for sending
attack your email clients. Some of these methods these types of messages.
include distribution of malware such as spyware,
adware, Trojans, and viruses, to name a few types. 3.3. Protect from Web Vulnerabilities: All the
Other attacks on your email client can include Consequences of the most common web application
phishing, spam that is laced with malware, and security vulnerabilities we present a basic methods
denial of service attacks which are the result of to protect against these vulnerabilities to secure
sending a massive amount of messages to a server coding security program
causing it to crash. Attacks can also cause a lot of
damage to your other applications, data, and 3.3.1Inject flaws: Injection occurs when user-
ultimately the PC operating system itself. supplied data is sent to an interpreter as part of a
query. The attackers hostile data tricks the
3.2. Protect from email vulnerabilities: Our interpreter into executing unintended queries or
computer operating system is used as a platform for changing data.
email client. Regardless of what type of client we
use such as Microsoft Outlook, Outlook Express, 3.3.2. Malicious File Execution: Code vulnerable to
Eudora, or other, there are steps we can take to remote file inclusion allows attackers to include
protect email client against vulnerabilities hostile code and data resulting in devastating attacks
such as total server compromise malicious file
3.2.1. Plain Text: When checking our email execution attacks affect PHP, XML and any
message, use plain text format instead of formats framework which accepts filenames or files from
such as HTML or rich text format that can open up users
email client to vulnerabilities hackers to exploit.
3.3.3. Insecure Direct Object: A direct object
3.2.2. Automatic Updates: Always use the latest reference occurs when a developer exposes a
version of the mail client software and make sure reference to an internal implementation object, such
you have the automatic update feature enabled. as a file directory database record or key as a URL
or form parameter. Attacker can manipulate those
3.23.3.Antivirus Software: Use antivirus software
that includes a virus signature for monitoring your
4|Page
5. Padmaja K / International Journal of Engineering Research and Applications (IJERA) ISSN:
2248-9622 www.ijera.com Vol. 2, Issue 6, November- December 2012, pp.001-006
references to access other objects without [3] If (P=Ti) then {
authorization. - Add 1 to match_count;
- Declare „Safe Query‟;
3.3.4. Cross Site Request Forgery: A CSRF attack - Exit; }
forces a logged-on victim‟s browser to send a pre- [4] End if;
authenticated request to a vulnerable web application [5] End For Loop;
which forces the victim‟s browser to perform a [6] If (match_count=0) then {
hostile action to the benefits of the attacker CSRF - Declare „Attack Alarm I‟;
can be as powerful as the web application that it - Call Approximate Matching; }
attacks [7] Stop;
Approximate Matching
3.3.5 Information Leakage & improper Error: Input : T, P, W
Applications can unintentionally leak information Output: Safe Query, Attack Alarm Final
about their configuration internal workings or violate [1] k = element_count(P);
privacy through a variety of application problems. [2] For i = 1 to n do {
Attackers use this weakness to steal sensitive data or [3] For j = 1 to k do {
conduct more serious attacks. [4] If (P[j] c T[i][j]) then
[5] D[i] b D[i] + 1 ;
3.3.6. Broken Authentication session [6] Enf if ; } }
Management: Account credentials and session [7] Edit_Distance b 0 ;
tokens are often not properly protected. Attackers [8] For i = 1 to n do {
compromise passwords keys or authentication [9] Edit_Distance = MIN (D[i]); }
tokens to assume other users identities. [10] If (Edit_Distance < W) then {
- Declare „Safe Query‟ ;
3.3.7. Insecure Cryptographic Storage: Web - Execute P; }
applications rarely use cryptographic functions [10] Else {
properly to protect data and credentials. Attackers [11] - Declare „Attack Alarm Final‟ ;
use weakly protected data to conduct identity theft [12] - Block P; }
and other crimes such as credit card fraud [13] End if;
[14] Stop;
3.3.8. Insecure Communications: Applications
frequently fail to encrypt network traffic when it is 4.2. Dynamic Analysis for vulnerabilities in web
necessary to protect sensitive communications. applications:
In context of web applications, static
3.3.9. Failure to restrict URL access: frequently an approaches have limited potential because, web
application protects sensitive functionality by applications are often written in dynamic scripting
preventing the display of links or URLs to languages that enables on fly creation of code the
unauthorized users. Attackers can use this weakness issue pose significant challenges to approaches
to access and perform unauthorized operations by based on static analysis. Testing of dynamic Web
accessing those URLs directory applications is also challenging because the input
space is large and applications typically require
SECTION IV multiple user interactions. The state of the practice
4.1. Algorithms for Detecting vulnerabilities: in validation for Web standard compliance of real
Content of text SQLMF are a set of n number of Web applications involves the use of programs such
legitimate SQL queries (where, 1≤ n). Each query is as HTML Kit5 that validate each generated page, but
expressed as a sequence of elements {s1, s2,.., sn`}. require manual generation of inputs that lead to
Each element is a string of characters. The text Dynamic Analysis Testing Tools
pattern (P) of the dynamic query, is expressed as one
or more elements {s`1,s`2,.. s`n}, where, 1≤ n. An 4.2.1. DART: (directed automated random testing)
element may have one or more sub elements, integration of random testing and dynamic test
identifiers and values. A function element count(P) generation using symbolic reasoning is best
computes the number of elements in P. Each element intuitively explained with an example.
