A Fuzzy Classifier-Based Penetration Testing for Web Applications
The biggest challenge of Web application is the inestimable losses arising from security flaws. Two approaches were advanced by a number of scholars to provide security to Web space. One of such approach is vulnerability assessment, which is a conscious effort to isolate, identify and recognize potentials vulnerabilities exploited by attackers. The second being the estimation and determination of level of risks/threats posed to Web applications by vulnerabilities obvious to the developer (or tester); this is generally referred to as penetration testing. Recently, there is Vulnerability Assessment and Penetration Testing (VAPT) that combined these two schemes to improve safety and effectively combat the menace of attackers on Web applications. This paper proposed Fuzzy Classifier-based Vulnerability and Assessment Testing (FCVAPT) model to provide security for sensitive data/information in Web applications. Cross Site Scripting (XSS) and Structured Query Language (SQL) injections were selected for evaluation of proposed FCVAPT model. FCVAPT model’s classification performance for MSE, MAPE and RMSE were 33.33, 14.81% and 5.77% respectively. FCVAPT is considerably effective for detecting vulnerability and ascertaining the nature of threats/risks available to Web applications.
KeywordsVulnerabilities assessment Penetration testing Fuzzy classifier-based Web applications
We acknowledge the support and sponsorship provided by Covenant University through the Centre for Research, Innovation and Discovery (CUCRID).
- 1.Doshi, J., Trivedi, B.: Comparison of vulnerability assessment and penetration testing. Int. J. Appl. Inf. Syst. 8(6), 51–54 (2015)Google Scholar
- 2.Ruse, M.E.: Modelling checking techniques for vulnerability analysis of web applications. Unpublished Ph.D. thesis, Department of Computer Science, Iowa State University, Ames, USA, pp. 1–90 (2013)Google Scholar
- 3.Aghariya, T.: Security testing on web application. Unpublished M.Eng. thesis, Department of Software Engineering, Charles Darwin University, Darwin, Australia, pp. 1–93 (2015)Google Scholar
- 4.Samant, N.: Automated penetration testing. Unpublished M.Sc. thesis, Department of Computer Science, San Jose State University, California, USA, pp. 1–69 (2011)Google Scholar
- 5.Jovanovic, N., Kruegel, K., Kirda, E.: Precise alias analysis for static detection of web application vulnerabilities. In: Proceedings of Programming Languages and Analysis for Security, New York, pp. 27–36. ACM press (2006)Google Scholar
- 6.Petukhov, A., Kozlov, D.: Detecting security vulnerabilities in web applications using dynamic analysis with penetration testing. Computing Systems Lab, Department of Computer Science, Moscow State University, pp. 1–120 (2008)Google Scholar
- 7.Chen, J.M., Wu, C.L.: An automated vulnerability scanner for injection attack based on injection point. In: Proceedings of International Computer Symposium, pp. 113–118 (2010)Google Scholar
- 8.Li, X., Xue, Y.: BLOCK: a black-box approach for detection of state violation attacks towards web applications. In: Proceedings of the 27th Annual Computer Security Applications Conference, pp. 247–256 (2011)Google Scholar
- 10.McAllister, S., Kirda, E., Kruegel, C.: Leveraging user interactions for in-depth testing of web applications. In: Proceedings of Recent Advances in Intrusion Detection, pp. 191–210. Springer, Berlin, Heidelberg (2008)Google Scholar
- 11.Doupe, A.L.: Advanced automated web application vulnerability analysis. Unpublished Ph.D. thesis, Department of Computer Science, University of California, Santa Barbara, USA, pp. 1–227 (2014)Google Scholar
- 12.Shelly, D.A.: Using a web server test bed to analyse the limitations of web application vulnerability scanners. Unpublished M.Sc. thesis, Department of Computer Engineering, Virginia Polytechnic Institute and State University, Blacksburg, USA, pp. 1–98 (2010)Google Scholar