Web applications have been a significant target for successful security breaches in the last few years. They are currently secured, as a primary method, by searching for their vulnerabilities with specialized tools referred to as Web Application Vulnerability Scanners (WVS’s). Although, these dynamic approaches of testing have some advantages, there is still a scarcity of studies that explore their features and detection capabilities in a systematic way. This article reports findings from a Systematic Literature Review (SLR) to look into the characteristics and effectiveness of the most frequently used WVS’s. A total of 90 research papers were carefully evaluated. Thirty (30) WVS’s were collected and reported, with only 12 having at least one quantitative assessment of effectiveness. These 12 WVS’s were evaluated by 15 original evaluation studies. We found that these evaluations tested mostly only two of the Open Web Application Security Project (OWASP) Top Ten vulnerability types: SQL injection (SQLi) (13/15) and Cross-Site Scripting (XSS) (8/15). Additionally, only one work evaluated six of the OWASP Top Ten vulnerability types and for only one scanner. We also found that the reported detection rates were highly dissimilar between these 15 evaluations. Based on these surprising results we suggest avenues for future directions. 

/pdf/a-systematic-literature-review-on-the-characteristics-and-2v75cj4p.pdf

A Systematic Literature Review on the Characteristics and Effectiveness of Web Application Vulnerability Scanners

In the era of rapid development of Internet technology, more and more Web application systems have emerged, and the security problems of Web applications have become more prominent. This paper analyzes the vulnerability detection methods of Web application systems and analyzes the scanners of black box testing. And the characteristics of the white box test tool, the scanner detects fast but can not locate the loophole, proposes a web application system vulnerability location method based on dynamic stain analysis technology, designs the system prototype and conducts experimental verification and testing.

Research and Implementation of Web Application System Vulnerability Location Technology.

Cross-site scripting is a vulnerability in Web applications that can be exploited by injecting malicious script codes such as JavaScript into a Web application. A cross-site scripting technique allows an authorised user to inject malicious codes into a Web application and perform malicious activities. This paper analyses the traditional methods used in preventing cross-site scripting. A security framework is then proposed to improve the security of Web applications against Web-scripting attacks. This framework defines a security checklist, which comprises a set of rules. These rules contribute towards strengthening the security of Web applications and making them more robust to cross-site scripting attacks.

Prevention of Cross-Site Scripting Attacks in Web Applications

With the explosive growth of the Industrial Internet scale, cyberattacks targeting industrial control systems also increased. The management and operation of Industrial Internet are usually performed via web servers which retain a large attack surface. In the Industrial Internet, attackers usually exploit vulnerabilities to inject malicious codes for remotely executing commands, stealing confidential data, and invading web servers. Existing approaches capture statistical and contextual dependence information from Webshell using machine learning (ML) or deep learning (DL) algorithms. However, the semantic feature mining of program code within Weshell is not sufficient when entering new types of Webshell. In this paper, we propose a graph learning-based PHP Webshell detection framework, GlareShell, using the word embedding technique, a risk weight allocation mechanism, and the graph neural network (GNN). First, GlareShell leverages static analysis to extract interprocedural control flow graphs (ICFGs) from PHP script files and then prunes these ICFGs to remove noisy statements. Then, word embedding techniques are employed to generate semantic representations from PHP statements. Next, we design a risk weight allocation mechanism to derive the risk levels of statements and concatenate them with word embeddings as attributions. The identified risk levels could guide the passing of potential attack patterns inside GNN models. Finally, GlareShell builds a GNN classifier directly from the ICFG with corresponding node attributions to identify the malicious PHP scripts. Experiment results on collected datasets prove the promise of our graph learning framework in the Webshell detection domain. 

Glareshell: Graph Learning-Based PHP Webshell Detection for Web Server of Industrial Internet

These days, Content Management Systems (CMS) have been the target for adversaries in the cyber world since they are mostly open-source like Drupal, Joomla and WordPress, where no experts want to address the vulnerabilities due to them having no price tags. This paper aims to review the available and proposed penetration testing approaches and tools used on content management systems (CMS) and tabu...

A Review: Penetration Testing Approaches on Content Management System (CMS)

In recent year a lot of web applications have been released in the world. At the same time, Zero-Day attacks against web application vulnerabilities have also increased. In such a scenario, it is necessary to make web applications more secure. However checking all web vulnerabilities by manually is very difficult and time-consuming. Therefore, we need a web application vulnerability scanner which is used for detecting security vulnerabilities in web services by underlining the service from the attacker's point of view. Web Application Penetration Testing (WAPT) plays an important role in every modern organization but, if an organization web apps does not properly test and secure then adversaries can compromise your applications, steal organization data and. damage business performance. Unfortunately, many organizations are under an illusion that a web application scanner which they are using will sincerely discover loopholes in their systems. According to research and study, there are different penetration testing tools have provide different performance on vulnerabilities detection. In this paper we have analyze and take survey of the different Zero-day vulnerability, how we can help organizations in testing their web applications in order to build reliable and secure applications.

A Review on 0-day Vulnerability Testing in Web Application

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Pratap Kumar

Author Tools

Chat about Author

Papers

A Review on 0-day Vulnerability Testing in Web Application