Web applications have become a widely accepted method to support the internet for the past decade.Since they have been successfully installed in the business activities and there is a requirement of advanced functiona...Web applications have become a widely accepted method to support the internet for the past decade.Since they have been successfully installed in the business activities and there is a requirement of advanced functionalities,the configuration is growing and becoming more complicated.The growing demand and complexity also make these web applications a preferred target for intruders on the internet.Even with the support of security specialists,they remain highly problematic for the complexity of penetration and code reviewing methods.It requires considering different testing patterns in both codes reviewing and penetration testing.As a result,the number of hacked websites is increasing day by day.Most of these vulnerabilities also occur due to incorrect input validation and lack of result validation for lousy programming practices or coding errors.Vulnerability scanners for web applications can detect a few vulnerabilities in a dynamic approach.These are quite easy to use;however,these often miss out on some of the unique critical vulnerabilities in a different and static approach.Although these are time-consuming,they can find complex vulnerabilities and improve developer knowledge in coding and best practices.Many scanners choose both dynamic and static approaches,and the developers can select them based on their requirements and conditions.This research explores and provides details of SQL injection,operating system command injection,path traversal,and cross-site scripting vulnerabilities through dynamic and static approaches.It also examines various security measures in web applications and selected five tools based on their features for scanning PHP,and JAVA code focuses on SQL injection,cross-site scripting,Path Traversal,operating system command.Moreover,this research discusses the approach of a cyber-security tester or a security developer finding out vulnerabilities through dynamic and static approaches using manual and automated web vulnerability scanners.展开更多
在今天Web2.0时代,越来越多的应用正在从桌面朝着网络化的方向发展。网络的内容从最初的静态的一些超链接逐渐的转变为一系列的多样化应用,包括电子商务,电子邮件,游戏娱乐,数字媒体等等都是可以装载到浏览器中的应用。随着浏览器平台...在今天Web2.0时代,越来越多的应用正在从桌面朝着网络化的方向发展。网络的内容从最初的静态的一些超链接逐渐的转变为一系列的多样化应用,包括电子商务,电子邮件,游戏娱乐,数字媒体等等都是可以装载到浏览器中的应用。随着浏览器平台的不断发展,带来了很多的安全隐患诸如网络钓鱼,Xss,Xsrf(cross-site request forgery),Dns等等一系列的黑客手段日益成为威胁互联网用户的安全隐患。黑客可以利用恶意代码,或者钓鱼网站对用户个人信息进行随意的窃取,甚至造成很大的经济损失。针对上述威胁中的Xss(跨站脚本攻击cross site scripting)攻击进行分析,并提出一个新的架构来解决日益凸显的安全问题。展开更多
基金The author swould like to thank the Deanship of Scientific Research at Majmaah University for supporting this work under Project Number No-R-14xx-4x.
文摘Web applications have become a widely accepted method to support the internet for the past decade.Since they have been successfully installed in the business activities and there is a requirement of advanced functionalities,the configuration is growing and becoming more complicated.The growing demand and complexity also make these web applications a preferred target for intruders on the internet.Even with the support of security specialists,they remain highly problematic for the complexity of penetration and code reviewing methods.It requires considering different testing patterns in both codes reviewing and penetration testing.As a result,the number of hacked websites is increasing day by day.Most of these vulnerabilities also occur due to incorrect input validation and lack of result validation for lousy programming practices or coding errors.Vulnerability scanners for web applications can detect a few vulnerabilities in a dynamic approach.These are quite easy to use;however,these often miss out on some of the unique critical vulnerabilities in a different and static approach.Although these are time-consuming,they can find complex vulnerabilities and improve developer knowledge in coding and best practices.Many scanners choose both dynamic and static approaches,and the developers can select them based on their requirements and conditions.This research explores and provides details of SQL injection,operating system command injection,path traversal,and cross-site scripting vulnerabilities through dynamic and static approaches.It also examines various security measures in web applications and selected five tools based on their features for scanning PHP,and JAVA code focuses on SQL injection,cross-site scripting,Path Traversal,operating system command.Moreover,this research discusses the approach of a cyber-security tester or a security developer finding out vulnerabilities through dynamic and static approaches using manual and automated web vulnerability scanners.
文摘在今天Web2.0时代,越来越多的应用正在从桌面朝着网络化的方向发展。网络的内容从最初的静态的一些超链接逐渐的转变为一系列的多样化应用,包括电子商务,电子邮件,游戏娱乐,数字媒体等等都是可以装载到浏览器中的应用。随着浏览器平台的不断发展,带来了很多的安全隐患诸如网络钓鱼,Xss,Xsrf(cross-site request forgery),Dns等等一系列的黑客手段日益成为威胁互联网用户的安全隐患。黑客可以利用恶意代码,或者钓鱼网站对用户个人信息进行随意的窃取,甚至造成很大的经济损失。针对上述威胁中的Xss(跨站脚本攻击cross site scripting)攻击进行分析,并提出一个新的架构来解决日益凸显的安全问题。
