Mapping software faults with web security vulnerabilities

International Journal of Computer Applications, 2018

Software security vulnerability is a flaw in a software product that could compromise the integrity, availability, or confidentiality of a software system. The growth and development of software have brought about a corresponding increase in vulnerabilities, which has necessitated the need to develop software security assurance tool that can detect and prevent these vulnerabilities. Previous studies have suggested both commercial and open source tools such as Ashcan, Web Inspect, Web King, Skipfish, and OWASP ZAP just to mention but a few to help mitigate against this security gaps. However, each of this approach has its merits and demerits in detecting vulnerabilities. As a result, this paper seeks to develop a more proactive approach which is a merger or integration of the strength of existing techniques into one system: An integrated web vulnerability detector scanner: which is a software assurance tool for 1 / 4

www.internationaljournalssrg.org, 2017

Nowadays, for digitization mostly web applications are used. All Government Offices, Private sectors, Educational, Banking and E-Business also use web application, that's why the multiple user are also introduced. Web application are accessible and multiple user in worldwide, that's why the security of web application is important. The main concern of the security is required to study the vulnerabilities of the web application. This paper focuses on study and analysis of the multiple types of web application vulnerabilities for systematizing the existing techniques and promotes future research. The analysis and performance of multiple types of attack in web application vulnerabilities.

IT Professional, 2023

In this work, we define the notions of software bug, weakness, and vulnerability in the context of cybersecurity and elucidate their causal relations.

2014 International Conference on Circuits, Systems, Communication and Information Technology Applications (CSCITA), 2014

Unified WVA.

Proceedings of the International Conference on Dependable Systems and Networks, 2009

In this paper we propose a methodology to inject realistic attacks in web applications. The methodology is based on the idea that by injecting realistic vulnerabilities in a web application and attacking them automatically we can assess existing security mechanisms. To provide true to life results, this methodology relies on field studies of a large number of vulnerabilities in web applications. The paper also describes a set of tools implementing the proposed methodology. They allow the automation of the entire process, including gathering results and analysis. We used these tools to conduct a set of experiments to demonstrate the feasibility and effectiveness of the proposed methodology. The experiments include the evaluation of coverage and false positives of an Intrusion Detection System for SQL Injection and the assessment of the effectiveness of two Web Application Vulnerability Scanners. Results show that the injection of vulnerabilities and attacks is an effective way to evaluate security mechanisms and tools.

… , Network, and Information …, 2006

The security vulnerabilities in software systems can be categorized by either the cause or severity. Several software vulnerabilities datasets for major operating systems and web servers are examined. The goal is to identify the attributes of each category that can potentially be exploited for enhancing security. Linking a vulnerability type to a severity level can help us prioritize testing to develop more effective testing plans. Instead of using an ad hoc security testing approach, testing can be directed to vulnerabilities with higher risk. ...

SQL injection and cross-site scripting are two of the most com-mon security vulnerabilities that plague web applications today. These and many others result from having unchecked data input reach security-sensitive operations. This paper describes a language called PQL (Program Query Language) that allows users to declare to specify information flow patterns succinctly and declaratively. We have developed a static context-sensitive, but flowinsensitive information flow tracking analysis that can be used to find all the vulnerabilities in a program. In the event that the analysis gener-ates too many warnings, the result can be used to drive a model-checking system to analyze more precisely. Model checking is also used to automatically generate the input vectors that expose the vulnerability. Any remaining behavior these static analyses have not isolated may be checked dynamically. The results of the static analyses may be used to optimize these dynamic checks.

Nowadays web applications have critical logical holes (bug) affecting its security, Thus it makes application as vulnerable and easy to attack by hackers and organized crime. In order to prevent these security problems from occurrence of its maximum importance to understand the typical software faults. This paper contributes the knowledge of widely spread two critical web applications by presenting a field study on most of vulnerabilities like SQL Injection and XSS. By analyzing the security patches of source code which are widely used in web applications written in weak and strong typed languages. In order to understand the way in which these vulnerabilities are really exploited by hackers, and also provides an analysis of the source code of the scripts used to attack them. With the outcomes of this result and its study can be used to train code inspectors and software developers in the detection of such software faults, and also with that outcomes research for realistic vulnerability and attackers can be used to assess security mechanisms, like vulnerability scanners, intrusion detection systems, and static code analyzers. By using various number of software testing techniques tools various level of vulnerability are identified and recovery mechanisms were suggested

We live in a period of time where Information Security has gained much attention. The core purpose of the paper is to critically study and analyze the trends in information security as far as the Internet is concerned. To counter the ever rising rates of cyber-crimes, the researcher has come up with a system that scans any target website for the most highly exploited security loophole. The system is a web application that is mainly targeted towards web developers so as to reduce the burden of security mechanism enforcement on them, while developing web content. This, in turn, makes the web a much safer and secure place to exist.

2014

Testing Web applications for detection and fixing of vulnerabilities has become an indispensable task in web applications’ development process. This task often consumes a lot of time, efforts and other resources. The research community have devoted considerable amount of efforts to address this problem by proposing many techniques for automated vulnerabilities detection and fix generation for web application. Many of these techniques can reliably detect vulnerabilities and generate fix(es), which can be applied to the web application’s code, by the developer, for possible fixing of the vulnerabilities. Hence, the actual code modifications that fix the vulnerabilities is not automated and has to be carried out manually. To the best of our knowledge, none of the existing automated techniques is able to do this, and hence the actual fixing of the vulnerabilities is left for the human developer to handle. In this paper, we propose a novel framework for automatic vulnerabilities fixing f...