A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions
Source abstract
Abstract
The growing use of the internet has resulted in an exponential rise in the use of web applications. Businesses, industries, financial and educational institutions, and the general populace depend on web applications. This mammoth rise in their usage has also resulted in many security issues that make these web applications vulnerable, thereby affecting the confidentiality, integrity, and availability of associated information systems. It has, therefore, become necessary to find vulnerabilities in these information system resources to guarantee information security. A publicly available web application vulnerability scanner is a computer program that assesses web application security by employing automated penetration testing techniques that reduce the time, cost, and resources required for web application penetration testing and eliminates test engineers’ dependency on human knowledge. However, these security scanners possess various weaknesses of not scanning complete web applications and generating wrong test results. Moreover, intensive research has been carried out to quantitatively enumerate web application security scanners’ results to inspect their effectiveness and limitations. However, the findings show no well-defined method or criteria available for assessing their results. In this research, we have evaluated the performance of web application vulnerability scanners by testing intentionally defined vulnerable applications and the level of their respective precision and accuracy. This was achieved by classifying the analyzed tools using the most common parameters. The evaluation is based on an extracted list of vulnerabilities from OWASP (Open Web Application Security Project).
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Web Application Security Vulnerabilities · Security and Verification in Computing · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Electrical Engineering and Computer Science, National University of Sciences and Technology (NUST), Islamabad 44000, Pakistan
Paperlessly Pakistan, Islamabad 44000, Pakistan
Center of Excellence in Artificial Intelligence (CoE-AI), Department of Computer Science, Bahria University, Islamabad 44000, Pakistan
Institut Mines-Télécom, Télécom SudParis, CEDEX, 91011 Evry, France
References (58)
Show source-provided references
1. Ivanov, D., Kalinin, M., Krundyshev, V., and Orel, E. (2020, January 27–28). Automatic security management of smart infrastructures using attack graph and risk analysis. Proceedings of the 2020 Fourth World Conference on Smart Trends in Systems, Security and Sustainability (WorldS4), London, UK.10.1109/WorldS450073.2020.9210410 ↗
2. Jyothi, P.D., and Lakshmy, K. (2022). Vuln-Check: A static analyzer framework for security sarameters in Web. Soft Computing and Signal Processing, Springer.10.1007/978-981-16-1249-7_23 ↗
3. Bhorkar, G. (2022, April 12). Security Analysis of an Operations Support System. Available online: https://aaltodoc.aalto.fi/handle/123456789/29252.
4. The approaches to quantify web application security scanners quality: A review10.19101/IJACR.2018.838012 ↗
5. Holik, F., Horalek, J., Marik, O., Neradova, S., and Zitta, S. (2014, January 19–21). Effective penetration testing with Metasploit framework and methodologies. Proceedings of the 2014 IEEE 15th International Symposium on Computational Intelligence and Informatics (CINTI), Budapest, Hungary.10.1109/CINTI.2014.7028682 ↗
6. Stasinopoulos, A., Ntantogian, C., and Xenakis, C. (2015). Commix: Detecting and Exploiting Command Injection Flaws, Department of Digital Systems, University of Piraeus. White Paper.
7. Whitehat website security statistics report
8. Symantec (2022, April 12). Welcome to Integrated Cyber Defense. Available online: https://docs.broadcom.com/docs/integrated-cyber-defense-reference-guide.
9. Black box evaluation of web application scanners: Standards mapping approach
10. Web Performance Evaluation for Internet of Things Applications10.1109/ACCESS.2016.2615181 ↗
11. Black box and white box testing techniques—A literature review
12. OWASP (2022, April 12). Welcome to the OWASP Top 10—2021. Available online: https://owasp.org/Top10/.
13. OWASP (2022, April 12). OWASP Foundation. Available online: https://owasp.org/.
14. Araújo, R., Pinto, A., and Pinto, P. (2021, January 22–24). A performance assessment of free-to-use vulnerability scanners-revisited. Proceedings of the IFIP International Conference on ICT Systems Security and Privacy Protection, Oslo, Norway.10.1007/978-3-030-78120-0_4 ↗
15. Acunetiex (2019, April 12). Acunetix Web Vulnerability Scanner. Available online: https://www.acunetix.com/?ab=v1.
16. Tenable (2022, April 12). Nessus Vulnerability Scanner. Available online: https://www.tenable.com/products/nessus.
17. HP (2022, April 12). HP WebInspect. Available online: http://www.hp.com/hpinfo/newsroom/press_kits/2011/risk2011/HP_WebInspect_data_sheet.pdf.
