WHAT IS WEB APPLICATION SECURITY?
Web application security is the process of protecting websites and online services against different security threats that exploit vulnerabilities in an application’s code. Common targets for web application attacks are content management systems (e.g., WordPress), database administration tools (e.g., phpMyAdmin) and SaaS applications.
Perpetrators consider web applications high-priority targets due to:
- The inherent complexity of their source code, which increases the likelihood of unattended vulnerabilities and malicious code manipulation.
- High value rewards, including sensitive private data collected from successful source code manipulation.
- Ease of execution, as most attacks can be easily automated and launched indiscriminately against thousands, or even tens or hundreds of thousands of targets at a time.
Organizations failing to secure their web applications run the risk of being attacked. Among other consequences, this can result in information theft, damaged client relationships, revoked licenses and legal proceedings.
Web application security remains a major roadblock to universal acceptance of the Web for many kinds of online transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities has been attributed to Web application bugs. In software engineering, software testing is an established and well-researched process for improving software quality. Recently, formal verification tools have also shown success in discovering vulnerabilities in C programs. In this chapter we shall discuss how to apply software testing and verification algorithms to Web applications and improve their security attributes. Two of the most common Web application vulnerabilities that are known to date are script injection, e.g., SQL injection, and cross-site scripting (XSS). We will formalize these vulnerabilities as problems related to information flow security—a conventional topic in security research. Using this formalization, we then present two tools, WAVES (Web Application Vulnerability and Error Scanner) and Web-SSARI (Web Application Security via Static Analysis and Runtime Inspection), which respectively utilize software testing and verification to deal in particular with script injection and XSS and address in general the Web application security problems. Finally we will present some results obtained by applying these tools to real-world Web applications that are in use today, and give some suggestions about the future research direction in this area.
As World Wide Web usage expands to cover a greater number of B2B (business-to-business), B2C (business-to-client), healthcare, and e-government services, the reliability and security of Web applications has become an increasingly important concern. In a Symantec analysis report of network-based attacks, known vulnerabilities, and malicious code recorded throughout 2003 [49], eight of the top ten attacks were associated with Web applications; and the report also stated that port 80 was the most frequently attacked TCP port. In addition to holding Web applications responsible for the sharp increase in moderately severe vulnerabilities found in 2003, the authors of the report also suggested that Web application vulnerabilities were by far the easiest to exploit. Web application insecurity is attributed to several factors. Firstly, the Web, which was initially designed as a data-delivery platform, has quickly evolved into a complex application platform on top of which more and more sophisticated applications have been developed. As a result, Web specifications have grown rapidly to meet rising demands, and browsers and Web-development languages fought a “feature war” to win market share. Unfortunately, security issues have been left as an afterthought. The fast-expanded features did help Web growth; however, many security side effects they induced have become today’s major concern for Web adoption. Secondly, since software vendors are becoming more adept at writing secure code and developing and distributing patches to counter traditional forms of attack (e.g., buffer overflows), hackers are increasingly targeting Web applications. Web application vulnerabilities are hard to eliminate because most Web applications a) go through rapid development phases with extremely short turnaround time, and b) are developed in-house by corporate MIS engineers, most of whom have less training and experience in secure software development compared to engineers at IBM, Sun, Microsoft, and other large software firms. Lastly, current technologies such as anti-virus software and network firewalls offer comparatively secure protection at the host and network levels, but not at the application level [24]. When network and host-level entry points are relatively secure, the public interfaces to Web applications become the focus or targets of attacks [68] [24]. Two of the most common Web application vulnerabilities are script injection (e.g., SQL injection) and cross-site
Security Testing
The Definition – In order to assure that data within some information system stays secure and not accessible by unapproved users, we use security testing. Successful security testing protects web applications against severe malware and other malicious threats that might lead it to crash or give out unexpected behavior.
Security testing helps in figuring out various loopholes and flaws of a web application in the initial stage. Furthermore, it also helps in testing whether an application has successfully encoded security code or not. Primary areas covered by security testing are:
- Authentication
- Authorization
- Availability
- Confidentiality
- Integrity
- Non-repudiation
The Intent – Security testing is used by organizations and professionals throughout the world to ensure their web applications and information systems remain secure. Chief purposes of deploying security testing are:
- To help improve the security and shelf-life of a product
- To identify as well as fix various security issues in the initial stage of development
- To rate the stability in the present state
The Need – Why do we need security testing? Well, there are a number of reasons, ranging from analyzing the degree of security to the prevention of unexpected breakdowns in the future. Some of the most important reasons are:
- Avert inconsistent performance
- Avoid losing customer trust
- Avoid losing important information in the form of security leaks
- Prevent information theft by unidentified users
- Save from unexpected breakdown
- Save additional costs required for fixing security issues
There are several free, paid, and open source tools available to check the vulnerabilities and flaws in your web applications. The best thing about open source tools, besides being free, is that you can customize them to match your specific requirements.
