The widespread adoption of web vulnerability scanners and their differences in effectiveness make it necessary to benchmark these scanners. Moreover, the literature lacks the comparison of the results of scanners effectiveness from different benchmarks. In this paper, we first compare the performances of some open source web vulnerability scanners of our careful choice by running them against the OWASP benchmark, which is developed by the Open Web Application Security Project (OWASP), a well-known non-profit web security organization. Furthermore, we compare our results from the OWASP benchmark with the existing results from the Web Application Vulnerability Security Evaluation Project (WAVSEP) benchmark, another popular benchmark used to evaluate scanner effectiveness. We are the first to make a comparison between these two benchmarks in literature. Our evaluation results allow us to make some valuable recommendations for the practice of benchmarking web scanners.

/pdf/evaluation-of-web-vulnerability-scanners-based-on-owasp-22r5c18qbg.pdf

Evaluation of Web Vulnerability Scanners Based on OWASP Benchmark

Web application attacks are an increasingly important area in information security and digital forensics. It has been observed that attackers are developing the capability to bypass security controls and launch a large number of sophisticated attacks. Several attempts have been made to address these attacks using a wide range of technology and one of the greatest challenges is responding to new and unknown attacks in an effective way. This study aims to investigate the techniques and solutions used to detect attacks, such as firewalls, intrusion detection systems, honeypots and forensic techniques. Data mining and machine learning techniques, which attempt to address traditional technology shortcomings and produce more effective solutions, are also investigated. It was aimed to contribute to this growing area of research by exploring more intelligent and convenient techniques for web application attack detection by focusing on the data mining techniques in forensics.

Web application attack detection and forensics: A survey

In a time of growing threats and advancing circumstances, receiving and keeping up a strong cybersecurity profile in the enterprises are crucial. Important data and resources must be protected. Nowadays, cybersecurity became a predominant issue facing most organizations. It is recognized by organizations as an enterprise-wide issue requiring protection and detection from possible and malicious attacks to protect enterprise information assets. Hence, enterprises are obligated to use multiple tools for covering most of the cybersecurity aspects through different operations and for supporting different levels of users. Information systems auditing is becoming more difficult due to the rapidly developing technological threats. Hence, having these audits and reviews performed by independent functions increase the likelihood of detecting control weaknesses and provides further checks. These control issues are typically not due to the failure of the technology. However, they are mostly the result of individuals not executing the process, or using a process that is poorly defended. The main purpose of this research is to make a comparative study of the capabilities of most of the available automated cybersecurity auditing tools for frontend cloud computing. The results of this comparative study lead to knowing how to secure the enterprise's assets by using automated tools and techniques. Also, it uses clear steps to gather the information to provide the evidence required in the final report of IS auditing.

Cybersecurity Tools for IS Auditing

In a recent work [1], we present an extended and enhanced gray-box combinatorial security testing methodology for SQL injection vulnerabilities in web applications. It proposes novel attack grammars modelling SQLi attacks against MySQL-compatible databases, each targeting a specific context within a query; additionally, the produced attack vectors are dynamically optimized for the system under test. The newly developed methodology is implemented in a prototype security testing tool called SQLInjector+. In a case study against four verification frameworks and five real-world applications, our approach performs equally well or better compared to existing state-of-the-art SQL injection security testing tools.

Summary of Combinatorial Methods for Dynamic Gray-Box SQL Injection Testing

In software engineering, web applications are software that are accessed using a web browser through a network such as the Internet or intranet. Web applications are applications that can be relied on by users to do many useful activities. Despite the awareness of web application developers about safe programming practices, there are still many aspect in web applications that can be exploited by attacker. The development of web applications and the Internet causes the movement of information systems to use them as a basis. Security is needed to protect the contents of web applications that are sensitive and provide a safe process of sending data, therefore application security must be applied to all infrastructure that supports web applications, including the web application itself. Most organizations today have some kind of web application security program or try to build/ improve. But most of these programs do not get the results expected for the organization, are not durable or are not able to provide value continuously and efficiently and also cannot improve the mindset of developers to build/ design secure web applications. This research aims to develop a web application security scanner that can help overcome security problems in web applications.

pdf/security-scanner-for-web-applications-case-study-learning-e4awxggzhy.pdf

Security Scanner For Web Applications Case Study: Learning Management System

Strong security in web applications is critical to the success of your online presence. Security importance has grown massively, especially among web applications. Dealing with web application or website security issues requires deep insight and planning, not only because of the many tools that are available but also because of the industry immaturity. Thus, finding the proper tools requires deep understanding and several steps, including analyzing the development environment, business needs, and the web applications’ complexity. In this paper, we demonstrate the architecture of web applications then list and evaluate the widespread security vulnerabilities. Those vulnerabilities are: Fingerprinting, Insufficient Transport Layer Protection, Information Leakage, Cross-Site Scripting, SQL Injection, and HTTP Splitting. In addition, this paper analyzes the tools that are used to scan for these widespread vulnerabilities in web applications. Finally, it evaluates tools due to security vulnerabilities and gives recommendations to the web applications’ users and administrators aiming to educate them.

/pdf/web-application-security-tools-analysis-40zndw4k76.pdf

Web Application Security Tools Analysis

Strong security in web applications is critical to the success of your online presence. Security importance has grown massively, especially among web applications. Dealing with web application or website security issues requires deep insight and planning, not only because of the many tools that are available but also because of the industry immaturity. Thus, finding the proper tools requires deep understanding and several steps, including analyzing the development environment, business needs, and the web applications' complexity. In this paper, we demonstrate the architecture of web applications then list and evaluate the widespread security vulnerabilities. Those vulnerabilities are: Insufficient Transport Layer Protection, Information Leakage, Cross-Site Scripting, and SQL Injection. In addition, this paper analyzes the tools that are used to scan for these widespread vulnerabilities in web applications. Finally, it evaluates tools due to security vulnerabilities and gives recommendations to the web applications' users and administrators aiming to educate them.

/pdf/web-application-security-tools-analysis-woedl1ko40.pdf

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Nabil Almashfi

Author Tools

Chat about Author

Papers

Web Application Security Tools Analysis

Web Application Security Tools Analysis