18. IBM (2022, April 12). IBM AppScan. Available online: https://www.ibm.com/support/pages/sites/default/files/inline-files/$$$FILE/AppScanUserGuide_0.pdf.
19. Netsparker (2019, June 24). Netsparker Web Application Security Solution. Available online: https://www.invicti.com/.
20. DVWA (2019, June 24). Damn Vulnerable Web Application. Available online: https://dvwa.co.uk/.
21. Roy, S., Sharmin, N., Acosta, J.C., Kiekintveld, C., and Laszka, A. (2021). Survey and Taxonomy of Adversarial Reconnaissance Techniques. arXiv.10.1145/3538704 ↗
22. Doupé, A., Cova, M., and Vigna, G. (2010, January 8–9). Why Johnny can’t pentest: An analysis of black-box web vulnerability scanners. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Bonn, Germany.10.1007/978-3-642-14215-4_7 ↗
23. PortSwigger (2022, April 12). Burp Suite Scanner. Available online: https://portswigger.net/burp/vulnerability-scanner.
24. Web application vulnerability detection method based on machine learning
25. Vulnerabilities mapping based on OWASP-SANS: A survey for static application security testing (SAST)10.33166/AETiC.2020.03.001 ↗
26. A Survey on Detection and Prevention of Web Vulnerabilities
27. An OWASP top ten driven survey on web application protection methods10.1007/978-3-030-68887-5_14 ↗
28. An empirical comparison of commercial and open-source web vulnerability scanners10.1002/spe.2870 ↗
29. Aldeid (2022, April 12). WackoPicko. Available online: https://github.com/adamdoupe/WackoPicko.
30. Bau, J., Bursztein, E., Gupta, D., and Mitchell, J. (2010, January 16–19). State of the art: Automated black-box web application vulnerability testing. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Berleley/Oakland, CA, USA.10.1109/SP.2010.27 ↗
31. Parvez, M., Zavarsky, P., and Khoury, N. (2015, January 14–16). Analysis of effectiveness of black-box web application scanners in detection of stored SQL injection and stored XSS vulnerabilities. Proceedings of the 2015 10th International Conference for Internet Technology and Secured Transactions (ICITST), London, UK.10.1109/ICITST.2015.7412085 ↗
32. Suteva, N., Zlatkovski, D., and Mileva, A. (2013, January 18–21). Evaluation and testing of several free/open source web vulnerability scanners 2013. Proceedings of the 10th Conference for Informatics and Information Technology (CIIT 2013), Bitola, Macedonia.
33. Performance evaluation of web application security scanners for prevention and protection against vulnerabilities
34. A survey on assessment and ranking methodologies for user-generated content on the web10.1145/2811282 ↗
35. Kumar, M., Majithia, S., and Bhushan, S. (2016). An Efficient Model for Web Vulnerabilities Detection based on Probabilistic Classification. Int. J. Technol. Comput. (IJTC). Techlive Solut., 50–58. Available online: https://www.semanticscholar.org/paper/An-Efficient-Model-for-Web-Vulnerabilities-based-on-Kumar-Majithia/f09ddc0501358e234a5f8e9ebec359beb91db8f1.
