WEB Applications Vulnerability Analysis and prevention

Abstract

Web based application is a software package, which is accessed through the internet connection via HTTP protocol. Therefore, web application operates by requesting and retrieving information from database server and presents this information through the browser. [1]  Despite the advantages of web application, a recent study presents that 75% of the cyber-attacks accrue in web applications level. In this paper, the professional steps of web application analysis will be shown to achieve high level of security (secure enough). The three steps are finding, exploiting and fixing the vulnerabilities.  W-agora and Wordpress applications were chosen to do this analysis, both of them are an open-source application, and a sort of forum acts as a communication channel between users. The main asset of these two applications needs to be protected are user’s data (database), user’s password (user’s identity), and root’s password. This paper aims to follow the three steps of web application analysis by scanning the applications, exploiting the vulnerabilities and preventing the attacks. Acunetix Web Vulnerability Scanner (AWVS) and Netsparker scanner was used to scan the applications in order to find vulnerabilities. This scanning was conducted on Windows operation system. After performing the scanners, several vulnerabilities in both web applications were detected. Furthermore, the scanners provided simple attack as an example of how each vulnerability can be exploited.