is separated from others by semicolon (;).
Consider the function h in the file below:
Exact Matching int f(int x) f return 2 * x; g
Input : T, P int h(int x, int y) {
Output: Safe Query, Attack Alarm I if (x != y)
[1] match_count <- 0; if (f(x) == x + 10)
[2] For i= 1 to n do abort(); /* error */
Begin return 0;}
5|Page
6. Padmaja K / International Journal of Engineering Research and Applications (IJERA) ISSN:
2248-9622 www.ijera.com Vol. 2, Issue 6, November- December 2012, pp.001-006
The function h is defective because it may [2] Appending “~” or back or old to GCI
lead to an abort statement for some value of its input names may send back an older version of
vector, which consists of the input parameters x and the source code. For example
y. Running the program with random values of x and www.xxx.com/cgi-bin/admin.jsp~ returns
y is unlikely to discover the bug. The problem is admin.jsp source code. Here hacking
typical of random testing: it is difficult to generate attempts that every serious business
input values that will drive the program through all application should be able
its different execution paths. In contrast, DART is [3] B. Beizer. Software Testing Techniques.
able to dynamically gather knowledge about the Van Nostrand Reinhold, 1990.
execution of the program in what we call a directed [4] Burp Spider. Web Application Security.
search. Starting with a random input, a DART- http://portswigger.net/spider/, 2008.
instrumented program calculates during each [5] Acunetix. AcunetixWeb Vulnerability
execution an input vector for the next execution. Scanner. http://www.acunetix.com/, 2008.
[6] D. Balzarotti, M. Cova, V. Felmetsger, N.
4.2.2. Apollo: Apollo first executes the Web Jovanov, E. Kirda, C. Kruegel, and G.
application under test with an empty input. During Vigna. Saner: Composing Static and
each execution, Apollo monitors the program to Dynamic Analysis to Validate Sanitization
record path constraints that reflect how input values in Web Applications. In IEEE Security and
affect control flow. Additionally, for each execution, Privacy Symposium, 2008.
Apollo determines whether execution failures or [7] Karl Forster, Lockstep Systems, Inc., “Why
HTML failures occur (for HTML failures, an HTML Firewalls Fail to Protect Web Sites,”
validator is used as an oracle). Apollo automatically http://www.lockstep.com/products/
and iteratively creates new inputs using the recorded webagain/why-firewalls-fail.pdf, 2007.
path constraints to create inputs that exercise [8] I. Ristic, “Web Application Firewalls
different control flow. Most previous approaches for Primer,” (IN)SECURE, vol. 1, no. 5, pp. 6-
concolic execution only detect “standard errors” 10, Jan. 2006.
such as crashes and assertion failures. This approach [9] Shah, Shreeraj. Hacking Web Services.
detects such standard errors as well as uses an oracle 2007.
which are interactively supplied by the user (e.g., by
clicking buttons in generated HTML pages).
Padmaja K pursuing Ph.D from
CONCLUSION V JNTU Kakinada. M.Tech(CSE) from
Our work have presented an approach to JNTU Kakinada. She is having 10
improve the best functionality web applications by years of experience in Academics.
the absence of runtime errors, dynamically proposed Has guided many UG & PG students.
solution prevent due to data dependencies on session Her research areas include Software
data. Algorithm combines to develop program Engineering, Software Security
annotation verification and validation checking to
protect against broken data dependencies in web
applications. In addition, the proposed solution is
interoperable with the existing web infrastructure
and does not interfere with other web security
solutions. Moreover, the proposed solution is able to
leverage the power of existing web security by
providing formal techniques guarantee to prove the
absence of broken data dependencies in a given web
protocol enforcement configuration. To the best of
our knowledge, the research presented in this paper
is the first to improve web application security by
providing an appropriate solution to the specific
problem of broken data dependencies on session
data.
References
[1] A registration page had an an HTML
comment mentioning a file named “
_private/customer.txt”typing
http://www.xxx.com/_private/customer.txt
sent back all customers information
6|Page