36. Raj, G., Mahajan, M., and Singh, D. (2018, January 22–23). Security testing for monitoring web service using Cloud. Proceedings of the 2018 International Conference on Advances in Computing and Communication Engineering (ICACCE), Paris, France.10.1109/ICACCE.2018.8441734 ↗
37. Ahmed, M., Adil, M., and Latif, S. (2015, January 17). Web application prototype: State-of-art survey evaluation. Proceedings of the 2015 National Software Engineering Conference (NSEC), Rawalpindi, Pakistan.10.1109/NSEC.2015.7396339 ↗
38. Hasan, A., and Meva, D. (2018). Web Application Safety by Penetration Testing. Int. J. Adv. Stud. Sci. Res., 3, Available online: https://www.academia.edu/38248493/Web_Application_Safety_by_Penetration_Testing.
39. Assessment of Web Scanner Tools
40. InfoSec (2022, April 12). Introduction to the Nikto Web Application Vulnerability Scanner. Available online: https://resources.infosecinstitute.com/topic/introduction-nikto-web-application-vulnerability-scanner/.
41. Web application security assessment tools10.1109/MSP.2006.108 ↗
42. Fang, Y., Long, X., Liu, L., and Huang, C. (2018, January 16–19). DarkHunter: A fingerprint recognition model for web automated scanners based on CNN. Proceedings of the 2nd International Conference on Cryptography, Security and Privacy, Guiyang, China.10.1145/3199478.3199504 ↗
43. Alsaleh, M., Alomar, N., Alshreef, M., Alarifi, A., and Al-Salman, A. (2022, April 12). Performance-based comparative assessment of open source web vulnerability scanners. Secur. Commun. Netw., Available online: https://www.hindawi.com/journals/scn/2017/6158107.10.1155/2017/6158107 ↗
44. A comprehensive security assessment toolkit for healthcare systems
45. Black, P.E., Fong, E., Okun, V., and Gaucher, R. (2022, April 12). Software assurance tools: Web application security scanner functional specification version 1.0, Special Publication, Available online: https://www.govinfo.gov/content/pkg/GOVPUB-C13-4be4dc7c71623dd4fdc2be6167bc769e/pdf/GOVPUB-C13-4be4dc7c71623dd4fdc2be6167bc769e.pdf.
46. (2019, April 12). Introduction to AppScan Enterprise. Available online: https://www.ibm.com/docs/en/dsm?topic=guide-appscan-enterprise-scanner-overview.
47. (2022, April 12). OWASP Zed Attack Proxy Project. Available online: https://owasp.org/www-project-zap/.
48. (2022, April 12). Automated Audit Using WAPITI. Available online: https://owasp.org/www-community/Automated_Audit_using_WAPITI.
49. (2019, April 12). Wapiti—The Black Box Vulnerability Scanner for Web Applications. Available online: https://wapiti-scanner.github.io.
50. Web penetration testing using nessus and metasploit tool10.9790/0661-1634126129 ↗
51. (2019, April 12). Arachni, Web Application Security Scanner Framework. Available online: https://www.arachni-scanner.com/.
52. CIRT.net (2022, April 12). Nikto2. Available online: https://cirt.net/.
53. Geek, P. (2019, December 01). What is Burp Suite. Available online: https://portswigger.net/burp.
54. Tools, P.T. (2019, December 01). w3af Package Description. Available online: http://docs.w3af.org/en/latest/install.html.
55. Catakoglu, O., Balduzzi, M., and Balzarotti, D. (2017, January 3–7). Attacks landscape in the dark side of the web. Proceedings of the Symposium on Applied Computing, Marrakech, Morocco.10.1145/3019612.3019796 ↗
56. Doupé, A., Cavedon, L., Kruegel, C., and Vigna, G. (2012, January 8–10). Enemy of the state: A state-aware black-box web vulnerability scanner. Proceedings of the 21st USENIX Security Symposium (USENIX Security 12), Bellevue, WA, USA.
57. Sutton, M., Greene, A., and Amini, P. (2007). Fuzzing: Brute Force Vulnerability Discovery, Pearson Education.
58. McAllister, S., Kirda, E., and Kruegel, C. (2008, January 15–17). Leveraging user interactions for in-depth testing of web applications. Proceedings of the International Workshop on Recent Advances in Intrusion Detection, Cambridge, MA, USA.