Developing a Security Typed Java Servlet

Business services are increasingly dependent upon Web applications. Whereas URL-based access control is one of the most prominent and pervasive security mechanism in use, failure to restrict URL accesses is still a major security risk. We argue that this risk can be mitigated by providing formal analysis tools to evaluate access control policies as well as the impact of changes on configurations. In order to tackle this issue, this paper gives a formal semantics for access control constraints standardized in the J2EE Java Servlet Specification, arguably one of the most common framework for web applications. Two different analysis tools are developed on top of this formal building block: a decision engine and a comparison algorithm for change impact of access control configurations. The formal semantics is compared against two major web application containers. The experiments reveal non-compliant access control decisions of these containers and validate our approach.

International Journal of Internet Technology and Secured Transactions

The security of web applications is an important issue for any organisation that deploys its own websites. If an organisation takes the required precautions and countermeasures, it can prevent the possible attacks. Otherwise, its critical data, reputation and credibility will be at risk. Nowadays, firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS) provide security at the network layer. However, more than 70% of present world's security attacks exploit the vulnerabilities at the application level. Cross-site scripting, SQL injection, cookie poisoning and forceful browsing are some of the most common website vulnerabilities. Stringent user input validation, proper session management, and exploitation of web application firewalls, etc., can be used as countermeasures to combat the attacks on websites. In this paper, we discuss how attackers can exploit the vulnerabilities of web applications and how we can implement effective countermeasures to secu...

Doaa Hassan Salem, 2008

This paper focuses on the different challenges to design a security typed web scripting language. It uses the type system approach on a simple imperative language that captures a subset of the security typed web language constructs to express the security properties that must be held in the language with respect to its formal semantics to prevent insecure information flow in web application system and hence the common web application security vulnerabilities.

2017

Internet users and its usage have grown almost exponentially during last decade. Most of the web applications contain both private(sensitive) and public information in theircorresponding database that brings the security of private information on the forefront of the challenge of this domain. Cyber criminals can attempt to stealor tamperwith private information from these insecure or vulnerable web applications by exploiting. In this paper, we have analyzed different approaches of web application security used in current practices since their development such as secure coding, Web Application firewall, vulnerability assessment and penetration testing. In addition, we have also discussed various approachesand repositories which support vulnerability assessment and penetration testing processes.

VIII INTERNATIONAL ANNUAL CONFERENCE “INDUSTRIAL TECHNOLOGIES AND ENGINEERING” (ICITE 2021)

Web Application Development has shown progressive and rapid growth using various techniques. Nonetheless, web application security is a major component in web development that is often overlooked or not properly focused on. Due to ad hoc existence and poor code written, most available web applications are vulnerable and desirable target for the attackers. To alleviate this issue, the use of defensive programming basic technique allows the developers to develop secure applications. Defensive programming includes validate output and correctly manages error messages. This avoids the misuse of snippets and builds the program in a consistent way despite unpredictable inputs. The purpose of this paper is twofold. Firstly, this paper discussed the development of a web application program using PHP as server-side scripting exploiting defensive programming techniques to overwhelm web application vulnerabilities. Secondly, this paper examined common vulnerabilities of web application risks refer to Open Web Application Security Project to validate the effectiveness of defensive programming technique. The work presented in this paper shall be a fundamental guideline for the development of secure web-based applications. ANATOMY OF WEB DEVELOPMENT Web application are relied upon by many services, as it constantly requires communicating with databases and back-end services so that information could be presented to end user via a browser. Furthermore, most of the web application have multiple of services running in a background so it can cope with user's requirements and requests. There are three components needed to build up a web application which are web browser, application server and database server. For a dynamic web application, data need to be store in database. For database server, there are multiple type of relational database management system (RDMS) available for managing data of the web application. It includes MySQL, Oracle Database or Microsoft SQL Server. Different type of RDMS used need a different type of configuration and programming skills. Moreover, in today technology, developers are allowing to choose lots of available scripting language for a development of web application. However, developers usually need to focus only two type of scripting language during development of web application.

International Journal of Computer and Communication Technology, 2017

The recent development in the field of Web system technology has transformed the software industry radically by integrating a wide range of web users, vendors, and enterprise applications worldwide. In Web-based system, a security requirement is a critical issue. This difficulty is due to the complexity level of such systems as well as their variety and increasing distribution. The World Wide Web has become a highly adopted platform for web system. In order to avoid the high impacts of software vulnerabilities, it is necessary to specify security requirements early in the development on a detailed level and it needs to be built into the application design up-front by explicitly stating the security approach. A current web system faces major security problems because security design is not integrated into the Web Engineering Development Process. Due to insufficient support for a concrete and assessable level the application security and the software security is invaded. This paper em...

2008

SQL Injection Attacks are a relatively recent threat to the confidentiality, integrity and availability of online applications and their technical infrastructure, accounting for nearly a fourth of web vulnerabilities . In this paper based on a master thesis [2], and numerous references therein, we present our study on the prevention of SQL Injections: overview of proposed approaches and existing solutions, and recommendations on preventive coding techniques for Java-powered web applications and other environments. Then, we review McClure's SQL DOM [3] approach for the prevention of SQL Injections in object-oriented applications. We also present our solution for Java-based online applications, SQLDOM4J, which is freely based on the SQL DOM but attempts to address some of our criticisms toward it, and evaluate its performance.

Journal of Software, 2009

2012

Web application security is a critical issue. Security concerns are often scattered through different parts of the system. Aspect oriented programming is a programming paradigm that provides explicit mechanisms to modularize these concerns. In this paper we present a technique for detecting and preventing common attacks in web applications like Cross Site Scripting (XSS) and SQL Injection using an aspect oriented approach by analyzing and validating user input strings. We use an aspect to capture input strings and compare them to predefined patterns. The intrusion detection aspect is implemented in AspectJ and is woven into the target system. The resulting system has the ability to detect malicious user input and prevent SQL Injection and Cross Site Scripting. We present an experimental evaluation by applying it to an insecure web application. The results of our tests show that our technique was able to detect all the attempted attacks without generating any false positives.

TJPRC, 2014

There are many reasons why Java is so popular and some of the reasons are javas’ strongly supports features. These features have made Java the first application language of the World Wide Web. The main aim had to make java simple, portable and reliable.