So, here is the list of 11 open source security testing tools for checking how secure your website or web application is:
Top Open Source Security Testing Tools
1. Arachni
Apt for both penetration testers and admins, Arachni is designed to identify security issues within a web application. The open-source security testing tool is capable of uncovering a number of vulnerabilities, including:
- Invalidated redirect
- Local and remote file inclusion
- SQL injection
- XSS injection
Key highlights:
- Instantly deployable
- Modular, high-performance Ruby framework
- Multi-platform support
2. Grabber
The portable Grabber is designed to scan small web applications, including forums and personal websites. The lightweight security testing tool has no GUI interface and is written in Python. Vulnerabilities uncovered by Grabber includes:
- Backup files verification
- Cross-site scripting
- File inclusion
- Simple AJAX verification
- SQL injection
Key highlights:
- Generates a stats analysis file
- Simple and portable
- Supports JS code analysis
3. Iron Wasp
An open-source, powerful scanning tool, Iron Wasp is able to uncover over 25 types of web application vulnerabilities. Additionally, it can also detect false positives and false negatives. Iron Wasp assists in exposing a wide variety of vulnerabilities, including:
- Broken authentication
- Cross-site scripting
- CSRF
- Hidden parameters
- Privilege escalation
Key highlights:
- Extensible via plugins or modules are written in C#, Python, Ruby, or VB.NET
- GUI-based
- Report generation in HTML and RTF formats
4. Nogotofail
A network traffic security testing tool from Google, Nogotofail is a lightweight application that is able to detect TLS/SSL vulnerabilities and misconfigurations. Vulnerabilities exposed by Nogotofail are:
- MiTM attacks
- SSL certificate verification issues
- SSL injection
- TLS injection
Key highlights:
- Easy to use
- Lightweight
- Readily deployable
- Supports setting up as a router, proxy or VPN server
5. SonarQube
Another opportune open source security testing tool is Sonaqube. In addition to exposing vulnerabilities, it is used to measure the source code quality of a web application. Despite being written in Java, SonarQube is able to carry out analysis of over 20 programming languages. Furthermore, it gets easily integrated with continuous integration tools to the likes of Jenkins. Issues found by SonarQube are highlighted in either green or red light. While the former represent low-risk vulnerabilities and issues, the latter corresponds to severe ones. For advanced users, access via command prompt is available. An interactive GUI is in place for those relatively new to testing. Some of the vulnerabilities exposed by SonarQube include:
- Cross-site scripting
- Denial of Service (DoS) attacks
- HTTP response splitting
- Memory corruption
- SQL injection
Key highlights:
- Detects tricky issues
- DevOps integration
- Set up analysis of pull requests
- Supports quality tracking of both short-lived and long-lived code branches
- Offers Quality Gate
- Visualize history of a project
6. SQLMap
Allowing automating the process of detecting and utilizing SQL injection vulnerability in a website’s database, SQL Map is entirely free to use. The security testing tool comes with a powerful testing engine, capable of supporting 6 types of SQL injection techniques:
- Boolean-based blind
- Error-based
- Out-of-band
- Stacked queries
- Time-based blind
- UNION query
Key highlights:
- Automates the process of finding SQL injection vulnerabilities
- Can also be used for security testing a website
- Robust detection engine
- Supports a range of databases, including MySQL, Oracle, and PostgreSQL
7. W3af
One of the most popular web application security testing frameworks that are also developed using Python is W3af The tool allows testers to find over 200 types of security issues in web applications, including:
- Blind SQL injection
- Buffer overflow
- Cross-site scripting
- CSRF
- Insecure DAV configurations
Key highlights:
- Authentication support
- Easy to get started with
- Offers intuitive GUI interface
- Output can be logged into a console, a file or email
8. Wapiti
One of the leading web application security testing tools, Wapiti is a free of cost, open source project from SourceForge and devloop. In order to check web applications for security vulnerabilities, Wapiti performs black box testing. As it is a command-line application, it is important to have a knowledge of various commands used by Wapiti. Wapiti is easy to use for the seasoned but testing for newcomers. But don’t worry, you can find all the Wapiti instructions on the official documentation. For checking whether a script is vulnerable or not, Wapiti injects payloads. The open source security testing tool provides support for both GET and POSTHTTP attack methods. Vulnerabilities exposed by Wapiti are:
- Command Execution detection
- CRLF injection
- Database injection
- File disclosure
- Shellshock or Bash bug
- SSRF (Server Side Request Forgery)
- Weak .htaccess configurations that can be bypassed
- XSS injection
- XXE injection
Key highlights:
- Allows authentication via different methods, including Kerberos and NTLM
- Comes with a buster module, allowing brute force directories and files names on the targeted web server
- Operates like a fizzer
- Supports both GET and POSTHTTP methods for attacks
9.Wfuzz
Developed in Python, Wfuzz is popularly used for brute-forcing web applications. The open-source security testing tool has no GUI interface and is usable only via command line. Vulnerabilities exposed by Wfuzz are:
- LDAP injection
- SQL injection
- XSS injection
Key highlights:
- Authentication support
- Cookies fuzzing
- Multi-threading
- Multiple injection points
- Support for proxy and SOCK
10. Zed Attack Proxy (ZAP)
Developed by OWASP (Open Web Application Security Project), Zed attack proxy is a multi-platform, open source web application security testing tool. ZAP is used for finding a number of security vulnerabilities in a web app during the development as well as testing phase. Thanks to its intuitive GUI, Zed Attach Proxy can be used with equal ease by newbies as that by experts. The security testing tool supports command-line access for advanced users. In addition to being one of the most famous OWASP projects, it is awarded the flagship status. ZAP is written in Java. Other than its use as a scanner, ZAP can also be used to intercept a proxy for manually testing a webpage. ZAP exposes:
- Application error disclosure
- Cookie not HttpOnly flag
- Missing anti-CSRF tokens and security headers
- Private IP disclosure
- Session ID in URL rewrite
- SQL injection
- XSS injection
Key highlights:
- Automatic scanning
- Easy to use
- Multi-platform
- Rest-based API
- Support for authentication
- Uses traditional and powerful AJAX spiders
Drop Your Comment below.
